Heterogeneous industrial control network intelligent protection method and system based on large model

Abstract

The invention provides a heterogeneous industrial control network intelligent protection method and system based on a large model, electronic equipment and a readable storage medium. The method comprises the following steps: constructing a security threat multi-dimensional knowledge base by adopting a first large model introduced with a gating mechanism; training based on the security threat multi-dimensional knowledge base to obtain a second large model, and performing security vulnerability mining on the target heterogeneous industrial control terminal system by adopting a preset security vulnerability mining strategy based on the second large model; performing intrusion detection on the target heterogeneous industrial control network by adopting a preset intrusion detection strategy based on the security threat multi-dimensional knowledge base; and taking corresponding protection measures according to a security vulnerability mining result and an attack behavior detection result. According to the method, the availability of security vulnerabilities can be automatically verified, the risk of attack behaviors can be evaluated, and corresponding processing of the vulnerabilities and the attack behaviors can be carried out, so that intelligent collaborative protection of a heterogeneous industrial control network environment can be realized.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to a large model-based heterogeneous industrial control network intelligent protection method, system, electronic device and readable storage medium. Background Art

[0002] With the popularization and development of global logistics digitalization, more and more industrial control Internet of Things scenarios have applied deeply coupled heterogeneous industrial control networks (IT networks and OT networks) to support networking and intelligent applications in various scenarios. However, heterogeneous industrial control networks have brought about a fragile software supply chain, and the interconnected networking requirements have brought about a variety of potential attack paths, making it difficult for existing general vulnerability detection and intrusion protection to be directly applied to such heterogeneous industrial control network environments. There are a large number of undisclosed vulnerabilities and potential attack behaviors that have not been discovered and blocked in a timely manner, resulting in frequent security incidents such as equipment operation interruption, data theft, and ransomware, which seriously endangers the network security of infrastructure.

[0003] Although existing technologies can perform vulnerability mining and intrusion detection on industrial control IoT devices, due to the wide range of security threats in heterogeneous industrial control network environments and their various forms, existing security protection methods have limitations in dealing with complex threats. There is a lack of effective mechanisms to integrate security vulnerability mining results, intrusion detection information, and multi-source security threat data in heterogeneous industrial control network environments, making it impossible to achieve intelligent collaborative protection.

[0004] It should be noted that the information disclosed in the background technology section of the invention is only intended to deepen the understanding of the general background technology of the invention, and should not be regarded as an admission or suggestion in any form that the information constitutes prior art already known to those skilled in the art. Summary of the invention

[0005] The purpose of the present invention is to provide a large-model-based intelligent protection method, system, electronic device and readable storage medium for heterogeneous industrial control networks, which can automatically verify the exploitability of security vulnerabilities, evaluate the risk of attack behaviors, and perform corresponding processing of vulnerabilities and attack behaviors, thereby realizing intelligent collaborative protection of heterogeneous industrial control network environments.

[0006] To achieve the above-mentioned purpose, the present invention provides a large-model-based intelligent protection method for heterogeneous industrial control networks, comprising: using a first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in a heterogeneous industrial control network environment to build a multi-dimensional knowledge base of security threats; training a second large model based on the multi-dimensional knowledge base of security threats, and based on the second large model, using a preset security vulnerability mining strategy to perform security vulnerability mining on a target heterogeneous industrial control terminal system to obtain security vulnerability mining results of the target heterogeneous industrial control terminal system; using a preset intrusion detection strategy to perform intrusion detection on a target heterogeneous industrial control network based on the multi-dimensional knowledge base of security threats to obtain attack behavior detection results of the target heterogeneous industrial control network; and taking corresponding protection measures according to the security vulnerability mining results and the attack behavior detection results.

[0007] Optionally, the first large model that introduces a gating mechanism is used to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in a heterogeneous industrial control network environment to construct a multi-dimensional knowledge base of security threats, including: integrating and normalizing the non-standardized multi-source data using the first large model that introduces a gating mechanism to obtain security threat information; converting the security threat information into nodes and edges in a knowledge graph, and using a graph database to store the knowledge graph, thereby constructing a multi-dimensional knowledge base of security threats.

[0008] Optionally, the method uses a preset security vulnerability mining strategy based on the second large model to perform security vulnerability mining on the target heterogeneous industrial control terminal system to obtain security vulnerability mining results of the target heterogeneous industrial control terminal system, including: based on a static taint analysis method with shared keywords, performing static taint analysis on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result; based on a dynamic fuzzy testing method assisted by binary slicing, performing a hybrid dynamic test on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result; based on the thinking chain technology and prompt word engineering, using the second large model to analyze the first vulnerability mining result and the second vulnerability mining result to obtain the security vulnerability mining result of the target heterogeneous industrial control terminal system.

[0009] Optionally, the static taint analysis method based on shared keywords performs static taint analysis on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result, including: analyzing sensitive data or key operations existing in the target heterogeneous industrial control terminal system to determine keywords related to the sensitive data or the key operations; scanning the source code of the target heterogeneous industrial control terminal system to find code segments containing the keywords; analyzing the context of the found code segments, and checking vulnerability points based on the analysis results of the context of the code segments to obtain a first vulnerability mining result.

[0010] Optionally, the dynamic fuzz testing method assisted by binary slicing performs hybrid dynamic testing on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result, including: using a binary slicing tool to analyze the target program of the target heterogeneous industrial control terminal system to determine the code path related to the test target of the target heterogeneous industrial control terminal system; analyzing the logical structure and input-output relationship of the sliced ​​code according to the code path; generating random input data based on the analysis results of the logical structure and input-output relationship of the sliced ​​code; inputting the input data into the target program to perform dynamic fuzz testing on the target program; and searching for vulnerabilities based on the dynamic fuzz testing results of the target program to obtain a second vulnerability mining result.

[0011] Optionally, the intrusion detection of the target heterogeneous industrial control network is performed using a preset intrusion detection strategy based on the multi-dimensional knowledge base of security threats to obtain the attack behavior detection results of the target heterogeneous industrial control network, including: based on a multi-dimensional traffic characterization algorithm for lightweight feature extraction, feature extraction of the traffic of the target heterogeneous industrial control network from the time dimension, space dimension and content dimension, and based on the extracted time dimension features, space dimension features and content dimension features, feature association is performed on different stages of cross-domain multi-hop attack behavior to obtain feature association results; based on the multi-dimensional knowledge base of security threats, a dynamically updated information technology network detection rule set and an operation technology network detection rule set are respectively constructed, and in combination with the feature association results, real-time alarms of traditional attack types and unknown threats are preliminarily screened to obtain preliminary screening results; based on the multi-dimensional knowledge base of security threats and the preliminary screening results, an attack sample is constructed; the attack sample is input into a meta-learning small model and at least one intrusion detection model to perform multi-model collaborative real-time intrusion detection to obtain the attack behavior detection results of the target heterogeneous industrial control network.

[0012] Optionally, constructing attack samples based on the security threat multidimensional knowledge base and the preliminary screening results includes: obtaining vulnerability information based on the security threat multidimensional knowledge base, the vulnerability information including vulnerability type, impact scope and triggering conditions; combining the vulnerability information with the preliminary screening results to determine potential attack scenarios and potential attack paths; and constructing attack samples based on the potential attack scenarios and the potential attack paths.

[0013] To achieve the above-mentioned purpose, the present invention also provides a large-model-based intelligent protection system for heterogeneous industrial control networks, comprising: a knowledge base construction module, configured to use a first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in a heterogeneous industrial control network environment to construct a multi-dimensional knowledge base of security threats; a security vulnerability mining module, configured to obtain a second large model based on training of the multi-dimensional knowledge base of security threats, and to perform security vulnerability mining on a target heterogeneous industrial control terminal system based on the second large model using a preset security vulnerability mining strategy to obtain security vulnerability mining results of the target heterogeneous industrial control terminal system; an intrusion detection module, configured to perform intrusion detection on a target heterogeneous industrial control network based on the multi-dimensional knowledge base of security threats using a preset intrusion detection strategy to obtain attack behavior detection results of the target heterogeneous industrial control network; and an intelligent collaborative protection module, configured to take corresponding protection measures based on the security vulnerability mining results and the attack behavior detection results.

[0014] To achieve the above-mentioned purpose, the present invention also provides an electronic device, including a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the above-mentioned large model-based heterogeneous industrial control network intelligent protection method is implemented.

[0015] To achieve the above-mentioned purpose, the present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned large model-based heterogeneous industrial control network intelligent protection method is implemented.

[0016] Compared with the prior art, the large-model-based intelligent protection method, system, electronic device and readable storage medium for heterogeneous industrial control networks provided by the present invention have the following beneficial effects: the present invention uses the first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to construct a security threat multidimensional knowledge base, which can improve the performance and accuracy of the large model in processing complex language structures, thereby effectively ensuring the accuracy of the constructed security threat multidimensional knowledge base; by training the second large model based on the security threat multidimensional knowledge base, and using the preset security vulnerability mining strategy to mine security vulnerabilities for the target heterogeneous industrial control terminal system based on the second large model, the accuracy of the obtained security vulnerability mining results can be effectively guaranteed; by using the preset intrusion detection strategy to perform intrusion detection on the target heterogeneous industrial control network based on the security threat multidimensional knowledge base, the accuracy of the obtained attack behavior detection results can be effectively guaranteed. In summary, the present invention can automatically verify the exploitability of security vulnerabilities, evaluate the risk of attack behaviors, and perform corresponding processing of vulnerabilities and attack behaviors, thereby realizing intelligent collaborative protection of heterogeneous industrial control network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a large model-based intelligent protection method for heterogeneous industrial control networks provided in one embodiment of the present invention.

[0018] Figure 2 A flowchart of building a multi-dimensional knowledge base of security threats provided by one embodiment of the present invention.

[0019] Figure 3 A flowchart of obtaining security vulnerability mining results provided by one embodiment of the present invention.

[0020] Figure 4 A flowchart of obtaining attack behavior detection results provided by one embodiment of the present invention.

[0021] Figure 5 A structural block diagram of a large model-based heterogeneous industrial control network intelligent protection system provided in one embodiment of the present invention.

[0022] Figure 6 A schematic diagram of a large-model-based heterogeneous industrial control network intelligent protection system provided in accordance with one embodiment of the present invention.

[0023] Figure 7 A structural block diagram of an electronic device provided in one embodiment of the present invention.

[0024] Among them, the description of the accompanying drawings is as follows: knowledge base construction module-110; security vulnerability mining module-120; intrusion detection module-130; intelligent collaborative protection module-140; processor-210; communication interface-220; memory-230; communication bus-240. DETAILED DESCRIPTION

[0025] The following is a further detailed description of the heterogeneous industrial control network intelligent protection method, system, electronic device and readable storage medium proposed in the present invention in conjunction with the accompanying drawings and specific implementation methods. According to the following description, the advantages and features of the present invention will become clearer. It should be noted that the structure, proportion, size, etc. illustrated in the drawings attached to this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the limiting conditions for the implementation of the present invention. Any modification of the structure, change in the proportional relationship or adjustment of the size, under the condition that the effect produced by the present invention and the purpose that can be achieved are the same or similar, should still fall within the scope of the technical content disclosed by the present invention.

[0026] The core idea of ​​the present invention is to provide a large-model-based intelligent protection method, system, electronic device and readable storage medium for heterogeneous industrial control networks, which can automatically verify the exploitability of security vulnerabilities, evaluate the risk of attack behaviors, and perform corresponding processing of vulnerabilities and attack behaviors, thereby realizing intelligent collaborative protection of heterogeneous industrial control network environments.

[0027] It should be noted that the large-model-based heterogeneous industrial control network intelligent protection method provided by the present invention can be applied to the large-model-based heterogeneous industrial control network intelligent protection system provided by the present invention. The large-model-based heterogeneous industrial control network intelligent protection system can be configured on an electronic device, wherein the electronic device can be a personal computer, a mobile terminal, etc., and the mobile terminal can be a mobile phone, a tablet computer, or other hardware device with various operating systems.

[0028] It should also be noted that the "heterogeneous industrial control network" referred to in the present invention refers to a network architecture in an industrial control system that integrates an IT network connected to the Internet and an OT network connected to industrial operating equipment; the "heterogeneous industrial control terminal system" refers to an embedded operating system on an IoT terminal device; the "intrusion detection" refers to the process of systematically monitoring network or system activities to identify potential security threats; the "gating mechanism" refers to the control of information flow by introducing gating units in a neural network, thereby improving the model's ability to process complex data; the "large model" refers to a natural language processing model that is trained with a large amount of text data and has a large number of parameters and a highly complex structure.

[0029] To realize the above idea, the present invention provides a heterogeneous industrial control network intelligent protection method based on a large model, please refer to Figure 1 , which is a flow chart of a large model-based intelligent protection method for heterogeneous industrial control networks provided by an embodiment of the present invention. Figure 1 As shown, the large model-based intelligent protection method for heterogeneous industrial control networks includes the following steps: step S100, using the first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to build a multi-dimensional knowledge base of security threats; step S200, training a second large model based on the multi-dimensional knowledge base of security threats, and based on the second large model, using a preset security vulnerability mining strategy to mine security vulnerabilities for the target heterogeneous industrial control terminal system to obtain security vulnerability mining results for the target heterogeneous industrial control terminal system; step S300, using a preset intrusion detection strategy to perform intrusion detection on the target heterogeneous industrial control network based on the multi-dimensional knowledge base of security threats to obtain attack behavior detection results of the target heterogeneous industrial control network; step S400, taking corresponding protection measures according to the security vulnerability mining results and the attack behavior detection results.

[0030] The present invention processes the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment by adopting the first large model that introduces the gating mechanism to construct a security threat multidimensional knowledge base, which can improve the performance and accuracy of the large model in processing complex language structures, thereby effectively ensuring the accuracy of the constructed security threat multidimensional knowledge base; by training the second large model based on the security threat multidimensional knowledge base, and using the preset security vulnerability mining strategy to mine security vulnerabilities for the target heterogeneous industrial control terminal system based on the second large model, the accuracy of the obtained security vulnerability mining results can be effectively guaranteed; by using the preset intrusion detection strategy to perform intrusion detection on the target heterogeneous industrial control network based on the security threat multidimensional knowledge base, the accuracy of the obtained attack behavior detection results can be effectively guaranteed. In summary, the present invention can automatically verify the exploitability of security vulnerabilities, evaluate the risk of attack behaviors, and perform corresponding processing of vulnerabilities and attack behaviors, thereby realizing intelligent collaborative protection of heterogeneous industrial control network environments.

[0031] It should be noted that although Figure 1 The example of executing step S200 first and then executing step S300 is used for explanation, but as those skilled in the art can understand, this does not constitute a limitation of the present invention. In some other implementations, step S300 may be executed first and then step S200, or step S200 and step S300 may be executed in parallel.

[0032] Furthermore, the first large model with the gating mechanism introduced can be trained through the following process: first, a suitable gating unit is designed to control the flow of information in the large model. The gating unit can dynamically adjust the transmission and processing of information according to the characteristics of the input data and the task requirements. For example, the attention mechanism can be used as a gating unit to make the large model pay more attention to the important information part and ignore irrelevant or noise information. Then the first large model is trained and optimized: during the training process of the first large model, the gating mechanism is introduced, and the performance and accuracy of the first large model are optimized by adjusting the parameters of the gating unit; then a large amount of heterogeneous industrial control network security threat intelligence data (i.e., non-standardized multi-source data related to security vulnerabilities and attack behaviors in heterogeneous industrial control network environments) is used for training, so that the first large model learns how to effectively process complex language structures and diverse information sources. Finally, appropriate evaluation indicators such as accuracy, recall rate, F1 value, etc. are used to evaluate the performance of the first large model after the gating mechanism is introduced, and compared with the first large model without the gating mechanism to verify the effectiveness of the gating mechanism.

[0033] Please continue to refer to Figure 2 , which is a flowchart of constructing a multi-dimensional knowledge base of security threats provided by an embodiment of the present invention. Figure 2 As shown, in some exemplary embodiments, the step S100, using the first large model introducing the gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to construct a multi-dimensional knowledge base of security threats, includes: step S110, using the first large model introducing the gating mechanism to integrate and normalize the non-standardized multi-source data to obtain security threat information; step S120, converting the security threat information into nodes and edges in a knowledge graph, and using a graph database to store the knowledge graph, thereby constructing a multi-dimensional knowledge base of security threats.

[0034] Since the security threat intelligence data collected from different sources (i.e., non-standardized multi-source data related to security vulnerabilities and attack behaviors in heterogeneous industrial control network environments) may include vulnerability descriptions, attack methods, affected systems, business specifications, and other information, and may also contain some semi-structured or unstructured data, such as tables in security reports, key information in pictures, etc., by using the natural language processing capabilities of the first large model that introduces the gating mechanism to understand and integrate these data, key information such as vulnerability types, attack methods, business specifications, etc. can be extracted; by using the first large model that introduces the gating mechanism to normalize the non-standardized multi-source data, a unified data format and standard can be specified for data from different sources, such as normalizing vulnerability information according to fields such as vulnerability number, vulnerability name, vulnerability description, impact range, and repair suggestions. At the same time, the first large model that introduces the gating mechanism can also clean and convert data from different sources, remove duplicate information, correct erroneous data, and convert it into a unified format. By further analyzing and processing the normalized non-standardized multi-source data using the first large model that introduces the gating mechanism, more in-depth security threat information can be extracted, such as potential attack paths, possible attack consequences, etc.

[0035] Specifically, the vulnerabilities in the security threat information can be used as nodes, and the relationships between the vulnerabilities and the affected systems, attack methods, etc. can be used as edges.

[0036] Furthermore, the first model that introduces the gating mechanism can output the acquired security threat information in the form of reports, charts, database records, etc. according to the user's needs and specific output formats.

[0037] In some exemplary embodiments, the non-standardized multi-source data is collected through the following steps: using automated tools to regularly scan vulnerability databases to obtain newly discovered security vulnerability information related to heterogeneous industrial control networks, and subscribing to mailing lists and RSS feeds of security vendors and research institutions to receive the latest security threat intelligence in a timely manner; according to the characteristics of heterogeneous industrial control networks, the collected security vulnerability information and security threat intelligence are screened and classified.

[0038] Therefore, by screening the collected security vulnerability information and security threat intelligence, irrelevant information can be removed; by classifying the collected security vulnerability information and security threat intelligence according to vulnerability type, attack method, business specification, affected industrial control system, etc., subsequent processing can be facilitated. Specifically, the sources of the non-standardized multi-source data include: vulnerability databases, such as the National Information Security Vulnerability Database (CNNVD), the US National Vulnerability Database (NVD), etc.; reports and research results of industrial control security vendors; security forums and communities, such as FreeBuf, Security Guest, etc., where users share their experiences and cases about industrial control network security; reports released by professional security research institutions.

[0039] Please continue to refer to Figure 3 , which is a flow chart of obtaining security vulnerability mining results provided by an embodiment of the present invention. Figure 3 As shown, in some exemplary embodiments, the step S200, based on the second large model, uses a preset security vulnerability mining strategy to perform security vulnerability mining on the target heterogeneous industrial control terminal system to obtain the security vulnerability mining results of the target heterogeneous industrial control terminal system, including: step S210, based on a static taint analysis method with shared keywords, performs static taint analysis on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result; step S220, based on a dynamic fuzzy testing method assisted by binary slicing, performs a hybrid dynamic test on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result; step S230, based on the thinking chain technology and prompt word engineering, uses the second large model to analyze the first vulnerability mining result and the second vulnerability mining result to obtain the security vulnerability mining result of the target heterogeneous industrial control terminal system.

[0040] Therefore, through the above-mentioned steps S210 to S230, not only the comprehensiveness, accuracy and depth of vulnerability mining can be effectively improved, but also the complexity and diversity of heterogeneous industrial control terminal systems can be adapted, and the comprehensiveness, efficiency and intelligence of security vulnerability mining can be effectively guaranteed.

[0041] Specifically, a large amount of security vulnerability data of heterogeneous industrial control terminal systems can be obtained based on the security threat multidimensional knowledge base, including known vulnerability types, vulnerability characteristics and repair methods. Use these data to train the second largest model, so that the second largest model learns how to identify and analyze security vulnerabilities. Specifically, deep learning techniques such as neural networks, recurrent neural networks, etc. can be used to build and train the second largest model. Further, the trained second largest model is optimized to improve its accuracy and efficiency. For example, hyperparameter adjustment, model compression and other technologies can be used to optimize the performance of the second largest model. By using the thinking chain technology, the second largest model is allowed to gradually analyze the first vulnerability mining results and the second vulnerability mining results. For example, for the discovered buffer overflow vulnerability, the second largest model can be gradually analyzed from the aspects of the manifestation of the vulnerability, possible causes, and impact range, providing a deeper understanding of the vulnerability. Through the thinking chain technology, the second largest model can generate a detailed vulnerability report, including information such as the description of the vulnerability, repair suggestions and risk assessment. In terms of prompt word engineering, by designing appropriate prompt words, the second largest model can be guided to perform specific vulnerability mining tasks. For example, you can use prompt words such as "find buffer overflow vulnerabilities" and "analyze SQL injection risks" to let the second largest model focus on specific types of vulnerability mining.

[0042] In some exemplary embodiments, the step S210, a static taint analysis method based on shared keywords, performs a static taint analysis on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result, including: analyzing sensitive data or key operations existing in the target heterogeneous industrial control terminal system, and determining keywords related to the sensitive data or the key operations; scanning the source code of the target heterogeneous industrial control terminal system to find code segments containing the keywords; analyzing the context of the found code segments, and checking vulnerability points based on the analysis results of the context of the code segments to obtain a first vulnerability mining result.

[0043] Specifically, different types of industrial control terminal systems have different specific keywords. For example, in industrial control systems, possible keywords include "sensor data", "control instructions", "communication protocols", etc.; for systems involving user input and database interaction, possible keywords include "user input", "database query", "SQL statement", etc. Scan the source code of the target heterogeneous industrial control terminal system to find code segments containing shared keywords. Analyze the context of these code segments to determine the source and flow of data. For example, if a code segment containing the "user input" keyword is found, trace the propagation path of the input data in the system to see if it is used without proper verification or filtering. Check for possible vulnerabilities, such as buffer overflow, SQL injection, command injection, etc. For buffer overflow, check whether the length limit and memory allocation of the input data are reasonable; for SQL injection, check whether the SQL statements entered by the user are adequately filtered and escaped.

[0044] In some exemplary embodiments, step S220, based on the dynamic fuzz testing method assisted by binary slicing, performs hybrid dynamic testing on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result, including: using a binary slicing tool to analyze the target program of the target heterogeneous industrial control terminal system to determine the code path related to the test target of the target heterogeneous industrial control terminal system; analyzing the logical structure and input-output relationship of the sliced ​​code according to the code path; generating random input data based on the analysis results of the logical structure and input-output relationship of the sliced ​​code; inputting the input data into the target program to perform dynamic fuzz testing on the target program; and finding vulnerabilities based on the dynamic fuzz testing results of the target program to obtain a second vulnerability mining result.

[0045] Specifically, for heterogeneous industrial control terminal systems, key control programs, communication modules or data processing modules can be selected as test targets. By using a binary slicing tool to analyze the target program of the target heterogeneous industrial control terminal system, the code path related to the function or data of the test target can be determined. For example, if you want to test the security of a communication module, you can find the code path related to data reception and processing through binary slicing. Further analysis of the sliced ​​code can understand its logical structure and input-output relationship, providing guidance for subsequent fuzz testing.

[0046] Then, generate random input data, including various possible combinations of boundary values, abnormal values, and legal values. Input these input data into the target program and observe the behavior and output of the target program. You can use automated testing tools to perform this process and record the running status, error information, and crash of the target program.

[0047] Finally, analyze the test results and find possible vulnerabilities. For example, if the target program crashes or produces abnormal behavior under specific input data, there may be vulnerabilities such as buffer overflow, memory leak, logic error, etc. Further, different types of fuzz testing techniques can be combined, such as mutation-based fuzz testing, generation-based fuzz testing, and protocol-based fuzz testing, to improve the effect of vulnerability mining.

[0048] Please continue to refer to Figure 4 , which is a flow chart of obtaining attack behavior detection results provided by one embodiment of the present invention. Figure 4 As shown, in some exemplary embodiments, the step S300, based on the security threat multi-dimensional knowledge base, uses a preset intrusion detection strategy to perform intrusion detection on the target heterogeneous industrial control network to obtain the attack behavior detection result of the target heterogeneous industrial control network, including: step S310, based on a multi-dimensional traffic characterization algorithm for lightweight feature extraction, feature extraction of the traffic of the target heterogeneous industrial control network from the time dimension, space dimension and content dimension, and based on the extracted time dimension features, space dimension features and content dimension features, feature association is performed on different stages of cross-domain multi-hop attack behavior to obtain feature association results; step S320. Based on the multidimensional knowledge base of security threats, dynamically updated information technology network detection rule sets and operational technology network detection rule sets are respectively constructed, and in combination with the feature association results, real-time alarms of traditional attack types and unknown threats are preliminarily screened to obtain preliminary screening results. Step S330. Based on the multidimensional knowledge base of security threats and the preliminary screening results, attack samples are constructed. Step S340. The attack samples are input into a meta-learning small model and at least one intrusion detection model to perform multi-model collaborative real-time intrusion detection to obtain attack behavior detection results of the target heterogeneous industrial control network.

[0049] Since a cross-domain multi-hop attack may exhibit different characteristics at different time and spatial locations, associating the different stages of the cross-domain multi-hop attack behavior based on the extracted time dimension features, space dimension features, and content dimension features can help to better understand the overall picture of the attack; by using meta-learning small models and other intrusion detection models for collaborative detection, multiple different types of models can be combined to improve the accuracy and reliability of detection.

[0050] Specifically, the time series characteristics of the target heterogeneous industrial control network traffic, such as the peak time, valley time, and periodicity of the traffic, can be analyzed, and the characteristics of the time dimension can be extracted by counting indicators such as the traffic size and the number of packets in different time periods. At the same time, the source and destination of the traffic, that is, the spatial distribution characteristics of the traffic, can be considered. The spatial characteristics of the traffic can be determined by analyzing information such as IP addresses, port numbers, and protocol types. For example, some attacks may come from a specific IP address range or a specific network area. By extracting the characteristics of the spatial dimension, the source of these abnormal traffic can be better identified. By analyzing the data packet content of the traffic, key information can be extracted as features. Further, deep packet inspection (DPI) technology or machine learning algorithms can be used to identify specific patterns or keywords in the data packets. For example, for attack traffic, specific attack codes or malicious instructions may be included. By extracting the characteristics of the content dimension, these attack traffic can be detected more accurately.

[0051] Furthermore, based on the multi-dimensional knowledge base of security threats, detection rule sets for IT (Information Technology) networks and OT (Operational Technology) networks are constructed respectively. These detection rules may include signature-based detection rules, behavior-based detection rules, etc. For known vulnerability attacks, signature detection rules can be constructed using the characteristics of the vulnerability and the attack method. For unknown threats, behavior-based detection rules can be used to discover potential attacks by analyzing abnormal behavior of traffic.

[0052] In some exemplary embodiments, the step S330, constructing an attack sample based on the security threat multidimensional knowledge base and the preliminary screening results, includes: obtaining vulnerability information based on the security threat multidimensional knowledge base, the vulnerability information including vulnerability type, impact scope and triggering conditions; combining the vulnerability information with the preliminary screening results to determine potential attack scenarios and potential attack paths; and constructing an attack sample based on the potential attack scenarios and the potential attack paths.

[0053] Specifically, by conducting an in-depth analysis of the discovered heterogeneous industrial control terminal vulnerabilities (i.e., the vulnerabilities recorded in the multi-dimensional knowledge base of security threats), characteristic information of the vulnerabilities, such as vulnerability type, impact range, triggering conditions, etc., can be extracted. For example, vulnerability scanning tools, security analysis software, etc. can be used to analyze the vulnerabilities to obtain detailed vulnerability information. The acquired vulnerability information is combined with the preliminary screening results obtained in step S320 to determine possible attack scenarios and attack paths (i.e., potential attack scenarios and potential attack paths). For example, if the preliminary screening results show that there is abnormal traffic from an external network, and the discovered vulnerability information indicates that the vulnerability can be exploited by an external attacker, then it can be inferred that there may be an external attack against the vulnerability.

[0054] Based on the analysis results of potential attack scenarios and potential attack paths, attack samples are constructed to simulate possible attack behaviors. Attack samples can include malicious data packets, attack scripts, etc. Attack samples can be used for further testing and analysis to verify the effectiveness of detection and the reliability of protection measures.

[0055] Furthermore, a large number of attack samples (which may be derived from the multi-dimensional knowledge base of security threats) and normal traffic samples may be collected for training the meta-learning model. The meta-learning model may be a model based on deep learning, such as a convolutional neural network (CNN), a recurrent neural network (RNN), etc. During the training process, the meta-learning model learns the characteristics and patterns of different types of attacks, as well as the characteristics of normal traffic. By continuously adjusting the parameters of the meta-learning model, the detection accuracy of the meta-learning model for attacks and the false alarm rate for normal traffic are improved.

[0056] Furthermore, we can use ensemble learning, multimodal fusion and other technologies to combine multiple different types of models to improve the accuracy and reliability of detection. For example, we can combine the meta-learning model with the signature-based intrusion detection model, the behavior-based intrusion detection model, etc. to jointly monitor network traffic in real time. Since different types of models can detect attacks from different angles and complement each other, the detection effect can be effectively improved.

[0057] Furthermore, when an attack is detected, an alarm is issued in a timely manner and corresponding protective measures are taken, such as blocking attack traffic, isolating attacked devices, etc.; when a vulnerability is detected, a corresponding vulnerability repair strategy can be adopted based on the multi-dimensional knowledge base of security threats.

[0058] In some exemplary implementations, the large model-based intelligent protection method for heterogeneous industrial control networks provided by the present invention further includes: updating the security threat multidimensional knowledge base according to the security vulnerability mining results and the attack behavior detection results. Thus, the accuracy and comprehensiveness of the security threat multidimensional knowledge base can be guaranteed, thereby effectively improving the intelligent collaborative protection effect of the heterogeneous industrial control network environment.

[0059] Based on the same inventive concept, the present invention also provides a heterogeneous industrial control network intelligent protection system based on a large model, please continue to refer to Figure 5 and Figure 6 ,in, Figure 5 A structural block diagram of a large model-based heterogeneous industrial control network intelligent protection system provided by one embodiment of the present invention; Figure 6 The schematic diagram of a large model-based heterogeneous industrial control network intelligent protection system provided by one embodiment of the present invention. Figure 5 and Figure 6 As shown, the large model-based intelligent protection system for heterogeneous industrial control networks provided by the present invention includes: a knowledge base construction module 110, configured to use a first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to build a security threat multi-dimensional knowledge base; a security vulnerability mining module 120, configured to obtain a second large model based on the security threat multi-dimensional knowledge base training, and based on the second large model, use a preset security vulnerability mining strategy to perform security vulnerability mining on the target heterogeneous industrial control terminal system to obtain the security vulnerability mining results of the target heterogeneous industrial control terminal system; an intrusion detection module 130, configured to use a preset intrusion detection strategy to perform intrusion detection on the target heterogeneous industrial control network based on the security threat multi-dimensional knowledge base to obtain the attack behavior detection results of the target heterogeneous industrial control network; and an intelligent collaborative protection module 140, configured to take corresponding protection measures according to the security vulnerability mining results and the attack behavior detection results.

[0060] It should be noted that the large-model-based heterogeneous industrial control network intelligent protection system provided by the present invention can be used to execute the large-model-based heterogeneous industrial control network intelligent protection method described above. The technical principles, technical problems solved and technical effects produced by the two are similar. Technical personnel in this technical field can clearly understand that for the convenience and conciseness of description, for more content about the large-model-based heterogeneous industrial control network intelligent protection system provided by the present invention, refer to the content described in the above text about the large-model-based heterogeneous industrial control network intelligent protection method provided by the present invention, which will not be repeated here.

[0061] Based on the same inventive concept, the present invention also provides an electronic device, please refer to Figure 7, which is a structural block diagram of an electronic device provided by an embodiment of the present invention. Figure 7 As shown, the electronic device includes: a processor 210, a communication interface 220, a memory 230 and a communication bus 240, wherein the processor 210, the communication interface 220, and the memory 230 communicate with each other through the communication bus 240. The processor 210 can call the computer program in the memory 230 to execute the above-mentioned large-model-based heterogeneous industrial control network intelligent protection method. Since the electronic device provided by the present invention and the large-model-based heterogeneous industrial control network intelligent protection method provided by the present invention belong to the same inventive concept, the electronic device provided by the present invention at least has all the beneficial effects of the large-model-based heterogeneous industrial control network intelligent protection method provided by the present invention. For details, please refer to the relevant description above, so the beneficial effects of the electronic device provided by the present invention will not be repeated here.

[0062] It should be noted that the computer program in the memory 230 can be implemented in the form of a software functional unit and sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the large model-based heterogeneous industrial control network intelligent protection method described in the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0063] The present invention also provides a readable storage medium, wherein a computer program is stored in the readable storage medium, and when the computer program is executed by a processor, the above-mentioned large-model-based intelligent protection method for heterogeneous industrial control networks can be implemented. Since the readable storage medium provided by the present invention and the large-model-based intelligent protection method for heterogeneous industrial control networks provided by the present invention belong to the same inventive concept, the readable storage medium provided by the present invention at least has all the beneficial effects of the large-model-based intelligent protection method for heterogeneous industrial control networks provided by the present invention. Therefore, the beneficial effects of the readable storage medium provided by the present invention can refer to the above description of the beneficial effects of the large-model-based intelligent protection method for heterogeneous industrial control networks provided by the present invention, and will not be repeated here one by one.

[0064] In summary, compared with the prior art, the large-model-based intelligent protection method, system, electronic device and readable storage medium for heterogeneous industrial control networks provided by the present invention have the following beneficial effects: the present invention uses the first large model that introduces a gating mechanism to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to construct a security threat multidimensional knowledge base, which can improve the performance and accuracy of the large model in processing complex language structures, thereby effectively ensuring the accuracy of the constructed security threat multidimensional knowledge base; by training the second large model based on the security threat multidimensional knowledge base, and using the preset security vulnerability mining strategy to mine security vulnerabilities for the target heterogeneous industrial control terminal system based on the second large model, the accuracy of the obtained security vulnerability mining results can be effectively guaranteed; by using the preset intrusion detection strategy based on the security threat multidimensional knowledge base to perform intrusion detection on the target heterogeneous industrial control network, the accuracy of the obtained attack behavior detection results can be effectively guaranteed. In summary, it can be seen that the present invention can automatically verify the exploitability of security vulnerabilities, evaluate the risk of attack behaviors, and perform corresponding processing of vulnerabilities and attack behaviors, thereby realizing intelligent collaborative protection of heterogeneous industrial control network environments.

[0065] It should be noted that the above description is only a description of the preferred embodiment of the present invention, and is not any limitation to the scope of the present invention. Any changes and modifications made by ordinary technicians in the field of the present invention based on the above disclosure are within the scope of protection of the present invention.

Claims

1. A large model-based intelligent protection method for heterogeneous industrial control networks, characterized in that: include: The first model that introduces the gating mechanism is used to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to build a multi-dimensional knowledge base of security threats; A second large model is obtained based on the security threat multi-dimensional knowledge base training, and a preset security vulnerability mining strategy is used to mine security vulnerabilities of a target heterogeneous industrial control terminal system based on the second large model to obtain security vulnerability mining results of the target heterogeneous industrial control terminal system; Based on the security threat multi-dimensional knowledge base, a preset intrusion detection strategy is used to perform intrusion detection on the target heterogeneous industrial control network to obtain an attack behavior detection result of the target heterogeneous industrial control network; According to the security vulnerability mining results and the attack behavior detection results, corresponding protective measures are taken.

2. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 1 is characterized in that: The first model using the gating mechanism is used to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in the heterogeneous industrial control network environment to build a multi-dimensional knowledge base of security threats, including: The non-standardized multi-source data is integrated and normalized using a first model that introduces a gating mechanism to obtain security threat information; The security threat information is converted into nodes and edges in a knowledge graph, and a graph database is used to store the knowledge graph, thereby constructing a multi-dimensional knowledge base of security threats.

3. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 1 is characterized in that: The method of performing security vulnerability mining on the target heterogeneous industrial control terminal system using a preset security vulnerability mining strategy based on the second large model to obtain security vulnerability mining results of the target heterogeneous industrial control terminal system includes: Based on a static taint analysis method of shared keywords, a static taint analysis is performed on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result; Based on a binary slicing-assisted dynamic fuzz testing method, a hybrid dynamic test is performed on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result; Based on the thinking chain technology and prompt word engineering, the second large model is used to analyze the first vulnerability mining result and the second vulnerability mining result to obtain the security vulnerability mining result of the target heterogeneous industrial control terminal system.

4. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 3 is characterized in that: The static taint analysis method based on shared keywords performs static taint analysis on the target heterogeneous industrial control terminal system to obtain a first vulnerability mining result, including: Analyze sensitive data or key operations in the target heterogeneous industrial control terminal system, and determine keywords related to the sensitive data or the key operations; Scanning the source code of the target heterogeneous industrial control terminal system to find out the code segment containing the keyword; The context of the found code segment is analyzed, and based on the analysis result of the context of the code segment, the vulnerability point is checked to obtain a first vulnerability mining result.

5. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 3 is characterized in that: The binary slicing-assisted dynamic fuzzy testing method performs a hybrid dynamic test on the target heterogeneous industrial control terminal system to obtain a second vulnerability mining result, including: Analyzing the target program of the target heterogeneous industrial control terminal system using a binary slicing tool to determine a code path related to a test target of the target heterogeneous industrial control terminal system; Analyzing the logical structure and input-output relationship of the sliced ​​code according to the code path; Generate random input data according to the analysis results of the logical structure and input-output relationship of the sliced ​​code; Inputting the input data into the target program to perform dynamic fuzz testing on the target program; According to the dynamic fuzzy test result of the target program, vulnerabilities are found to obtain a second vulnerability mining result.

6. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 1 is characterized in that: The method of performing intrusion detection on a target heterogeneous industrial control network based on the security threat multi-dimensional knowledge base using a preset intrusion detection strategy to obtain an attack behavior detection result of the target heterogeneous industrial control network includes: A multi-dimensional traffic characterization algorithm based on lightweight feature extraction is used to extract features of the target heterogeneous industrial control network traffic from the time dimension, space dimension, and content dimension. Based on the extracted time dimension features, space dimension features, and content dimension features, feature association is performed on different stages of cross-domain multi-hop attack behaviors to obtain feature association results. Based on the security threat multi-dimensional knowledge base, dynamically updated information technology network detection rule sets and operational technology network detection rule sets are respectively constructed, and combined with the feature association results, real-time alarms of traditional attack types and unknown threats are preliminarily screened to obtain preliminary screening results; Constructing an attack sample based on the security threat multidimensional knowledge base and the preliminary screening results; The attack sample is input into a meta-learning small model and at least one intrusion detection model to perform multi-model collaborative real-time intrusion detection to obtain attack behavior detection results of the target heterogeneous industrial control network.

7. The large model-based intelligent protection method for heterogeneous industrial control networks according to claim 6 is characterized in that: The constructing of attack samples based on the security threat multi-dimensional knowledge base and the preliminary screening results includes: Based on the security threat multi-dimensional knowledge base, vulnerability information is obtained, wherein the vulnerability information includes vulnerability type, impact scope and triggering condition; combining the vulnerability information with the preliminary screening results to determine potential attack scenarios and potential attack paths; An attack sample is constructed according to the potential attack scenario and the potential attack path.

8. A large model-based intelligent protection system for heterogeneous industrial control networks, characterized in that: include: a knowledge base construction module configured to process the collected non-standardized multi-source data related to security vulnerabilities and attack behaviors in a heterogeneous industrial control network environment using a first large model that introduces a gating mechanism, so as to construct a multi-dimensional knowledge base of security threats; A security vulnerability mining module is configured to obtain a second large model based on the security threat multi-dimensional knowledge base training, and to perform security vulnerability mining on a target heterogeneous industrial control terminal system using a preset security vulnerability mining strategy based on the second large model to obtain a security vulnerability mining result of the target heterogeneous industrial control terminal system; An intrusion detection module is configured to perform intrusion detection on a target heterogeneous industrial control network using a preset intrusion detection strategy based on the security threat multi-dimensional knowledge base, so as to obtain an attack behavior detection result of the target heterogeneous industrial control network; as well as The intelligent collaborative protection module is configured to take corresponding protection measures according to the security vulnerability mining results and the attack behavior detection results.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the large model-based intelligent protection method for heterogeneous industrial control networks described in any one of claims 1 to 7 is implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by a processor, the large model-based intelligent protection method for heterogeneous industrial control networks described in any one of claims 1 to 7 is implemented.

Images