An Abnormal Detection Method for Industrial Control Protocol Content Based on Artificial Intelligence

Abstract

The present invention relates to the field of protocol detection, and particularly to an abnormal detection method for industrial control protocol content based on artificial intelligence, including: capturing data packets of industrial control protocols corresponding to each group of interaction terminals; extracting features from the data packets and analyzing the transmission features of each group of interaction terminals in different dimensions; simulating tampering with the transmission features to determine the sensitivity values of each group of interaction terminals corresponding to different-dimensional transmission features, determining the corresponding sensitive dimensions, and classifying each group of interaction terminals based on the number and sensitivity values of the sensitive dimensions; calculating the dimension correlation values by using the sensitive dimensions and sensitivity values of the same type of interaction terminal groups; performing transmission analysis on each group of interaction terminals based on the transmission features and dimension correlation values; and sending corresponding warning messages according to the results of the data packet transmission analysis. The present invention effectively improves the efficiency of abnormal detection of industrial control protocol content and the accuracy of abnormal detection of industrial control protocol content.

Description

Technical Field

[0001] The present invention relates to the technical field of protocol detection, and in particular to an abnormal detection method for industrial control protocol content based on artificial intelligence. Background Art

[0002] In recent years, with the rapid development of information technology in the industrial field, in today's highly automated and intelligent industrial production environment, the industrial control system, as the core driving the production process, its stability and security are directly related to the operation efficiency and product quality of industrial enterprises. However, with the continuous progress of technology, the industrial control system faces increasingly complex external threats and internal challenges, such as equipment aging, human errors, and malicious attacks, etc., which may all have a significant impact on production. Therefore, developing an efficient and accurate abnormal detection method is crucial for ensuring the normal operation of the industrial control system.

[0003] Chinese Patent Publication No.: CN119011305A discloses a data security intelligent protection method and system for industrial switches. The invention discloses a data security intelligent protection method and system for industrial switches, which relates to the technical field of industrial switches. According to the preprocessed industrial switch monitoring data set, a dynamic network topology structure Tnet is constructed. By generating nodes Ni of each network device and calculating the topological path Pi,i + 1 between devices, a real-time topological map of network devices is realized, and potential problems in the network connection can be automatically detected. At the same time, the system calculates by constructing flow anomaly and path anomaly algorithm formulas, and respectively outputs a flow anomaly index Aflow and a path anomaly index Apath, so as to realize in-depth analysis of the entire network. This intelligent anomaly detection based on the topological structure can quickly locate abnormal nodes and abnormal paths in the network, and display the health status of current network devices through a visual interface to help administrators monitor in real time, improving the reliability and security of the network.

[0004] Chinese Patent Publication No.: CN119232763A discloses an industrial control loop network monitoring system and its monitoring method. The invention discloses an industrial control loop network monitoring system and its monitoring method, including: a data acquisition module: obtaining industrial control loop network data packets in the industrial control network; a data processing module: performing data cleaning and data sorting on the collected data, and performing protocol matching on the data packets to identify industrial protocols in the data packets; a data identification module: performing protocol matching on the data in the network data packets to identify the communication data of each network packet; through the organic cooperation of multiple units, the system realizes all-round monitoring, analysis and dynamic adjustment of the network, so that the system architecture provides a real-time, intelligent and adaptive network security solution. Compared with traditional intrusion detection systems, this system pays more attention to the real-time optimization of network performance. In the case of a high bandwidth occupancy rate, it reduces unnecessary interference to other servers, thus solving the problem of the length and complexity of protocol identification.

[0005] It can be seen that in the prior art, by constructing nodes and topological paths for analysis, it can only judge traffic anomalies and path failures, and cannot confirm the common problems of the device itself or the special reasons of a single device. It is impossible to analyze and early warn of potential problems of the device itself by analyzing normal data packets. Summary of the Invention

[0006] Therefore, the present invention provides an artificial intelligence-based method for detecting anomalies in industrial control protocol content, aiming to overcome the problems in the prior art that by constructing nodes and topological paths for analysis, it can only judge traffic anomalies and path failures, and cannot confirm the common problems of the device itself or the special reasons of a single device. It is impossible to analyze and early warn of potential problems of the device itself by analyzing normal data packets.

[0007] To achieve the above object, the present invention provides an artificial intelligence-based method for detecting anomalies in industrial control protocol content, including:

[0008] Capturing data packets of the industrial control protocol corresponding to each interactive terminal group, and each of the interactive terminal groups includes at least two interactive terminals;

[0009] Performing feature extraction on the data packets to analyze the transmission features of each interactive terminal group in different dimensions, where the dimensions include data volume, transmission frequency, and data payload;

[0010] Simulating tampering with the transmission features to determine the sensitivity values of the interactive terminal groups corresponding to different-dimensional transmission features, determining the corresponding sensitive dimensions, and classifying each interactive terminal group based on the number of sensitive dimensions and the sensitivity values of the transmission features;

[0011] Calculate the correlation values of each dimension of the interaction terminal groups of the same type;

[0012] Based on the transmission characteristics and the correlation values of each dimension between the interaction terminal groups, perform data packet transmission analysis on each interaction terminal group;

[0013] Send corresponding warning information according to the results of the data packet transmission analysis.

[0014] Furthermore, the process of capturing the data packets corresponding to each interaction terminal group for the industrial control protocol includes:

[0015] Determine the specific type of the industrial control protocol and determine the network connection method to perform a packet capture operation on the data packets;

[0016] Parse and store the captured data packets according to the specific type of the industrial control protocol.

[0017] Furthermore, the process of extracting features from the data packets includes:

[0018] Extract the port numbers of the data packets;

[0019] Use a feature selection algorithm to select a feature subset related to the target task;

[0020] Analyze the lengths of the link layer, network layer, transport layer, and data layer in the feature subset;

[0021] Extract the duration of the feature subset and set a timestamp, and record the time interval between adjacent feature subsets;

[0022] Statistically calculate the number of transmitted bytes in the feature subset.

[0023] Furthermore, the process of analyzing the transmission characteristics of each interaction terminal group in different dimensions includes:

[0024] Unify the units of each feature subset in each data packet into the same format;

[0025] Calculate the total number of transmitted bytes of each data packet;

[0026] Calculate the average transmission frequency of each data packet;

[0027] Calculate the average data payload of each data packet;

[0028] Among them, the transmission characteristics include the total number of transmitted bytes, the average transmission frequency, and the average data payload.

[0029] Furthermore, the process of determining the sensitivity values of the interaction terminal group corresponding to different dimension transmission characteristics includes:

[0030] Simulate tampering with each of the transmission characteristics of the data packet;

[0031] Transmit the experimental data packet after completing the simulated tampering in the corresponding interactive terminal group to obtain experimental transmission characteristics;

[0032] Calculate the sensitivity values of each of the transmission characteristics by calculating each of the experimental transmission characteristics and the corresponding transmission characteristics.

[0033] Further, the process of determining the corresponding sensitive dimension according to the sensitivity values of the transmission characteristics corresponding to different dimensions of the interactive terminal group includes:

[0034] If the sensitivity value of the transmission characteristic is greater than the corresponding first preset sensitivity value, it is determined that the dimension corresponding to the sensitivity value of the transmission characteristic is the sensitive dimension, where

[0035] Each of the first preset sensitivity values is positively correlated with the time of data packet transmission.

[0036] Further, based on the number of sensitive dimensions and the numerical values of the sensitivity values of the transmission characteristics, each of the interactive terminals is divided into a sensitive interactive terminal group, an intermediate interactive terminal group, or a normal interactive terminal group.

[0037] Further, the process of calculating the dimension correlation values of each of the interactive terminal groups of the same type includes:

[0038] Calculate the dimension correlation values by calculating the sensitive dimensions and the sensitivity values of the transmission characteristics of the interactive terminal group of the same type;

[0039] The interactive terminal group of the same type is an interactive terminal group containing the same type and number of interactive terminals.

[0040] Further, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension correlation values between each of the interactive terminal groups includes:

[0041] Select the largest dimension correlation value in the interactive terminal group of the same type;

[0042] If the largest dimension correlation value is less than the preset correlation degree value, it is determined that similar anomalies occur in the corresponding interactive terminals during data transmission in the interactive terminal group of the same type and a similar anomaly warning message is issued;

[0043] If the largest dimension correlation value is greater than or equal to the preset correlation degree value, it is determined that different anomalies occur in the corresponding interactive terminals during data transmission in the interactive terminal group of the same type;

[0044] Among them, the preset correlation value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

[0045] Further, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the transmission characteristics and the dimension correlation values between the interactive terminal groups includes:

[0046] In the case where it is determined that the corresponding interactive terminals in the interactive terminal groups of the same type have different abnormal states during data transmission, select the two groups of interactive terminal groups corresponding to the largest difference in the dimension correlation values, and calculate the difference in the total transmission bytes, the difference in the average transmission frequency, and the difference in the average data payload of the corresponding interactive terminals in the two groups of interactive terminal groups respectively;

[0047] Compare the difference in the total transmission bytes, the difference in the average transmission frequency, and the difference in the average data payload with the preset difference in the total transmission bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload respectively to obtain abnormal transmission characteristics;

[0048] Send corresponding single - machine abnormal warning information according to the abnormal transmission characteristics;

[0049] The preset difference in the total transmission bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload are positively correlated with the time of data packet transmission.

[0050] Compared with the prior art, the beneficial effects of the present invention are as follows. The present invention extracts features by capturing data packets corresponding to industrial control protocols of each interaction terminal group, and extracts time features related to industrial control protocols, such as the sending time interval and response time of data packets, which helps to deeply understand the execution rhythm of each link in the production process. Integrating and analyzing the extracted features can realize real-time perception of the industrial network security situation. Extracting time features related to industrial control protocols, such as the sending time interval and response time of data packets, helps to deeply understand the execution rhythm of each link in the production process. According to features such as the data packet size and data volume, the resource occupancy of each interaction terminal group during industrial production can be accurately evaluated. By long-term extracting and analyzing data packet features, a feature baseline when the device is running normally is established. Once the device fails or its performance degrades, some features of the data packet, such as the frequency of error check codes and abnormal responses to specific instructions, will change. Based on these feature changes, device failures can be predicted in advance, maintenance measures can be taken in a timely manner, and production interruptions can be prevented. Industrial control protocols usually have corresponding standards and specifications. Extracting features such as protocol versions and instruction formats in data packets can be used to verify whether the communication of the interaction terminal group complies with relevant standards, effectively ensuring that the communication of the industrial system meets industry requirements and improving the accuracy of abnormal detection of industrial control protocol content based on artificial intelligence.

[0051] Furthermore, in the present invention, by simulating the tampering of the transmission characteristics to determine the sensitivity values of the corresponding different-dimensional transmission characteristics of the interactive terminal group, simulating the tampering of the transmission characteristics and observing the reactions of different interactive terminal groups, the impact degree of the change of the transmission characteristics of each dimension on the system security can be accurately evaluated. By simulating the tampering of the instruction field (data payload dimension) in the industrial control protocol data packet, if the system immediately shows abnormal operations, it indicates that the interactive terminal group has a high sensitivity to the data payload dimension, which means that once an attacker tampers with the characteristics of this dimension, the system faces great risks. This helps security personnel focus on the dimensions with high sensitivity. After determining the sensitivity values of the transmission characteristics of each dimension, more targeted security policies can be formulated according to the characteristics of different interactive terminal groups. For the interactive terminal group sensitive to the transmission frequency dimension, a strict frequency threshold monitoring mechanism can be set. Once an abnormal frequency change is detected, an alarm is immediately triggered and blocking measures are taken, thus effectively preventing attacks based on frequency changes. Determining the sensitivity values of the transmission characteristics helps to understand the adaptability of each interactive terminal group to different-dimensional changes during the production process. The sensitivity differences of different interactive terminal groups to the transmission characteristic dimensions provide an important basis for resource allocation. For the interactive terminal group with high sensitivity to the data volume dimension, priority should be given to ensuring network bandwidth allocation to ensure the efficiency of its data transmission and avoid data volume transmission limitations due to insufficient bandwidth, which affects production efficiency. By simulating tampering and analyzing the sensitivity values, a sensitivity model is established. Based on this model, the change trend of the transmission characteristics can be monitored in real time, and abnormal situations that may occur during the production process can be predicted. When a system failure occurs, the sensitivity values can help quickly locate the possible causes of the failure. When the industrial system is upgraded or new equipment is introduced, by simulating the tampering of the transmission characteristics to determine the sensitivity values of the new interactive terminal group and comparing and analyzing them with the existing system, the compatibility of the new equipment with the existing system can be evaluated, further improving the accuracy of the abnormal detection of the industrial control protocol content based on artificial intelligence.

[0052] Furthermore, in the present invention, packet transmission analysis is performed on each interactive terminal group based on transmission characteristics and the dimensional correlation values between each interactive terminal group. By analyzing transmission characteristics (such as data volume, transmission frequency, data payload, etc.), the transmission characteristics of each interactive terminal group itself can be understood. Combining the dimensional correlation values can further clarify the connection of packet transmission between different interactive terminal groups, and a benchmark model is established based on the transmission characteristics and dimensional correlation values under normal conditions. When the packet transmission of a certain interactive terminal group deviates from the benchmark model, such as the data volume increases abnormally but the transmission frequency does not change as expected, abnormal behavior can be quickly identified. The influence degrees of transmission characteristics in different dimensions on network security are different, and the dimensional correlation values can reflect the relationships between these influences. Through comprehensive analysis, the security risks faced by each interactive terminal group can be evaluated more accurately. Understanding the transmission characteristics and dimensional correlation values of each interactive terminal group helps to reasonably allocate network resources. When a network or system fails, the analysis of transmission characteristics and dimensional correlation values can help quickly narrow down the scope of fault troubleshooting. Long-term monitoring of the change trends of the transmission characteristics of interactive terminal groups and their dimensional correlations can predict possible device failures. Understanding the current dimensional correlations between interactive terminal groups helps to design a network architecture with good scalability. When adding new interactive terminal groups or service functions, they can be better integrated into the existing network, maintaining reasonable correlations between each dimension, avoiding network performance degradation or compatibility problems caused by system expansion, and further improving the accuracy of abnormal detection of industrial control protocol content based on artificial intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 is a flowchart of the method for abnormal detection of industrial control protocol content based on artificial intelligence according to the present invention;

[0054] Figure 2 is a flowchart of extracting packet characteristics in an embodiment of the present invention;

[0055] Figure 3 is a logic diagram for determining sensitive dimensions in an embodiment of the present invention;

[0056] Figure 4 is a logic diagram for classifying interactive terminals in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0057] In order to make the objectives and advantages of the present invention clearer, the present invention will be further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0058] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are only used to explain the technical principles of the present invention and do not limit the protection scope of the present invention.

[0059] It should be noted that in the description of the present invention, the terms indicating the direction or positional relationship such as "upper", "lower", "left", "right", "inner", "outer", etc. are based on the direction or positional relationship shown in the drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation to the present invention.

[0060] In addition, it should also be noted that in the description of the present invention, unless otherwise clearly specified and defined, the terms "installation", "connection", and "connection" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be directly connected or indirectly connected through an intermediate medium, and it can be the communication inside two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0061] Please refer to Figure 1 As shown, it is a flowchart of the method for detecting anomalies in the content of industrial control protocols based on artificial intelligence according to the present invention. An embodiment of the present invention provides a method for detecting anomalies in the content of industrial control protocols based on artificial intelligence, including:

[0062] Step S1, capturing the data packets of the industrial control protocols corresponding to each group of interactive terminals. A single group of interactive terminals includes at least two interactive terminals;

[0063] Step S2, extracting features from the data packets and analyzing the transmission features of each group of interactive terminals in different dimensions. The dimensions include the data volume, transmission frequency, and data payload;

[0064] Step S3, simulating and tampering with the transmission features, determining the sensitivity values of the corresponding transmission features of each group of interactive terminals in different dimensions, determining the corresponding sensitive dimensions, and classifying each group of interactive terminals based on the number of sensitive dimensions and the sensitivity values of the transmission features;

[0065] Step S4, calculating the correlation values of each dimension of the groups of interactive terminals of the same type;

[0066] Step S5, performing data packet transmission analysis on each group of interactive terminals based on the transmission features and the correlation values of each dimension between the groups of interactive terminals;

[0067] Step S6, sending out corresponding warning messages according to the results of the data packet transmission analysis.

[0068] Specifically, the process of capturing the data packets of the industrial control protocols corresponding to each group of interactive terminals includes:

[0069] Determine the specific type of the industrial control protocol and determine the network connection method, and perform packet capture operations on the data packets;

[0070] Parse and store the captured data packets according to the specific type of the industrial control protocol.

[0071] It can be understood that determining the specific type of the industrial control protocol requires clearly defining the group of interactive terminals for which data packets need to be captured and their corresponding industrial control protocols. For example, it is determined that it is for the group of interactive terminals that execute equipment control in the workshop, and the protocols it may use are Modbus, PROFIBUS, etc.; or for the group of interactive terminals at the management and monitoring level, which may involve protocols such as OPCUA. Clearly defining the target helps to select targeted capture tools and set filtering conditions in the follow-up.

[0072] It can be understood that determining the network connection method requires a detailed understanding of the topology of the industrial network, including information such as network levels, device connection relationships, and network segmentation. For example, knowing whether the industrial network is a star, bus, or ring topology; which devices are in the same subnet and which devices communicate across subnets through gateways. This is crucial for determining the best location for packet capture. For example, capturing packets at the gateway can obtain data packets for cross-subnet interactions, while capturing at the switch port within a specific subnet can focus on internal subnet communications.

[0073] It can be understood that in the process of packet capture, deploying the capture tool first and then configuring the capture parameters, and parsing and storing the data after packet capture are prior arts for those skilled in the art and will not be elaborated here.

[0074] Please refer to Figure 2 as shown, which is the flowchart for extracting the characteristics of the data packets in the embodiment of the present invention. In step S2, the process of extracting the characteristics of the data packets includes:

[0075] Step S21, extract the port numbers of the data packets;

[0076] Step S22, use a feature selection algorithm to select a feature subset relevant to the target task;

[0077] Step S23, analyze the lengths of the link layer, network layer, transport layer, and data layer in the feature subset;

[0078] Step S24, extract the duration of the feature subset and set a timestamp, and record the time interval between adjacent feature subsets;

[0079] Step S25, count the number of transmitted bytes in the feature subset.

[0080] It is understandable that when extracting the port numbers of data packets, the source port and the destination port are used to determine the application layer protocol or service used for communication. Different application layer protocols usually use fixed port numbers. For example, HTTP uses port 80 (HTTPS uses port 443), and SMTP uses port 25.

[0081] It is understandable that when using a feature selection algorithm to select a feature subset relevant to the target task, feature selection algorithms such as the filter method (selecting features based on statistical metrics such as information gain, chi-square test, etc.), the wrapper method (iteratively selecting a feature subset with the performance of a machine learning model as the metric), or the embedding method (automatically performing feature selection during model training, such as Lasso regression) are used to pick out the feature subset that has the most influence on the target task (such as traffic classification, anomaly detection, etc.).

[0082] It is understandable that the number of bytes of the entire data packet includes the lengths of the link layer, network layer, transport layer, and data part.

[0083] It is understandable that an accurate timestamp for each data packet arriving at the collection point is recorded, which can be obtained through a collection tool or a parsing library. For example, in the dpkt library, ts is the timestamp of the data packet. The arrival time is used to analyze the change of network traffic over time and the traffic characteristics in different time periods.

[0084] Specifically, the present invention extracts features by capturing data packets corresponding to industrial control protocols of each interactive terminal group, extracts time features related to industrial control protocols, such as the sending time interval and response time of data packets, which helps to deeply understand the execution rhythm of each link in the production process. Integrating and analyzing the extracted features can realize the real-time perception of the industrial network security situation. Extracting time features related to industrial control protocols, such as the sending time interval and response time of data packets, helps to deeply understand the execution rhythm of each link in the production process. According to features such as the data packet size and data volume, the resource occupancy of each interactive terminal group in the industrial production process can be accurately evaluated. By long-term extracting and analyzing data packet features, a feature baseline for normal operation of the device is established. Once the device fails or its performance degrades, some features of the data packet, such as the frequency of error check codes and abnormal responses of specific instructions, will change. Based on these feature changes, device failures can be predicted in advance, and maintenance measures can be taken in time to prevent production interruptions. Industrial control protocols usually have corresponding standards and specifications. Extracting features such as the protocol version and instruction format in the data packet can be used to verify whether the communication of the interactive terminal group complies with relevant standards, effectively ensuring that the communication of the industrial system meets industry requirements and improving the accuracy of anomaly detection of industrial control protocol content based on artificial intelligence.

[0085] Specifically, the process of analyzing the transmission characteristics of each interaction terminal group in different dimensions includes:

[0086] Unify the units of each feature subset in each data packet into the same format;

[0087] Calculate the total number of bytes transmitted for each data packet;

[0088] Calculate the average transmission frequency of each data packet;

[0089] Calculate the average value of the data payload of each data packet;

[0090] Among them, the transmission characteristics include the total number of bytes transmitted, the average transmission frequency, and the average value of the data payload.

[0091] Specifically, the process of determining the sensitivity value of the interaction terminal group corresponding to the transmission characteristics in different dimensions includes:

[0092] Perform simulated tampering on each transmission characteristic of the data packet;

[0093] Transmit the experimental data packet after completing the simulated tampering in the corresponding interaction terminal group to obtain the experimental transmission characteristics;

[0094] Calculate the sensitivity value of each transmission characteristic by calculating the experimental transmission characteristics and the corresponding transmission characteristics.

[0095] In implementation, the experimental transmission characteristics include the experimental total number of bytes transmitted, the experimental average transmission frequency, and the experimental average value of the data payload. Subtract the experimental total number of bytes transmitted from the total number of bytes transmitted, take the absolute value of the difference, and then divide by the total number of bytes transmitted to obtain the sensitivity value A of the total number of bytes transmitted. Subtract the experimental average transmission frequency from the average transmission frequency, take the absolute value of the difference, and then divide by the average transmission frequency to obtain the sensitivity value B of the average transmission frequency. Subtract the experimental average value of the data payload from the average value of the data payload, take the absolute value of the difference, and then divide by the average value of the data payload to obtain the sensitivity value C of the average value of the data payload;

[0096] Please refer to Figure 3 As shown, it is the logic diagram for determining the sensitive dimension in the embodiment of the present invention. According to the sensitivity value of the interaction terminal group corresponding to the transmission characteristics in different dimensions, the process of determining the corresponding sensitive dimension includes:

[0097] If the sensitivity value of the transmission characteristic is greater than the corresponding first preset sensitivity value, it is determined that the dimension corresponding to the sensitivity value of the transmission characteristic is the sensitive dimension, where

[0098] If the sensitivity value of the total number of bytes transmitted is greater than the preset sensitivity value of the total number of bytes transmitted, it is determined that the dimension corresponding to the total number of bytes transmitted is the sensitive dimension;

[0099] If the average transmission frequency sensitivity value is greater than the first average transmission frequency preset sensitivity value, it is determined that the dimension corresponding to the average transmission frequency is a sensitive dimension;

[0100] If the data payload average sensitivity value is greater than the first data payload average preset sensitivity value, it is determined that the dimension corresponding to the data payload average is a sensitive dimension;

[0101] In implementation, the preset sensitivity value of the total number of transmitted bytes is 0.05, the preset sensitivity value of the average transmission frequency is 0.03, and the preset sensitivity value of the data payload average is 0.1. If the sensitivity value of the total number of transmitted bytes is 0.08, which is greater than the first preset sensitivity value of the total number of transmitted bytes, it is determined that the dimension corresponding to the total number of transmitted bytes is a sensitive dimension;

[0102] If the average transmission frequency sensitivity value is 0.06, which is greater than the first average transmission frequency preset sensitivity value, it is determined that the dimension corresponding to the average transmission frequency is a sensitive dimension;

[0103] If the data payload average sensitivity value is 1.2, which is greater than the first data payload average preset sensitivity value, it is determined that the dimension corresponding to the data payload average is a sensitive dimension;

[0104] The first preset sensitivity value includes the first preset sensitivity value of the total number of transmitted bytes, the first preset sensitivity value of the average transmission frequency, and the first preset sensitivity value of the data payload average. Each first preset sensitivity value is positively correlated with the time of data packet transmission.

[0105] It can be understood that the longer the time of data packet transmission, the larger the total number of transmitted bytes, the greater the probability of fluctuation of the average transmission frequency, and the greater the probability of fluctuation of the data payload average. Therefore, the preset sensitivity value of the total number of transmitted bytes, the preset sensitivity value of the average transmission frequency, and the preset sensitivity value of the data payload average are positively correlated with the time of data packet transmission.

[0106] Specifically, in the present invention, by simulating and tampering with transmission characteristics to determine the sensitivity values of the interactive terminal group corresponding to different-dimensional transmission characteristics, simulating and tampering with the transmission characteristics, and observing the reactions of different interactive terminal groups, the impact degree of the change in the transmission characteristics of each dimension on the system security can be accurately evaluated. By simulating and tampering with the instruction field (data payload dimension) in the industrial control protocol data packet, if the system immediately exhibits abnormal operations, it indicates that the interactive terminal group has a high sensitivity to the data payload dimension, meaning that once an attacker tampers with the characteristics of this dimension, the system faces great risks. This helps security personnel focus on the dimensions with high sensitivity. After determining the sensitivity values of the transmission characteristics of each dimension, more targeted security policies can be formulated according to the characteristics of different interactive terminal groups. For the interactive terminal group that is sensitive to the transmission frequency dimension, a strict frequency threshold monitoring mechanism can be set. Once an abnormal frequency change is detected, an alarm is immediately triggered and blocking measures are taken, thus effectively preventing attacks based on frequency changes. Determining the sensitivity values of the transmission characteristics helps to understand the adaptability of each interactive terminal group to different-dimensional changes during the production process. The sensitivity differences of different interactive terminal groups to the transmission characteristic dimensions provide an important basis for resource allocation. For the interactive terminal group with high sensitivity to the data volume dimension, priority should be given to ensuring network bandwidth allocation to ensure the efficiency of its data transmission and avoid data volume transmission limitations caused by insufficient bandwidth, which affects production efficiency. By simulating and tampering with and analyzing the sensitivity values, a sensitivity model is established. Based on this model, the change trend of the transmission characteristics can be monitored in real time, and possible abnormal situations during the production process can be predicted. When a system failure occurs, the sensitivity values can help quickly locate the possible causes of the failure. When the industrial system is upgraded or new equipment is introduced, the sensitivity values of the new interactive terminal group are determined by simulating and tampering with the transmission characteristics and compared and analyzed with the existing system to evaluate the compatibility of the new equipment with the existing system, further improving the accuracy of anomaly detection of the industrial control protocol content based on artificial intelligence.

[0107] Please refer to Figure 4 As shown, it is the logic diagram of the classification of interactive terminals in the embodiment of the present invention. The process of classifying each interactive terminal based on the number of sensitive dimensions and the numerical values of the sensitivity values of the transmission characteristics includes:

[0108] If the number of sensitive dimensions is greater than the preset number of sensitive dimensions and there is a sensitivity value of the transmission characteristic greater than the corresponding second preset sensitivity value, it is determined that the interactive terminal group is a sensitive interactive terminal group;

[0109] If the number of sensitive dimensions is greater than the preset number of sensitive dimensions and there is no sensitivity value of the transmission characteristic greater than the corresponding second preset sensitivity value, it is determined that the interactive terminal group is an intermediate interactive terminal group;

[0110] If the number of sensitive dimensions is less than or equal to the preset number of sensitive dimensions and there exists a sensitivity value of a transmission feature greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be an intermediate interaction terminal group;

[0111] If the number of sensitive dimensions is less than or equal to the preset number of sensitive dimensions and there does not exist a sensitivity value of a transmission feature greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be a normal interaction terminal group;

[0112] In implementation, the preset number of sensitive dimensions is 1, the preset sensitivity value of the second total transmission byte count is 0.08, the preset sensitivity value of the second average transmission frequency is 0.07, the preset sensitivity value of the second average data payload is 1.2. If the number of sensitive dimensions is 2 which is greater than the preset number of sensitive dimensions and the sensitivity value of the total transmission byte count is 0.12 which is greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be a sensitive interaction terminal group;

[0113] If the number of sensitive dimensions is 2 which is greater than the preset number of sensitive dimensions and there does not exist a sensitivity value of a transmission feature greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be an intermediate interaction terminal group;

[0114] If the number of sensitive dimensions is 0 which is less than the preset number of sensitive dimensions and the sensitivity value of the second average data payload is 1.5 which is greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be an intermediate interaction terminal group;

[0115] If the number of sensitive dimensions is 0 which is less than the preset number of sensitive dimensions and there does not exist a sensitivity value of a transmission feature greater than the corresponding second preset sensitivity value, then the interaction terminal group is determined to be a normal interaction terminal group;

[0116] Among them, the preset number of sensitive dimensions is positively correlated with the time of data packet transmission; each second preset sensitivity value is positively correlated with the time of data packet transmission; the second preset sensitivity value includes the preset sensitivity value of the second total transmission byte count, the preset sensitivity value of the second average transmission frequency, and the preset sensitivity value of the second average data payload, and the first preset sensitivity value is less than the corresponding second preset sensitivity value.

[0117] It can be understood that the longer the data packet transmission time, the greater the total transmission byte count, the greater the probability of fluctuations in the average transmission frequency, the greater the probability of changes in the average data payload, and the greater the probability of becoming a sensitive dimension. Therefore, the preset sensitivity value of the second total transmission byte count, the preset sensitivity value of the second average transmission frequency, the preset sensitivity value of the second average data payload, and the preset number of sensitive dimensions are positively correlated with the time of data packet transmission.

[0118] Specifically, the process of comparing the sensitive dimensions and the sensitivity values of the transmission features of the interaction terminal groups of the same type to obtain the dimension correlation value includes:

[0119] Compare the sensitive dimensions of the same type of interactive terminal group with the sensitivity values corresponding to the sensitive dimensions, and calculate to obtain the correlation value of each dimension;

[0120] The same type of interactive terminal group is an interactive terminal group that contains the same type and number of interactive terminals.

[0121] It can be understood that the dimension correlation value = (a * total number of sensitive dimensions of the dimension + ∑b * sensitivity value), where a and b are parameters, a generally takes 0.8, and b generally takes 0.2;

[0122] There are 2 groups in the same type of interactive terminal group. The total number of sensitive dimensions of the transmission total byte number dimension is 1, and the sensitivity value corresponding to the sensitive dimension is 1.5. Therefore, the dimension correlation value = 0.8 * 1 + 1.5 * 0.2 = 1.1.

[0123] Specifically, the process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension correlation values between the interactive terminal groups includes:

[0124] Select the largest dimension correlation value in the same type of interactive terminal group;

[0125] If the largest dimension correlation value is less than the preset correlation degree value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have similar anomalies in data transmission and a similar anomaly warning message is issued;

[0126] If the largest dimension correlation value is greater than or equal to the preset correlation degree value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have different anomalies in data transmission;

[0127] In implementation, the preset correlation degree value is 0.8. If the largest dimension correlation value is 0.4 and less than the preset correlation degree value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have similar anomalies in data transmission and a similar anomaly warning message is issued;

[0128] If the largest dimension correlation value is 1.1 and greater than the preset correlation degree value, it is determined that the corresponding interactive terminals in the same type of interactive terminal group have different anomalies in data transmission;

[0129] Among them, the preset correlation degree value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

[0130] It can be understood that the larger the number of corresponding interactive terminals in a single interactive terminal group, the greater the probability of the occurrence of sensitive dimensions. Therefore, the preset correlation degree value is larger.

[0131] Specifically, the process of performing data packet transmission analysis on the intermediate interaction terminal group or the sensitive interaction terminal group based on the transmission characteristics and the dimensional correlation values between each interaction terminal group includes:

[0132] In the case where different abnormal states occur in the data transmission of the corresponding interaction terminals in the interaction terminal groups of the same type, select the two groups of interaction terminal groups corresponding to the largest difference in dimensional correlation values, and calculate the difference in the total number of transmitted bytes, the difference in the average transmission frequency, and the difference in the average data payload of the corresponding interaction terminals in the two groups of interaction terminal groups respectively;

[0133] Compare the difference in the total number of transmitted bytes, the difference in the average transmission frequency, and the difference in the average data payload with the preset difference in the total number of transmitted bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload respectively to obtain the abnormal transmission characteristics;

[0134] Send the corresponding single - machine abnormal warning information according to the abnormal transmission characteristics;

[0135] In implementation, the preset difference in the total number of transmitted bytes is 2000 bytes, the preset difference in the average transmission frequency is 80 Hz, and the preset difference in the average data payload is 200 KB. In the case where different abnormal states occur in the data transmission of the corresponding interaction terminals in the interaction terminal groups of the same type, select the two groups of interaction terminal groups corresponding to the largest difference in dimensional correlation values, and calculate that the difference in the total number of transmitted bytes of the corresponding interaction terminals in the two groups of interaction terminal groups is 2560 bytes, which is greater than the preset difference in the total number of transmitted bytes, the difference in the average transmission frequency is 76 Hz, which is less than the preset difference in the average transmission frequency, and the difference in the average data payload is 254 KB, which is greater than the preset difference in the average data payload; then the total number of transmitted bytes and the average data payload belong to the abnormal transmission characteristics, and a single - machine total number of transmitted bytes abnormal warning information and a single - machine average data payload abnormal warning information are sent.

[0136] The preset difference in the total number of transmitted bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload are positively correlated with the time of data packet transmission.

[0137] It can be understood that the longer the data packet transmission time, the larger the total number of transmitted bytes, the greater the probability of fluctuations in the average transmission frequency, and the greater the probability of changes in the average data payload. Therefore, the preset difference in the total number of transmitted bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload are positively correlated with the time of data packet transmission.

[0138] Specifically, in the present invention, packet transmission analysis is performed on each interactive terminal group based on transmission characteristics and the dimensional correlation value between each interactive terminal group. By analyzing the transmission characteristics (such as data volume, transmission frequency, data payload, etc.), the transmission characteristics of each interactive terminal group itself can be understood. Combining with the dimensional correlation value, the connection of packet transmission between different interactive terminal groups can be further clarified, and a benchmark model is established based on the transmission characteristics and dimensional correlation value under normal conditions. When the packet transmission of a certain interactive terminal group deviates from the benchmark model, such as the data volume increases abnormally but the transmission frequency does not change as expected, the abnormal behavior can be quickly identified. The influence degrees of transmission characteristics in different dimensions on network security are different, and the dimensional correlation value can reflect the relationship between these influences. Through comprehensive analysis, the security risks faced by each interactive terminal group can be evaluated more accurately. Understanding the transmission characteristics and dimensional correlation value of each interactive terminal group helps to reasonably allocate network resources. When a network or system fails, the analysis of transmission characteristics and dimensional correlation value can help quickly narrow down the scope of fault troubleshooting. Long-term monitoring of the change trend of the transmission characteristics of the interactive terminal group and its dimensional correlation can predict possible failures of the device. Understanding the current dimensional correlation between interactive terminal groups helps to design a network architecture with good scalability. When adding a new interactive terminal group or service function, it can be better integrated into the existing network, maintain a reasonable correlation between each dimension, avoid a decline in network performance or compatibility problems caused by system expansion, and further improve the accuracy of abnormal detection of industrial control protocol content based on artificial intelligence.

[0139] So far, the technical solution of the present invention has been described in combination with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. An abnormal detection method for industrial control protocol content based on artificial intelligence, characterized in that Including: Capturing data packets corresponding to the industrial control protocol of each interaction terminal group, where a single said interaction terminal group includes at least two interaction terminals; Performing feature extraction on the data packets to analyze the transmission characteristics of each said interaction terminal group in different dimensions, where the dimensions include data volume, transmission frequency, and data payload; Simulating tampering with the transmission characteristics, determining the sensitivity values of the interaction terminal group corresponding to different-dimensional transmission characteristics, determining the corresponding sensitive dimensions, and classifying each said interaction terminal group based on the number of sensitive dimensions and the sensitivity values of the transmission characteristics; Calculating the correlation values of each dimension of the interaction terminal groups of the same type; Performing data packet transmission analysis on each said interaction terminal group based on the transmission characteristics and the dimension correlation values between each said interaction terminal group; Sending corresponding warning information according to the results of the data packet transmission analysis; The process of determining the sensitivity values of the interaction terminal group corresponding to different-dimensional transmission characteristics includes: Simulating tampering with each said transmission characteristic of the data packet; Transmitting the experimental data packets after completing the simulation tampering in the corresponding said interaction terminal group to obtain experimental transmission characteristics; Calculating the sensitivity values of each said transmission characteristic by calculating each said experimental transmission characteristic and the corresponding said transmission characteristic.

2. The method for detecting abnormal content of industrial control protocol based on artificial intelligence according to claim 1, wherein The process of capturing the data packets corresponding to the industrial control protocol of each said interaction terminal group includes: Determining the specific type of the industrial control protocol and determining the network connection method to perform a packet capture operation on the data packet; Parsing and storing the captured data packets according to the specific type of the industrial control protocol.

3. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 2, wherein The process of performing feature extraction on the data packet includes: Extracting the port number of the data packet; Using a feature selection algorithm to select a feature subset related to the target task; Analyzing the lengths of the link layer, network layer, transport layer, and data layer in the feature subset; Extracting the duration of the feature subset and setting a timestamp, and recording the time interval between adjacent said feature subsets; Counting the number of transmitted bytes in the feature subset.

4. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 3, characterized in that, The process of analyzing the transmission characteristics of each said interaction terminal group in different said dimensions includes: Unifying the units of each said feature subset in each said data packet into the same format; Calculating the total number of transmitted bytes of each said data packet; Calculating the average transmission frequency of each said data packet; Calculating the average value of the data payload of each said data packet; Wherein, the transmission characteristics include the total number of transmitted bytes, the average transmission frequency, and the average value of the data payload.

5. The method for detecting abnormal content of industrial control protocol based on artificial intelligence according to claim 4, characterized in that, The process of determining the corresponding sensitive dimension according to the sensitivity values of the interaction terminal group corresponding to different-dimensional transmission characteristics includes: If the sensitivity value of the transmission characteristic is greater than the corresponding first preset sensitivity value, then it is determined that the dimension corresponding to the sensitivity value of the transmission characteristic is the sensitive dimension, where Each said first preset sensitivity value is positively correlated with the time of data packet transmission.

6. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 5, wherein Classifying each said interaction terminal into a sensitive interaction terminal group, an intermediate interaction terminal group, or a normal interaction terminal group based on the number of sensitive dimensions and the numerical values of the sensitivity values of the transmission characteristics.

7. The method for abnormal detection of industrial control protocol content based on artificial intelligence according to claim 6, wherein The process of calculating the dimension correlation values of each of the interactive terminal groups of the same type includes: Calculating the sensitivity values of the sensitive dimension and the transmission characteristics of the interactive terminal group of the same type to obtain each dimension correlation value; The interactive terminal group of the same type is an interactive terminal group containing interactive terminals of the same type and quantity.

8. The method for detecting abnormal content of industrial control protocols based on artificial intelligence according to claim 7, wherein, The process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the dimension correlation values between the interactive terminal groups includes: Selecting the largest dimension correlation value in the interactive terminal group of the same type; If the largest dimension correlation value is less than the preset correlation degree value, it is determined that the corresponding interactive terminals in the interactive terminal group of the same type have similar anomalies during data transmission and a similar anomaly warning message is issued; If the largest dimension correlation value is greater than or equal to the preset correlation degree value, it is determined that the corresponding interactive terminals in the interactive terminal group of the same type have different anomalies during data transmission; Wherein, the preset correlation degree value is positively correlated with the number of corresponding interactive terminals in a single interactive terminal group.

9. The method for detecting abnormal content of an industrial control protocol based on artificial intelligence according to claim 8, wherein The process of performing data packet transmission analysis on the intermediate interactive terminal group or the sensitive interactive terminal group based on the transmission characteristics and the dimension correlation values between the interactive terminal groups includes: In the state where it is determined that the corresponding interactive terminals in the interactive terminal group of the same type have different anomalies during data transmission, select the two groups of interactive terminal groups corresponding to the largest difference in dimension correlation values, and calculate the difference in the total transmission bytes, the difference in the average transmission frequency, and the difference in the average data payload of the corresponding interactive terminals in the two groups of interactive terminal groups respectively; Respectively compare the difference in the total transmission bytes, the difference in the average transmission frequency, and the difference in the average data payload with the preset difference in the total transmission bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload to obtain abnormal transmission characteristics; Send a corresponding single-machine anomaly warning message according to the abnormal transmission characteristics; The preset difference in the total transmission bytes, the preset difference in the average transmission frequency, and the preset difference in the average data payload are positively correlated with the time of data packet transmission.

Images