Industrial control system safety protection algorithm design method

Abstract

The invention provides a safety protection algorithm design method for an industrial control system, which is used for determining a safety protection target and range, determining a key component and a business process and defining a protection boundary. And then risk assessment and threat modeling are carried out, potential threat and attack vectors are identified, and asset vulnerability and risk influence are assessed. Designing a security protection algorithm framework, selecting proper security technology and algorithm, and determining architecture and module composition. Identity authentication modules, data encryption and integrity protection modules, intrusion detection and defense modules and the like are designed in detail, and authentication modes, key management modules, integrity verification modules, intrusion detection algorithms, response strategies and the like are designed. And then realizing and integrating an algorithm, and programming in the system to realize and guarantee the cooperative work among the modules. And the performance and the security of the algorithm are optimized through a function and security test. And finally, deploying the algorithm to the industrial control system, continuously monitoring the operation state and the security situation of the industrial control system, dynamically adjusting the strategy and parameters, and effectively guaranteeing the security of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of industrial control systems, and in particular to a method for designing a security protection algorithm for an industrial control system. Background Art

[0002] With the widespread application of information technology in the industrial field, the complexity and interconnectivity of industrial control systems (ICS) are increasing, and they are facing severe security threats. ICS includes field control layer, process monitoring layer and system network layer, covering key components such as sensors, actuators, controllers, servers, operator stations, etc., and realizes automation and monitoring through business process collaboration such as data collection, control instruction transmission, configuration and configuration. However, the openness of ICS and its connectivity with external networks make it a target of attack.

[0003] ICS faces diverse threats, such as viruses, Trojans, hacker attacks, and industrial espionage, which use attack vectors such as network protocol vulnerabilities, insecure configurations, and malware injections to penetrate the system. Network protocol vulnerabilities may be exploited to gain access rights, insecure configurations may cause control instructions to be tampered with and affect production, and industrial espionage may damage corporate competitiveness and intellectual property.

[0004] Assets in ICS, such as PLCs, computers, and servers, are vulnerable and contain various types of loopholes. Once exploited, they may have serious impacts on the production process, data security, personnel safety, and the environment. For example, tampering with control instructions may cause safety accidents, data leakage may expose confidential information, and attacks in specific industrial scenarios may pollute the environment and endanger personnel safety.

[0005] Existing security protection measures have limitations. Traditional network security technology is not suitable for ICS environments. ICS has high requirements for real-time and reliability. Traditional security mechanisms may introduce delays or interfere with production processes. In addition, ICS equipment and protocols are diverse and professional, and traditional security products are difficult to effectively protect. Existing security protection solutions are mostly targeted at single threats or problems at a certain level, lacking comprehensive considerations. For example, the identity authentication mechanism may be imperfect, the data encryption solution has poor coordination, and the ability to continuously monitor and dynamically adjust the security protection algorithm after deployment is insufficient. Summary of the invention

[0006] The main purpose of the present invention is to provide a method for designing a security protection algorithm for an industrial control system, so as to solve the problems that existing security protection schemes mostly target a single threat or a certain level of problem and lack comprehensive consideration, such as the identity authentication mechanism may be imperfect, the data encryption scheme has poor coordination, and the continuous monitoring and dynamic adjustment capabilities of the security protection algorithm after deployment are insufficient.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is: a method for designing a security protection algorithm for an industrial control system, the method comprising: S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection; S2. Conduct risk assessment and threat modeling: identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts; S3. Design a security protection algorithm framework: select appropriate security technologies and algorithms, and determine the algorithm architecture and module composition; S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and defense module; S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert them into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction; S6. Test and optimize security protection algorithms: perform functional tests and security tests, evaluate identity authentication, data encryption and integrity protection, intrusion detection functions and security; optimize algorithm performance and security based on test results, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds and identity authentication processes; S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure that they do not affect system operation, and perform security configuration updates; Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

[0008] In the preferred scheme, in step S1: The key components include sensors, actuators, controllers, servers, and operator stations, and the business processes include data acquisition, control instruction transmission, and configuration; Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

[0009] In the preferred scheme, in step S1: S11. Collect the connection relationship data between sensors, actuators, controllers, servers, and operator stations in each device in the industrial control system, as well as the data flow information in data collection, control instruction transmission, and configuration in the business process; Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data; S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and abstract the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model ,in is a collection of nodes, is the edge set, is the set of edge weights; For edge weights , assign values ​​according to factors such as data traffic size and communication frequency; S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes; Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node And through the node The number of shortest paths; Betweenness centrality reflects the ability of a node to control the flow of information in the network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a key control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected. Calculate the closeness centrality of a node , the formula is: ,in Is a node and The shortest path length between Closeness centrality is used to measure the closeness between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process; Assign a comprehensive importance index to each node based on the calculated degree centrality, betweenness centrality, and closeness centrality , the formula is: ,in , , is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system; Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected; S14, identifying paths related to data collection, control instruction transmission, and configuration business processes from the network model; For each business process path , calculate its importance index , the formula is: ,in Is the path The nodes on Is a node With adjacent nodes The weight of the edge between them; S15. Security protection boundary definition: Divide the industrial control system network into field control layer, process monitoring layer and system network layer, and analyze the connection relationship and data interaction mode between each layer; Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and It is a boundary node The set of nodes in two different network layers connected, Is a node With Node The weight of the edge between them; The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection, and protection measures need to be strengthened to prevent external attacks from penetrating into the system through these nodes. According to the importance of the border node, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls, intrusion detection systems and other security equipment at the border node to monitor and filter the network traffic in and out of the boundary.

[0010] In the preferred scheme, in step S2: Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection; Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of their vulnerabilities and unsafe configurations on production processes, data security, personnel safety, and the environment after being attacked; S21. Threat data collection and collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data; Classify and sort the collected data, categorize threats into viruses, Trojans, hacker attacks, and industrial espionage, and categorize attack vectors into network protocol vulnerabilities, insecure configurations, and malware injection types; For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined by the difficulty and popularity of the attack vector. The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector, and the greater the possibility of posing a threat to the system; S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity; Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk vulnerabilities, and count the number of vulnerabilities of different severity on each asset; For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole The severity score of a high-risk vulnerability is higher, which can be set as ; Medium-severity vulnerabilities have moderate scores, such as ; Low-risk vulnerabilities have lower scores, such as ; It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation; This formula takes into account the severity and exploitability of the vulnerabilities on the asset and is used to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack; S23. Establish a risk influencing factor matrix: Determine the assessment factors for risk impact, including impact on production process, data security, personnel safety and environment; Build a Risk Factor Matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the degree of impact, including high, medium, and low; Matrix Elements Indicated in Under the influence of factors, the attack leads to The probability of the degree of impact; When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: ; This formula comprehensively considers the possibility of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors, and is used to measure the degree of risk impact on various aspects when assets are attacked by specific attack vectors; Calculating assets Attack vectors Comprehensive risk indicators of attacks , the formula is: ; This formula combines the risk impact of all factors affecting the asset being attacked to obtain a comprehensive risk assessment value; By comparing different asset and attack vector combinations The value can be used to identify the parts of the system that face higher risks, so as to carry out targeted security protection and resource allocation.

[0011] In the preferred scheme, in step S3: Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms; The cryptographic technology adopts the national secret algorithm; Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms; Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

[0012] In the preferred scheme, in step S3: S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block is of length bits, according to the SM4 algorithm requirements; The encryption process uses the encryption function ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on Message Group ( ), the calculation process is as follows: Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function, which contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage to ensure data integrity; Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database; When a device or user requests authentication, a random number is generated , using the private key For random numbers Sign with the device or user's ID to get the signature value , and , and Send to the authentication server; After receiving the request, the authentication server uses the stored public key Verify the signature ; If the verification is successful, the authentication is passed; otherwise, the authentication fails; The signature and verification process is based on the principle of asymmetric encryption to ensure the security and unforgeability of identity authentication; S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences of industrial control systems , normalize the data to make it in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms; Model training: Use the sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network; The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size; Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; the population is updated according to the fitness value, and the best individual is selected for iterative optimization; After multiple iterations, the optimal hyperparameter combination is obtained , using the optimized hyperparameters to train the LSTM network; this optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies; Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ; Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based approach: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, It is a parameter set according to the system's requirements for false alarm rate and missed alarm rate; if , then determine the data point is an outlier point; This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and false negatives; S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control systems , calculate the observation statistics , the formula is ,in It is a state parameter calculated based on historical data The expected estimated value of is calculated using moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value; Application of non-parametric CUSUM algorithm: Initializing decision statistics , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ; Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected; S33, interaction between the identity authentication module and other modules: when the device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations; If the authentication fails, the identity authentication module sends an alarm message to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen the monitoring of the device or user. Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module; When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data; if it is found that the data integrity is destroyed or the encrypted data is abnormal, an alarm is triggered in time and corresponding defense measures are taken; S33, performance index definition: define the performance index of the security protection algorithm, including security index, efficiency index and reliability index; Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms; Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration, and interaction mechanism to improve overall performance and security. In the preferred scheme, in step S4: Identity authentication module design: determine the authentication method and protocol, and use the national secret algorithm or the TPM chip in trusted computing technology to implement hardware-level identity authentication; Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, key information, and ensure their integrity and confidentiality; Design of data encryption and integrity protection module: select encryption algorithm and key management strategy, use national secret algorithm for data encryption, and use key management function in trusted computing technology to ensure key security; implement data integrity verification mechanism, use hash algorithm to calculate data message digest and verify it during transmission and storage; Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusions.

[0013] In the preferred scheme, in step S4: S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair. ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ; Calculate the initial hash value of the device ,in is a hash function, || represents a connection operation, and this hash value will be used as the initial identity authentication credential of the device and stored in the secure storage area of ​​the TPM chip; The user sends an authentication request to the system, including the user ID and device identification ; After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ; The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then , , and Send to the system; After receiving the authentication information, the system first verifies the timestamp The validity of the device public key is then used Signature Decrypt it and get and ;if If the password verification is successful, the next step of authentication will be continued; otherwise, the authentication fails; the encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity; The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process, and the device hardware and its corresponding public key still match; If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user, the user and the system will use the session key Perform subsequent communication encryption; If the authentication fails, the system sends an authentication failure message to the user and records the relevant authentication failure information for subsequent analysis and auditing; Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , User Password , User permissions etc.; the device information table stores the device identification , device type , Device Status Information; Key management table stores device public keys , Private Key , Session Key Key related information When a new user or device is registered, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security; When the user password or device key needs to be updated, the update operation is performed according to the corresponding security process; for user password update, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated; for device key update, a new key pair is generated using the key update function of the TPM chip, and the relevant information in the key management table is updated; S42, Data encryption and integrity protection module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ; The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only a trusted entity can decrypt and obtain the symmetric key , and then decrypt the data; For data that needs to be encrypted , split it into fixed-size chunks ; For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and get the encrypted data block ; Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent data from being obtained and understood by unauthorized parties during storage or transmission; When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ; Then, for each encrypted data block , using a symmetric key Decrypted with the corresponding SM4 algorithm to obtain the original data block ; Finally, all decrypted data blocks are combined into the original data set ; For data that needs to protect integrity , use the SM3 function to calculate its message digest ; The length of the message digest depends on the selected hash function. store or transmit together; When data integrity needs to be verified, recalculate the data Message Summary ; The calculated message digest Digest of the message stored or transmitted Compare; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and corresponding measures need to be taken; S43, Intrusion Detection and Defense Module Algorithm: SSA-LSTM-based network traffic and process data analysis algorithm: collect network traffic data and process data of industrial control systems, clean and normalize the data; for example, remove noise, outliers and duplicate data in the data, and map the data to a specific interval to facilitate subsequent algorithm processing; The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time; SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , Iterations Etc., these hyperparameters are combined into a hyperparameter vector ; Initialize the sparrow population , where each sparrow individual Represents a set of hyperparameter values; calculates the fitness value of each sparrow individual , the fitness function can be defined based on the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination; According to the rules of the sparrow optimization algorithm, the sparrow population is updated; during the iteration process, the individual sparrows update their positions according to their own roles (, the formula is as follows: Finder location update formula: ,in Indicates Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size The dimensions and elements are The matrix of and Represent the warning value and safety value respectively; when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values; when When the finder conducts a wide search; Follower position update formula: ,in Indicates In the first iteration, the sparrow The worst position of dimension, Indicates The optimal position of the sparrow in the iteration, Represents each element as or of dimensional matrix, and ; when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location; The position update formula of the sentinel takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which is subject to the mean , the variance is The normal distribution of is a random number with a value range of , is a small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When , the sentinel is close to the global optimal position; when When , the vigilant moves away from the global worst position to jump out of the local optimum; Use the optimized hyperparameters to build the LSTM model and During the training process, the LSTM model learns the time dependencies and patterns in the data based on the input network traffic or process data sequence; For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ; Set an error threshold ,if , it is considered that the data sample is abnormal, which may be caused by intrusion. In this way, the LSTM model can monitor the abnormalities in network traffic and process data in real time; Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assume that the data sequence during normal operation are independent and identically distributed, and their probability density function is ; Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the security requirements of the system and the characteristics of the data to determine whether an abnormality occurs; For each new data point ( ), calculate the likelihood ratio ; Since the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is ; Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the assumption that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at the data points by kernel density estimation. The estimated value at , we get the likelihood ratio ; According to the likelihood ratio Update the cumulative sum variable: if ,but , ; if ,but , ; if ,but , ; Cumulative and variable and They are used to detect abnormal upward and downward changes in data respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior; When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, corresponding response measures are taken, including: sending alarm information to the system administrator, including the time when the abnormality occurred, the characteristics of the abnormal data, possible attack types, etc., so that the administrator can understand the security status of the system in a timely manner; Through firewalls or intrusion prevention system security devices, according to the source information of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding; If the abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired; According to the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

[0014] In the preferred scheme, in steps S5-S6: S51. Implementation and integration of security protection algorithms are as follows: for the programming language and development environment used by industrial control systems, a code generation model based on syntax tree and semantic analysis is constructed; Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language; Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, ; The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on devices such as PLCs, computers, and servers; For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics; Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to a suitable value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices; Security protection module integration: Design a unified interface for modules such as identity authentication, data encryption and integrity protection, intrusion detection and defense; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ; The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying the integrity of data; The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are abnormalities; Implement these interface functions in each module, ensuring that they are consistent with the module's internal logic; In the authentication module, The function will call the authentication process based on the national encryption algorithm and TPM chip mentioned above to implement the authentication function; these interface functions provide a standard calling method for the interaction between modules, so that different modules can work together; Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set the module To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules About Information Encrypt and get the encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ; When the module Received data packet When first using the shared key right Decrypt it and get ; then calculate Hash value , and with the received Make comparisons; if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission; S61. The steps for testing and optimizing the security protection algorithm are as follows: Construct a model-based test case generation model that takes into account the functional requirements and security requirements of the security protection algorithm; suppose the functional requirement set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement; For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements; Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices; The same type of users include legitimate users and illegitimate users: The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information; For every security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for example, for the security requirement of resisting brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information; Total test case set By combining all functional test cases and security test cases, Right now ; This formula is used to generate comprehensive test cases that cover all functions and security aspects of the security protection algorithm to ensure the integrity of the test; Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ; Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ; Otherwise, the test case fails and the evaluation function returns ; For example, for a legitimate user test case for identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ; By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; assuming that the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm ;This pass rate can intuitively reflect the functionality and security quality of the algorithm; S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results; The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ; Define a performance optimization objective function , which determines the optimization direction based on the actual value of the performance indicator and the expected target value; If the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to this parameter, and a performance optimization model is established,such as ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters; Adjust the algorithm parameters according to the optimization objective function; for example, to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters; S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its relevant algorithm components and parameters; Among them, a vulnerability was found in the intrusion detection module that a new type of attack was not detected in time. Analysis found that it was related to the threshold of the intrusion detection algorithm. related; Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold, it may be adjusted according to the severity and impact scope of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the detection capability of the intrusion detection algorithm for new attacks, thereby enhancing the security of the algorithm.

[0015] In the preferred scheme, in step S7: S71. The steps for deploying and continuously monitoring security protection algorithms are: Deployment plan generation: First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ; For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , Dependencies and operating status ; Building a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Indicates the attribute value of the corresponding hardware or software; through this matrix, you can clearly understand the current status and dependencies of the system and provide basic data for deployment planning; Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module; For each module , analyze its dependencies on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the authentication module depends on; for example, the authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ; Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm. Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies; Suppose the topological sorting algorithm is ,but ; This formula is used to determine the correct deployment order to ensure that the security protection algorithm can be successfully deployed in the industrial control system; Resource allocation and scheduling: Based on the resource usage of hardware components And the resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components The available resources determine how much resources to allocate to the module ; Among them, if the intrusion detection module Certain CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements. At the same time, considering the operation plan of the industrial control system, arrange the deployment time of the security protection algorithm; suppose the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operation plan , select the appropriate time window to deploy the security protection algorithm; for example, if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, such as the update of the identity authentication module; S72. The steps for updating the security configuration are: Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ; For each configuration parameter , establish an adjustment model related to system environmental factors; Among them, for the key length of the encryption algorithm Considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is ; This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm; By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained ; These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure the best performance of the algorithms in the new environment; Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings; Define a configuration validation function , it checks whether the updated configuration is correct and effective; for example, for a new key length configuration of an encryption algorithm, the verification function checks whether the encryption module actually uses the new key length for encryption operations; if the configuration verification fails, the configuration update operation needs to be performed again until all configuration parameters are correctly updated and verified; S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ; For each status indicator , establish a corresponding collection mechanism; Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the timestamp of the end execution is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis; State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range to ; Among them, for the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ; Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ; Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module; By comprehensively analyzing the evaluation results of all status indicators, it is possible to determine whether the overall operating status of the security protection algorithm is abnormal. Some multivariate anomaly detection methods can be used, such as the method based on principal component analysis. Suppose the collected status indicator value vector is , and transform it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not in the normal area, it is judged that the operation status of the security protection algorithm is abnormal; S74, Security situation monitoring and policy adjustment: The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , Internal security risk level , Data security level , System vulnerability level ; For each quantitative indicator , establish the corresponding calculation model; Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity of the attack is assessed as , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: ; This formula takes into account the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security situation; By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems; Policy Adjustment Model: Quantifying Vectors Based on Security Situation , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix It is represented by, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation strategy For quantitative indicators the extent of the impact; Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix; Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If the policy adjustment objective function has a significant impact, it will suggest adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, which determines the specific strategy adjustment plan, dynamically adjusts the security protection strategy and algorithm parameters according to the security situation, and ensures the continuous security of the industrial control system.

[0016] The present invention provides a method for designing a security protection algorithm for an industrial control system, which can accurately identify potential threats and attack vectors in ICS, and comprehensively evaluate the risks faced by the system by analyzing multiple threat types and attack methods. Based on an in-depth understanding of the ICS architecture and business processes, the security protection goals and scope are clarified, including determining key components and defining protection boundaries, so that the protection is more targeted. An algorithm including multifunctional modules such as identity authentication, data encryption and integrity protection, intrusion detection and defense is designed, and each module works together to improve overall security. In terms of identity authentication, hardware-level identity authentication is implemented by combining the national secret algorithm and the TPM chip to ensure the authenticity and confidentiality of the user and device identities and prevent illegal access. The data encryption and integrity protection module uses appropriate encryption algorithms and key management strategies to protect the confidentiality and integrity of data during transmission and storage, and avoid data leakage and tampering. The intrusion detection and defense module uses complex algorithms to monitor and analyze network traffic and process data in real time, which can detect abnormal behavior in a timely manner, effectively respond to intrusions, and reduce the impact of attacks. The algorithm can be accurately implemented on various types of ICS devices, and is compatible with different programming languages ​​and development environments to ensure stable operation. The perfect testing mechanism can comprehensively evaluate the performance of the algorithm in identity authentication, data encryption and integrity protection, intrusion detection and other functions to ensure the quality of the algorithm. The algorithm is continuously optimized according to the test results, and the parameters are dynamically adjusted to adapt to the ever-changing security environment and system status. After deployment, the algorithm operation status and security situation can be continuously monitored, problems can be discovered in a timely manner, and security protection strategies and algorithm parameters can be dynamically adjusted to ensure the long-term safe and stable operation of industrial control systems, reduce production accidents, data leakage, personnel safety threats and environmental hazards caused by security issues, improve the reliability and security of ICS, and ensure the normal progress of industrial production. BRIEF DESCRIPTION OF THE DRAWINGS The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 It is a design flow chart of the present invention; DETAILED DESCRIPTION Example 1 like Figure 1 As shown, a method for designing a security protection algorithm for an industrial control system includes: S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection; S2. Conduct risk assessment and threat modeling: identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts; S3. Design a security protection algorithm framework: select appropriate security technologies and algorithms, and determine the algorithm architecture and module composition; S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and defense module; S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert them into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction; S6. Test and optimize security protection algorithms: perform functional tests and security tests, evaluate identity authentication, data encryption and integrity protection, intrusion detection functions and security; optimize algorithm performance and security based on test results, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds and identity authentication processes; S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure that they do not affect system operation, and perform security configuration updates; Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

[0017] In the preferred scheme, in step S1: The key components include sensors, actuators, controllers, servers, and operator stations, and the business processes include data acquisition, control instruction transmission, and configuration; Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

[0018] Accurately identify the key components and business processes in industrial control systems, and clearly define the boundaries and scope of security protection. By building a network model of the system, analyzing the characteristics of nodes and edges, and using specific mathematical formulas to calculate indicators such as node importance, a comprehensive understanding of industrial control systems and effective protection can be achieved.

[0019] In the preferred scheme, in step S1: S11. Collect the connection relationship data between sensors, actuators, controllers, servers, and operator stations in each device in the industrial control system, as well as the data flow information in data collection, control instruction transmission, and configuration in the business process; Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data; S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and abstract the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model ,in is a collection of nodes, is the edge set, is the set of edge weights; For edge weights , and assigns values ​​according to factors such as data traffic size and communication frequency; if the data traffic between two devices is large, the weight of the edge between them will be correspondingly larger.

[0020] S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes; The usefulness of this formula is to measure the number of direct connections of a node in the network. The nodes with higher degree centrality may be more important in information dissemination or system control. For example, in the data collection process, the controller node that is directly connected to multiple sensors may have a higher degree centrality and have a greater impact on the entire data collection process.

[0021] Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node And through the node The number of shortest paths; Betweenness centrality reflects the ability of a node to control the flow of information in the network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a key control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected. Calculate the closeness centrality of a node , the formula is: ,in Is a node and The shortest path length between Closeness centrality is used to measure the closeness between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process; In the communication between the operator station and the controller, nodes with high proximity centrality can transmit operation instructions faster, which is of great significance to the real-time control of the system.

[0022] Assign a comprehensive importance index to each node based on the calculated degree centrality, betweenness centrality, and closeness centrality , the formula is: ,in , , is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system; Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected; S14, identifying paths related to data collection, control instruction transmission, and configuration business processes from the network model; For each business process path , calculate its importance index , the formula is: ,in Is the path The nodes on Is a node With adjacent nodes The weight of the edge between them; This formula comprehensively considers the importance of nodes on the path and the weight of edges to measure the importance of the business process path in the entire system. Business process paths with higher importance require stricter security protection to ensure accurate data collection, reliable transmission of instructions, and correct configuration.

[0023] S15. Security protection boundary definition: Divide the industrial control system network into field control layer, process monitoring layer and system network layer, and analyze the connection relationship and data interaction mode between each layer; Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and It is a boundary node The set of nodes in two different network layers connected, Is a node With Node The weight of the edge between them; The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection, and protection measures need to be strengthened to prevent external attacks from penetrating into the system through these nodes. According to the importance of the border node, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls, intrusion detection systems and other security equipment at the border node to monitor and filter the network traffic in and out of the boundary.

[0024] Through complex network analysis methods, the various characteristics of nodes in industrial control systems, the importance of business processes, and the boundary relationships between network layers are fully considered. By accurately identifying key components, evaluating the importance of business processes, and defining security protection boundaries, a scientific basis and effective technical support are provided for the security protection of industrial control systems, which helps to improve the security and reliability of the system and reduce security risks. In practical applications, the parameters and thresholds in the algorithm can be further optimized according to the specific situation and security requirements of the system to meet the security protection requirements of different industrial scenarios.

[0025] Example 2 Further described in conjunction with Example 1, in the preferred solution, in step S2: Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection; Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of their vulnerabilities and unsafe configurations on production processes, data security, personnel safety, and the environment after being attacked; It can comprehensively identify potential threats and attack vectors in industrial control systems, and accurately assess asset vulnerabilities and the risk impact after being attacked. It can provide a scientific basis for system security protection by comprehensively analyzing multiple factors and applying complex mathematical models.

[0026] S21. Threat data collection and collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data; Classify and sort the collected data, categorize threats into viruses, Trojans, hacker attacks, and industrial espionage, and categorize attack vectors into network protocol vulnerabilities, insecure configurations, and malware injection types; For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined by the difficulty and popularity of the attack vector. The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector, and the greater the possibility of posing a threat to the system; If there are many historical attack events related to the network protocol vulnerability and the vulnerability is easy to exploit (high weight), then its The value will be larger.

[0027] S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity; Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk vulnerabilities, and count the number of vulnerabilities of different severity on each asset; For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole The severity score of a high-risk vulnerability is higher, which can be set as ; Medium-severity vulnerabilities have moderate scores, such as ; Low-risk vulnerabilities have lower scores, such as ; It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation; This formula takes into account the severity and exploitability of the vulnerabilities on the asset and is used to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack; a server with multiple highly exploitable and high severity vulnerabilities has The value will be higher.

[0028] S23. Establish a risk influencing factor matrix: Determine the assessment factors for risk impact, including impact on production process, data security, personnel safety and environment; Build a Risk Factor Matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the degree of impact, including high, medium, and low; Matrix Elements Indicated in Under the influence of factors, the attack leads to The probability of the degree of impact; When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: ; This formula comprehensively considers the possibility of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors, and is used to measure the degree of risk impact on various aspects when assets are attacked by specific attack vectors; If a PLC with high vulnerability is attacked by a malware injection attack with high probability, and according to the matrix The probability that the attack will have a high impact on the production process is high. (For factors affecting the production process) the value will be larger.

[0029] Calculating assets Attack vectors Comprehensive risk indicators of attacks , the formula is: ; This formula combines the risk impact of all factors affecting the asset being attacked to obtain a comprehensive risk assessment value; By comparing different asset and attack vector combinations The value can be used to identify the parts of the system that face higher risks, so as to carry out targeted security protection and resource allocation.

[0030] By systematically identifying threats and attack vectors, assessing asset vulnerabilities, and calculating risk impact indicators, we can fully and accurately grasp the security risk status faced by industrial control systems. Based on the calculation results, we can focus on high-risk assets and attack vectors in the system, formulate corresponding security strategies and protective measures, effectively reduce the risk of system attacks, and ensure the safe and stable operation of industrial control systems. In practical applications, threat intelligence and risk assessment parameters should be updated regularly to adapt to the ever-changing security environment.

[0031] Example 3 Further described in conjunction with Example 1, in the preferred solution, in step S3: Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms; The cryptographic technology adopts the national secret algorithm; Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms; Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

[0032] Build a comprehensive industrial control system security protection framework that integrates a variety of advanced security technologies, including identity authentication based on trusted computing technology, data encryption and integrity protection based on national secret algorithms, and intelligent intrusion detection and defense. Through innovative mathematical models and algorithmic processes, high-intensity security protection for industrial control systems is achieved.

[0033] In the preferred scheme, in step S3: S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block is of length bits, according to the SM4 algorithm requirements; The encryption process uses the encryption function ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on Message Group ( ), the calculation process is as follows: Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function, which contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage to ensure data integrity; Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database; When a device or user requests authentication, a random number is generated , using the private key For random numbers Sign with the device or user's ID to get the signature value , and , and Send to the authentication server; After receiving the request, the authentication server uses the stored public key Verify the signature ; If the verification is successful, the authentication is passed; otherwise, the authentication fails; The signature and verification process is based on the principle of asymmetric encryption to ensure the security and unforgeability of identity authentication; S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences of industrial control systems , normalize the data to make it in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms; Model training: Use the sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network; The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size; Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; the population is updated according to the fitness value, and the best individual is selected for iterative optimization; After multiple iterations, the optimal hyperparameter combination is obtained , using the optimized hyperparameters to train the LSTM network; this optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies; Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ; Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based approach: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, It is a parameter set according to the system's requirements for false alarm rate and missed alarm rate; if , then determine the data point is an outlier point; This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and false negatives; S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control systems , calculate the observation statistics , the formula is ,in It is a state parameter calculated based on historical data The expected estimated value of is calculated using moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value; Application of non-parametric CUSUM algorithm: Initializing decision statistics , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ; Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected; S33, interaction between the identity authentication module and other modules: when the device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations; If the authentication fails, the identity authentication module sends an alarm message to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen the monitoring of the device or user. Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module; When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data; if it is found that the data integrity is destroyed or the encrypted data is abnormal, an alarm is triggered in time and corresponding defense measures are taken; S33, performance index definition: define the performance index of the security protection algorithm, including security index, efficiency index and reliability index; Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms; Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration, and interaction mechanism to improve overall performance and security. If it is found that a certain intrusion detection algorithm has a high false alarm rate in a specific attack scenario, its threshold can be adjusted or the algorithm model structure can be optimized.

[0034] A multi-level, all-round industrial control system security protection system has been built. Based on innovative mathematical models and algorithmic processes, confidentiality and integrity protection of data, reliable identity authentication of devices and users, and accurate detection and defense of system intrusion behaviors have been achieved. By continuously optimizing algorithm parameters and architecture, it can adapt to complex and changing industrial control environments and effectively ensure the safe and stable operation of industrial control systems. In practical applications, the algorithm functions can be further customized and expanded according to specific system requirements and security strategies.

[0035] Example 4 Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred scheme, in step S4: Identity authentication module design: determine the authentication method and protocol, and use the national secret algorithm or the TPM chip in trusted computing technology to implement hardware-level identity authentication; Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, key information, and ensure their integrity and confidentiality; Design of data encryption and integrity protection module: select encryption algorithm and key management strategy, use national secret algorithm for data encryption, and use key management function in trusted computing technology to ensure key security; implement data integrity verification mechanism, use hash algorithm to calculate data message digest and verify it during transmission and storage; Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusions.

[0036] In the preferred scheme, in step S4: S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair. ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ; Calculate the initial hash value of the device ,in is a hash function, || represents a connection operation. This hash value will be used as the initial identity authentication credential of the device and stored in the secure storage area of ​​the TPM chip. The purpose of the formula is to bind the device ID and public key to generate a unique hash value that can be used for authentication, preventing the device ID and public key from being tampered with or forged.

[0037] The user sends an authentication request to the system, including the user ID and device identification ; After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ; The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then , , and Send to the system; After receiving the authentication information, the system first verifies the timestamp The effectiveness of Is it within a certain range of the current time to prevent replay attacks? Is it within a certain range of the current time to prevent replay attacks? Then use the device public key Signature Decrypt it and get and ;if If the password verification is successful, the next step of authentication will be continued, where Compare with the user password stored in the system; Otherwise, the authentication fails. The encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity. The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process, and the device hardware and its corresponding public key still match; If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user (for example, encrypted using the public key of the user's device), and the user and the system will use the session key Perform subsequent communication encryption; If the authentication fails, the system sends an authentication failure message to the user and records relevant authentication failure information (such as time, user ID, failure reason, etc.) for subsequent analysis and auditing; Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , User Password , User permissions etc.; the device information table stores the device identification , device type , Device Status Information; Key management table stores device public keys , Private Key , Session Key Key related information When a new user or device is registered, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security; When the user password or device key needs to be updated, the update operation is performed according to the corresponding security process; for user password update, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated; for device key update, a new key pair is generated using the key update function of the TPM chip, and the relevant information in the key management table is updated; S42, Data encryption and integrity protection module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ; The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only a trusted entity can decrypt and obtain the symmetric key , and then decrypt the data; For data that needs to be encrypted , split it into fixed-size chunks ; For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and get the encrypted data block ; Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent data from being obtained and understood by unauthorized parties during storage or transmission; When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ; Then, for each encrypted data block , using a symmetric key Decrypted with the corresponding SM4 algorithm to obtain the original data block ; Finally, all decrypted data blocks are combined into the original data set ; For data that needs to protect integrity , use the SM3 function to calculate its message digest ; The length of the message digest depends on the selected hash function. store or transmit together; When data integrity needs to be verified, recalculate the data Message Summary ; The calculated message digest Digest of the message stored or transmitted Compare; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and corresponding measures need to be taken; S43, Intrusion Detection and Defense Module Algorithm: SSA-LSTM-based network traffic and process data analysis algorithm: collect network traffic data and process data of industrial control systems, clean and normalize the data; for example, remove noise, outliers and duplicate data in the data, and map the data to a specific interval to facilitate subsequent algorithm processing; The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time; SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , Iterations Etc., these hyperparameters are combined into a hyperparameter vector ; Initialize the sparrow population , where each sparrow individual Represents a set of hyperparameter values; calculates the fitness value of each sparrow individual , the fitness function can be defined based on the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination; According to the rules of the sparrow optimization algorithm, the sparrow population is updated; during the iteration process, the individual sparrows update their positions according to their own roles (, the formula is as follows: Finder location update formula: ,in Indicates Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size The dimensions and elements are The matrix of and Represent the warning value and safety value respectively; when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values; when When the finder conducts a wide search; Follower position update formula: ,in Indicates In the first iteration, the sparrow The worst position of dimension, Indicates The optimal position of the sparrow in the iteration, Represents each element as or of dimensional matrix, and ; when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location; The position update formula of the sentinel takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which is subject to the mean , the variance is The normal distribution of is a random number with a value range of , is a small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When , the sentinel is close to the global optimal position; when When , the vigilant moves away from the global worst position to jump out of the local optimum; Use the optimized hyperparameters to build the LSTM model and During the training process, the LSTM model learns the time dependencies and patterns in the data based on the input network traffic or process data sequence; For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ; Set an error threshold ,if , it is considered that the data sample is abnormal, which may be caused by intrusion. In this way, the LSTM model can monitor the abnormalities in network traffic and process data in real time; Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assume that the data sequence during normal operation are independent and identically distributed, and their probability density function is ; Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the security requirements of the system and the characteristics of the data to determine whether an abnormality occurs; For each new data point ( ), calculate the likelihood ratio ; Since the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is ; Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the assumption that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at the data points by kernel density estimation. The estimated value at , we get the likelihood ratio ; According to the likelihood ratio Update the cumulative sum variable: if ,but , ; if ,but , ; if ,but , ; Cumulative and variable and They are used to detect abnormal upward and downward changes in data respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior; When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, corresponding response measures are taken, including: sending alarm information to the system administrator, including the time when the abnormality occurred, the characteristics of the abnormal data, possible attack types, etc., so that the administrator can understand the security status of the system in a timely manner; Through firewalls or intrusion prevention system security devices, according to the source information of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding; If the abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired; According to the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

[0038] Abnormal response and defense strategy When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, appropriate response measures are taken. For example: Alarm: Send alarm information to system administrators, including the time when the anomaly occurred, the characteristics of the abnormal data, possible attack types, etc., so that administrators can understand the security status of the system in a timely manner.

[0039] Block the attack source: Through security devices such as firewalls or intrusion prevention systems (IPS), the connection between the attack source and the industrial control system is blocked based on the source information of abnormal data (such as IP address, MAC address, etc.) to prevent the attack from further expanding.

[0040] Switch to backup system: If abnormal behavior has a serious impact on the currently running system, start the backup system to ensure the continuity of the industrial production process. At the same time, further check and repair the faulty system.

[0041] Adjust control strategies: According to the impact of abnormal behaviors on the production process, dynamically adjust the control strategies of industrial control systems, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behaviors on production and ensure production safety and product quality.

[0042] Through the above complex algorithm design, the industrial control system's identity authentication, data encryption and integrity protection, intrusion detection and defense can be effectively processed comprehensively and accurately to improve the system's security and reliability. In practical applications, the algorithm parameters and adjustment strategies can be further optimized according to the specific situation and security requirements of the system.

[0043] Example 5 Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred scheme, in steps S5-S6: S51. Implementation and integration of security protection algorithms are as follows: for the programming language and development environment used by industrial control systems, a code generation model based on syntax tree and semantic analysis is constructed; Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language; For the hash calculation operation in the identity authentication algorithm, if Indicates calculating the hash value of the user's password (using a specific hash function H), then Code similar to the following may be generated, mainly in C++: unsigned charhash_value[HASH_LENGTH]; H(password, strlen(password), hash_value); here H is the library function that implements the hash function, password is the password entered by the user, and HASH_LENGTH is the length of the hash value.

[0044] Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, ; The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on devices such as PLCs, computers, and servers; For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics; Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to a suitable value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices; Security protection module integration: Design a unified interface for modules such as identity authentication, data encryption and integrity protection, intrusion detection and defense; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ; The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying the integrity of data; The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are abnormalities; Implement these interface functions in each module, ensuring that they are consistent with the module's internal logic; In the authentication module, The function will call the authentication process based on the national encryption algorithm and TPM chip mentioned above to implement the authentication function; these interface functions provide a standard calling method for the interaction between modules, so that different modules can work together; Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set the module To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules About Information Encrypt and get the encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ; When the module Received data packet When first using the shared key right Decrypt it and get ; then calculate Hash value , and with the received Make comparisons; if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission; S61. The steps for testing and optimizing the security protection algorithm are as follows: Construct a model-based test case generation model that takes into account the functional requirements and security requirements of the security protection algorithm; suppose the functional requirement set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement; For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements; Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices; The same type of users include legitimate users and illegitimate users: The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information; For every security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for example, for the security requirement of resisting brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information; Total test case set By combining all functional test cases and security test cases, Right now ; This formula is used to generate comprehensive test cases that cover all functions and security aspects of the security protection algorithm to ensure the integrity of the test; Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ; Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ; Otherwise, the test case fails and the evaluation function returns ; For example, for a legitimate user test case for identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ; By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; assuming that the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm ;This pass rate can intuitively reflect the functionality and security quality of the algorithm; S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results; The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ; Define a performance optimization objective function , which determines the optimization direction based on the actual value of the performance indicator and the expected target value; If the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to this parameter, and a performance optimization model is established,such as ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters; Adjust the algorithm parameters according to the optimization objective function; for example, to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters; S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its relevant algorithm components and parameters; Among them, a vulnerability was found in the intrusion detection module that a new type of attack was not detected in time. Analysis found that it was related to the threshold of the intrusion detection algorithm. related; Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold, it may be adjusted according to the severity and impact scope of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the detection capability of the intrusion detection algorithm for new attacks, thereby enhancing the security of the algorithm.

[0045] Through the above detailed algorithm design, the programming implementation, module integration, testing, performance and security optimization of industrial control system security protection algorithms can be effectively realized to ensure the safe and reliable operation of industrial control systems. In practical applications, these algorithms can be continuously improved and perfected according to the continuous changes in the system and emerging security threats.

[0046] Example 6 Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred scheme, in step S7: S71. The steps for deploying and continuously monitoring security protection algorithms are: Deployment plan generation: First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ; For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , Dependencies and operating status ; Building a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Indicates the attribute value of the corresponding hardware or software; through this matrix, you can clearly understand the current status and dependencies of the system and provide basic data for deployment planning; Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module; For each module , analyze its dependencies on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the authentication module depends on; for example, the authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ; Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm. Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies; Suppose the topological sorting algorithm is ,but ; This formula is used to determine the correct deployment order to ensure that the security protection algorithm can be successfully deployed in the industrial control system; Resource allocation and scheduling: Based on the resource usage of hardware components And the resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components The available resources determine how much resources to allocate to the module ; Among them, if the intrusion detection module Certain CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements. At the same time, considering the operation plan of the industrial control system, arrange the deployment time of the security protection algorithm; suppose the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operation plan , select the appropriate time window to deploy the security protection algorithm; for example, if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, such as the update of the identity authentication module; S72. The steps for updating the security configuration are: Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ; For each configuration parameter , establish an adjustment model related to system environmental factors; Among them, for the key length of the encryption algorithm Considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is ; This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm; By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained ; These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure the best performance of the algorithms in the new environment; Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings; Define a configuration validation function , it checks whether the updated configuration is correct and effective; for example, for a new key length configuration of an encryption algorithm, the verification function checks whether the encryption module actually uses the new key length for encryption operations; if the configuration verification fails, the configuration update operation needs to be performed again until all configuration parameters are correctly updated and verified; S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ; For each status indicator , establish a corresponding collection mechanism; Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the timestamp of the end execution is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis; State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range to ; Among them, for the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ; Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ; Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module; By comprehensively analyzing the evaluation results of all status indicators, it is possible to determine whether the overall operating status of the security protection algorithm is abnormal. Some multivariate anomaly detection methods can be used, such as the method based on principal component analysis. Suppose the collected status indicator value vector is , and transform it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not in the normal area, it is judged that the operation status of the security protection algorithm is abnormal; S74, Security situation monitoring and policy adjustment: The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , Internal security risk level , Data security level , System vulnerability level ; For each quantitative indicator , establish the corresponding calculation model; Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity of the attack is assessed as , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: ; This formula takes into account the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security situation; By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems; Policy Adjustment Model: Quantifying Vectors Based on Security Situation , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix It is represented by, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation strategy For quantitative indicators the extent of the impact; Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix; Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If the policy adjustment objective function has a significant impact, it will suggest adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, which determines the specific strategy adjustment plan, dynamically adjusts the security protection strategy and algorithm parameters according to the security situation, and ensures the continuous security of the industrial control system.

[0047] The above embodiments are only preferred technical solutions of the present invention and should not be regarded as limiting the present invention. The protection scope of the present invention shall be the technical solutions recorded in the claims, including equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. A method for designing a security protection algorithm for an industrial control system, characterized by: The method includes: S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection; S2. Conduct risk assessment and threat modeling: identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts; S3. Design a security protection algorithm framework: select appropriate security technologies and algorithms, and determine the algorithm architecture and module composition; S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and defense module; S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert them into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction; S6. Test and optimize security protection algorithms: perform functional tests and security tests, evaluate identity authentication, data encryption and integrity protection, intrusion detection functions and security; optimize algorithm performance and security based on test results, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds and identity authentication processes; S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure that they do not affect system operation, and perform security configuration updates; Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

2. According to claim 1, a method for designing a security protection algorithm for an industrial control system is characterized in that: in step S1: The key components include sensors, actuators, controllers, servers, and operator stations, and the business processes include data acquisition, control instruction transmission, and configuration; Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

3. According to the industrial control system security protection algorithm design method described in claim 2, Its characteristics are: in step S1: S11. Collect the connection relationship data between sensors, actuators, controllers, servers, and operator stations in each device in the industrial control system, as well as the data flow information in data collection, control instruction transmission, and configuration in the business process; Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data; S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and abstract the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model ,in is a collection of nodes, is the edge set, is the set of edge weights; For edge weights , assign values ​​according to factors such as data traffic size and communication frequency; S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes; Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node And through the node The number of shortest paths; Betweenness centrality reflects the ability of a node to control the flow of information in the network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a key control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected. Calculate the closeness centrality of a node , the formula is: ,in Is a node and The shortest path length between Closeness centrality is used to measure the closeness between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process; Assign a comprehensive importance index to each node based on the calculated degree centrality, betweenness centrality, and closeness centrality , the formula is: ,in , , is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system; Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected; S14, identifying paths related to data collection, control instruction transmission, and configuration business processes from the network model; For each business process path , calculate its importance index , the formula is: ,in Is the path The nodes on Is a node With adjacent nodes The weight of the edge between them; S15. Security protection boundary definition: Divide the industrial control system network into field control layer, process monitoring layer and system network layer, and analyze the connection relationship and data interaction mode between each layer; Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and It is a boundary node The set of nodes in two different network layers connected, Is a node With Node The weight of the edge between them; The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection, and protection measures need to be strengthened to prevent external attacks from penetrating into the system through these nodes. According to the importance of the border node, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls, intrusion detection systems and other security equipment at the border node to monitor and filter the network traffic in and out of the boundary.

4. According to the industrial control system security protection algorithm design method described in claim 1, Its characteristics are: in step S2: Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection; Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of their vulnerabilities and unsafe configurations on production processes, data security, personnel safety, and the environment after being attacked; S21. Threat data collection and collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data; Classify and sort the collected data, categorize threats into viruses, Trojans, hacker attacks, and industrial espionage, and categorize attack vectors into network protocol vulnerabilities, insecure configurations, and malware injection types; For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined by the difficulty and popularity of the attack vector. The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector, and the greater the possibility of posing a threat to the system; S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity; Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk vulnerabilities, and count the number of vulnerabilities of different severity on each asset; For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole The severity score of a high-risk vulnerability is higher, which can be set as ; Medium-severity vulnerabilities have moderate scores, such as ; Low-risk vulnerabilities have lower scores, such as ; It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation; This formula takes into account the severity and exploitability of the vulnerabilities on the asset and is used to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack; S23. Establish a risk influencing factor matrix: Determine the assessment factors for risk impact, including impact on production process, data security, personnel safety and environment; Build a Risk Factor Matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the degree of impact, including high, medium, and low; Matrix Elements Indicated in Under the influence of factors, the attack leads to The probability of the degree of impact; When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: ; This formula comprehensively considers the possibility of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors, and is used to measure the degree of risk impact on various aspects when assets are attacked by specific attack vectors; Calculating assets Attack vectors Comprehensive risk indicators of attacks , the formula is: ; This formula combines the risk impact of all factors affecting the asset being attacked to obtain a comprehensive risk assessment value; By comparing different asset and attack vector combinations The value can be used to identify the parts of the system that face higher risks, so as to carry out targeted security protection and resource allocation.

5. The method for designing a security protection algorithm for an industrial control system according to claim 1 is characterized in that: In step S3: Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms; The cryptographic technology adopts the national secret algorithm; Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms; Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

6. The method for designing a security protection algorithm for an industrial control system according to claim 5 is characterized by: In step S3: S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block has a length of bits, according to the SM4 algorithm requirements; The encryption process uses the encryption function ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on Message Group ( ), the calculation process is as follows: Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function, which contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage, ensuring data integrity; Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database; When a device or user requests authentication, a random number is generated , using the private key For random numbers Sign with the device or user's ID to get the signature value , and , and Send to the authentication server; After receiving the request, the authentication server uses the stored public key Verify the signature ; If the verification is successful, the authentication is passed; otherwise, the authentication fails; the signature and verification process is based on the principle of asymmetric encryption to ensure the security and unforgeability of identity authentication; S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences of industrial control systems , normalize the data to make it in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms; Model training: Use the sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network; The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size; Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; Update the population according to the fitness value and select the best individual for iterative optimization; After multiple iterations, the optimal hyperparameter combination is obtained , train the LSTM network using the optimized hyperparameters; This optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies; Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ; Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based approach: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, It is a parameter set according to the system's requirements for false alarm rate and missed alarm rate; if , then determine the data point is an outlier point; This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and false negatives; S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control systems , calculate the observation statistics , the formula is ,in is a state parameter calculated based on historical data The expected estimated value of is calculated using moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value; Application of non-parametric CUSUM algorithm: Initializing decision statistics , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ; Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected; S33, interaction between the identity authentication module and other modules: when the device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations; If the authentication fails, the identity authentication module sends an alarm message to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen the monitoring of the device or user. Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module; When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data; If data integrity is compromised or encrypted data is found to be abnormal, an alarm will be triggered in a timely manner and corresponding defensive measures will be taken; S33, performance index definition: define the performance index of the security protection algorithm, including security index, efficiency index and reliability index; Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms; Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration, and interaction mechanism to improve overall performance and security.

7. The method for designing a security protection algorithm for an industrial control system according to claim 1 is characterized by: In step S4: Identity authentication module design: determine the authentication method and protocol, and use the national secret algorithm or the TPM chip in trusted computing technology to implement hardware-level identity authentication; Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, key information, and ensure their integrity and confidentiality; Data encryption and integrity protection module design: select encryption algorithms and key management strategies, use national secret algorithms for data encryption, and use key management functions in trusted computing technology to ensure key security; Implement a data integrity verification mechanism, use a hash algorithm to calculate the data message digest and verify it during transmission and storage; Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusions.

8. According to the industrial control system security protection algorithm design method of claim 7, Its characteristics are: in step S4: S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair. ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ; Calculate the initial hash value of the device ,in is a hash function, || represents a connection operation, and this hash value will be used as the initial identity authentication credential of the device and stored in the secure storage area of ​​the TPM chip; The user sends an authentication request to the system, including the user ID and device identification ; After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ; The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then , , and Send to the system; After receiving the authentication information, the system first verifies the timestamp The validity of the device public key is then used Signature Decrypt it and get and ;if If the password verification is successful, the next step of authentication will be continued; otherwise, the authentication fails; the encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity; The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process, and the device hardware and its corresponding public key still match; If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user, the user and the system will use the session key Perform subsequent communication encryption; If the authentication fails, the system sends an authentication failure message to the user and records the relevant authentication failure information for subsequent analysis and auditing; Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , User Password , User permissions etc.; the device information table stores the device identification , device type , Device Status Information; Key management table stores device public keys , Private Key , Session Key Key related information When a new user or device is registered, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security; When the user password or device key needs to be updated, the update operation is carried out according to the corresponding security process; for user password update, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated; For device key update, use the key update function of the TPM chip to generate a new key pair and update the relevant information in the key management table; S42, Data encryption and integrity protection module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ; The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only a trusted entity can decrypt and obtain the symmetric key , and then decrypt the data; For data that needs to be encrypted , split it into fixed-size chunks ; For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and get the encrypted data block ; Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent data from being obtained and understood by unauthorized parties during storage or transmission; When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ; Then, for each encrypted data block , using a symmetric key Decrypted with the corresponding SM4 algorithm to obtain the original data block ; Finally, all decrypted data blocks are combined into the original data set ; For data that needs to protect integrity , use the SM3 function to calculate its message digest ; The length of the message digest depends on the selected hash function. store or transmit together; When data integrity needs to be verified, recalculate the data Message Summary ; The calculated message digest The message digest stored or transmitted Compare; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and corresponding measures need to be taken; S43, Intrusion Detection and Defense Module Algorithm: SSA-LSTM-based network traffic and process data analysis algorithm: collect network traffic data and process data of industrial control systems, clean and normalize the data; for example, remove noise, outliers and duplicate data in the data, and map the data to a specific interval to facilitate subsequent algorithm processing; The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time; SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , Iterations Etc., these hyperparameters are combined into a hyperparameter vector ; Initialize the sparrow population , where each sparrow individual represents a set of hyperparameter values; Calculate the fitness value of each sparrow individual , the fitness function can be defined based on the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination; According to the rules of the sparrow optimization algorithm, the sparrow population is updated; during the iteration process, the individual sparrows update their positions according to their own roles (, the formula is as follows: Finder location update formula: ,in Indicates Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size The dimensions and elements are The matrix of and Represent the warning value and safety value respectively; when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values; when When the finder conducts a wide search; Follower position update formula: ,in Indicates In the first iteration, the sparrow The worst position of dimension, Indicates The optimal position of the sparrow in the iteration, Represents each element as or of dimensional matrix, and ; when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location; The position update formula of the sentinel takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which is subject to the mean , the variance is The normal distribution of is a random number with a value range of , is a small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When , the sentinel is close to the global optimal position; when When , the vigilant moves away from the global worst position to jump out of the local optimum; Use the optimized hyperparameters to build the LSTM model and During the training process, the LSTM model learns the time dependencies and patterns in the data based on the input network traffic or process data sequence; For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ; Set an error threshold ,if , it is considered that the data sample is abnormal, which may be caused by intrusion. In this way, the LSTM model can monitor the abnormalities in network traffic and process data in real time; Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assume that the data sequence during normal operation are independent and identically distributed, and their probability density function is ; Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the security requirements of the system and the characteristics of the data to determine whether an abnormality occurs; For each new data point ( ), calculate the likelihood ratio ; Since the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is ; Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the assumption that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at the data points by kernel density estimation. The estimated value at , we get the likelihood ratio ; According to the likelihood ratio Update the cumulative sum variable: if ,but , ; if ,but , ; if ,but , ; Cumulative and variable and They are used to detect abnormal upward and downward changes in data respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior; When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, corresponding response measures are taken, including: sending alarm information to the system administrator, including the time when the abnormality occurred, the characteristics of the abnormal data, possible attack types, etc., so that the administrator can understand the security status of the system in a timely manner; Through firewalls or intrusion prevention system security devices, according to the source information of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding; If the abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired; According to the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

9. The method for designing a security protection algorithm for an industrial control system according to claim 1, characterized in that: In steps S5-S6: S51. Implementation and integration of security protection algorithms are as follows: for the programming language and development environment used by industrial control systems, a code generation model based on syntax tree and semantic analysis is constructed; Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language; Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, ; The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on devices such as PLCs, computers, and servers; For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics; Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to a suitable value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices; Security protection module integration: Design a unified interface for modules such as identity authentication, data encryption and integrity protection, intrusion detection and defense; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ; The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying the integrity of data; The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are abnormalities; Implement these interface functions in each module, ensuring that they are consistent with the module's internal logic; In the authentication module, The function will call the authentication process based on the national encryption algorithm and TPM chip mentioned above to implement the authentication function; these interface functions provide a standard calling method for the interaction between modules, so that different modules can work together; Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set the module To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules About Information Encrypt and get the encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ; When the module Received data packet When first using the shared key right Decrypt it and get ; then calculate Hash value , and with the received Make comparisons; if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission; S61. The steps for testing and optimizing the security protection algorithm are as follows: Construct a model-based test case generation model that takes into account the functional requirements and security requirements of the security protection algorithm; suppose the functional requirement set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement; For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements; Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices; The same type of users include legitimate users and illegitimate users: The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information; For every security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for example, for the security requirement of resisting brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information; Total test case set By combining all functional test cases and security test cases, Right now ; This formula is used to generate comprehensive test cases that cover all functions and security aspects of the security protection algorithm to ensure the integrity of the test; Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ; Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ; Otherwise, the test case fails and the evaluation function returns ; For example, for a legitimate user test case for identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ; By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; assuming that the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm ;This pass rate can intuitively reflect the functionality and security quality of the algorithm; S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results; The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ; Define a performance optimization objective function , which determines the optimization direction based on the actual value of the performance indicator and the expected target value; If the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to this parameter, and a performance optimization model is established,such as ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters; Adjust the algorithm parameters according to the optimization objective function; for example, to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters; S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its relevant algorithm components and parameters; Among them, a vulnerability was found in the intrusion detection module that a new type of attack was not detected in time. Analysis found that it was related to the threshold of the intrusion detection algorithm. related; Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold, it may be adjusted according to the severity and impact scope of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the detection capability of the intrusion detection algorithm for new attacks, thereby enhancing the security of the algorithm.

10. According to the industrial control system security protection algorithm design method described in claim 1, Its characteristics are: in step S7: S71. The steps for deploying and continuously monitoring security protection algorithms are: Deployment plan generation: First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ; For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , Dependencies and operating status ; Building a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Indicates the attribute value of the corresponding hardware or software; through this matrix, you can clearly understand the current status and dependencies of the system and provide basic data for deployment planning; Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module; For each module , analyze its dependencies on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the authentication module depends on; for example, the authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ; Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm. Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies; Suppose the topological sorting algorithm is ,but ; This formula is used to determine the correct deployment order to ensure that the security protection algorithm can be successfully deployed in the industrial control system; Resource allocation and scheduling: Based on the resource usage of hardware components And the resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components The available resources determine how much resources to allocate to the module ; Among them, if the intrusion detection module Certain CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements. At the same time, considering the operation plan of the industrial control system, arrange the deployment time of the security protection algorithm; suppose the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operation plan , select the appropriate time window to deploy the security protection algorithm; for example, if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, such as the update of the identity authentication module; S72. The steps for updating the security configuration are: Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ; For each configuration parameter , establish an adjustment model related to system environmental factors; Among them, for the key length of the encryption algorithm Considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is ; This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm; By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained ; These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure the best performance of the algorithms in the new environment; Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings; Define a configuration validation function , it checks whether the updated configuration is correct and effective; for example, for a new key length configuration of an encryption algorithm, the verification function checks whether the encryption module actually uses the new key length for encryption operations; if the configuration verification fails, the configuration update operation needs to be performed again until all configuration parameters are correctly updated and verified; S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ; For each status indicator , establish a corresponding collection mechanism; Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the execution end timestamp is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis; State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range to ; Among them, for the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ; Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ; Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module; By comprehensively analyzing the evaluation results of all status indicators, it is possible to determine whether the overall operating status of the security protection algorithm is abnormal. Some multivariate anomaly detection methods can be used, such as the method based on principal component analysis. Suppose the collected status indicator value vector is , and transform it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not in the normal area, it is judged that the operation status of the security protection algorithm is abnormal; S74, Security situation monitoring and policy adjustment: The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , Internal security risk level , Data security level , System vulnerability level ; For each quantitative indicator , establish the corresponding calculation model; Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity of the attack is assessed as , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: ; This formula takes into account the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security situation; By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems; Policy Adjustment Model: Quantifying Vectors Based on Security Situation , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix It is represented by, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation strategy For quantitative indicators the extent of the impact; Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix; Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If the policy adjustment objective function has a significant impact, it will suggest adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, which determines the specific strategy adjustment plan, dynamically adjusts the security protection strategy and algorithm parameters according to the security situation, and ensures the continuous security of the industrial control system.

Images