Design method of security protection algorithm for industrial control systems

Abstract

The present invention provides a method for designing security protection algorithms for industrial control systems, which clarifies the security protection objectives and scope, identifies key components and business processes, and defines protection boundaries. Risk assessment and threat modeling are then performed to identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts. A security protection algorithm framework is designed, appropriate security technologies and algorithms are selected, and the architecture and module composition are determined. Modules such as identity authentication, data encryption and integrity protection, intrusion detection and defense are designed in detail, including authentication methods, key management, integrity verification, intrusion detection algorithms, and response strategies. The algorithm is then implemented and integrated, programmed into the system, and collaboration between modules is ensured. Algorithm performance and security are optimized through functional and security testing. Finally, the algorithm is deployed to the industrial control system, its operating status and security situation are continuously monitored, and strategies and parameters are dynamically adjusted to effectively ensure the security of the industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of industrial control systems, and in particular to a method for designing a security protection algorithm for an industrial control system. Background Art

[0002] With the widespread application of information technology in the industrial sector, industrial control systems (ICS) are becoming increasingly complex and interconnected, facing severe security threats. ICS comprise the field control layer, process monitoring layer, and system network layer, encompassing key components such as sensors, actuators, controllers, servers, and operator stations. They achieve automation and monitoring through collaborative business processes such as data acquisition, control command transmission, and configuration. However, the openness of ICS and their connectivity to external networks make them attractive targets for attack.

[0003] ICS face diverse threats, including viruses, Trojans, hacker attacks, and industrial espionage, which exploit attack vectors such as network protocol vulnerabilities, insecure configurations, and malware injection to penetrate systems. Network protocol vulnerabilities can be exploited to gain access, insecure configurations can lead to tampering with control instructions and impact production, and industrial espionage can damage corporate competitiveness and intellectual property.

[0004] ICS assets, such as PLCs, computers, and servers, are vulnerable to various vulnerabilities. Exploiting these vulnerabilities can have serious impacts on production processes, data security, personnel safety, and the environment. For example, tampering with control instructions can cause security incidents, data leaks can expose confidential information, and in specific industrial scenarios, attacks can pollute the environment and endanger personnel safety.

[0005] Existing security measures have limitations. Traditional network security technologies are not suitable for ICS environments. ICS requires high real-time performance and reliability, and traditional security mechanisms can introduce delays or disrupt production processes. Furthermore, the diversity and specialization of ICS equipment and protocols make traditional security products difficult to effectively protect against. Existing security solutions often target a single threat or a specific level of concern, lacking comprehensive considerations. For example, identity authentication mechanisms may be imperfect, data encryption schemes lack interoperability, and the ability to continuously monitor and dynamically adjust security algorithms after deployment is insufficient. Summary of the Invention

[0006] The main purpose of the present invention is to provide a method for designing security protection algorithms for industrial control systems, so as to solve the problems that existing security protection solutions mostly target single threats or problems at a certain level and lack comprehensive considerations, such as imperfect identity authentication mechanisms, poor coordination of data encryption solutions, and insufficient ability to continuously monitor and dynamically adjust security protection algorithms after deployment.

[0007] To solve the above technical problems, the technical solution adopted by the present invention is: a method for designing a security protection algorithm for an industrial control system, the method comprising:

[0008] S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection;

[0009] S2. Conduct risk assessment and threat modeling: Identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts;

[0010] S3. Design a security protection algorithm framework: Select appropriate security technologies and algorithms, and determine the algorithm's architecture and module composition;

[0011] S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and prevention module;

[0012] S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert it into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction;

[0013] S6. Testing and Optimizing Security Protection Algorithms: Conduct functional and security testing to evaluate identity authentication, data encryption and integrity protection, and intrusion detection functionality and security. Based on test results, optimize algorithm performance and security, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds, and identity authentication processes.

[0014] S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure they do not affect system operations, and perform security configuration updates;

[0015] Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

[0016] In the preferred scheme, in step S1:

[0017] Key components include sensors, actuators, controllers, servers, and operator stations. The business process includes data acquisition, control instruction transmission, and configuration.

[0018] Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

[0019] In the preferred scheme, in step S1:

[0020] S11. Collect connection relationship data between sensors, actuators, controllers, servers, and operator stations in various devices in the industrial control system, as well as data flow information in data acquisition, control instruction transmission, and configuration in business processes;

[0021] Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data;

[0022] S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model. ,in is a collection of nodes, is the edge set, is the set of edge weights;

[0023] For edge weights , assigned values ​​based on factors such as data traffic size and communication frequency;

[0024] S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes;

[0025] Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node and passing through the node The number of shortest paths;

[0026] Betweenness centrality reflects a node's ability to control the flow of information in a network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a critical control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected.

[0027] Calculate the closeness centrality of nodes , the formula is: ,in is a node and The shortest path length between

[0028] Closeness centrality is used to measure the proximity between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process.

[0029] Assign a comprehensive importance index to each node based on the calculated degree centrality, betweenness centrality, and closeness centrality , the formula is: ,in 、 、 is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system;

[0030] Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected;

[0031] S14. Identify paths related to data collection, control instruction transmission, and configuration business processes from the network model;

[0032] For each business process path , calculate its importance index , the formula is: ,in Is the path Nodes on is a node With adjacent nodes The weight of the edge between them;

[0033] S15. Define security protection boundaries: Divide the industrial control system network into the field control layer, process monitoring layer, and system network layer, and analyze the connection relationship and data interaction mode between each layer;

[0034] Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and Is a boundary node The set of nodes in two different network layers connected, is a node With node The weight of the edge between them;

[0035] The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection and require enhanced protection measures to prevent external attacks from penetrating into the system through these nodes.

[0036] Based on the importance of the boundary nodes, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls, intrusion detection systems and other security equipment at the boundary nodes to monitor and filter the network traffic in and out of the boundary.

[0037] In the preferred solution, in step S2:

[0038] Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage; attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection;

[0039] Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of vulnerabilities and insecure configurations on production processes, data security, personnel safety, and the environment after being attacked;

[0040] S21. Threat Data Collection and Collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data.

[0041] Categorize and organize the collected data, categorizing threats into viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors into network protocol vulnerabilities, insecure configurations, and malware injections.

[0042] For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined by the difficulty and prevalence of the attack vector.

[0043] The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector and the greater the possibility of posing a threat to the system;

[0044] S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity;

[0045] Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk, and count the number of vulnerabilities of different severity on each asset;

[0046] For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole Severity score of high-risk vulnerabilities, high scores can be set to ; Medium-severity vulnerabilities have moderate scores, such as ; Low-risk vulnerabilities have lower scores, such as ;

[0047] It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation;

[0048] This formula takes into account the severity and exploitability of the vulnerabilities on an asset to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack;

[0049] S23. Establish a risk influencing factor matrix:

[0050] Determine the assessment factors for risk impact, including impact on production processes, data security, personnel safety and the environment;

[0051] Build a Risk influencing factor matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the impact levels, including high, medium, and low;

[0052] Matrix elements Indicates in Under the influence of factors, the attack leads to The probability of the degree of impact;

[0053] When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: This formula comprehensively considers the likelihood of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors. It is used to measure the risk impact of a specific attack vector on an asset in various aspects.

[0054] Computational Assets Attack vectors Comprehensive risk indicators of attacks , the formula is: This formula integrates the risk impact of all factors affecting an asset attack to produce a comprehensive risk assessment value.

[0055] By comparing different asset and attack vector combinations The value can be used to identify the parts of the system facing higher risks, so as to carry out targeted security protection and resource allocation.

[0056] In the preferred solution, in step S3:

[0057] Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms;

[0058] The cryptographic technology adopts the national secret algorithm;

[0059] Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms;

[0060] Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

[0061] In the preferred solution, in step S3:

[0062] S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block is bits, according to the SM4 algorithm requirements;

[0063] The encryption process uses encryption functions ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on message groups ( ), the calculation process is as follows:

[0064] Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function that contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage, ensuring data integrity;

[0065] Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database;

[0066] When a device or user requests authentication, a random number is generated. , using the private key For random numbers Sign with the device or user's identification information ID to obtain the signature value , and 、 and Send to the authentication server;

[0067] After receiving the request, the authentication server uses the stored public key Verify the signature If the verification is successful, the authentication is passed; otherwise, the authentication fails. The signature and verification process is based on the asymmetric encryption principle to ensure the security and non-forgeability of identity authentication.

[0068] S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences from industrial control systems , normalize the data so that it is in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms;

[0069] Model training: Use the Sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network;

[0070] The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size;

[0071] Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; the population is updated according to the fitness value, and the optimal individual is selected for iterative optimization;

[0072] After multiple iterations, the optimal hyperparameter combination is obtained , using the optimized hyperparameters to train the LSTM network; this optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies;

[0073] Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ;

[0074] Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based method: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, Parameters set according to the system's requirements for false alarm rate and missed alarm rate;

[0075] if , then determine the data point is an abnormal point;

[0076] This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and missed negatives;

[0077] S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control system , calculate the observation statistics , the formula is ,in It is a state parameter calculated based on historical data The expected estimated value of is calculated using the moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value;

[0078] Application of non-parametric CUSUM algorithm: initializing the decision statistic , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ;

[0079] Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected;

[0080] S33. Interaction between the identity authentication module and other modules: When a device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations;

[0081] If authentication fails, the identity authentication module sends an alarm to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen monitoring of the device or user.

[0082] Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module;

[0083] When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data. If data integrity is compromised or encrypted data is abnormal, an alarm is triggered in a timely manner and appropriate defensive measures are taken.

[0084] S33, Performance indicator definition: Define the performance indicators of the security protection algorithm, including security indicators, efficiency indicators and reliability indicators;

[0085] Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms;

[0086] Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration and interaction mechanism to improve overall performance and security.

[0087] In the preferred solution, in step S4:

[0088] Identity authentication module design: Determine the authentication method and protocol, and implement hardware-level identity authentication using a national secret algorithm or a TPM chip in trusted computing technology;

[0089] Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, and key information, and ensure their integrity and confidentiality;

[0090] Data encryption and integrity protection module design: Select encryption algorithms and key management strategies, adopt national secret algorithms for data encryption, and use key management functions in trusted computing technology to ensure key security; implement data integrity verification mechanisms, use hash algorithms to calculate data message digests and verify them during transmission and storage;

[0091] Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusion behaviors.

[0092] In the preferred solution, in step S4:

[0093] S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ;

[0094] Calculate the initial hash value of the device ,in is a hash function, || represents a concatenation operation. This hash value will be used as the initial authentication credential of the device and stored in the secure storage area of ​​the TPM chip.

[0095] The user sends an authentication request to the system, which includes the user ID and device identification ;

[0096] After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ;

[0097] The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then 、 、 and Send to the system;

[0098] After receiving the authentication information, the system first verifies the timestamp The validity of the device public key Signature Decrypt and get and ;if If the password verification passes, the authentication proceeds to the next step; otherwise, the authentication fails. The encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity.

[0099] The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process and that the device hardware and its corresponding public key still match.

[0100] If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user, the user and the system will use the session key Perform subsequent communication encryption;

[0101] If the authentication fails, the system will send an authentication failure message to the user and record the relevant authentication failure information for subsequent analysis and auditing;

[0102] Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , user password , User Permissions etc.; the device information table stores the device identification , device type , device status Information; key management table stores device public keys , private key , session key Key-related information

[0103] When a new user or device registers, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security;

[0104] When a user password or device key needs to be updated, the update operation is carried out according to the corresponding security process. For user password updates, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated. For device key updates, a new key pair is generated using the key update function of the TPM chip and the relevant information in the key management table is updated.

[0105] S42, Data Encryption and Integrity Protection Module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ;

[0106] The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only trusted entities can decrypt and obtain the symmetric key , and then decrypt the data;

[0107] For data that needs to be encrypted , split it into fixed-size data blocks ;

[0108] For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and obtain the encrypted data block ;

[0109] Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent it from being obtained and understood by unauthorized parties during storage or transmission;

[0110] When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ;

[0111] Then, for each encrypted data block , using a symmetric key Decrypt with the corresponding SM4 algorithm to obtain the original data block ;

[0112] Finally, all decrypted data blocks are combined into the original data set ;

[0113] For data that needs to protect integrity , use the SM3 function to calculate its message digest ; The length of the message digest depends on the selected hash function. Store or transmit together;

[0114] When data integrity needs to be verified, recalculate the data Message Summary ;

[0115] The calculated message digest Digest of the message stored or transmitted Compare; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and appropriate measures need to be taken;

[0116] S43, Intrusion Detection and Defense Module Algorithm:

[0117] SSA-LSTM-based network traffic and process data analysis algorithm: This algorithm collects network traffic and process data from industrial control systems, cleans and normalizes the data, for example, removing noise, outliers, and duplicate data, and mapping the data to specific intervals for subsequent algorithm processing.

[0118] The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time;

[0119] SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , number of iterations Etc., these hyperparameters are combined into a hyperparameter vector ;

[0120] Initialize the sparrow population , where each sparrow individual Represents a set of hyperparameter values; calculates the fitness value of each sparrow individual , the fitness function can be defined based on the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination.

[0121] According to the rules of the sparrow optimization algorithm, the sparrow population is updated; during the iteration process, the individual sparrows update their positions according to their own roles (the formula is as follows:

[0122] Finder location update formula: ,in Indicates the Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size Dimensions and elements are The matrix, and Represent the warning value and safety value respectively;

[0123] when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values;

[0124] when When the finder conducts a wide search;

[0125] Follower position update formula: ,in Indicates the In the first iteration, the sparrow The worst position of dimension, Indicates the The optimal position of the sparrow in the iteration, Indicates that each element is or of dimensional matrix, and ;

[0126] when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location;

[0127] The sentinel position update formula takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which obeys the mean , the variance is The normal distribution of Is a random number with a value range of , is a very small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When , the guard is close to the global optimal position; when When , the vigilant moves away from the global worst position to jump out of the local optimum;

[0128] Use the optimized hyperparameters to build the LSTM model and During training, the LSTM model learns the temporal dependencies and patterns in the data based on the input network traffic or process data sequence.

[0129] For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ;

[0130] Set an error threshold ,if , then the data sample is considered abnormal and may be caused by intrusion. In this way, the LSTM model can monitor anomalies in network traffic and process data in real time.

[0131] Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assuming that the data sequence is normal are independent and identically distributed, and their probability density function is ;

[0132] Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the system's security requirements and the characteristics of the data to determine whether an anomaly occurs;

[0133] For each new data point ( ), calculate the likelihood ratio ; Due to the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the hypothesis that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at data points by kernel density estimation. The estimated value at , we get the likelihood ratio ;

[0134] According to the likelihood ratio Update the cumulative sum variable:

[0135] if ,but , ;

[0136] if ,but , ;

[0137] if ,but , ;

[0138] Cumulative and variable and They are used to detect abnormal changes in data upward and downward respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior;

[0139] When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, appropriate response measures are taken, including sending alert information to the system administrator, including the time when the abnormality occurred, the characteristics of the abnormal data, and the possible attack type, so that the administrator can promptly understand the security status of the system;

[0140] Using firewalls or intrusion prevention system security devices, based on the source of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding.

[0141] If abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired;

[0142] Based on the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

[0143] In the preferred solution, in steps S5-S6:

[0144] S51. Implementation and integration of security protection algorithms: Specifically, for the programming language and development environment used by industrial control systems, a code generation model based on syntax trees and semantic analysis is constructed;

[0145] Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language;

[0146] Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on devices such as PLCs, computers, and servers.

[0147] For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics;

[0148] Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize;

[0149] Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to an appropriate value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices;

[0150] Security protection module integration: Design a unified interface for modules such as identity authentication, data encryption and integrity protection, and intrusion detection and defense; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ;

[0151] The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying data integrity;

[0152] The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are any abnormalities;

[0153] Implement these interface functions within each module, ensuring they are consistent with the module's internal logic;

[0154] In the authentication module, The function will call the aforementioned authentication process based on the national encryption algorithm and TPM chip to implement the authentication function; these interface functions provide a standard calling method for interaction between modules, enabling different modules to work together;

[0155] Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set up modules To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules Information Encrypt and obtain encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ;

[0156] When the module Received data packet When first using the shared key right Decrypt and get ; then calculate Hash value and with the received Make comparisons;

[0157] if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission;

[0158] S61. The steps for testing and optimizing the security protection algorithm are as follows:

[0159] Construct a model-based test case generation model that considers the functional requirements and security requirements of the security protection algorithm; suppose the functional requirements set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement;

[0160] For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements;

[0161] Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices;

[0162] The same type of users include legitimate users and illegitimate users:

[0163] The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information;

[0164] For each security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for example, for the security requirement of resisting brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information;

[0165] Total test case set By combining all functional test cases and security test cases,

[0166] Right now This formula is used to generate comprehensive test cases that cover all functional and security aspects of the security protection algorithm, ensuring the integrity of the test.

[0167] Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ;

[0168] Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ;

[0169] Otherwise, the test case fails and the evaluation function returns ; For example, for legitimate user test cases for identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ;

[0170] By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; suppose the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm is ;This pass rate can intuitively reflect the functionality and security quality of the algorithm;

[0171] S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results;

[0172] The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ;

[0173] Define a performance optimization objective function , which determines the optimization direction based on the actual value and expected target value of the performance indicator;

[0174] Among them, if the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to ,this parameter, and a performance optimization model is established, such as ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters;

[0175] Adjust the algorithm parameters according to the optimization objective function; for example, to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters;

[0176] S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its related algorithm components and parameters;

[0177] Among them, a vulnerability was found in the intrusion detection module that it could not detect a new type of attack in a timely manner. Analysis showed that it was related to the threshold of the intrusion detection algorithm. related;

[0178] Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold problem, it may be based on the severity and impact range of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the intrusion detection algorithm's ability to detect new attacks, thereby enhancing the security of the algorithm.

[0179] In the preferred solution, in step S7:

[0180] S71. The steps for deploying and continuously monitoring security protection algorithms are as follows:

[0181] Deployment plan generation:

[0182] First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ;

[0183] For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , dependencies and operating status ;

[0184] Build a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Represents the attribute values ​​of the corresponding hardware or software; this matrix can clearly understand the current status and dependencies of the system, providing basic data for deployment planning;

[0185] Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module;

[0186] For each module , analyze its dependency on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the system depends on; for example, the identity authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ;

[0187] Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm, Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies;

[0188] Suppose the topological sorting algorithm is ,but This formula is used to determine the correct deployment order to ensure that security protection algorithms can be successfully deployed in industrial control systems.

[0189] Resource allocation and scheduling: Based on the resource usage of hardware components and resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components Available resources determine how much resources to allocate to the module ;

[0190] Among them, if the intrusion detection module A certain amount of CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements.

[0191] At the same time, considering the operation plan of the industrial control system, the deployment time of the security protection algorithm is arranged; the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operational plans , select the appropriate time window for deploying security protection algorithms; for example, if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, such as the update of the identity authentication module;

[0192] S72. The steps for updating the security configuration are as follows:

[0193] Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ;

[0194] For each configuration parameter , establish an adjustment model related to system environmental factors;

[0195] Among them, for the key length of the encryption algorithm , considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm.

[0196] By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure optimal performance in the new environment.

[0197] Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings;

[0198] Define a configuration validation function , which checks whether the updated configuration is correct and effective. For example, for a new key length configuration of an encryption algorithm, the verification function checks whether the encryption module actually uses the new key length for encryption operations. If the configuration verification fails, the configuration update operation needs to be repeated until all configuration parameters are correctly updated and verified.

[0199] S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ;

[0200] For each status indicator , establish corresponding collection mechanisms;

[0201] Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the execution end timestamp is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis;

[0202] State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range as ;

[0203] Among them, the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ;

[0204] Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ;

[0205] Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module;

[0206] By comprehensively analyzing the evaluation results of all status indicators, it is possible to determine whether the overall operating status of the security protection algorithm is abnormal. Some multivariate anomaly detection methods can be used, such as the method based on principal component analysis. Suppose the collected status indicator value vector is , and convert it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not within the normal area, it is judged that the security protection algorithm is operating abnormally;

[0207] S74. Security situation monitoring and policy adjustment:

[0208] The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , internal security risk level , data security level , system vulnerability level ;

[0209] For each quantitative indicator , establish the corresponding calculation model;

[0210] Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity assessment value of the attack is , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: This formula comprehensively considers the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security posture.

[0211] By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems;

[0212] Policy Adjustment Model: Quantifying Vectors Based on Security Posture , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix To represent, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation Strategy For quantitative indicators the extent of the impact;

[0213] Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix;

[0214] Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If there is a significant impact, the policy adjustment objective function will recommend adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, determines the specific policy adjustment plan, and dynamically adjusts the security protection strategy and algorithm parameters according to the security situation to ensure the continuous security of the industrial control system.

[0215] This invention provides a method for designing security protection algorithms for industrial control systems (ICS). It accurately identifies potential threats and attack vectors within ICS systems (ICS). By analyzing various threat types and attack vectors, it comprehensively assesses the risks facing the system. Based on a deep understanding of ICS architecture and business processes, the security protection objectives and scope are clearly defined, including the identification of key components and the definition of protection boundaries, ensuring more targeted protection. The algorithm incorporates multifunctional modules, including identity authentication, data encryption and integrity protection, and intrusion detection and prevention. These modules work together to enhance overall security. Regarding identity authentication, hardware-level authentication is implemented using a combination of national secret algorithms and a Trusted Platform Module (TPM) chip, ensuring the authenticity and confidentiality of user and device identities and preventing unauthorized access. The data encryption and integrity protection module utilizes appropriate encryption algorithms and key management strategies to protect the confidentiality and integrity of data during transmission and storage, preventing data leakage and tampering. The intrusion detection and prevention module employs complex algorithms to monitor and analyze network traffic and process data in real time, enabling timely detection of abnormal behavior, effective response to intrusions, and mitigation of attack impacts. The algorithm can be accurately implemented on various ICS devices and is compatible with various programming languages ​​and development environments, ensuring stable operation. A comprehensive testing mechanism can comprehensively evaluate the performance of algorithms in identity authentication, data encryption and integrity protection, intrusion detection and other functions to ensure algorithm quality. Based on the test results, the algorithm is continuously optimized and parameters are dynamically adjusted to adapt to the ever-changing security environment and system status. After deployment, the algorithm operation status and security situation can be continuously monitored, problems can be discovered in a timely manner, and security protection strategies and algorithm parameters can be dynamically adjusted to ensure the long-term safe and stable operation of industrial control systems, reduce production accidents, data leaks, personnel safety threats and environmental hazards caused by security issues, improve the reliability and security of ICS, and ensure the normal operation of industrial production. BRIEF DESCRIPTION OF THE DRAWINGS

[0216] The present invention will be further described below with reference to the accompanying drawings and examples:

[0217] Figure 1 It is a design flow chart of the present invention; DETAILED DESCRIPTION

[0218] Example 1

[0219] like Figure 1 As shown, a method for designing a security protection algorithm for an industrial control system includes:

[0220] S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection;

[0221] S2. Conduct risk assessment and threat modeling: Identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts;

[0222] S3. Design a security protection algorithm framework: Select appropriate security technologies and algorithms, and determine the algorithm's architecture and module composition;

[0223] S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and prevention module;

[0224] S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert it into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction;

[0225] S6. Testing and Optimizing Security Protection Algorithms: Conduct functional and security testing to evaluate identity authentication, data encryption and integrity protection, and intrusion detection functionality and security. Based on test results, optimize algorithm performance and security, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds, and identity authentication processes.

[0226] S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure they do not affect system operations, and perform security configuration updates;

[0227] Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

[0228] In the preferred scheme, in step S1:

[0229] Key components include sensors, actuators, controllers, servers, and operator stations. The business process includes data acquisition, control instruction transmission, and configuration.

[0230] Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

[0231] Accurately identify key components and business processes within industrial control systems, and clearly define the boundaries and scope of security protection. By building a network model of the system, analyzing the characteristics of nodes and edges, and applying specific mathematical formulas to calculate metrics such as node importance, we achieve a comprehensive understanding of industrial control systems and effective protection.

[0232] In the preferred scheme, in step S1:

[0233] S11. Collect connection relationship data between sensors, actuators, controllers, servers, and operator stations in various devices in the industrial control system, as well as data flow information in data acquisition, control instruction transmission, and configuration in business processes;

[0234] Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data;

[0235] S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model. ,in is a collection of nodes, is the edge set, is the set of edge weights;

[0236] For edge weights , and assigns values ​​based on factors such as data traffic size and communication frequency; if the data traffic between two devices is large, the weight of the edge between them will be correspondingly larger.

[0237] S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes;

[0238] This formula is useful for measuring the number of direct connections a node has within a network. Nodes with higher degree centrality are more likely to be important in information dissemination or system control. For example, in a data collection process, a controller node directly connected to multiple sensors may have a higher degree centrality and have a greater impact on the overall data collection process.

[0239] Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node and passing through the node The number of shortest paths;

[0240] Betweenness centrality reflects a node's ability to control the flow of information in a network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a critical control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected.

[0241] Calculate the closeness centrality of nodes , the formula is: ,in is a node and The shortest path length between

[0242] Closeness centrality is used to measure the proximity between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process.

[0243] In the communication between the operator station and the controller, nodes with high proximity centrality can transmit operation instructions faster, which is of great significance to the real-time control of the system.

[0244] Assign a comprehensive importance index to each node based on the calculated degree centrality, betweenness centrality, and closeness centrality , the formula is: ,in 、 、 is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system;

[0245] Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected;

[0246] S14. Identify paths related to data collection, control instruction transmission, and configuration business processes from the network model;

[0247] For each business process path , calculate its importance index , the formula is: ,in Is the path Nodes on is a node With adjacent nodes The weight of the edge between them;

[0248] This formula comprehensively considers the importance of nodes and edge weights along a path to measure the importance of a business process path within the entire system. More important business process paths require stricter security protection to ensure accurate data collection, reliable instruction transmission, and correct configuration.

[0249] S15. Define security protection boundaries: Divide the industrial control system network into the field control layer, process monitoring layer, and system network layer, and analyze the connection relationship and data interaction mode between each layer;

[0250] Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and Is a boundary node The set of nodes in two different network layers connected, is a node With node The weight of the edge between them;

[0251] The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection and require enhanced protection measures to prevent external attacks from penetrating into the system through these nodes.

[0252] Based on the importance of the boundary nodes, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls, intrusion detection systems and other security equipment at the boundary nodes to monitor and filter the network traffic in and out of the boundary.

[0253] Using complex network analysis methods, this algorithm comprehensively considers the diverse characteristics of nodes in industrial control systems, the importance of business processes, and the boundary relationships between network layers. By accurately identifying key components, assessing the importance of business processes, and defining security protection boundaries, it provides a scientific basis and effective technical support for the security protection of industrial control systems, helping to improve system security and reliability and reduce security risks. In practical applications, the algorithm's parameters and thresholds can be further optimized based on the specific system conditions and security requirements to meet the security protection requirements of different industrial scenarios.

[0254] Example 2

[0255] Further explanation is given in conjunction with Example 1. In the preferred solution, in step S2:

[0256] Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage; attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection;

[0257] Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of vulnerabilities and insecure configurations on production processes, data security, personnel safety, and the environment after being attacked;

[0258] Comprehensively identify potential threats and attack vectors within industrial control systems, and accurately assess asset vulnerabilities and the impact of attacks. By comprehensively analyzing multiple factors and applying complex mathematical models, we provide a scientific basis for system security protection.

[0259] S21. Threat Data Collection and Collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data.

[0260] Categorize and organize the collected data, categorizing threats into viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors into network protocol vulnerabilities, insecure configurations, and malware injections.

[0261] For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined by the difficulty and prevalence of the attack vector.

[0262] The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector and the greater the possibility of posing a threat to the system;

[0263] If there are many historical attack events related to the network protocol vulnerability and the vulnerability is easy to exploit (high weight), then its The value will be larger.

[0264] S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity;

[0265] Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk, and count the number of vulnerabilities of different severity on each asset;

[0266] For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole Severity score of high-risk vulnerabilities, high scores can be set to ; Medium-severity vulnerabilities have moderate scores, such as ; Low-risk vulnerabilities have lower scores, such as ;

[0267] It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation;

[0268] This formula takes into account the severity and exploitability of the vulnerabilities on an asset to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack; a server with multiple highly exploitable and high severity vulnerabilities has a higher The value will be higher.

[0269] S23. Establish a risk influencing factor matrix:

[0270] Determine the assessment factors for risk impact, including impact on production processes, data security, personnel safety and the environment;

[0271] Build a Risk influencing factor matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the impact levels, including high, medium, and low;

[0272] Matrix elements Indicates in Under the influence of factors, the attack leads to The probability of the degree of impact;

[0273] When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: This formula comprehensively considers the likelihood of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors. It is used to measure the risk impact of a specific attack vector on an asset in various aspects.

[0274] If a PLC with high vulnerability is attacked by a malware injection attack with high probability, and according to the matrix The probability that the attack will have a high impact on the production process is high. (For factors affecting the production process) the value will be larger.

[0275] Computational Assets Attack vectors Comprehensive risk indicators of attacks , the formula is: This formula integrates the risk impact of all factors affecting an asset attack to produce a comprehensive risk assessment value.

[0276] By comparing different asset and attack vector combinations The value can be used to identify the parts of the system facing higher risks, so as to carry out targeted security protection and resource allocation.

[0277] By systematically identifying threats and attack vectors, assessing asset vulnerabilities, and calculating risk impact indicators, we can comprehensively and accurately understand the security risks facing industrial control systems. Based on these results, we can prioritize high-risk assets and attack vectors within the system and formulate appropriate security strategies and protective measures to effectively reduce the risk of system attacks and ensure the secure and stable operation of industrial control systems. In practice, threat intelligence and risk assessment parameters should be regularly updated to adapt to the ever-changing security environment.

[0278] Example 3

[0279] Further explanation is given in conjunction with Example 1. In the preferred solution, in step S3:

[0280] Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms;

[0281] The cryptographic technology adopts the national secret algorithm;

[0282] Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms;

[0283] Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

[0284] We build a comprehensive industrial control system security framework that integrates multiple advanced security technologies, including identity authentication based on trusted computing, data encryption and integrity protection using national secret algorithms, and intelligent intrusion detection and prevention. Through innovative mathematical models and algorithmic processes, we achieve high-intensity security protection for industrial control systems.

[0285] In the preferred solution, in step S3:

[0286] S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block is bits, according to the SM4 algorithm requirements;

[0287] The encryption process uses encryption functions ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on message groups ( ), the calculation process is as follows:

[0288] Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function that contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage, ensuring data integrity;

[0289] Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database;

[0290] When a device or user requests authentication, a random number is generated. , using the private key For random numbers Sign with the device or user's identification information ID to obtain the signature value , and 、 and Send to the authentication server;

[0291] After receiving the request, the authentication server uses the stored public key Verify the signature If the verification is successful, the authentication is passed; otherwise, the authentication fails. The signature and verification process is based on the asymmetric encryption principle to ensure the security and non-forgeability of identity authentication.

[0292] S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences from industrial control systems , normalize the data so that it is in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms;

[0293] Model training: Use the Sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network;

[0294] The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size;

[0295] Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; the population is updated according to the fitness value, and the optimal individual is selected for iterative optimization;

[0296] After multiple iterations, the optimal hyperparameter combination is obtained , using the optimized hyperparameters to train the LSTM network; this optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies;

[0297] Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ;

[0298] Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based method: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, Parameters set according to the system's requirements for false alarm rate and missed alarm rate;

[0299] if , then determine the data point is an abnormal point;

[0300] This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and missed negatives;

[0301] S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control system , calculate the observation statistics , the formula is ,in It is a state parameter calculated based on historical data The expected estimated value of is calculated using the moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value;

[0302] Application of non-parametric CUSUM algorithm: initializing the decision statistic , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ;

[0303] Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected;

[0304] S33. Interaction between the identity authentication module and other modules: When a device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations;

[0305] If authentication fails, the identity authentication module sends an alarm to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen monitoring of the device or user.

[0306] Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module;

[0307] When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data. If data integrity is compromised or encrypted data is abnormal, an alarm is triggered in a timely manner and appropriate defensive measures are taken.

[0308] S33, Performance indicator definition: Define the performance indicators of the security protection algorithm, including security indicators, efficiency indicators and reliability indicators;

[0309] Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms;

[0310] Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration and interaction mechanism to improve overall performance and security.

[0311] If it is found that a certain intrusion detection algorithm has a high false alarm rate in a specific attack scenario, its threshold can be adjusted or the algorithm model structure can be optimized.

[0312] A multi-layered, comprehensive industrial control system security protection system has been constructed. Based on innovative mathematical models and algorithmic processes, it ensures data confidentiality and integrity protection, reliable device and user authentication, and precise detection and prevention of system intrusions. By continuously optimizing algorithm parameters and architecture, it adapts to complex and changing industrial control environments, effectively ensuring the secure and stable operation of industrial control systems. In practical applications, the algorithm's functionality can be further customized and expanded based on specific system requirements and security strategies.

[0313] Example 4

[0314] Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred solution, in step S4:

[0315] Identity authentication module design: Determine the authentication method and protocol, and implement hardware-level identity authentication using a national secret algorithm or a TPM chip in trusted computing technology;

[0316] Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, and key information, and ensure their integrity and confidentiality;

[0317] Data encryption and integrity protection module design: Select encryption algorithms and key management strategies, adopt national secret algorithms for data encryption, and use key management functions in trusted computing technology to ensure key security; implement data integrity verification mechanisms, use hash algorithms to calculate data message digests and verify them during transmission and storage;

[0318] Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusion behaviors.

[0319] In the preferred solution, in step S4:

[0320] S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ;

[0321] Calculate the initial hash value of the device ,in is a hash function, || represents a concatenation operation. This hash value will serve as the device's initial authentication credential and will be stored in the secure storage area of ​​the TPM chip. The formula is used to bind the device ID and public key to generate a unique hash value that can be used for authentication, preventing the device ID and public key from being tampered with or forged.

[0322] The user sends an authentication request to the system, which includes the user ID and device identification ;

[0323] After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ;

[0324] The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then 、 、 and Send to the system;

[0325] After receiving the authentication information, the system first verifies the timestamp The validity of Is it within a certain range of the current time to prevent replay attacks? Is it within a certain range of the current time to prevent replay attacks? Then use the device public key Signature Decrypt and get and ;if If the password verification is passed, the next step of authentication will be continued. Compare with the user password stored in the system;

[0326] Otherwise, the authentication fails. The encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity.

[0327] The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process and that the device hardware and its corresponding public key still match.

[0328] If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user (for example, encrypted using the public key of the user's device), the user and the system will use the session key Perform subsequent communication encryption;

[0329] If authentication fails, the system sends an authentication failure message to the user and records relevant authentication failure information (such as time, user ID, failure reason, etc.) for subsequent analysis and auditing;

[0330] Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , user password , User Permissions etc.; the device information table stores the device identification , device type , device status Information; key management table stores device public keys , private key , session key Key-related information

[0331] When a new user or device registers, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security;

[0332] When a user password or device key needs to be updated, the update operation is carried out according to the corresponding security process. For user password updates, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated. For device key updates, a new key pair is generated using the key update function of the TPM chip and the relevant information in the key management table is updated.

[0333] S42, Data Encryption and Integrity Protection Module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ;

[0334] The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only trusted entities can decrypt and obtain the symmetric key , and then decrypt the data;

[0335] For data that needs to be encrypted , split it into fixed-size data blocks ;

[0336] For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and obtain the encrypted data block ;

[0337] Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent it from being obtained and understood by unauthorized parties during storage or transmission;

[0338] When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ;

[0339] Then, for each encrypted data block , using a symmetric key Decrypt with the corresponding SM4 algorithm to obtain the original data block ;

[0340] Finally, all decrypted data blocks are combined into the original data set ;

[0341] For data that needs to protect integrity , use the SM3 function to calculate its message digest ; The length of the message digest depends on the selected hash function. Store or transmit together;

[0342] When data integrity needs to be verified, recalculate the data Message Summary ;

[0343] The calculated message digest Digest of the message stored or transmitted Compare; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and appropriate measures need to be taken;

[0344] S43, Intrusion Detection and Defense Module Algorithm:

[0345] SSA-LSTM-based network traffic and process data analysis algorithm: This algorithm collects network traffic and process data from industrial control systems, cleans and normalizes the data, for example, removing noise, outliers, and duplicate data, and mapping the data to specific intervals for subsequent algorithm processing.

[0346] The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time;

[0347] SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , number of iterations Etc., these hyperparameters are combined into a hyperparameter vector ;

[0348] Initialize the sparrow population , where each sparrow individual Represents a set of hyperparameter values; calculates the fitness value of each sparrow individual , the fitness function can be defined based on the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination.

[0349] According to the rules of the sparrow optimization algorithm, the sparrow population is updated; during the iteration process, the individual sparrows update their positions according to their own roles (the formula is as follows:

[0350] Finder location update formula: ,in Indicates the Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size Dimensions and elements are The matrix, and Represent the warning value and safety value respectively;

[0351] when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values;

[0352] when When the finder conducts a wide search;

[0353] Follower position update formula: ,in Indicates the In the first iteration, the sparrow The worst position of dimension, Indicates the The optimal position of the sparrow in the iteration, Indicates that each element is or of dimensional matrix, and ;

[0354] when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location;

[0355] The sentinel position update formula takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which obeys the mean , the variance is The normal distribution of Is a random number with a value range of , is a very small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When , the guard is close to the global optimal position; when When , the vigilant moves away from the global worst position to jump out of the local optimum;

[0356] Use the optimized hyperparameters to build the LSTM model and During training, the LSTM model learns the temporal dependencies and patterns in the data based on the input network traffic or process data sequence.

[0357] For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ;

[0358] Set an error threshold ,if , then the data sample is considered abnormal and may be caused by intrusion. In this way, the LSTM model can monitor anomalies in network traffic and process data in real time.

[0359] Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assuming that the data sequence is normal are independent and identically distributed, and their probability density function is ;

[0360] Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the system's security requirements and the characteristics of the data to determine whether an anomaly occurs;

[0361] For each new data point ( ), calculate the likelihood ratio ; Due to the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the hypothesis that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at data points by kernel density estimation. The estimated value at , we get the likelihood ratio ;

[0362] According to the likelihood ratio Update the cumulative sum variable:

[0363] if ,but , ;

[0364] if ,but , ;

[0365] if ,but , ;

[0366] Cumulative and variable and They are used to detect abnormal changes in data upward and downward respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior;

[0367] When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, appropriate response measures are taken, including sending alert information to the system administrator, including the time when the abnormality occurred, the characteristics of the abnormal data, and the possible attack type, so that the administrator can promptly understand the security status of the system;

[0368] Using firewalls or intrusion prevention system security devices, based on the source of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding.

[0369] If abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired;

[0370] Based on the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

[0371] Abnormal response and defense strategies

[0372] When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, appropriate response measures are taken. For example:

[0373] Alarm: Send alarm information to the system administrator, including the time when the anomaly occurred, the characteristics of the abnormal data, possible attack types, etc., so that the administrator can understand the security status of the system in a timely manner.

[0374] Block the attack source: Use security devices such as firewalls or intrusion prevention systems (IPS) to block the connection between the attack source and the industrial control system based on the source information of abnormal data (such as IP address, MAC address, etc.) to prevent the attack from further expanding.

[0375] Switching to a backup system: If abnormal behavior severely impacts the currently running system, the backup system is activated to ensure the continuity of the industrial production process. At the same time, the faulty system is further inspected and repaired.

[0376] Adjust control strategies: Based on the impact of abnormal behavior on the production process, dynamically adjust the control strategy of the industrial control system, such as adjusting process parameters, changing control modes, etc., to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

[0377] The complex algorithm design described above comprehensively and accurately handles identity authentication, data encryption and integrity protection, intrusion detection and prevention, and other aspects of industrial control systems, improving system security and reliability. In practical applications, algorithm parameters can be further optimized and strategies adjusted based on the specific circumstances and security requirements of the system.

[0378] Example 5

[0379] Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred solution, in steps S5-S6:

[0380] S51. Implementation and integration of security protection algorithms: Specifically, for the programming language and development environment used by industrial control systems, a code generation model based on syntax trees and semantic analysis is constructed;

[0381] Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language;

[0382] For the hash calculation operation in the identity authentication algorithm, if Indicates calculating the hash value of the user's password (using a specific hash function H), then Code similar to the following may be generated, mainly in C++: unsigned charhash_value[HASH_LENGTH]; H(password, strlen(password), hash_value); where H is the library function that implements the hash function, password is the password entered by the user, and HASH_LENGTH is the length of the hash value.

[0383] Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on devices such as PLCs, computers, and servers.

[0384] For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics;

[0385] Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize;

[0386] Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to an appropriate value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices;

[0387] Security protection module integration: Design a unified interface for modules such as identity authentication, data encryption and integrity protection, and intrusion detection and defense; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ;

[0388] The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying data integrity;

[0389] The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are any abnormalities;

[0390] Implement these interface functions within each module, ensuring they are consistent with the module's internal logic;

[0391] In the authentication module, The function will call the aforementioned authentication process based on the national encryption algorithm and TPM chip to implement the authentication function; these interface functions provide a standard calling method for interaction between modules, enabling different modules to work together;

[0392] Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set up modules To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules Information Encrypt and obtain encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ;

[0393] When the module Received data packet When first using the shared key right Decrypt and get ; then calculate Hash value and with the received Make comparisons;

[0394] if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission;

[0395] S61. The steps for testing and optimizing the security protection algorithm are as follows:

[0396] Construct a model-based test case generation model that considers the functional requirements and security requirements of the security protection algorithm; suppose the functional requirements set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement;

[0397] For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements;

[0398] Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices;

[0399] The same type of users include legitimate users and illegitimate users:

[0400] The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information;

[0401] For each security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for example, for the security requirement of resisting brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information;

[0402] Total test case set By combining all functional test cases and security test cases,

[0403] Right now This formula is used to generate comprehensive test cases that cover all functional and security aspects of the security protection algorithm, ensuring the integrity of the test.

[0404] Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ;

[0405] Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ;

[0406] Otherwise, the test case fails and the evaluation function returns ; For example, for legitimate user test cases for identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ;

[0407] By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; suppose the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm is ;This pass rate can intuitively reflect the functionality and security quality of the algorithm;

[0408] S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results;

[0409] The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ;

[0410] Define a performance optimization objective function , which determines the optimization direction based on the actual value and expected target value of the performance indicator;

[0411] Among them, if the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to ,this parameter, and a performance optimization model is established, such as ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters;

[0412] Adjust the algorithm parameters according to the optimization objective function; for example, to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters;

[0413] S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its related algorithm components and parameters;

[0414] Among them, a vulnerability was found in the intrusion detection module that it could not detect a new type of attack in a timely manner. Analysis showed that it was related to the threshold of the intrusion detection algorithm. related;

[0415] Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold problem, it may be based on the severity and impact range of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the intrusion detection algorithm's ability to detect new attacks, thereby enhancing the security of the algorithm.

[0416] The detailed algorithm design described above effectively implements the programming, module integration, testing, and performance and security optimization of industrial control system security protection algorithms, ensuring the safe and reliable operation of industrial control systems. In practical applications, these algorithms can be continuously improved and refined based on ongoing system changes and emerging security threats.

[0417] Example 6

[0418] Further illustrate with reference to Example 1, Figure 1 In the structure shown, in the preferred solution, in step S7:

[0419] S71. The steps for deploying and continuously monitoring security protection algorithms are as follows:

[0420] Deployment plan generation:

[0421] First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ;

[0422] For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , dependencies and operating status ;

[0423] Build a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Represents the attribute values ​​of the corresponding hardware or software; this matrix can clearly understand the current status and dependencies of the system, providing basic data for deployment planning;

[0424] Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module;

[0425] For each module , analyze its dependency on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the system depends on; for example, the identity authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ;

[0426] Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm, Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies;

[0427] Suppose the topological sorting algorithm is ,but This formula is used to determine the correct deployment order to ensure that security protection algorithms can be successfully deployed in industrial control systems.

[0428] Resource allocation and scheduling: Based on the resource usage of hardware components and resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components Available resources determine how much resources to allocate to the module ;

[0429] Among them, if the intrusion detection module A certain amount of CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements.

[0430] At the same time, considering the operation plan of the industrial control system, the deployment time of the security protection algorithm is arranged; the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operational plans , select the appropriate time window for deploying security protection algorithms; for example, if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, such as the update of the identity authentication module;

[0431] S72. The steps for updating the security configuration are as follows:

[0432] Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ;

[0433] For each configuration parameter , establish an adjustment model related to system environmental factors;

[0434] Among them, for the key length of the encryption algorithm , considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm.

[0435] By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure optimal performance in the new environment.

[0436] Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings;

[0437] Define a configuration validation function , which checks whether the updated configuration is correct and effective. For example, for a new key length configuration of an encryption algorithm, the verification function checks whether the encryption module actually uses the new key length for encryption operations. If the configuration verification fails, the configuration update operation needs to be repeated until all configuration parameters are correctly updated and verified.

[0438] S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ;

[0439] For each status indicator , establish corresponding collection mechanisms;

[0440] Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the execution end timestamp is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis;

[0441] State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range as ;

[0442] Among them, the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ;

[0443] Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ;

[0444] Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module;

[0445] By comprehensively analyzing the evaluation results of all status indicators, it is possible to determine whether the overall operating status of the security protection algorithm is abnormal. Some multivariate anomaly detection methods can be used, such as the method based on principal component analysis. Suppose the collected status indicator value vector is , and convert it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not within the normal area, it is judged that the security protection algorithm is operating abnormally;

[0446] S74. Security situation monitoring and policy adjustment:

[0447] The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , internal security risk level , data security level , system vulnerability level ;

[0448] For each quantitative indicator , establish the corresponding calculation model;

[0449] Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity assessment value of the attack is , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: This formula comprehensively considers the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security posture.

[0450] By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems;

[0451] Policy Adjustment Model: Quantifying Vectors Based on Security Posture , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix To represent, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation Strategy For quantitative indicators the extent of the impact;

[0452] Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix;

[0453] Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If there is a significant impact, the policy adjustment objective function will recommend adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, determines the specific policy adjustment plan, and dynamically adjusts the security protection strategy and algorithm parameters according to the security situation to ensure the continuous security of the industrial control system.

[0454] The above embodiments are merely preferred technical solutions of the present invention and should not be construed as limiting the present invention. The scope of protection of the present invention shall be the technical solutions set forth in the claims, including equivalent alternatives to the technical features of the technical solutions set forth in the claims. In other words, equivalent alternatives and improvements within this scope are also within the scope of protection of the present invention.

Claims

1. A method for designing a security protection algorithm for an industrial control system, characterized by: The method includes: S1. Clarify security protection objectives and scope: Identify the key components and business processes of the industrial control system, and then define the boundaries and scope of security protection; S2. Conduct risk assessment and threat modeling: Identify potential threats and attack vectors, and assess asset vulnerabilities and risk impacts; S3. Design a security protection algorithm framework: Select appropriate security technologies and algorithms, and determine the algorithm's architecture and module composition; S4. Detailed design of each security protection module: including identity authentication module, data encryption and integrity protection module, intrusion detection and prevention module; S5. Implement and integrate security protection algorithms: Implement algorithm programming in industrial control systems and convert it into executable code to ensure correct operation on the equipment; integrate various security protection modules to ensure secure information transmission and interaction; S6. Testing and Optimizing Security Protection Algorithms: Conduct functional and security testing to evaluate identity authentication, data encryption and integrity protection, and intrusion detection functionality and security. Based on test results, optimize algorithm performance and security, adjust cryptographic algorithm parameters, intrusion detection algorithm thresholds, and identity authentication processes. S7. Deploy and continuously monitor security protection algorithms: Deploy security protection algorithms to industrial control systems, develop deployment plans to ensure they do not affect system operations, and perform security configuration updates; Continuously monitor the algorithm's operating status and security situation, and dynamically adjust security protection strategies and algorithm parameters based on the situation.

2. The method for designing a security protection algorithm for an industrial control system according to claim 1, wherein in step S1: Key components include sensors, actuators, controllers, servers, and operator stations. The business process includes data acquisition, control instruction transmission, and configuration. Define the boundaries and scope of security protection, covering the field control layer, process monitoring layer and system network layer of the industrial control system, including the connection boundary between the internal network and the external network.

3. According to claim 2, a method for designing a security protection algorithm for an industrial control system, Its characteristics are: in step S1: S11. Collect connection relationship data between sensors, actuators, controllers, servers, and operator stations in various devices in the industrial control system, as well as data flow information in data acquisition, control instruction transmission, and configuration in business processes; Pre-process the collected data to remove invalid or erroneous data records to ensure the accuracy and completeness of the data; S12. Abstract the equipment and business processes in the industrial control system as nodes in the network, and the connection relationship between the equipment and the data flow in the business process as edges to build a directed weighted network model. ,in is a collection of nodes, is the edge set, is the set of edge weights; For edge weights , assign values ​​according to data traffic size and communication frequency factors; S13. Calculate the degree centrality of each node , the formula is: ,in is an element of the adjacency matrix. If the node and If there is a connection, ,otherwise ; is the total number of nodes; Calculate the betweenness centrality of a node , the formula is: ,in It is a slave node To Node The number of shortest paths, It is a slave node To Node and passing through the node The number of shortest paths; Betweenness centrality reflects a node's ability to control the flow of information in a network. During the transmission of control instructions, a node with high betweenness centrality may become a bottleneck or a critical control point. If the node is attacked, the transmission efficiency and accuracy of the entire control instruction may be affected. Calculate the closeness centrality of nodes , the formula is: ,in is a node and The shortest path length between Closeness centrality is used to measure the proximity between a node and other nodes. The higher the closeness centrality, the more efficient the node may be in the information transmission process. According to the calculated degree centrality, betweenness centrality and closeness centrality, each node is assigned a node comprehensive importance index , the formula is: ,in 、 、 is the weight coefficient, which can be adjusted according to the actual needs and characteristics of the system; Set a threshold ,Will The nodes are identified as key components; these key components play an important role in industrial control systems and need to be protected; S14. Identify paths related to data collection, control instruction transmission, and configuration business processes from the network model; For each business process path , calculate its importance index , the formula is: ,in Is the path Nodes on is a node With adjacent nodes The weight of the edge between them; S15. Define security protection boundaries: Divide the industrial control system network into the field control layer, process monitoring layer, and system network layer, and analyze the connection relationship and data interaction mode between each layer; Determine the boundary nodes connecting different network layers. , calculate its boundary importance index , the formula is: ,in and Is a boundary node The set of nodes in two different network layers connected, is a node With node The weight of the edge between them; The boundary importance index is used to measure the importance of boundary nodes in cross-layer data interaction. Nodes with high boundary importance are key nodes for security protection and require enhanced protection measures to prevent external attacks from penetrating into the system through these nodes. Based on the importance of the boundary nodes, determine the boundary scope of security protection, including the connection boundary between the internal network and the external network; deploy firewalls and intrusion detection system security equipment at the boundary nodes to monitor and filter the network traffic in and out of the boundary.

4. The industrial control system security protection algorithm design method according to claim 1, Its characteristics are: in step S2: Identify potential threats and attack vectors: Potential threats include viruses, Trojans, hacker attacks, and industrial espionage; attack vectors include network protocol vulnerabilities, insecure configurations, and malware injection; Assess asset vulnerabilities and risk impacts, including PLCs, computers, and servers, and assess the impact of vulnerabilities and insecure configurations on production processes, data security, personnel safety, and the environment after being attacked; S21. Threat Data Collection and Collation: Collect threat intelligence related to industrial control systems from multiple data sources, including vulnerability information released by security vendors, industry security reports, and internal enterprise security monitoring data. Categorize and organize the collected data, categorizing threats into viruses, Trojans, hacker attacks, and industrial espionage, and attack vectors into network protocol vulnerabilities, insecure configurations, and malware injections. For each identified attack vector , calculate its attack probability index , the formula is: ,in Is related to the attack vector The number of related historical attack events, is the total number of historical attack events, It is a weight coefficient determined based on the difficulty and prevalence of the attack vector; The usefulness of this formula is to measure the likelihood of each attack vector occurring. The higher the value, the easier it is to exploit the attack vector and the greater the possibility of posing a threat to the system; S22. Asset vulnerability scanning and analysis: Use professional vulnerability scanning tools to conduct a comprehensive scan of PLC, computer, and server assets to obtain asset vulnerability information, including vulnerability type and severity; Analyze vulnerability information, classify vulnerabilities into high, medium, and low risk, and count the number of vulnerabilities of different severity on each asset; For each asset , calculate its vulnerability index , the formula is: ,in It is an asset The set of vulnerabilities that exist on It's a loophole Severity score of high-risk vulnerabilities, high-risk vulnerabilities have high scores; medium-risk vulnerabilities have moderate scores; low-risk vulnerabilities have low scores; It's a loophole The exploitability coefficient is determined based on the characteristics of the vulnerability and the difficulty of exploitation, and is obtained through data analysis or expert evaluation; This formula takes into account the severity and exploitability of the vulnerabilities on an asset to measure the vulnerability of the asset; The higher the value, the more vulnerable the asset is to attack; S23. Establish a risk influencing factor matrix: Determine the assessment factors for risk impact, including impact on production processes, data security, personnel safety and the environment; Build a Risk influencing factor matrix , where the rows represent the influencing factors, including production process, data security, personnel safety, and environment, and the columns represent the impact levels, including high, medium, and low; Matrix elements Indicates in Under the influence of factors, the attack leads to The probability of the degree of impact; When assets Attack vectors When attacking, calculate the risk impact index of each influencing factor , the formula is: This formula comprehensively considers the likelihood of attack vectors, the vulnerability of assets, and the probability of attacks on specific influencing factors. It is used to measure the risk impact of a specific attack vector on an asset in various aspects. Computational Assets Attack vectors Comprehensive risk indicators of attacks , the formula is: This formula integrates the risk impact of all factors affecting an asset attack to produce a comprehensive risk assessment value. By comparing different asset and attack vector combinations The value can be used to identify the parts of the system facing higher risks, so as to carry out targeted security protection and resource allocation.

5. The method for designing a security protection algorithm for an industrial control system according to claim 1, wherein: In step S3: Select appropriate security technologies and algorithms, including cryptography, trusted computing, and intrusion detection algorithms; The cryptographic technology adopts the national secret algorithm; Intrusion detection algorithms include SSA-LSTM-based algorithms and non-parametric CUSUM algorithms; Determine the architecture and module composition of the algorithm, including identity authentication module, data encryption and integrity protection module, and intrusion detection and defense module.

6. The method for designing a security protection algorithm for an industrial control system according to claim 5, wherein: In step S3: S31, using the SM4 algorithm in the national secret algorithm to encrypt data; for the data blocks that need to be encrypted , divide it into sub-blocks of fixed length ( ), each sub-block is bits, according to the SM4 algorithm requirements; The encryption process uses encryption functions ,in is the key generated by the key generation algorithm; the encrypted sub-block , and finally encrypt the data ,in Represents a connection operation and calculates its hash value ;set up Depend on message groups ( ), the calculation process is as follows: Initialize hash value is a fixed initial vector, for each message packet , calculate the intermediate hash value ,in It is a compression function that contains complex logical operations and permutation operations; the final hash value ; This hash value is used to verify whether the data has been tampered with during transmission or storage, ensuring data integrity; Identity authentication process based on TPM chip: When the system starts, the trusted platform module generates a pair of public and private keys , and the public key Stored in a trusted database; When a device or user requests authentication, a random number is generated. , using the private key For random numbers Sign with the device or user's identification information ID to obtain the signature value , and 、 and Send to the authentication server; After receiving the request, the authentication server uses the stored public key Verify the signature ; If the verification is successful, the authentication is passed; otherwise, the authentication fails. The signature and verification process is based on the asymmetric encryption principle to ensure the security and non-forgeability of identity authentication. S32. Process data anomaly detection based on SSA-LSTM: Collecting process data sequences from industrial control systems , normalize the data so that it is in a specific range, the formula is ,in is the normalized data points, and The data series are This step is used to eliminate the difference in data dimensions and improve the accuracy of subsequent algorithms; Model training: Use the Sparrow optimization algorithm to optimize the hyperparameters of the long short-term memory neural network; The hyperparameter vector of the LSTM network is ,in is the learning rate, is the number of iterations, is the number of hidden layer nodes, initialize the population , is the population size; Calculate the fitness value of each individual , the fitness function uses the mean square error formula: ,in is the actual process data value, is the value predicted by the LSTM network; Update the population according to the fitness value and select the best individual for iterative optimization; After multiple iterations, the optimal hyperparameter combination is obtained , train the LSTM network using the optimized hyperparameters; This optimization process can improve the LSTM network's prediction accuracy for process data, thereby better detecting anomalies; Anomaly detection: Input real-time process data into the trained LSTM network to obtain the predicted value ; Calculate the error between the predicted value and the actual value ; Set a dynamic threshold , calculated according to the statistical characteristics of historical error data, using a quantile-based method: ,in , is the length of historical data used to calculate the threshold, yes of Quantile, Parameters set according to the system's requirements for false alarm rate and missed alarm rate; if , then determine the data point is an abnormal point; This threshold calculation method can adjust the detection sensitivity according to the dynamic changes of data, reducing false positives and missed negatives; S32. System state parameter change point detection based on non-parametric CUSUM: For the system state parameter sequence of industrial control system , calculate the observation statistics , the formula is ,in It is a state parameter calculated based on historical data The expected estimated value of is calculated using the moving average or exponential smoothing method; this observation statistic is used to measure the degree of deviation between the current state parameter and the expected value; Application of non-parametric CUSUM algorithm: initializing the decision statistic , offset constant , set according to system characteristics and false alarm rate requirements; for , calculate the decision statistic , Indicates when hour, ;when hour, ; Setting alarm thresholds ,when When , it is determined that the system state has changed and the change point is detected; S33. Interaction between the identity authentication module and other modules: When a device or user is successfully authenticated by the identity authentication module, the identity authentication module sends an authentication success signal to the data encryption and integrity protection module and the intrusion detection and prevention module, allowing them to perform subsequent operations; If authentication fails, the identity authentication module sends an alarm to the system administrator and blocks the device or user from accessing system resources. At the same time, it notifies the intrusion detection and prevention module to strengthen monitoring of the device or user. Collaboration between the data encryption and integrity protection module and the intrusion detection and prevention module: After encrypting and calculating the integrity of the data, the data encryption and integrity protection module passes the relevant information to the intrusion detection and prevention module; When detecting data traffic and system status, the intrusion detection and prevention module uses the information provided by the data encryption and integrity protection module to verify the legitimacy and integrity of the data; If data integrity is compromised or encrypted data is found to be abnormal, an alarm will be triggered in a timely manner and appropriate defensive measures will be taken; S33, Performance indicator definition: Define the performance indicators of the security protection algorithm, including security indicators, efficiency indicators and reliability indicators; Simulation testing and optimization: Use a simulated industrial control system environment to test algorithms, generate simulated normal and abnormal data traffic, process data, and attack scenarios, and conduct comprehensive testing of security protection algorithms; Based on the test results, analyze the algorithm's performance on different performance indicators, and optimize and adjust the algorithm parameters, module configuration and interaction mechanism to improve overall performance and security.

7. The method for designing a security protection algorithm for an industrial control system according to claim 1, wherein: In step S4: Identity authentication module design: Determine the authentication method and protocol, and implement hardware-level identity authentication using a national secret algorithm or a TPM chip in trusted computing technology; Manage user and device identity information, establish an identity information database, securely store user IDs, device identifiers, and key information, and ensure their integrity and confidentiality; Data encryption and integrity protection module design: Select encryption algorithms and key management strategies, use national secret algorithms for data encryption, and use key management functions in trusted computing technology to ensure key security; Implement a data integrity verification mechanism, use a hash algorithm to calculate the data message digest and verify it during transmission and storage; Intrusion detection and defense module design: Use intrusion detection algorithms to monitor and analyze network traffic and process data in real time, and use alarms, block attack sources, switch to backup systems, and adjust control strategies to respond to intrusion behaviors.

8. The industrial control system security protection algorithm design method according to claim 7, Its characteristics are: in step S4: S41. Hardware-level identity authentication based on national secret algorithm and TPM chip: When the system starts, the TPM chip generates an asymmetric key pair ,in is the public key, A private key; at the same time, a unique identifier is assigned to each user and device and ; Calculate the initial hash value of the device ,in is a hash function, || represents a concatenation operation. This hash value will be used as the initial authentication credential of the device and stored in the secure storage area of ​​the TPM chip. The user sends an authentication request to the system, which includes the user ID and device identification ; After receiving the request, the system obtains the public key of the device from the TPM chip and the initial hash value ; The user uses the device private key Current timestamp and user password Sign and generate signature information ,in is an encryption function based on the national secret algorithm; then 、 、 and Send to the system; After receiving the authentication information, the system first verifies the timestamp The validity of the device public key Signature Decrypt and get and ;if If the password verification passes, the authentication proceeds to the next step; otherwise, the authentication fails. The encryption and decryption formulas in this step are used to ensure the confidentiality and integrity of the user authentication information. Only devices with the correct private key can generate a valid signature, and the system can correctly decrypt and verify the user's identity. The system calculates the hash value of the device again and the initial hash value stored in the TPM chip Compare; if , the device identity authentication passes; otherwise, the authentication fails. This formula is used to ensure that the device identity has not been tampered with during the authentication process and that the device hardware and its corresponding public key still match. If both user authentication and device identity authentication are passed, the system generates a session key for the user , and transmit it securely to the user, the user and the system will use the session key Perform subsequent communication encryption; If the authentication fails, the system will send an authentication failure message to the user and record the relevant authentication failure information for subsequent analysis and auditing; Design an identity information database, including a user information table, a device information table, and a key management table; the user information table stores user identification , user password , User Permissions Information; the device information table stores the device identification , device type , device status Information; key management table stores device public keys , private key , session key Key-related information When a new user or device registers, its related identity information is stored according to the database structure; when storing the user password When using the hash function Hash the password to get , then store , rather than directly storing plain text passwords to improve password security; When a user password or device key needs to be updated, the update operation is carried out according to the corresponding security process. For user password updates, the user's old password is first verified, and then a new hash value is generated using the new password and the password hash value in the database is updated; For device key updates, use the TPM chip's key update function to generate a new key pair and update the relevant information in the key management table; S42, Data Encryption and Integrity Protection Module: The TPM chip trusted computing platform generates a symmetric encryption key for each data that needs to be encrypted ; At the same time, generate an asymmetric key pair , used to encrypt the symmetric key ; The symmetric key Using asymmetric public keys Encrypt and obtain the encrypted symmetric key and store or transmit it together with the encrypted data; asymmetric private key Securely stored by the trusted computing platform and used to decrypt the symmetric key ;formula The role of the symmetric key is to ensure the security of the symmetric key during storage and transmission. Only trusted entities can decrypt and obtain the symmetric key , and then decrypt the data; For data that needs to be encrypted , split it into fixed-size data blocks ; For each data block , using the symmetric SM4 encryption algorithm and symmetric key Encrypt and obtain the encrypted data block ; Combine all encrypted data blocks into an encrypted data set ; The encryption formula in this process Used to convert plaintext data blocks into ciphertext to protect the confidentiality of data and prevent it from being obtained and understood by unauthorized parties during storage or transmission; When data needs to be decrypted, the asymmetric private key in the trusted computing platform is first used The encrypted symmetric key Decrypt and obtain the symmetric key ; Then, for each encrypted data block , using a symmetric key Decrypt with the corresponding SM4 algorithm to get the original data block ; Finally, all decrypted data blocks are combined into the original data set ; For data that needs to protect integrity , use SM3 function to calculate its message digest The length of the message digest depends on the selected hash function. Store or transmit together; When data integrity needs to be verified, recalculate the data Message Summary ; Compare the calculated message digest MD' with the stored or transmitted message digest MD; if , the data integrity check passes, indicating that the data has not been tampered with during storage or transmission; otherwise, the data integrity check fails, and the data may have been modified or damaged, and appropriate measures need to be taken; S43, Intrusion Detection and Defense Module Algorithm: SSA-LSTM-based network traffic and process data analysis algorithm: collects network traffic and process data from industrial control systems, cleans and normalizes the data, removes noise, outliers, and duplicate data, and maps the data to specific intervals to facilitate subsequent algorithm processing. The processed data is divided into time series to form a data sample set , where each sample Contains characteristic values ​​of network traffic or process data over a period of time; SSA algorithm optimizes LSTM hyperparameters: defines the hyperparameters of the LSTM neural network, including the number of hidden layers , learning rate , number of iterations , these hyperparameters are combined into a hyperparameter vector ; Initialize the sparrow population , where each sparrow individual represents a set of hyperparameter values; Calculate the fitness value of each sparrow individual , the fitness function is defined according to the error of the LSTM model on the training set, and the formula is ,in Indicates the use of hyperparameters The constructed LSTM model is used for the data sample set The error after training and prediction; the function of this formula is to evaluate the impact of each set of hyperparameters on the performance of the LSTM model. The smaller the fitness value, the better the hyperparameter combination. Update the sparrow population according to the rules of the sparrow optimization algorithm; During the iteration process, the position of each sparrow is updated according to its own role. The formula is as follows: Finder location update formula: ,in Indicates the Daizhongdi A sparrow in the The location of the dimension, is the maximum number of iterations, for A random number between is a random number that follows a standard normal distribution, Indicates size Dimensions and elements are The matrix, and Represent the warning value and safety value respectively; when When , the discoverer quickly flies to the safe area, that is, the area with better hyperparameter values; when When the finder conducts a wide search; Follower position update formula: ,in Indicates the In the first iteration, the sparrow The worst position of dimension, Indicates the The optimal position of the sparrow in the iteration, Indicates that each element is or of dimensional matrix, and ; when When , the follower is in a hungry state and will fly to other locations to find better hyperparameters; otherwise, it will search randomly around the best location; The sentinel position update formula takes action when danger is detected to ensure the safety of the population, that is, to avoid falling into the local optimal hyperparameter value: ,in is the step size control parameter, which obeys the mean , the variance is The normal distribution of Is a random number with a value range of , is a very small positive constant used to avoid the denominator being , is the fitness value of the current sparrow individual, is the fitness value of the global optimal sparrow individual, is the fitness value of the worst sparrow individual in the world, is the current global optimal position; when When the guard is close to the global optimal position ;when When the guard is away from the global worst position , in order to escape from the local optimum; Use the optimized hyperparameters to build the LSTM model and During training, the LSTM model learns the temporal dependencies and patterns in the data based on the input network traffic or process data sequence. For new network traffic or process data samples , input it into the trained LSTM model to get the predicted output ; Calculate the error between the predicted output and the actual sample ; Set an error threshold ,if , then the data sample is considered abnormal and may be caused by intrusion. In this way, the LSTM model can monitor anomalies in network traffic and process data in real time. Anomaly detection algorithm based on non-parametric CUSUM algorithm: For the network traffic or process data of industrial control systems, assuming that the data sequence is normal are independent and identically distributed, and their probability density function is ; Initialize two cumulative sum variables and , and two reference values and ,in, and It is set according to the system's security requirements and the characteristics of the data to determine whether an anomaly occurs; For each new data point ( ), calculate the likelihood ratio ; Due to the probability density function Unknown, use kernel density estimation method to estimate ; Let the kernel function be , the bandwidth is , then at the data point The probability density estimate at is Likelihood ratio The calculation formula is ,in represents the assumption that the data are normal, Indicates the hypothesis that the data is abnormal; here we assume that the probability density function of abnormal data is Probability density function with normal data Different, they are calculated at data points by kernel density estimation. The estimated value at , we get the likelihood ratio ; According to the likelihood ratio Update the cumulative sum variable: if ,but , ; if ,but , ; if ,but , ; Cumulative and variable and They are used to detect abnormal changes in data upward and downward respectively; when or When the data is abnormal, it is judged that there may be intrusion behavior; When abnormal behavior is detected based on the SSA-LSTM algorithm or the non-parametric CUSUM algorithm, appropriate response measures are taken, including: sending alert information to the system administrator, including the time of the abnormality, the characteristics of the abnormal data, and the possible attack type, so that the administrator can promptly understand the security status of the system; Using firewalls or intrusion prevention system security devices, based on the source of abnormal data, the connection between the attack source and the industrial control system is blocked to prevent the attack from further expanding. If abnormal behavior has a serious impact on the currently running system, the backup system will be activated to ensure the continuity of the industrial production process; at the same time, the faulty system will be further inspected and repaired; According to the impact of abnormal behavior on the production process, the control strategy of the industrial control system is dynamically adjusted, the process parameters are adjusted, and the control mode is changed to reduce the impact of abnormal behavior on production and ensure production safety and product quality.

9. The method for designing a security protection algorithm for an industrial control system according to claim 1, wherein: In steps S5-S6: S51. Implementation and integration of security protection algorithms: Specifically, for the programming language and development environment used by industrial control systems, a code generation model based on syntax trees and semantic analysis is constructed; Assume that the abstract syntax of the security protection algorithm is represented as ,in are different operations or statements of the algorithm; for each , define a mapping function , which converts abstract syntax elements into code snippets in the target programming language; Executable code of the entire security protection algorithm It is obtained by combining the mapping results of all abstract syntax elements, that is, The function of this formula is to convert the high-level security protection algorithm description into specific code that can be executed on the target device, ensuring that the algorithm can run on PLCs, computers, and server devices. For different types of devices, including PLC, computer, and server, analyze their hardware characteristics, including CPU architecture, memory size, and storage speed; let the hardware characteristic vector of the device be ,in Indicates CPU frequency, or memory capacity hardware characteristics; Adjust the generated code according to the hardware characteristics; define an optimization function , which adjusts the code based on the hardware characteristics of the device Optimize; Specifically, if There are data encryption operations involving temporary buffers , the optimization function may be based on the memory size Will is adjusted to an appropriate value, where ,in The proportional coefficient is determined according to the characteristics of the encryption algorithm, and the code is modified accordingly. This optimization based on the hardware characteristics of the device can ensure that the algorithm runs correctly and efficiently on different devices; Security protection module integration: Design a unified interface for identity authentication, data encryption and integrity protection, intrusion detection and defense modules; Suppose the interface function of the identity authentication module is , which accepts user information and device information , returns the authentication result, success is , failed as ; The interface function of the data encryption and integrity protection module is and , respectively used to encrypt data and verifying data integrity; The interface function of the intrusion detection and defense module is , used to detect the input data flow Whether there are any abnormalities; Implement these interface functions within each module, ensuring they are consistent with the module's internal logic; In the authentication module, The function will call the aforementioned authentication process based on the national encryption algorithm and TPM chip to implement the authentication function; these interface functions provide a standard calling method for interaction between modules, enabling different modules to work together; Information transmission and security mechanism: Design an information transmission model to ensure the safe transmission of information between modules; set up modules To module Delivering information , encrypt and encapsulate information before transmission; define encryption function , which uses a key shared between modules Information Encrypt and obtain encrypted information ; At the same time, calculate the hash value of the information , and and Together they form a transmission data packet ; When the module Received data packet When first using the shared key right Decrypt and get ; then calculate Hash value and with the received Make comparisons; if , then the information integrity verification is passed, the module Decrypted information can be used Perform subsequent operations; this encryption and hash verification process ensures the confidentiality and integrity of information transmitted between modules, preventing the information from being stolen or tampered with during transmission; S61. The steps for testing and optimizing the security protection algorithm are as follows: Construct a model-based test case generation model that considers the functional requirements and security requirements of the security protection algorithm; suppose the functional requirements set of the security protection algorithm is ,in Represents a specific functional requirement; the security requirement set is ,in Indicates a security requirement; For each functional requirement , define a functional test case generation function , which generates a set of test cases based on functional requirements; Among them, the accuracy of identity authentication is required. Test cases may be generated for different types of users authenticating on different devices; Different types of users include legitimate users and illegitimate users: The test case for a legitimate user is , the test case for illegal users is ,in and It is different types of user information. and It is different device information; For each security requirement , define a security test case generation function , which generates test cases that simulate attack scenarios based on security requirements; for security requirements to resist brute force attacks, A series of test cases may be generated to try different password combinations to attack the authentication module; let the test case of brute force attack be ,in It is a brute force attack strategy. It is the target user information; Total test case set By combining all functional test cases and security test cases, Right now This formula is used to generate comprehensive test cases that cover all functional and security aspects of the security protection algorithm, ensuring the integrity of the test. Test Execution and Evaluation: Execute a collection of test cases in an industrial control system test environment ; For each test case , observe the execution results of the security protection algorithm according to the type and goal of the test case; set the test case The expected result is The actual execution result is ; Define an evaluation function , used to evaluate the execution results of the test case; if , the test case passes and the evaluation function returns ; Otherwise, the test case fails and the evaluation function returns ; For legitimate user test cases of identity authentication , if the identity authentication module successfully authenticates the legitimate user, that is , expected results ,but ; By statistically analyzing the evaluation results of all test cases, the functional test and security test results of the security protection algorithm are obtained; suppose the number of passed test cases is , the total number of test cases is , then the overall test pass rate of the algorithm is ;This pass rate can intuitively reflect the functionality and security quality of the algorithm; S62, Algorithm performance and security optimization: Analyze algorithm performance bottlenecks based on test results; The performance indicator vector of the algorithm is ,in Represents a performance indicator; for each performance indicator , collecting its actual value during the test ; Define a performance optimization objective function , which determines the optimization direction based on the actual value and expected target value of the performance indicator; Among them, if the algorithm execution time The actual value of The expected maximum execution time was exceeded , then the optimization objective function will focus on reducing the algorithm execution time; suppose a parameter in the cryptographic algorithm is ,Through analysis, it is found that the execution time is related to this parameter, and a performance optimization model is established ,in, It is a function obtained by fitting experimental data, which represents the relationship between execution time and cryptographic algorithm parameters; Adjust the algorithm parameters according to the optimization objective function; in order to reduce the execution time, solve the optimization problem , find the new cryptographic algorithm parameter values ; This process optimizes performance indicators and improves the algorithm's operating efficiency by adjusting algorithm parameters; S63, Security Optimization Model: Analyze the root causes of security vulnerabilities based on the problems found in security testing; Suppose the security vulnerability set is , for each security vulnerability , determine its related algorithm components and parameters; Among them, a vulnerability was found in the intrusion detection module that it could not detect a new type of attack in a timely manner. Analysis showed that it was related to the threshold of the intrusion detection algorithm. related; Establish a security optimization model to adjust relevant parameters according to the severity and impact of security vulnerabilities; set security vulnerabilities The severity of , the impact range is , define a security optimization function , which determines the amplitude of parameter adjustment based on these factors; for the above-mentioned intrusion detection threshold problem, it may be based on the severity and impact range of the vulnerability through the formula ,in is based on and The calculated adjustment value is used to adjust the threshold, thereby improving the intrusion detection algorithm's ability to detect new attacks, thereby enhancing the security of the algorithm.

10. The industrial control system security protection algorithm design method according to claim 1, Its characteristics are: in step S7: S71. The steps for deploying and continuously monitoring security protection algorithms are as follows: Deployment plan generation: First, a comprehensive scan of the industrial control system is performed to identify all hardware components and software modules related to the security protection algorithm. Suppose the hardware component set is , the software module set is ; For each hardware component , analyze its current configuration parameters and resource usage ; For each software module , analyze its version information , dependencies and operating status ; Build a system dependency matrix , where rows represent hardware components and software modules ( ), columns represent different attributes; matrix elements Represents the attribute values ​​of the corresponding hardware or software; this matrix can clearly understand the current status and dependencies of the system, providing basic data for deployment planning; Deployment order determination: based on the system dependency matrix and the module structure of the security protection algorithm, determine the deployment order of each part of the security protection algorithm; suppose the module set of the security protection algorithm is , including identity authentication module, encryption module, and intrusion detection module; For each module , analyze its dependency on system hardware and software; define a dependency function , which returns the module The set of hardware components and software modules that the authentication module depends on; the authentication module may depend on a specific version of the operating system and a hardware device with a TPM chip, that is, ; Build a directed acyclic graph based on dependencies , where the vertex The module representing the security protection algorithm, Indicates the dependency relationship between modules; if the module Dependencies on modules , then there is a directed edge ; By topologically sorting this directed acyclic graph, the deployment order of the security protection algorithm can be obtained , ensure that dependent modules are deployed first during the deployment process to avoid deployment failures caused by dependencies; Suppose the topological sorting algorithm is ,but This formula is used to determine the correct deployment order to ensure that security protection algorithms can be successfully deployed in industrial control systems. Resource allocation and scheduling: Based on the resource usage of hardware components and resource requirements of each module of the security protection algorithm , allocate hardware resources to each module; let the resource allocation function be , which is based on the module Resource requirements and hardware components Available resources determine how much resources to allocate to the module ; Among them, if the intrusion detection module A certain amount of CPU resources and memory resources are required. The resource allocation function will allocate resources based on the CPU and memory availability of each server to meet the module's operating requirements. At the same time, considering the operation plan of the industrial control system, the deployment time of the security protection algorithm is arranged; the operation plan of the industrial control system is , define a scheduling function , which is based on the deployment order and operational plans , select the appropriate time window for deploying security protection algorithms; if the system's production tasks are light in a certain time period and the interference to the system is small, the time scheduling function will choose this time period to deploy modules that have a greater impact on the system, including updates to the identity authentication module; S72. The steps for updating the security configuration are as follows: Analyze the optimal configuration parameters of the security protection algorithm under different hardware and software environments; suppose the configuration parameter set of the security protection algorithm is ; For each configuration parameter , establish an adjustment model related to system environmental factors; Among them, for the key length of the encryption algorithm , considering the sensitivity of data and the security of communication links in industrial control systems, the data sensitivity factor is , the communication link security factor is , then the key length adjustment formula is This formula dynamically adjusts configuration parameters based on system environmental factors to improve the adaptability and security of the security protection algorithm. By calculating the adjustment model of all configuration parameters, the updated configuration parameter set is obtained These updated parameters will be applied to the deployment of security protection algorithms in industrial control systems to ensure optimal performance in the new environment. Configuration update implementation and verification: Based on the updated configuration parameter set , configure and update security protection algorithms in industrial control systems; this involves modifying relevant configuration files, database records or hardware device settings; Define a configuration validation function , it checks whether the updated configuration is correct and effective; for the new key length configuration of the encryption algorithm, the verification function will check whether the encryption module actually uses the new key length for encryption operations; if the configuration verification fails, the configuration update operation needs to be repeated until all configuration parameters are correctly updated and verified; S73, the continuous monitoring algorithm step is: determine the security protection algorithm operation status indicators that need to be monitored, and set the operation status indicator set as , these metrics include the execution time of the algorithm , resource usage, and inter-module communication status , the error rate of the algorithm ; For each status indicator , establish corresponding collection mechanisms; Among them, for the algorithm execution time , set a timestamp on the key execution path of the security protection algorithm, and obtain the execution time by calculating the time difference; set the timestamp of the algorithm start execution to , the execution end timestamp is , then the execution time ; For CPU usage , collect data through the system's performance monitoring tools; these collection mechanisms ensure that the value of each status indicator can be accurately obtained, providing data support for subsequent analysis; State assessment and anomaly detection: For each state indicator , determine its normal range based on historical data and system requirements; set the normal range as ; Among them, the identity authentication failure rate , the normal range may be , indicating that the authentication failure rate should be lower than ; Define a state evaluation function , it determines whether the indicator is abnormal based on the currently collected status indicator value and the normal range; if , then the state indicator Exception, the evaluation function returns ; Otherwise, return ; Among them, if the currently collected identity authentication failure rate for , beyond the normal range ,but , indicating that there may be a problem with the identity authentication module; By comprehensively analyzing the evaluation results of all status indicators, we can determine whether the overall operating status of the security protection algorithm is abnormal. We use some multivariate anomaly detection methods, including the method based on principal component analysis. Let the collected status indicator value vector be , and convert it into a low-dimensional vector through PCA ; In low-dimensional space, a normal area is determined based on historical data. If If it is not within the normal area, it is judged that the security protection algorithm is operating abnormally; S74. Security situation monitoring and policy adjustment: The security situation of industrial control systems is quantified from multiple dimensions; the set of security situation quantification indicators is set as , these indicators include the degree of external attack threat , internal security risk level , data security level , system vulnerability level ; For each quantitative indicator , establish the corresponding calculation model; Among them, the threat level of external attacks , let the number of attack events detected by intrusion be , the severity assessment value of the attack is , the system's protection capability evaluation value is , then the external attack threat level calculation formula is: This formula comprehensively considers the number and severity of attacks and the system's protection capabilities, and can more accurately quantify the impact of external attacks on the system's security posture. By calculating all quantitative indicators, the security situation quantitative vector is obtained , used to comprehensively describe the security posture of industrial control systems; Policy Adjustment Model: Quantifying Vectors Based on Security Posture , establish a security protection strategy adjustment model; suppose the security protection strategy set is , each strategy The impact on security posture can be measured through an impact matrix To represent, where the rows represent security protection strategies, the columns represent security situation quantitative indicators, and the matrix elements Representation Strategy For quantitative indicators the extent of the impact; Define a policy adjustment objective function ,It determines the security protection strategies that need to be adjusted based on the current security situation and policy impact matrix; Among them, if the external attack threat level Too high, by analyzing the impact matrix , it is found that adjusting the threshold of the intrusion detection algorithm To reduce If there is a significant impact, the policy adjustment objective function will recommend adjusting the threshold of the intrusion detection algorithm; by solving the optimization problem ,in It is the desired security situation target vector, determines the specific policy adjustment plan, and dynamically adjusts the security protection strategy and algorithm parameters according to the security situation to ensure the continuous security of the industrial control system.

Images