Behavior detection method and device of industrial control power protocol, equipment and medium

Abstract

The embodiment of the invention discloses a behavior detection method and device of an industrial control power protocol, equipment and a medium. The method comprises the following steps: acquiring industrial control power protocol data; preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data; analyzing the preprocessed industrial control power protocol data, extracting a plurality of target features, and integrating the plurality of target features to obtain a target integrated feature; and inputting the target integration feature into a decision tree model to obtain a target behavior type of the industrial control power protocol data. According to the technical scheme, the target integration feature is obtained by processing the industrial control power protocol data, and the target behavior type of the industrial control power protocol data is determined based on the decision tree model and the target integration feature, so that the robustness and the security of a power system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a behavior detection method, device, equipment and medium for an industrial control power protocol. Background Art

[0002] The power system is a vast and complex system encompassing multiple components, including power generation, transmission, and distribution. To monitor and control each component of the power system, specific communication protocols are required to ensure efficient information exchange between devices. However, with the continuous advancement of network technology, power systems are facing new security challenges, such as cyberattacks and malware. Industrial control system protocols are the communication protocols used to monitor, manage, and control power systems.

[0003] Currently, commonly used power protocols in power systems include IEC61850, Modbus, and DNP3. These protocols have vulnerabilities, such as unauthenticated access, plaintext communication, and protocol parsing issues. These vulnerabilities can be exploited by hackers or attackers to send abnormal commands, posing security risks to the power system. Therefore, detecting abnormal behavior in industrial control power protocols is crucial. Summary of the Invention

[0004] The present invention provides a behavior detection method, device, equipment and medium for industrial control power protocols. By processing industrial control power protocol data to obtain target integration features, the target behavior type of the industrial control power protocol data is determined based on a decision tree model and the target integration features to ensure the robustness and security of the power system.

[0005] According to one aspect of the present invention, a behavior detection method for an industrial control power protocol is provided, comprising:

[0006] Obtain industrial control power protocol data;

[0007] Preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data;

[0008] Parsing the pre-processed industrial control power protocol data and extracting multiple target features, and integrating the multiple target features to obtain target integrated features;

[0009] The target integration feature is input into a decision tree model to obtain the target behavior type of the industrial control power protocol data.

[0010] Optionally, preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data includes:

[0011] Performing a data removal operation on the industrial control power protocol data to obtain the industrial control power protocol data after the removal;

[0012] The removed industrial control power protocol data is converted into a set format to obtain pre-processed industrial control power protocol data.

[0013] Optionally, the pre-processed industrial control power protocol data is parsed and multiple target features are extracted, including:

[0014] Parsing the pre-processed industrial control power protocol data to obtain field features;

[0015] Feature extraction is performed on the pre-processed industrial control power protocol data based on the field features to obtain multiple target features.

[0016] Optionally, the field characteristics include a function code and a data field;

[0017] The pre-processed industrial control power protocol data is parsed to obtain field features, including:

[0018] Parsing the pre-processed industrial control power protocol data to obtain a data format and data fields;

[0019] The function code and data domain of the data field are extracted based on the data format.

[0020] Optionally, the pre-processed industrial control power protocol data includes multiple control instructions; the multiple target features include frequency features, sequence features and delay features.

[0021] Optionally, feature extraction is performed on the pre-processed industrial control power protocol data based on the field features to obtain multiple target features, including:

[0022] Determine the sending frequency of control instructions of the same category within a set time period based on the field feature, and use the sending frequency as the frequency feature;

[0023] Determining a sequence characteristic of the control instructions based on a set logic rule base;

[0024] For each category of control instructions, the time intervals between adjacent control instructions are extracted, and the delay characteristics of the control instructions are determined according to the time intervals.

[0025] Optionally, integrating the multiple target features to obtain a target integrated feature includes:

[0026] The field features, frequency features, sequence features and delay features are integrated to obtain target integrated features.

[0027] According to another aspect of the present invention, a behavior detection device for an industrial control power protocol is provided, comprising:

[0028] Data packet acquisition module, used to obtain industrial control power protocol data;

[0029] A preprocessing module, configured to preprocess the industrial control power protocol data to obtain preprocessed industrial control power protocol data;

[0030] A feature extraction module, configured to parse the pre-processed industrial control power protocol data and extract multiple target features, and integrate the multiple target features to obtain target integrated features;

[0031] The target behavior type acquisition module is used to input the target integration feature into the decision tree model to obtain the target behavior type of the industrial control power protocol data.

[0032] According to another aspect of the present invention, an electronic device is provided, comprising:

[0033] at least one processor; and

[0034] a memory communicatively connected to the at least one processor; wherein,

[0035] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the behavior detection method of the industrial control power protocol described in any embodiment of the present invention.

[0036] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the behavior detection method of the industrial control power protocol described in any embodiment of the present invention when executed.

[0037] The technical solution of an embodiment of the present invention obtains industrial control power protocol data; preprocesses the industrial control power protocol data to obtain preprocessed industrial control power protocol data; parses the preprocessed industrial control power protocol data and extracts multiple target features, and integrates the multiple target features to obtain target integration features; and inputs the target integration features into a decision tree model to obtain the target behavior type of the industrial control power protocol data. This technical solution processes the industrial control power protocol data to obtain target integration features, and determines the target behavior type of the industrial control power protocol data based on the decision tree model and the target integration features, thereby ensuring the robustness and security of the power system.

[0038] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0040] Figure 1 This is a flow chart of a behavior detection method for an industrial control power protocol provided according to the first embodiment of the present invention;

[0041] Figure 2 This is a flow chart of a behavior detection method for an industrial control power protocol provided in accordance with a second embodiment of the present invention;

[0042] Figure 3 This is a structural diagram of a behavior detection device for an industrial control power protocol provided according to a third embodiment of the present invention;

[0043] Figure 4 It is a structural diagram of an electronic device provided according to the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0045] It should be noted that the terms "first", "second" and "target" in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0046] Example 1

[0047] Figure 1 This is a flow chart of a behavior detection method for an industrial control power protocol provided according to the first embodiment of the present invention. This embodiment is applicable to detecting the behavior of the industrial control power protocol in the power system. The method can be executed by a behavior detection device for an industrial control power protocol. The behavior detection device for an industrial control power protocol can be implemented in the form of hardware and / or software. The behavior detection device for an industrial control power protocol can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0048] S110: Obtain industrial control power protocol data.

[0049] The industrial power control protocol refers to a series of standards and specifications for enabling inter-device communication and data exchange in power systems. Industrial power control protocol data can be understood as control command data contained in protocol data packets collected within the power system. In this embodiment, the industrial power control protocol data can include various types of remote commands. In this embodiment, different types of industrial power control protocol data packets containing various remote commands can be collected from the master and slave stations of the power industrial control system.

[0050] In this embodiment, the acquired industrial control power protocol data is preliminarily classified according to the protocol type (such as Modbus, DNP3, IEC61850, IEC60870, etc.) to ensure that the processing flow can adapt to different protocol formats.

[0051] S120 : Preprocess the industrial control power protocol data to obtain preprocessed industrial control power protocol data.

[0052] Among them, preprocessing includes processing operations such as data cleaning and data normalization, and specific preprocessing operations for data can also be set according to actual needs. In this embodiment, the data cleaning operation can also be understood as a data removal operation, which can achieve the purpose of data cleaning by removing duplicate or useless data packets. Data normalization can be understood as converting data into a unified standardized format for subsequent processing and analysis. The preprocessed industrial control power protocol data can be understood as a standardized data packet obtained after data cleaning and data normalization. In this embodiment, data cleaning and data normalization operations can be performed on the industrial control power protocol data to obtain a standardized data packet.

[0053] In this embodiment, optionally, the industrial control power protocol data is preprocessed to obtain preprocessed industrial control power protocol data, including: performing a data removal operation on the industrial control power protocol data to obtain the removed industrial control power protocol data; and performing a set format conversion on the removed industrial control power protocol data to obtain the preprocessed industrial control power protocol data.

[0054] The data removal operation can be understood as an operation to remove useless data, duplicate data, or abnormal data. In this embodiment, the specific method of performing the data removal operation on the industrial control power protocol data can be to remove redundant data, remove outliers, and perform noise filtering on the industrial control power protocol data, thereby obtaining the removed industrial control power protocol data.

[0055] Specifically, in this embodiment, since there may be duplicate or useless data packets during the acquisition process, such as repeatedly sent heartbeat packets or timed status updates, these data packets need to be removed to reduce redundancy and improve the efficiency of the model, thereby completing the removal of redundant data. In this embodiment, the specific method of removing outliers can be to identify and process outliers in protocol data packets, such as invalid addresses and malformed data packets, and then remove the identified outliers. In this embodiment, the specific method of filtering operation can be to filter noise in data packets, such as irrelevant communication content (non-industrial control power protocol messages) or data such as error bits during transmission.

[0056] Among them, setting format conversion can be understood as standard format conversion. In this embodiment, the specific format that the data needs to be converted can be set according to actual needs. In this embodiment, since the formats and corresponding fields of protocol data packets from different sources are different, it is necessary to convert the protocol data packets from different sources into a unified standardized format for subsequent processing and analysis. The unified standardized format can specifically include standardizing protocol fields, such as converting timestamps into a unified format, or converting address formats in different protocols into consistent representation methods. In this embodiment, the industrial control power protocol data after removal is subjected to data planning processing, which can be performed through data standardization format conversion and data normalization processing operations. Specifically, the numerical fields in the industrial control power protocol data after removal are normalized. For example, the range of physical quantities such as current and voltage in the power protocol message can be mapped to a standard interval (such as 0 to 1) to ensure that features of different dimensions can be analyzed and compared on the same scale.

[0057] Through such a setting in this embodiment, the industrial control power protocol data can be pre-processed by data removal operations and format conversion, so that the obtained data is more prepared and effective, and can be in a unified standardized format to facilitate subsequent analysis and processing of the data packets.

[0058] Furthermore, in this embodiment, preliminary feature extraction is performed on the pre-processed industrial control power protocol data, which may specifically include protocol field extraction, timing feature extraction and behavioral logic feature extraction. Specifically, in this embodiment, the specific method for extracting the protocol field may be to extract key fields from the protocol data packet, such as source address, destination address, function code and operation point, etc. Since the structure of each protocol packet is different, it is necessary to parse the fields according to the protocol specification. For example, the function codes and data value positions of the Modbus protocol and IEC60870 are fixed, while IEC61850 needs to parse nested structures. In this embodiment, the specific method for extracting timing features may be to extract the timestamp of each data packet and analyze the interval between its arrival times. Extracting timing features can be used to detect abnormal delays or frequent retransmissions, which are often potential indicators of abnormal behavior.

[0059] In this embodiment, behavioral logic feature extraction involves analyzing the order and execution logic of control instructions, including whether there are logical conflicts (e.g., a device receiving two mutually exclusive control instructions) and whether the execution order of control instructions meets business process expectations. This analysis can be used to identify a logical rule base for control instructions, which can be used as a feature for subsequent model judgment.

[0060] S130 , parsing the pre-processed industrial control power protocol data and extracting multiple target features, and integrating the multiple target features to obtain target integrated features.

[0061] Among them, parsing can be understood as performing a deep protocol parsing operation on the pre-processed industrial control power protocol data. The deep protocol parsing operation on the pre-processed industrial control power protocol data in this embodiment can be to identify and parse the structure of the pre-processed industrial control power protocol data packet, including the protocol header, load and check part. In this embodiment, each type of power protocol data has its own unique format and field, such as the function code and data field in the Modbus protocol, IEC60870-5-104 protocol, or the data object and operation status in the IEC61850 protocol. Multiple target features can be understood as multiple feature data that need to be extracted. The multiple target features in this embodiment may include frequency features, sequence features and delay features. The multiple target features in this embodiment can set the feature data to be extracted according to actual needs. The target integration feature can be understood as the feature data obtained by integrating the extracted target data.

[0062] In this embodiment, the pre-processed industrial control power protocol data can be deeply analyzed. Each type of power protocol data has its own unique protocol format and data fields. Based on the protocol format and fields, the frequency characteristics, sequence characteristics, and delay characteristics of the control instructions of each type of power protocol data are extracted. In this embodiment, the specific method of integrating multiple target features to obtain the target integrated feature can be understood as performing a feature fusion operation on the multiple extracted target features to obtain the target integrated feature.

[0063] S140: Input the target integration features into the decision tree model to obtain the target behavior type of the industrial control power protocol data.

[0064] The decision tree model can be understood as a trained network model. In this embodiment, the decision tree model can be used to identify the behavior type of industrial control power protocol data, thereby predicting whether the industrial control power protocol data exhibits abnormal behavior. Target behavior types can include normal behavior types and abnormal behavior types. In this embodiment, the target integration features can be input into the decision tree model, so that the decision tree model, after processing, outputs the normal behavior type or abnormal behavior type corresponding to the industrial control power protocol data.

[0065] The technical solution of an embodiment of the present invention obtains industrial control power protocol data; preprocesses the industrial control power protocol data to obtain preprocessed industrial control power protocol data; parses the preprocessed industrial control power protocol data and extracts multiple target features, integrating the multiple target features to obtain target integration features; and inputs the target integration features into a decision tree model to obtain the target behavior type of the industrial control power protocol data. This technical solution processes the industrial control power protocol data to obtain target integration features, and determines the target behavior type of the industrial control power protocol data based on the decision tree model and the target integration features, thereby ensuring the robustness and security of the power system.

[0066] Example 2

[0067] Figure 2 This is a flow chart of a behavior detection method for an industrial control power protocol according to the second embodiment of the present invention. This embodiment is optimized based on the above embodiment. The specific optimization is: parsing the pre-processed industrial control power protocol data and extracting multiple target features, including: parsing the pre-processed industrial control power protocol data to obtain field features; extracting features from the pre-processed industrial control power protocol data based on the field features to obtain multiple target features. Figure 2 As shown, the method includes:

[0068] S210: Acquire industrial control power protocol data.

[0069] S220 : Preprocess the industrial control power protocol data to obtain preprocessed industrial control power protocol data.

[0070] S230: Parse the pre-processed industrial control power protocol data to obtain field features.

[0071] Among them, field features can be understood as unique field data obtained by deep analysis of industrial control power protocol data. Field features can be used to store specific types of data. Field features generally describe how the fields in the protocol are defined, used, and the type of data it contains. The field features in this embodiment may include a function code (Function Code) and a data domain (Data Domain). For example, the corresponding unique function codes and data domains in the Modbus protocol and the IEC60870-5-104 protocol, or the data objects and operation status in the IEC61850 protocol, are all unique field features corresponding to each protocol.

[0072] In this embodiment, the pre-processed industrial control power protocol data can be identified and the data packet structure, including the protocol header, payload and check part, can be parsed to obtain the field features corresponding to each industrial control power protocol data.

[0073] In this embodiment, optionally, the field characteristics include a function code and a data domain; the pre-processed industrial control power protocol data is parsed to obtain the field characteristics, including: parsing the pre-processed industrial control power protocol data to obtain a data format and a data field; extracting the function code and data domain of the data field based on the data format.

[0074] Among them, the function code can specify the purpose or operation type of the data in the protocol data packet. The data field can be understood as the set or range of data values ​​where the valid field is located. The data field in this embodiment can be used to store actual data. The data format can be understood as the specific format of the data of the industrial control power protocol. Specifically, the data format can include binary format (such as Modbus RTU), text format (such as CSV, JSON), database table structure, etc. Different data formats have different parsing methods and tools. The data field can be understood as the valid data field specified by each industrial control power protocol data.

[0075] In this embodiment, the control instructions contained in the processed industrial power control protocol data are parsed to obtain the protocol's data format structure, message type, data field definition, encoding method (such as ASCII, hexadecimal, and binary), and any specific checksum or synchronization mechanism. The valid data field can then be determined based on the parsed data format, and the corresponding function code and data field can be extracted from the valid data field. In this embodiment, the function code and data field corresponding to each piece of industrial power control protocol data can be different, and the corresponding function code and data field are determined based on the type of industrial power control protocol.

[0076] Through such a setting in this embodiment, the data in the pre-processed industrial control power protocol data can be deeply analyzed to obtain the function code and data field in the control instructions in the industrial control power protocol data, thereby facilitating behavioral analysis and behavioral judgment operations on the industrial control power protocol data.

[0077] S240 , performing feature extraction on the pre-processed industrial control power protocol data based on field features to obtain multiple target features.

[0078] Among them, the pre-processed industrial control power protocol data includes multiple control instructions; the multiple target features include frequency features, sequence features, and delay features. Among them, the multiple control instructions can be understood as various types of four-remote control instructions. In this embodiment, the control instructions specifically include various types of telemetry, telesignaling, remote control, and remote adjustment control instructions. In this embodiment, the frequency features, sequence features, and delay features of the control instructions can be extracted from the pre-processed industrial control power protocol data based on field features to obtain multiple target features. Through such a setting in this embodiment, the required features can be extracted from the control instructions as multiple target features to facilitate the analysis and processing of the industrial control power protocol.

[0079] In this embodiment, optionally, feature extraction is performed on the preprocessed industrial control power protocol data based on field features to obtain multiple target features, including: determining the sending frequency of control instructions of the same category within a set time length based on the field features, and using the sending frequency as the frequency feature; determining the sequence feature of the control instructions based on the set logic rule base; for each category of control instructions, extracting the time interval between adjacent control instructions, and determining the delay feature of the control instructions based on the time interval.

[0080] Among them, the set duration can be understood as a pre-set duration. The set duration in this embodiment can be one hour, and can also be set according to actual needs. The sending frequency can be determined by the number of occurrences of the same control instruction per unit time. In this embodiment, the same category of control instructions can refer to at least control instructions with the same application layer protocol type and function code, and can also include consistent control instructions such as point positions and point position operations. In this embodiment, the sending frequency of control instructions of the same category within an hour can be identified based on field characteristics. For example, in this embodiment, the number of occurrences of a specific control instruction per hour can be counted.

[0081] In this embodiment, the transmission frequency of each control instruction can be counted. Based on the transmission frequency of each control instruction, the transmission frequency of control instructions of the same category within a set period of time can be further determined, and the transmission frequency of control instructions of the same category of control instructions can be used as the frequency characteristic of the control instruction. In this embodiment, the frequency characteristic of control instructions can also be used to identify frequency anomalies. For example, an abnormally high frequency of control instructions may indicate that the system is under attack or has a malfunction.

[0082] The set logic rule base can be understood as a database pre-established based on various business logic rules. Specifically, in this embodiment, after extracting the function code and data domain of the data field, semantic analysis can also be performed on the parsed protocol field. For the function code and data domain in the control instruction, combined with the point information, the specific operational significance and business logic are analyzed to form a logic rule base.

[0083] In this embodiment, the specific method for determining the sequential characteristics of control instructions based on the set logic rule base is to analyze the execution sequence of the control instructions to determine whether the execution sequence of the control instructions conforms to the expected business logic, that is, whether it conforms to the set logic rule base. The sequential characteristics of the control instructions can be determined based on whether the control instructions conform to the business logic sequence of the set logic rule base. For example, whether there is a necessary initialization control instruction before a certain business operation step, or whether there is an illegal control instruction sequence.

[0084] This embodiment extracts the timestamp of each data packet from the preprocessed industrial control power protocol data and analyzes the arrival time interval. For each category of control instructions, the time interval between any adjacent control instructions is calculated, and the corresponding time interval information is determined as the delay characteristic of the control instruction. This embodiment can also analyze whether the intervals between two consecutive control instructions conform to normal operating procedures based on the time interval between them. In this embodiment, abnormal delays can be identified through the delay characteristics of control instructions. For example, excessively long response times may indicate system performance issues or malicious attacks, while excessively short intervals may indicate repeated control instructions or system anomalies.

[0085] In this embodiment, such a setting can be used to perform in-depth analysis on the pre-processed industrial control power protocol data and then extract multiple target features, so as to facilitate the classification of the industrial control power protocol data, accurately identify whether there is abnormal behavior and predict possible security threats, such as illegal control instructions or timing anomalies and other security risks.

[0086] S250: Integrate multiple target features to obtain target integrated features.

[0087] Integration can be understood as the operation of fusing multiple extracted target features. A target integration feature can be understood as a comprehensive feature obtained by integrating multiple different target features. In this embodiment, the pre-processed industrial control power protocol data can be deeply analyzed to obtain multiple target features such as field features, frequency features, sequence features, and delay features. The field features, frequency features, sequence features, and delay features are then fused to obtain the target integration feature.

[0088] In this embodiment, optionally, a plurality of target features are integrated to obtain a target integrated feature, including: integrating a field feature, a frequency feature, a sequence feature, and a delay feature to obtain a target integrated feature.

[0089] In this embodiment, the field features, control instruction frequency, sequence, and latency features obtained from deep protocol analysis of the pre-processed industrial control power protocol data can be fused to construct a comprehensive feature vector. The specific fusion operation in this embodiment can be to standardize different features and then splice them to form a unified feature representation, namely the comprehensive feature vector.

[0090] In this embodiment, through such a setting, the extracted multiple target features can be integrated to obtain comprehensive features, and then the behavior type of the industrial control power protocol data can be determined based on the comprehensive features input into the decision tree model.

[0091] S260: Input the target integration features into the decision tree model to obtain the target behavior type of the industrial control power protocol data.

[0092] The decision tree model in this embodiment is a tree-based classification algorithm that makes decisions by recursively splitting the feature space, ultimately classifying data into different categories. In this embodiment, an initial decision tree model can be constructed based on protocol fields and depth features. This initial decision tree model is then trained using cost-sensitive learning to obtain a final, applicable decision tree model, further improving classification accuracy.

[0093] The initial decision tree model construction process in this embodiment primarily involves preparing protocol data features and performing data labeling operations. In this embodiment, field features and deep features that can be extracted from industrial power control protocol data include the protocol type, frequency, sequence, and latency of control instructions. These can be structured fields (such as source address, destination address, function code, etc.) or complex features extracted through deep protocol parsing (such as the timing characteristics of protocol instructions). Each industrial power control protocol data packet can be labeled as normal or abnormal. Specifically, data labeling can be performed using historical data, known abnormal patterns, and expert knowledge. The steps for constructing a decision tree model are as follows: Selecting a splitting criterion: Decision trees require a criterion for selecting split points. Commonly used criteria include information gain and the Gini coefficient. These criteria measure the extent to which a feature effectively classifies data into different categories. Specifically, information gain measures the reduction in entropy after a feature classifies data. Entropy represents the uncertainty of the classification. The Gini coefficient measures the impurity of a classification; a smaller value indicates a purer classification. The maximum tree depth can be used to determine the depth of the decision tree. The depth of the decision tree will affect the complexity of the model. A tree that is too deep will lead to overfitting, while a tree that is too shallow may lead to underfitting. The maximum depth of the tree can be set to prevent overfitting.

[0094] Furthermore, during the training process, data can be labeled, including anomaly labeling. Based on historical experience or known abnormal behavior patterns, known abnormal behaviors in the protocol data are labeled, such as illegal control instructions and abnormal response times. Data labeling is used in subsequent model training to help the model better learn and distinguish between normal and abnormal behaviors. In this embodiment, the processed data is classified according to whether abnormal behavior exists, so that normal control operations can be distinguished from abnormal operations during model training.

[0095] In this embodiment, the training and learning process for the decision tree model can employ cost-sensitive learning. Cost-sensitive learning addresses the problem of different costs for different types of errors. For example, in abnormal behavior detection, the cost of misclassifying abnormal behavior as normal (missing an attack) may be much greater than the cost of misclassifying normal behavior as abnormal (false positive). Cost-sensitive learning can include setting a classification error cost matrix. In cost-sensitive learning, different costs can be assigned to each classification error. For example, assuming a classification of 1 indicates abnormality and a classification of 0 indicates normality, the following cost matrix can be specifically set: misclassifying normal behavior as abnormal (FP) is assigned a lower cost. Misclassifying abnormal behavior as normal (FN) is assigned a higher cost. When training the decision tree model, the cost weights of the samples are passed to the decision tree model. The model adjusts the classification criteria based on the weights, prioritizing the reduction of high-cost errors (i.e., reducing the cases where abnormal behavior is misclassified as normal). Positive-negative sample imbalance refers to the fact that in anomaly detection tasks, the amount of normal behavior data is often much greater than that of abnormal behavior. This class imbalance needs to be addressed, otherwise the model will favor the majority class (i.e., the normal class) and ignore the minority class (i.e., the abnormal class). The importance of a category can be judged based on prior knowledge (for example, the abnormal category is more important), and the weight can be manually specified.

[0096] In this embodiment, the trained decision tree model can also be evaluated and optimized. Specifically, the model performance can be evaluated by using indicators such as accuracy, precision, recall, and F1 score to evaluate the classification performance of the model. In particular, the recall rate (i.e., the proportion of abnormal behaviors correctly detected) in the anomaly detection task is a key indicator because missed detection may have serious consequences. Cost-sensitive tuning can further adjust the cost matrix or other parameters (such as the depth of the tree) to optimize the model performance based on the false alarm rate and missed detection rate results of the model. The focus is on reducing the missed detection rate to improve the accuracy of abnormal behavior detection.

[0097] In this embodiment, through deep analysis of power scenarios combined with reinforcement learning methods, fuzzy testing is performed on the power system to explore system vulnerabilities to protect the power system; and a decision tree model is constructed based on the extracted protocol fields and deep features. Through cost-sensitive learning strategies, the model's ability to identify high-risk abnormal behaviors is enhanced, and classification accuracy and robustness are improved. By using the trained decision tree model in real-time data streams, newly received protocol data can be classified to accurately identify whether there is abnormal behavior and predict possible security threats, such as illegal control instructions or timing anomalies.

[0098] The technical solution of the embodiment of the present invention obtains industrial control power protocol data; preprocesses the industrial control power protocol data to obtain preprocessed industrial control power protocol data; parses the preprocessed industrial control power protocol data to obtain field features; extracts features from the preprocessed industrial control power protocol data based on the field features to obtain multiple target features, and integrates the multiple target features to obtain target integration features; and inputs the target integration features into a decision tree model to obtain the target behavior type of the industrial control power protocol data. This technical solution processes the industrial control power protocol data to obtain the target integration features, and determines the target behavior type of the industrial control power protocol data based on the decision tree model and the target integration features to ensure the robustness and security of the power system.

[0099] Example 3

[0100] Figure 3 Schematic diagram of a behavior detection device for industrial control power protocol according to the third embodiment of the present invention. Figure 3 As shown, the device includes:

[0101] The data packet acquisition module 310 is used to acquire industrial control power protocol data;

[0102] The preprocessing module 320 is used to preprocess the industrial control power protocol data to obtain preprocessed industrial control power protocol data;

[0103] The feature extraction module 330 is used to parse the pre-processed industrial control power protocol data and extract multiple target features, and integrate the multiple target features to obtain target integrated features;

[0104] The target behavior type acquisition module 340 is used to input the target integration feature into the decision tree model to obtain the target behavior type of the industrial control power protocol data.

[0105] Optionally, the preprocessing module 320 is specifically used to perform a data removal operation on the industrial control power protocol data to obtain the removed industrial control power protocol data; and perform a set format conversion on the removed industrial control power protocol data to obtain the preprocessed industrial control power protocol data.

[0106] Optionally, the feature extraction module 330 includes:

[0107] A field feature acquisition unit, configured to parse the pre-processed industrial control power protocol data to obtain field features;

[0108] The feature extraction unit is used to extract features from the pre-processed industrial control power protocol data based on field features to obtain multiple target features.

[0109] Optionally, the field features include function codes and data fields; the field feature acquisition unit is specifically used to parse the pre-processed industrial control power protocol data to obtain data format and data fields; and extract the function code and data fields of the data fields based on the data format.

[0110] Optionally, the pre-processed industrial control power protocol data includes multiple control instructions; the multiple target features include frequency features, sequence features, and delay features.

[0111] Optionally, a feature extraction unit is specifically used to determine the sending frequency of control instructions of the same category within a set time length based on field characteristics, and use the sending frequency as the frequency feature; determine the sequence characteristics of the control instructions based on a set logic rule base; for each category of control instructions, extract the time interval between adjacent control instructions, and determine the delay characteristics of the control instructions based on the time interval.

[0112] Optionally, the feature extraction module 330 is specifically configured to integrate the field feature, the frequency feature, the sequence feature, and the delay feature to obtain a target integrated feature.

[0113] The behavior detection device of an industrial control power protocol provided by an embodiment of the present invention can execute the behavior detection method of an industrial control power protocol provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0114] Example 4

[0115] Figure 4 1 is a schematic diagram of the structure of an electronic device provided according to embodiment four of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0116] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0117] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0118] Processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any other suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as the behavior detection method for the industrial control power protocol.

[0119] In some embodiments, the behavior detection method for the industrial power control protocol can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the behavior detection method for the industrial power control protocol described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the behavior detection method for the industrial power control protocol in any other appropriate manner (e.g., by means of firmware).

[0120] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0121] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0122] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0124] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0125] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0126] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0127] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A behavior detection method for industrial control power protocol, characterized in that: include: Obtain industrial control power protocol data; Preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data; Parsing the preprocessed industrial control power protocol data and extracting multiple target features, and integrating the multiple target features to obtain target integration features; The target integration feature is input into a decision tree model to obtain the target behavior type of the industrial control power protocol data.

2. The method according to claim 1, characterized in that Preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data includes: Performing a data removal operation on the industrial control power protocol data to obtain the industrial control power protocol data after the removal; The removed industrial control power protocol data is converted into a set format to obtain pre-processed industrial control power protocol data.

3. The method according to claim 1, characterized in that The pre-processed industrial control power protocol data is parsed and multiple target features are extracted, including: Parsing the preprocessed industrial control power protocol data to obtain field features; Feature extraction is performed on the preprocessed industrial control power protocol data based on the field features to obtain multiple target features.

4. The method according to claim 3, characterized in that The field features include a function code and a data field; The pre-processed industrial control power protocol data is parsed to obtain field features, including: Parsing the preprocessed industrial control power protocol data to obtain data format and data fields; The function code and the data domain of the data field are extracted based on the data format.

5. The method according to claim 3, characterized in that: The preprocessed industrial control power protocol data includes multiple control instructions; the multiple target features include frequency features, sequence features and delay features.

6. The method according to claim 5, characterized in that Feature extraction is performed on the preprocessed industrial control power protocol data based on the field features to obtain multiple target features, including: Determine the sending frequency of the same type of control instructions within a set time period based on the field feature, and use the sending frequency as the frequency feature; Determining the sequence characteristics of the control instructions based on a set logic rule base; For each category of control instructions, the time interval between adjacent control instructions is extracted, and the delay characteristics of the control instructions are determined according to the time interval.

7. The method according to claim 5, characterized in that Integrating the multiple target features to obtain target integrated features includes: The field features, frequency features, sequence features and delay features are integrated to obtain target integrated features.

8. A behavior detection device for industrial control power protocol, characterized in that: include: Data packet acquisition module, used to acquire industrial control power protocol data; A preprocessing module, used for preprocessing the industrial control power protocol data to obtain preprocessed industrial control power protocol data; A feature extraction module, used to parse the pre-processed industrial control power protocol data and extract multiple target features, and integrate the multiple target features to obtain target integration features; The target behavior type acquisition module is used to input the target integration feature into the decision tree model to obtain the target behavior type of the industrial control power protocol data.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the behavior detection method of the industrial control power protocol according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the behavior detection method of the industrial control power protocol according to any one of claims 1 to 7 when executed.

Images