Industrial control protocol content anomaly detection method based on artificial intelligence

Abstract

The invention relates to the field of protocol detection, in particular to an industrial control protocol content anomaly detection method based on artificial intelligence, which comprises the following steps: capturing data packets of industrial control protocols corresponding to interactive terminal groups; performing feature extraction on the data packet, and analyzing transmission features of each interactive terminal group in different dimensions; performing simulated tampering on the transmission characteristics, determining sensitivity values of the interaction terminal groups corresponding to the transmission characteristics of different dimensions, determining corresponding sensitive dimensions, and classifying the interaction terminal groups based on the number of the sensitive dimensions and the sensitivity values; calculating the sensitive dimensions and the sensitivity values of the interactive terminal groups of the same type to obtain dimension correlation values; performing transmission analysis on each interaction terminal group based on the transmission characteristics and the dimension association values; sending corresponding early warning information according to a data packet transmission analysis result; according to the invention, the efficiency of industrial control protocol content anomaly detection is effectively improved, and the accuracy of industrial control protocol content anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of protocol detection, and in particular to an abnormal detection method for industrial control protocol content based on artificial intelligence. Background Art

[0002] In recent years, with the rapid development of information technology in the industrial field, in today's highly automated and intelligent industrial production environment, the industrial control system, as the core driving the production process, its stability and security are directly related to the operation efficiency and product quality of industrial enterprises. However, with the continuous progress of technology, the industrial control system faces increasingly complex external threats and internal challenges, such as equipment aging, human errors, and malicious attacks, etc., all of which may have a significant impact on production. Therefore, developing an efficient and accurate abnormal detection method is crucial for ensuring the normal operation of the industrial control system.

[0003] Chinese Patent Publication No.: CN119011305A discloses a data security intelligent protection method and system for industrial switches. The invention discloses a data security intelligent protection method and system for industrial switches, which relates to the technical field of industrial switches. The method constructs a dynamic network topology structure Tnet based on the preprocessed industrial switch monitoring data set, realizes the real-time topology map of network devices by generating nodes Ni of each network device and calculating the topological path Pi,i+1 between devices, and can automatically detect potential problems in the network connection. At the same time, the system calculates by constructing traffic anomaly and path anomaly algorithm formulas, and respectively outputs a traffic anomaly index Aflow and a path anomaly index Apath, so as to realize the in-depth analysis of the entire network. This intelligent anomaly detection based on the topology structure can quickly locate abnormal nodes and abnormal paths in the network, and display the health status of current network devices through a visual interface to help administrators monitor in real time, improving the reliability and security of the network.

[0004] Chinese Patent Publication No.: CN119232763A discloses an industrial control ring network monitoring system and a monitoring method thereof. The invention discloses an industrial control ring network monitoring system and a monitoring method thereof, including: a data acquisition module: obtaining industrial control ring network data packets in the industrial control network; a data processing module: performing data cleaning and data sorting on the collected data, performing protocol matching on the data packets, thereby identifying the industrial protocol in the data packets; a data identification module: performing protocol matching on the data in the network data packets, and identifying the communication data of each network packet; the invention realizes all-round monitoring, analysis and dynamic adjustment of the network through the organic collaboration of multiple units, so that the system architecture provides a real-time, intelligent and adaptive network security solution, and compared with the traditional intrusion detection system, the system pays more attention to the real-time optimization of network performance, and reduces unnecessary interference to other servers when the bandwidth occupancy rate is high, thereby solving the problem of lengthy and cumbersome protocol identification.

[0005] It can be seen that the existing technology can only determine traffic anomalies and path failures by building nodes and topological paths for analysis, but cannot confirm common problems of the device itself or special causes of a single device, and cannot analyze potential problems of the device itself and provide early warning by analyzing normal data packets. Summary of the invention

[0006] To this end, the present invention provides an industrial control protocol content anomaly detection method based on artificial intelligence, which is used to overcome the problem that the prior art can only judge traffic anomalies and path failures by constructing nodes and topological paths for analysis, but cannot confirm common problems of the equipment itself or special causes of a single device, and cannot analyze potential problems of the equipment itself and provide early warning by analyzing normal data packets.

[0007] To achieve the above object, the present invention provides an artificial intelligence-based industrial control protocol content anomaly detection method, comprising: Capturing data packets corresponding to the industrial control protocol of each interactive terminal group, wherein a single interactive terminal group includes at least two interactive terminals; Extracting features from the data packets to analyze transmission features of each interactive terminal group in different dimensions, wherein the dimensions include data volume, transmission frequency, and data load; Simulate tampering of the transmission feature, determine the sensitivity value of the transmission feature of different dimensions corresponding to the interactive terminal group, determine the corresponding sensitive dimension, and classify each of the interactive terminal groups based on the number of the sensitive dimensions and the sensitivity value of the transmission feature; Calculate and obtain the correlation values ​​of each dimension of the interactive terminal group of the same type; Performing data packet transmission analysis on each of the interactive terminal groups based on the transmission characteristics and the dimension association values ​​between the interactive terminal groups; Corresponding warning information is issued according to the result of the data packet transmission analysis.

[0008] Furthermore, the process of capturing the data packets corresponding to the industrial control protocol of each interactive terminal group includes: Determine the specific type of the industrial control protocol and determine the network connection mode to perform a packet capture operation on the data packet; The captured data packets are parsed and stored according to the specific type of the industrial control protocol.

[0009] Furthermore, the process of extracting features from the data packet includes: Extracting the port number of the data packet; Use feature selection algorithms to select feature subsets relevant to the target task; Analyzing the lengths of the link layer, the network layer, the transport layer, and the data layer in the feature subset; Extracting the duration of the feature subset and setting a timestamp, and recording the time interval between adjacent feature subsets; The number of transmitted bytes in the feature subset is counted.

[0010] Furthermore, the process of analyzing the transmission characteristics of each of the interactive terminal groups in different dimensions includes: unifying the units of each of the feature subsets in each of the data packets into the same format; Calculate the total number of bytes transmitted of each of the data packets; Calculating the average transmission frequency of each of the data packets; Calculating the average data load of each of the data packets; The transmission characteristics include the total number of bytes transmitted, the average transmission frequency and the average data load value.

[0011] Furthermore, the process of determining the sensitivity values ​​of the interactive terminal group corresponding to the transmission features of different dimensions includes: Simulating tampering of each of the transmission characteristics of the data packet; Transmitting the experimental data packet that completes the simulated tampering in the corresponding interactive terminal group to obtain the experimental transmission characteristics; The sensitivity value of each of the transmission characteristics is obtained by calculating each of the experimental transmission characteristics and the corresponding transmission characteristics.

[0012] Furthermore, according to the sensitivity values ​​of the interactive terminal group corresponding to the transmission features of different dimensions, the process of determining the corresponding sensitive dimensions includes: If the sensitivity value of the transmission feature is greater than the corresponding first preset sensitivity value, the dimension corresponding to the sensitivity value of the transmission feature is determined to be the sensitive dimension, wherein: Each of the first preset sensitivity values ​​is positively correlated with the transmission time of the data packet.

[0013] Furthermore, each of the interactive terminals is divided into a sensitive interactive terminal group, a medium interactive terminal group or a normal interactive terminal group based on the number of the sensitive dimensions and the numerical value of the sensitivity value of the transmission feature.

[0014] Furthermore, the process of calculating and obtaining the dimension association values ​​of the interactive terminal groups of the same type includes: Calculating the sensitivity values ​​of the sensitive dimensions and the transmission characteristics of the interactive terminal groups of the same type to obtain correlation values ​​of the dimensions; The interactive terminal group of the same type is an interactive terminal group including interactive terminals of the same type and quantity.

[0015] Furthermore, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension association value between each of the interactive terminal groups includes: Selecting the largest dimension association value among the interactive terminal groups of the same type; If the largest dimension correlation value is less than a preset correlation value, it is determined that similar anomalies occur in data transmission for the corresponding interactive terminals in the interactive terminal group of the same type and similar anomaly warning information is issued; If the largest dimension association value is greater than or equal to the preset association value, it is determined that different anomalies occur in data transmission for each corresponding interactive terminal in the interactive terminal group of the same type; The preset correlation value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

[0016] Further, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the transmission characteristics and the dimension association values ​​between the interactive terminal groups includes: When it is determined that different abnormalities occur in data transmission in the corresponding interactive terminals in the interactive terminal groups of the same type, two groups of interactive terminal groups corresponding to the largest difference in the dimension association values ​​are selected, and the difference in the total number of bytes transmitted, the difference in the average transmission frequency, and the difference in the average value of the data load corresponding to the interactive terminals in the two groups of interactive terminal groups are respectively calculated; Respectively comparing the total number of transmitted bytes difference, the average transmission frequency difference and the data load average value difference with a preset total number of transmitted bytes difference, a preset average transmission frequency difference and a preset data load average value difference to obtain abnormal transmission characteristics; Issue corresponding single-machine abnormal warning information according to the abnormal transmission characteristics; The preset total transmission byte number difference, the preset average transmission frequency difference and the preset data load average value difference are positively correlated with the data packet transmission time.

[0017] Compared with the prior art, the beneficial effect of the present invention lies in that the present invention extracts features by capturing data packets corresponding to the industrial control protocol of each interactive terminal group, and extracts time features related to the industrial control protocol, such as the sending time interval and response time of the data packet, which helps to deeply understand the execution rhythm of each link in the production process, and integrates and analyzes the extracted features to achieve real-time perception of the security situation of the industrial network, and extracts time features related to the industrial control protocol, such as the sending time interval and response time of the data packet, which helps to deeply understand the execution rhythm of each link in the production process, and accurately evaluates the performance of each interactive terminal group in the industrial production process according to the characteristics of the data packet size and data volume. Resource occupancy, through long-term extraction and analysis of data packet features, establish a feature baseline for normal equipment operation. Once the equipment fails or performance degrades, certain features of the data packet, such as the frequency of error check codes and abnormal responses to specific instructions, will change. Based on these feature changes, equipment failures can be predicted in advance, and maintenance measures can be taken in time to prevent production interruptions. Industrial control protocols usually have corresponding standards and specifications. Extracting features such as protocol versions and instruction formats from data packets can be used to verify whether the communication of interactive terminal groups complies with relevant standards, effectively ensuring that the communication of industrial systems meets industry requirements and improving the accuracy of anomaly detection in industrial control protocol content based on artificial intelligence.

[0018] Furthermore, the present invention simulates tampering of the transmission characteristics, determines the sensitivity values ​​of the transmission characteristics of different dimensions corresponding to the interactive terminal group, simulates tampering of the transmission characteristics, and observes the reactions of different interactive terminal groups. It is possible to accurately evaluate the impact of changes in the transmission characteristics of each dimension on the security of the system, and simulates tampering of the instruction field (data load dimension) in the industrial control protocol data packet. If the system immediately experiences abnormal operation, it indicates that the interactive terminal group is highly sensitive to the data load dimension, which means that once the attacker tampers with the characteristics of this dimension, the system faces great risks, which helps security personnel focus on protecting dimensions with high sensitivity. After clarifying the sensitivity values ​​of the transmission characteristics of each dimension, more targeted measures can be formulated according to the characteristics of different interactive terminal groups. The security strategy of the system can be set up for interactive terminal groups that are sensitive to the transmission frequency dimension. A strict frequency threshold monitoring mechanism can be set. Once an abnormal frequency change is detected, an alarm is immediately triggered and blocking measures are taken to effectively prevent attacks based on frequency changes. Determining the transmission feature sensitivity value helps to understand the adaptability of each interactive terminal group to changes in different dimensions during the production process. The difference in sensitivity of different interactive terminal groups to the transmission feature dimension provides an important basis for resource allocation. For interactive terminal groups that are highly sensitive to the data volume dimension, priority should be given in network bandwidth allocation to ensure the efficiency of their data transmission and avoid data volume transmission restrictions due to insufficient bandwidth, which affects production efficiency. By simulating tampering and analyzing the sensitivity value, a sensitivity model is established. Based on this model, the change trend of transmission characteristics can be monitored in real time, and the abnormal situations that may occur in the production process can be predicted. When the system fails, the sensitivity value can help quickly locate the possible cause of the failure. When the industrial system is upgraded or new equipment is introduced, the sensitivity value of the new interactive terminal group is determined by simulating the tampering of the transmission characteristics, and compared and analyzed with the existing system to evaluate the compatibility of the new equipment with the existing system, further improving the accuracy of anomaly detection of industrial control protocol content based on artificial intelligence.

[0019] Furthermore, in the present invention, data packet transmission analysis is performed on each interactive terminal group based on transmission characteristics and dimension association values ​​between each interactive terminal group. By analyzing transmission characteristics (such as data volume, transmission frequency, data load, etc.), the transmission characteristics of each interactive terminal group can be understood. Combined with the dimension association value, the connection between data packet transmission between different interactive terminal groups can be further clarified, and a benchmark model is established based on the transmission characteristics and dimension association values ​​under normal circumstances. When the data packet transmission of a certain interactive terminal group deviates from the benchmark model, such as the abnormal increase in data volume but the transmission frequency does not change as expected, the abnormal behavior can be quickly identified. The transmission characteristics of different dimensions have different degrees of influence on network security, and the dimension association value can reflect the relationship between these influences. Through comprehensive analysis, the security risks faced by each interactive terminal group can be more accurately evaluated, and the transmission characteristics and dimension association values ​​of each interactive terminal group can be understood, which is helpful for the reasonable allocation of network resources. When a network or system fails, the analysis of transmission characteristics and dimension association values ​​can help quickly narrow the scope of troubleshooting, and long-term monitoring of the transmission characteristics of the interactive terminal group and the changing trend of its dimension association can predict possible equipment failures, and understanding the dimension association between the current interactive terminal groups can help design a network architecture with good scalability. When adding new interactive terminal groups or business functions, they can be better integrated into the existing network, maintain reasonable connections between dimensions, avoid network performance degradation or compatibility issues due to system expansion, and further improve the accuracy of AI-based industrial control protocol content anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flow chart of the method for detecting abnormal content of industrial control protocols based on artificial intelligence of the present invention; Figure 2 A flowchart of extracting data packet features according to an embodiment of the present invention; Figure 3 A logic diagram for determining sensitive dimensions for an embodiment of the present invention; Figure 4 This is a logical diagram of the interactive terminal classification according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0022] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0023] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0024] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0025] See also Figure 1 As shown, it is a flow chart of an industrial control protocol content anomaly detection method based on artificial intelligence of the present invention. An embodiment of the present invention provides an industrial control protocol content anomaly detection method based on artificial intelligence, including: Step S1, capturing data packets corresponding to the industrial control protocol of each interactive terminal group, where a single interactive terminal group includes at least two interactive terminals; Step S2, extracting features from the data packets, and analyzing the transmission features of each interactive terminal group in different dimensions, including data volume, transmission frequency, and data load; Step S3, simulating tampering of the transmission characteristics, determining the sensitivity values ​​of the transmission characteristics of the interactive terminal groups corresponding to different dimensions, determining the corresponding sensitive dimensions, and classifying each interactive terminal group based on the number of sensitive dimensions and the sensitivity values ​​of the transmission characteristics; Step S4, calculating and obtaining the correlation values ​​of each dimension of the same type of interactive terminal group; Step S5, performing data packet transmission analysis on each interactive terminal group based on the transmission characteristics and the dimension association values ​​between each interactive terminal group; Step S6: issuing corresponding warning information according to the result of data packet transmission analysis.

[0026] Specifically, the process of capturing data packets corresponding to the industrial control protocol of each interactive terminal group includes: Determine the specific type of industrial control protocol and the network connection method to perform packet capture operations on the data packets; The captured data packets are parsed and stored according to the specific type of industrial control protocol.

[0027] It is understandable that determining the specific type of industrial control protocol requires a clear definition of the interactive terminal group that needs to capture data packets and its corresponding industrial control protocol. For example, it is necessary to determine whether it is an interactive terminal group that performs equipment control in the workshop, which may use Modbus, PROFIBUS and other protocols; or an interactive terminal group at the management and monitoring level, which may involve OPCUA and other protocols. Clarifying the goal will help in the subsequent selection of targeted capture tools and setting of filtering conditions.

[0028] It is understandable that determining the network connection method requires a detailed understanding of the topology of the industrial network, including network hierarchy, device connection relationships, network segmentation and other information. For example, knowing whether the industrial network is a star, bus or ring topology; which devices are in the same subnet and which devices communicate across the network through a gateway. This is crucial for determining the best location for packet capture. For example, capturing at the gateway can obtain data packets that interact across subnets, while capturing at the switch port within a specific subnet can focus on communications within the subnet.

[0029] It is understandable that, in the process of packet capture, the capture tool is deployed first and then the capture parameters are configured. After the packet capture is completed, the data is parsed and stored. This is the prior art for those skilled in the art and will not be described in detail here.

[0030] See also Figure 2 As shown, it is a flow chart of extracting features of a data packet according to an embodiment of the present invention. In step S2, the process of extracting features of a data packet includes: Step S21, extracting the port number of the data packet; Step S22, using a feature selection algorithm to select a feature subset relevant to the target task; Step S23, analyzing the lengths of the link layer, network layer, transport layer and data layer in the feature subset; Step S24, extracting the duration of the feature subset and setting a timestamp, and recording the time interval between adjacent feature subsets; Step S25, counting the number of transmitted bytes in the feature subset.

[0031] It is understandable that when extracting the port number of a data packet, the source port and the destination port are used to determine the application layer protocol or service used for communication. Different application layer protocols usually use fixed port numbers, such as HTTP uses port 80 (HTTPS uses port 443) and SMTP uses port 25.

[0032] It is understandable that when using feature selection algorithms to select feature subsets relevant to the target task, feature selection algorithms such as filtering method (selecting features based on statistical indicators such as information gain, chi-square test, etc.), packaging method (iteratively selecting feature subsets based on machine learning model performance) or embedding method (automatically performing feature selection during model training, such as Lasso regression) are used to select the feature subsets that have the greatest impact on the target task (such as traffic classification, anomaly detection, etc.).

[0033] It can be understood that the number of bytes of the entire data packet includes the length of the link layer, network layer, transport layer and data part.

[0034] It is understandable that the precise timestamp of each data packet arriving at the collection point is recorded, which can be obtained through the collection tool or parsing library. For example, in the dpkt library, ts is the timestamp of the data packet, and the arrival time is used to analyze the changes in network traffic over time and the traffic characteristics in different time periods.

[0035] Specifically, the present invention extracts features by capturing data packets corresponding to industrial control protocols of each interactive terminal group, extracting time features related to the industrial control protocol, such as the sending time interval and response time of the data packet, etc., which helps to deeply understand the execution rhythm of each link in the production process, and integrates and analyzes the extracted features to achieve real-time perception of the industrial network security situation, extracting time features related to the industrial control protocol, such as the sending time interval and response time of the data packet, etc., which helps to deeply understand the execution rhythm of each link in the production process. According to the characteristics of the data packet size, data volume, etc., the resource occupation of each interactive terminal group in the industrial production process can be accurately evaluated. By extracting and analyzing the data packet features for a long time, a feature baseline is established when the equipment is operating normally. Once the equipment fails or the performance degrades, certain features of the data packet, such as the frequency of occurrence of error check codes and abnormal responses to specific instructions, will change. Based on these feature changes, equipment failures can be predicted in advance, maintenance measures can be taken in time, and production interruptions can be prevented. Industrial control protocols usually have corresponding standards and specifications. Extracting features such as the protocol version and instruction format in the data packet can be used to verify whether the communication of the interactive terminal group meets the relevant standards, effectively ensuring that the communication of the industrial system meets the industry requirements, and improving the accuracy of abnormal detection of industrial control protocol content based on artificial intelligence.

[0036] Specifically, the process of analyzing the transmission characteristics of each interactive terminal group in different dimensions includes: Unify the units of each feature subset in each data packet into the same format; Calculate the total number of bytes transmitted for each data packet; Calculate the average transmission frequency of each data packet; Calculate the average data load of each data packet; The transmission characteristics include the total number of bytes transmitted, the average transmission frequency and the average data load.

[0037] Specifically, the process of determining the sensitivity values ​​of the interactive terminal group corresponding to the transmission characteristics of different dimensions includes: Simulate tampering of each transmission feature of the data packet; The experimental data packets that have completed the simulated tampering are transmitted in the corresponding interactive terminal group to obtain the experimental transmission characteristics; Each experimental transmission feature is calculated with the corresponding transmission feature to obtain the sensitivity value of each transmission feature.

[0038] In implementation, the experimental transmission characteristics include the total number of bytes of experimental transmission, the experimental average transmission frequency and the experimental data load average value. The absolute value of the difference obtained by subtracting the total number of bytes of experimental transmission from the total number of bytes of transmission is then divided by the total number of bytes of transmission to obtain the total number of bytes of transmission sensitivity value A. The absolute value of the difference obtained by subtracting the experimental average transmission frequency from the average transmission frequency is then divided by the average transmission frequency to obtain the average transmission frequency sensitivity value B. The absolute value of the difference obtained by subtracting the experimental data load average value from the data load average value is then divided by the data load average value to obtain the data load average sensitivity value C. See also Figure 3 As shown, it is a logic diagram for determining sensitive dimensions in an embodiment of the present invention. According to the sensitivity values ​​of the transmission features of different dimensions corresponding to the interactive terminal group, the process of determining the corresponding sensitive dimensions includes: If the sensitivity value of the transmission feature is greater than the corresponding first preset sensitivity value, the dimension corresponding to the sensitivity value of the transmission feature is determined to be a sensitive dimension, wherein: If the sensitivity value of the total number of bytes transmitted is greater than the first preset sensitivity value of the total number of bytes transmitted, then the dimension corresponding to the total number of bytes transmitted is determined to be a sensitive dimension; If the average transmission frequency sensitivity value is greater than the first average transmission frequency preset sensitivity value, then determining that the dimension corresponding to the average transmission frequency is a sensitive dimension; If the data load average value sensitivity value is greater than the first data load average value preset sensitivity value, then determining that the dimension corresponding to the data load average value is a sensitive dimension; In the implementation, the preset sensitivity value of the total number of bytes transmitted is 0.05, the preset sensitivity value of the average transmission frequency is 0.03, and the preset sensitivity value of the average value of the data load is 0.1. If the sensitivity value of the total number of bytes transmitted is 0.08, which is greater than the first preset sensitivity value of the total number of bytes transmitted, then the dimension corresponding to the total number of bytes transmitted is determined to be the sensitive dimension; If the average transmission frequency sensitivity value is 0.06 and is greater than the first average transmission frequency preset sensitivity value, then the dimension corresponding to the average transmission frequency is determined to be a sensitive dimension; If the data load average sensitivity value is 1.2 and is greater than the first data load average preset sensitivity value, then the dimension corresponding to the data load average is determined to be a sensitive dimension; The first preset sensitivity values ​​include a first total transmission byte count preset sensitivity value, a first average transmission frequency preset sensitivity value, and a first data load average value preset sensitivity value, and each first preset sensitivity value is positively correlated with the data packet transmission time.

[0039] It can be understood that the longer the data packet transmission time is, the larger the total number of bytes transmitted is, the greater the probability of fluctuation in the average transmission frequency is, and the greater the probability of fluctuation in the average data load value is. Therefore, the preset sensitivity value of the total number of bytes transmitted, the preset sensitivity value of the average transmission frequency, and the preset sensitivity value of the average data load value are positively correlated with the data packet transmission time.

[0040] Specifically, the present invention simulates tampering of transmission characteristics, determines the sensitivity values ​​of transmission characteristics of different dimensions corresponding to the interactive terminal group, simulates tampering of transmission characteristics, and observes the reactions of different interactive terminal groups. It can accurately evaluate the impact of changes in transmission characteristics of each dimension on system security, and simulates tampering of instruction fields (data load dimensions) in industrial control protocol data packets. If the system immediately experiences abnormal operation, it indicates that the interactive terminal group is highly sensitive to the data load dimension, which means that once an attacker tampers with the characteristics of this dimension, the system faces great risks, which helps security personnel focus on protecting highly sensitive dimensions. After clarifying the sensitivity values ​​of transmission characteristics of each dimension, more targeted security measures can be formulated according to the characteristics of different interactive terminal groups. Full strategy, for interactive terminal groups that are sensitive to the transmission frequency dimension, a strict frequency threshold monitoring mechanism can be set. Once an abnormal frequency change is detected, an alarm is immediately triggered and blocking measures are taken to effectively prevent attacks based on frequency changes. Determining the transmission feature sensitivity value helps to understand the adaptability of each interactive terminal group to changes in different dimensions during the production process. The difference in sensitivity of different interactive terminal groups to the transmission feature dimension provides an important basis for resource allocation. For interactive terminal groups that are highly sensitive to the data volume dimension, priority should be given in network bandwidth allocation to ensure the efficiency of their data transmission and avoid data volume transmission restrictions due to insufficient bandwidth, which affects production efficiency. By simulating tampering and analyzing the sensitivity value, a sensitivity model is established. Based on this model, the change trend of transmission characteristics can be monitored in real time, and possible abnormal situations that may occur in the production process can be predicted. When the system fails, the sensitivity value can help quickly locate the possible cause of the failure. When the industrial system is upgraded or new equipment is introduced, the sensitivity value of the new interactive terminal group is determined by simulating tampering with the transmission characteristics, and compared and analyzed with the existing system to evaluate the compatibility of the new equipment with the existing system, further improving the accuracy of anomaly detection of industrial control protocol content based on artificial intelligence.

[0041] See also Figure 4 As shown, it is a logic diagram of interactive terminal classification according to an embodiment of the present invention. The process of classifying each interactive terminal based on the number of sensitive dimensions and the value of the sensitivity value of the transmission feature includes: If the number of sensitive dimensions is greater than the preset number of sensitive dimensions and the sensitivity value of the transmission feature exists is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be a sensitive interactive terminal group; If the number of sensitive dimensions is greater than the preset number of sensitive dimensions and there is no transmission feature whose sensitivity value is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be an intermediate interactive terminal group; If the number of sensitive dimensions is less than or equal to the preset number of sensitive dimensions and the sensitivity value of the transmission feature exists is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be an intermediate interactive terminal group; If the number of sensitive dimensions is less than or equal to the preset number of sensitive dimensions and there is no transmission feature whose sensitivity value is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be a normal interactive terminal group; In the implementation, the preset number of sensitive dimensions is 1, the preset sensitivity value of the second total number of bytes transmitted is 0.08, the preset sensitivity value of the second average transmission frequency is 0.07, and the preset sensitivity value of the second data load average is 1.2. If the number of sensitive dimensions is 2, which is greater than the preset number of sensitive dimensions and the sensitivity value of the total number of bytes transmitted is 0.12, which is greater than the corresponding second preset sensitivity value, the interactive terminal group is determined to be a sensitive interactive terminal group; If the number of sensitive dimensions is 2, which is greater than the preset number of sensitive dimensions and there is no transmission feature whose sensitivity value is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be an intermediate interactive terminal group; If the number of sensitive dimensions is 0, which is less than the preset number of sensitive dimensions and the second data load average sensitivity value is 1.5, which is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be a medium-level interactive terminal group; If the number of sensitive dimensions is 0, which is less than the preset number of sensitive dimensions and there is no transmission feature whose sensitivity value is greater than the corresponding second preset sensitivity value, then the interactive terminal group is determined to be a normal interactive terminal group; Among them, the number of preset sensitive dimensions is positively correlated with the time of data packet transmission; each second preset sensitivity value is positively correlated with the time of data packet transmission; the second preset sensitivity values ​​include the second total transmission byte number preset sensitivity value, the second average transmission frequency preset sensitivity value and the second data load average value preset sensitivity value, and the first preset sensitivity value is smaller than the corresponding second preset sensitivity value.

[0042] It can be understood that the longer the data packet transmission time is, the larger the total number of bytes transmitted is, the greater the probability of fluctuation in the average transmission frequency is, the greater the probability of change in the average data load value is, and the greater the probability of becoming a sensitive dimension. Therefore, the second total number of bytes transmitted preset sensitivity value, the second average transmission frequency preset sensitivity value, the second data load average preset sensitivity value and the preset number of sensitive dimensions are positively correlated with the data packet transmission time.

[0043] Specifically, the process of comparing the sensitivity values ​​of the sensitive dimensions and transmission features of the same type of interactive terminal groups to obtain the dimension association values ​​includes: The sensitive dimensions of the same type of interactive terminal groups and the sensitivity values ​​corresponding to the sensitive dimensions are compared with each other and the correlation values ​​of each dimension are calculated; The same type of interactive terminal group is an interactive terminal group including the same type and number of interactive terminals.

[0044] It can be understood that the dimension association value = (a*total number of dimension sensitive dimensions + ∑b*sensitivity value), where a and b are parameters, a is generally taken as 0.8, and b is generally taken as 0.2; The same type of interactive terminal groups includes 2 groups, the total number of sensitive dimensions of the total number of bytes transmitted is 1, and the sensitivity value corresponding to the sensitive dimension is 1.5. Therefore, the dimension association value = 0.8*1+1.5*0.2=1.1.

[0045] Specifically, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension association value between each interactive terminal group includes: Select the largest dimension correlation value among the interactive terminal groups of the same type; If the maximum dimension correlation value is less than the preset correlation value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have similar anomalies in data transmission and similar anomaly warning information is issued; If the maximum dimension correlation value is greater than or equal to the preset correlation value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have different anomalies in data transmission; In implementation, the preset correlation value is 0.8. If the maximum dimension correlation value is 0.4, which is less than the preset correlation value, then it is determined that the corresponding interactive terminals in the same type of interactive terminal group have similar anomalies in data transmission and similar anomaly warning information is issued; If the maximum dimension correlation value is 1.1 and is greater than the preset correlation value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have different anomalies in data transmission; The preset correlation value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

[0046] It is understandable that the greater the number of corresponding interactive terminals in a single interactive terminal group, the greater the probability of the occurrence of sensitive dimensions, and thus the greater the preset correlation value.

[0047] Specifically, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the transmission characteristics and the dimension association values ​​between the interactive terminal groups includes: When determining that each corresponding interactive terminal in the same type of interactive terminal group has different abnormalities in data transmission, select two groups of interactive terminal groups corresponding to the largest difference in dimension correlation values, and calculate the difference in the total number of bytes transmitted, the difference in average transmission frequency, and the difference in average data load value of the corresponding interactive terminals in the two groups of interactive terminal groups respectively; Respectively comparing the total number of bytes transmitted, the average transmission frequency difference and the data load average value difference with the preset total number of bytes transmitted, the preset average transmission frequency difference and the preset data load average value difference to obtain abnormal transmission characteristics; Issue corresponding single-machine abnormal warning information according to abnormal transmission characteristics; In implementation, the preset total number of bytes transmitted is 2000 bytes, the preset average transmission frequency is 80 Hz, and the preset data load average is 200KB. When determining that the corresponding interactive terminals in the same type of interactive terminal group have different abnormalities in data transmission, two groups of interactive terminal groups corresponding to the largest dimension association value difference are selected, and the total number of bytes transmitted of the corresponding interactive terminals in the two groups of interactive terminal groups are calculated to be 2560 bytes, which is greater than the preset total number of bytes transmitted, 76 Hz, which is less than the preset average transmission frequency, and 254KB, which is greater than the preset data load average. The total number of bytes transmitted and the data load average belong to abnormal transmission characteristics and an abnormal warning message of the total number of bytes transmitted by a single machine and an abnormal warning message of the average value of the data load of a single machine are issued.

[0048] The preset total transmission byte number difference, the preset average transmission frequency difference and the preset data load average value difference are positively correlated with the data packet transmission time.

[0049] It can be understood that the longer the data packet transmission time is, the larger the total number of bytes transmitted is, the greater the probability of fluctuation in the average transmission frequency is, and the greater the probability of change in the average data load value is. Therefore, the preset total number of bytes transmitted difference, the preset average transmission frequency difference and the preset data load average difference are positively correlated with the data packet transmission time.

[0050] Specifically, in the present invention, data packet transmission analysis is performed on each interactive terminal group based on transmission characteristics and dimension association values ​​between each interactive terminal group. By analyzing transmission characteristics (such as data volume, transmission frequency, data load, etc.), the transmission characteristics of each interactive terminal group can be understood. Combined with the dimension association value, the connection between data packet transmission between different interactive terminal groups can be further clarified, and a benchmark model is established based on the transmission characteristics and dimension association values ​​under normal circumstances. When the data packet transmission of a certain interactive terminal group deviates from the benchmark model, such as the abnormal increase in data volume but the transmission frequency does not change as expected, the abnormal behavior can be quickly identified. The transmission characteristics of different dimensions have different degrees of influence on network security, and the dimension association value can reflect the relationship between these influences. Through comprehensive analysis, the security risks faced by each interactive terminal group can be more accurately evaluated, and the transmission characteristics and dimension association values ​​of each interactive terminal group are understood, which helps to reasonably allocate network resources. When a network or system fails, the analysis of transmission characteristics and dimension association values ​​can help to quickly narrow the scope of troubleshooting, and long-term monitoring of the transmission characteristics of the interactive terminal group and the changing trend of its dimension association can predict possible equipment failures. Understanding the dimensional association between the current interactive terminal groups helps to design a network architecture with good scalability. When adding new interactive terminal groups or business functions, they can be better integrated into the existing network, maintain reasonable connections between dimensions, avoid network performance degradation or compatibility issues due to system expansion, and further improve the accuracy of AI-based industrial control protocol content anomaly detection.

[0051] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for detecting abnormal content of industrial control protocols based on artificial intelligence, characterized in that: include: Capturing data packets corresponding to the industrial control protocol of each interactive terminal group, wherein a single interactive terminal group includes at least two interactive terminals; Extracting features from the data packets to analyze transmission features of each interactive terminal group in different dimensions, wherein the dimensions include data volume, transmission frequency, and data load; Simulate tampering of the transmission feature, determine the sensitivity value of the transmission feature of different dimensions corresponding to the interactive terminal group, determine the corresponding sensitive dimension, and classify each of the interactive terminal groups based on the number of the sensitive dimensions and the sensitivity value of the transmission feature; Calculate and obtain the correlation values ​​of each dimension of the interactive terminal group of the same type; Performing data packet transmission analysis on each of the interactive terminal groups based on the transmission characteristics and the dimension association values ​​between the interactive terminal groups; Corresponding warning information is issued according to the result of the data packet transmission analysis.

2. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 1 is characterized in that: The process of capturing the data packets corresponding to the industrial control protocol of each interactive terminal group includes: Determine the specific type of the industrial control protocol and determine the network connection mode to perform a packet capture operation on the data packet; The captured data packets are parsed and stored according to the specific type of the industrial control protocol.

3. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 2 is characterized in that: The process of extracting features from the data packet includes: Extracting the port number of the data packet; Use feature selection algorithms to select feature subsets relevant to the target task; Analyzing the lengths of the link layer, the network layer, the transport layer, and the data layer in the feature subset; Extracting the duration of the feature subset and setting a timestamp, and recording the time interval between adjacent feature subsets; The number of transmitted bytes in the feature subset is counted.

4. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 3 is characterized in that: The process of analyzing the transmission characteristics of each interactive terminal group in different dimensions includes: unifying the units of each of the feature subsets in each of the data packets into the same format; Calculate the total number of bytes transmitted of each of the data packets; Calculating the average transmission frequency of each of the data packets; Calculating the average data load of each of the data packets; The transmission characteristics include the total number of bytes transmitted, the average transmission frequency and the average data load value.

5. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 4 is characterized in that: The process of determining the sensitivity values ​​of the interactive terminal group corresponding to the transmission features of different dimensions includes: Simulating tampering of each of the transmission characteristics of the data packet; Transmitting the experimental data packet that completes the simulated tampering in the corresponding interactive terminal group to obtain experimental transmission characteristics; The sensitivity value of each of the transmission characteristics is obtained by calculating each of the experimental transmission characteristics and the corresponding transmission characteristics.

6. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 5 is characterized in that: The process of determining the corresponding sensitive dimension according to the sensitivity values ​​of the interactive terminal group corresponding to the transmission features of different dimensions includes: If the sensitivity value of the transmission feature is greater than the corresponding first preset sensitivity value, the dimension corresponding to the sensitivity value of the transmission feature is determined to be the sensitive dimension, wherein: Each of the first preset sensitivity values ​​is positively correlated with the transmission time of the data packet.

7. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 6 is characterized in that: The interactive terminals are divided into a sensitive interactive terminal group, a medium interactive terminal group or a normal interactive terminal group based on the number of the sensitive dimensions and the value of the sensitivity value of the transmission feature.

8. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 7 is characterized in that: The process of calculating and obtaining the dimension association values ​​of the interactive terminal groups of the same type includes: Calculating the sensitivity values ​​of the sensitive dimensions and the transmission characteristics of the interactive terminal groups of the same type to obtain correlation values ​​of the dimensions; The interactive terminal group of the same type is an interactive terminal group including interactive terminals of the same type and quantity.

9. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 8 is characterized in that: The process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension association value between each of the interactive terminal groups includes: Selecting the largest dimension association value among the interactive terminal groups of the same type; If the largest dimension correlation value is less than a preset correlation value, it is determined that similar anomalies occur in data transmission for the corresponding interactive terminals in the interactive terminal group of the same type and similar anomaly warning information is issued; If the largest dimension association value is greater than or equal to the preset association value, it is determined that different anomalies occur in data transmission for each corresponding interactive terminal in the interactive terminal group of the same type; The preset correlation value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

10. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 9 is characterized in that: The process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the transmission characteristics and the dimension association values ​​between the interactive terminal groups includes: When it is determined that different abnormalities occur in data transmission in the corresponding interactive terminals in the interactive terminal groups of the same type, two groups of interactive terminal groups corresponding to the largest difference in the dimension association values ​​are selected, and the difference in the total number of bytes transmitted, the difference in the average transmission frequency, and the difference in the average value of the data load corresponding to the interactive terminals in the two groups of interactive terminal groups are respectively calculated; Respectively comparing the total number of transmitted bytes difference, the average transmission frequency difference and the data load average value difference with a preset total number of transmitted bytes difference, a preset average transmission frequency difference and a preset data load average value difference to obtain abnormal transmission characteristics; Issue corresponding single-machine abnormal warning information according to the abnormal transmission characteristics; The preset total transmission byte number difference, the preset average transmission frequency difference and the preset data load average value difference are positively correlated with the data packet transmission time.

Images