Intrusion detection and defense system and method for gate pump industrial control network in water conservancy industry

Abstract

The invention relates to the technical field of network security in the water conservancy industry, in particular to an intrusion detection and defense system and method for a gate pump industrial control network in the water conservancy industry. Comprising an intrusion detection module, a virus cleaning module, a regenerated virus deep analysis module and an advanced prevention module. The virus regeneration condition is judged according to a virus regeneration analysis unit based on a numerical value estimation method, regeneration and variation viruses are prevented in advance, a virus propagation sequence chart is constructed according to the basic regeneration number and the final infection node number, new virus performance characteristics and information are compared with a historical virus propagation sequence chart, and a new virus regeneration result is obtained. And judging historical viruses or new viruses according to a comparison result, importing analysis data into the established neural network model, converting the characteristics into rules by using a rule generation algorithm, and updating the rules into a rule base of the intrusion detection system in real time, so that the rule base of the intrusion detection system is expanded, and the accuracy of the intrusion detection system is improved. And the detection efficiency and accuracy of the intrusion detection system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security in the water conservancy industry, and in particular to an intrusion detection and defense system and method for a gate pump industrial control network in the water conservancy industry. Background Art

[0002] With the continuous development and in-depth research of various network applications, network attacks such as computer viruses, Trojans, and hacker attacks are becoming increasingly rampant. At this stage, network security incidents have entered a high incidence period, which has had a serious impact on the production and life of the entire society. As a key information infrastructure involving multiple industries, industrial control systems are an important part of the modern production process. However, with the development of networking and informatization of industrial control systems, the possibility of them being attacked by network attacks is also rapidly increasing, and the impact on industrial control systems is showing an increasingly severe development trend.

[0003] In the prior art, when detecting and preventing network viruses, the honeypot system usually simulates vulnerable systems, services or information to attract and lure potential viruses, thereby collecting information about virus behavior and strategies, and then inputs the captured data into the established neural network model, obtains new intrusion rules for virus behavior based on the output data, replaces the corresponding old rules in the intrusion rules with the new intrusion rules, and deletes the old rules at the same time. Although this method can reduce the system burden of the intrusion detection system, improve detection efficiency and accuracy, and has a preventive effect. However, since viruses have the phenomenon of mutation and regeneration, the above method cannot detect whether the virus has the possibility of regeneration, and the mutated virus will show different behaviors from before, and different behaviors correspond to different intrusion rules. The similarity between sequences is calculated by comparing virus sequences in the prior art, and then it is judged whether the mutated virus is derived from the mutation of the historical virus. This method requires processing a large amount of data, occupies system resources, and sequence comparison is usually only performed on known virus sequences. For newly emerged, unknown viruses, or viruses that have undergone major mutations, the comparison results cannot accurately reflect the similarity between viruses, thereby affecting the control of pumps and gates by the water conservancy industry. Summary of the invention

[0004] The purpose of the present invention is to provide an intrusion detection and defense system and method for the industrial control network of gate pumps in the water conservancy industry, so as to solve the problems raised in the above background technology.

[0005] To achieve the above-mentioned object, the present invention aims to provide an intrusion detection and defense system for the industrial control network of gate pumps in the water conservancy industry, including an intrusion detection module, a virus cleaning module, a regenerated virus in-depth analysis module and an advance prevention module; The intrusion detection module is used to obtain data parameters sent in the information honeypot environment through the intrusion detection system and pre-process them; The virus cleaning module analyzes the acquired data parameters, obtains virus parameters, matches and identifies the virus parameters with the existing intrusion detection system rule library, and determines whether to remove the virus based on the matching and identification results; The regeneration virus in-depth analysis module obtains the status of all nodes in the network, calculates the number of regenerations and virus propagation range of each virus in the network based on the node infection rate, node recovery rate and node average infection period through a numerical estimation method, and constructs a virus propagation sequence chart, stores the virus propagation sequence chart and historical virus data in the virus library, establishes an index mechanism, compares the virus propagation sequence chart with the historical virus propagation sequence chart, and determines whether the current virus belongs to a historical virus based on the comparison result; The early prevention module performs analysis based on a deep learning algorithm in combination with the evaluation results, and updates the rule base of the intrusion detection system according to the analysis results.

[0006] As a further improvement of the present technical solution, data parameters sent in the information honeypot environment are obtained in the intrusion detection module, and the data parameters include network traffic data, system logs, file contents, and user behavior data. The obtained data parameters are analyzed, and irrelevant and redundant information is removed through data cleaning. The cleaned data is converted into a unified standard format using data standardization technology.

[0007] As a further improvement of the technical solution, the regenerated virus deep analysis module first establishes a method for obtaining the states of all nodes in the network and divides the node states into normal state, infected state, isolated state and recovered state.

[0008] As a further improvement of the technical solution, the regenerated virus depth analysis module includes a virus regeneration analysis unit, and the specific steps of the numerical estimation method in the virus regeneration analysis unit are as follows: Step 1: Set parameters, node infection rate ( ) represents the average number of other nodes infected by each infected node per unit time; Node recovery rate ( ): The probability of each infected node recovering (or removed) within a unit time; Average infection period of nodes ( ): The average time that an infected node remains infected; Step 2: Set the basic reproduction number of the virus is the average number of new nodes that an infected node can infect during its entire infection period in an environment where all nodes are uninfected; Step 3: Calculate the basic reproduction number; .

[0009] As a further improvement of the technical solution, the virus propagation range in the virus reproducibility analysis unit is based on the SIR model, and the specific estimation method is as follows: ; in, is the total number of network nodes, is the basic reproduction number, is the final number of infected nodes, the basic reproduction number is a threshold parameter, when The virus can spread in the network when The virus will gradually die out; Then the calculated basic reproduction number and the final number of infected nodes are integrated in time series to construct a sequence of changes in virus propagation in the network and form a data set, and a virus propagation sequence chart is constructed based on the data set.

[0010] As a further improvement of the technical solution, the steps of constructing a virus propagation sequence chart in the virus reproducibility analysis unit are as follows: The basic reproduction number of the virus and the final number of infected nodes are used as the data sources of two dimensions respectively, and the virus propagation sequence chart is constructed with time as the coordinate; The basic reproduction number and the final number of infected nodes of the virus at different times are marked and connected to form a line chart, which reflects the change curve of the spread range of the virus; and the historical virus parameter information in the rule library is also marked in the chart; The historical virus parameter information includes virus type, basic reproduction number, final number of infected nodes and time.

[0011] As a further improvement of the technical solution, the regenerated virus deep analysis module includes establishing a data storage unit, and the method of establishing an index mechanism in the data storage unit is shown as follows: Based on hash index, the data source in the virus propagation sequence chart is replaced with a fixed-length hash value through a hash function; The hash value is used as the index key, and the storage location of the historical virus parameter information and the chart in the virus library is used as the index value to construct a hash index table.

[0012] As a further improvement of the technical solution, the regenerated virus in-depth analysis module includes a virus evaluation unit, in which a virus propagation sequence chart is compared with a historical virus propagation sequence chart, and the comparison steps are as follows: Based on the dynamic time warping algorithm, the time dimension of the virus propagation sequence graph and the historical virus graph are compared through dynamic programming to find the best matching path between the two time series and calculate the similarity between them. Based on the Euclidean distance measurement method, the basic reproduction number similarity and the final number of infected nodes similarity are calculated respectively. The preset range of similarity of the basic reproduction number and the preset range of similarity of the final number of infected nodes are set respectively, and then compared. If the similarity falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a historical virus. If only one of the similarities or neither of them falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a mutant virus.

[0013] As a further improvement of the technical solution, the early prevention module is based on the neural network model in the deep learning algorithm, and uses the extracted virus features and corresponding labels to train the neural network model. During the training process, the recognition performance of the model is optimized by adjusting the model parameters and the learning rate parameters, and the cross-validation method is used to evaluate the generalization ability of the model; Combining the extracted virus features and corresponding labels, the rule generation algorithm is used to convert these features into rules and update them to the rule base of the intrusion detection system in real time.

[0014] The second object of the invention is to provide a method for intrusion detection and defense of the industrial control network of the water conservancy industry sluice pump, including the following method steps: S1. Obtain the data parameters sent in the information honeypot environment through the intrusion detection system and pre-process them; S2. Analyze the acquired data parameters to obtain virus parameters, match and identify the virus parameters with the existing intrusion detection system rule library, and confirm whether to remove the virus based on the matching and identification results; S3. Obtain the status of all nodes in the network, calculate the reproduction number and virus propagation range of each virus in the network through a numerical estimation method based on the node infection rate, node recovery rate and node average infection period, and construct a virus propagation sequence chart, store the virus propagation sequence chart and historical virus data in the virus library, establish an index mechanism, compare the virus propagation sequence chart with the historical virus propagation sequence chart, and determine whether the current virus belongs to the historical virus based on the comparison result; S4. Perform analysis based on the deep learning algorithm based on the evaluation results, and update the rule base of the intrusion detection system according to the analysis results.

[0015] Compared with the prior art, the present invention has the following beneficial effects: In the intrusion detection and defense system for the industrial control network of the gate pump in the water conservancy industry, the virus regeneration situation is judged based on the virus regeneration analysis unit based on the numerical estimation method, the regenerated and mutated viruses are prevented in advance, and the virus propagation sequence chart is constructed through the basic regeneration number and the final number of infected nodes. The performance characteristics and information of the new virus are compared with the historical virus propagation sequence chart, and the historical virus or the new virus is judged according to the comparison results. According to the analysis of the new virus, the analysis data is imported into the established neural network model, and the rule generation algorithm is used to convert these features into rules, and the rules are updated in real time to the rule base of the intrusion detection system, thereby expanding the rule base of the intrusion detection system and improving the detection efficiency and accuracy of the intrusion detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a block diagram of an intrusion detection and defense system for a water conservancy industry sluice pump industrial control network of the present invention; Figure 2 The present invention is a flow chart of the intrusion detection and defense method for the water conservancy industry gate pump industrial control network.

[0017] The meaning of each number in the figure is: 100. Intrusion detection module; 200. Virus cleaning module; 300. Regeneration virus in-depth analysis module; 301. Virus regeneration analysis unit; 302. Data storage unit; 303. Virus evaluation unit; 400. Early prevention module. DETAILED DESCRIPTION

[0018] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, an intrusion detection and defense system for the industrial control network of the water conservancy industry gate pump is provided, including an intrusion detection module 100, a virus cleaning module 200, a regenerated virus in-depth analysis module 300 and an advance prevention module 400; The intrusion detection module 100 is used to obtain the data parameters sent in the information honeypot environment through the intrusion detection system and pre-process them; The virus cleaning module 200 analyzes the acquired data parameters, obtains virus parameters, combines the virus parameters with the existing intrusion detection system rule library for matching and identification, and determines whether to remove the virus based on the matching and identification results; The regeneration virus in-depth analysis module 300 obtains the status of all nodes in the network, and calculates the number of regenerations and virus propagation range of each virus in the network based on the node infection rate, node recovery rate and node average infection period through a numerical estimation method, and constructs a virus propagation sequence chart, stores the virus propagation sequence chart and historical virus data in the virus library, establishes an index mechanism, compares the virus propagation sequence chart with the historical virus propagation sequence chart, and determines whether the current virus belongs to a historical virus based on the comparison result; The early prevention module 400 performs analysis based on a deep learning algorithm in combination with the evaluation results, and updates the rule base of the intrusion detection system according to the analysis results.

[0020] The data parameters sent in the information honeypot environment are obtained in the intrusion detection module 100, and the data parameters include network traffic data, system logs, file contents, and user behavior data. The obtained data parameters are analyzed, and irrelevant and redundant information is removed through data cleaning. The cleaned data is converted into a unified standard format using data standardization technology.

[0021] In order to further improve the quality and availability of data, data standardization technology is adopted, including data coding standardization, data format standardization, data naming standardization, etc. Through standardization processing, it can ensure that data from different sources and in different formats can be converted into a unified standard format, thereby facilitating subsequent analysis and processing.

[0022] Then, according to the acquired data parameters, real-time monitoring and virus scanning technology are used to obtain the virus's feature code, the path of the infected file, the virus's behavior pattern, the danger level, etc. from the data parameters, and the rule library already contains the feature code, behavior pattern, signature and other information of known viruses. Therefore, through matching, the module can detect the type of virus and its characteristics. If the virus parameters successfully match a virus in the rule library, the virus cleaning module 200 will identify the virus and take corresponding measures to remove the virus, such as: isolating infected files, deleting virus codes, restoring the original state of files, etc., and continue to monitor abnormal behavior after cleaning the virus. If the match is not successful, continue to monitor abnormal behavior. Secondly, during the cleaning process, the module will ensure that no additional damage is caused to the system, and retain the user's data and files as much as possible for normal use.

[0023] Since the virus will be continuously replicated and mutated during the process of propagation, when the virus is in the process of replication and regeneration without mutation, each copy it generates will contain the same signature code. This is because the signature code is generated based on the original code or data pattern of the virus. If the original code or data pattern remains unchanged, the signature code will not change. Therefore, the replicated virus can be cleared by the virus cleaning module 200.

[0024] On the contrary, some viruses will mutate during the replication process, such as by changing certain parts of themselves (such as code segments, encryption methods, etc.) to avoid being detected and removed by antivirus software. At this time, they cannot be matched and identified through the existing intrusion detection system rule library, thereby reducing the accuracy of detection.

[0025] In the regenerated virus deep analysis module 300, the node states of all nodes in the network are first obtained and divided into normal state, infection state, isolation state and recovery state. By dividing the states of all nodes in the network, the security status of the network can be more clearly understood, and corresponding security measures can be taken to deal with potential virus threats. This helps to improve the security, stability and reliability of the network.

[0026] Furthermore, the regenerated virus depth analysis module 300 includes a virus regeneration analysis unit 301. The specific steps of the numerical estimation method in the virus regeneration analysis unit 301 are as follows: Step 1: Set parameters, node infection rate ( ) represents the average number of other nodes infected by each infected node per unit time; Node recovery rate ( ): The probability of each infected node recovering (or removed) within a unit time; Average infection period of nodes ( ): The average time that an infected node remains infected; Step 2: Set the basic reproduction number of the virus is the average number of new nodes that an infected node can infect during its entire infection period in an environment where all nodes are uninfected; Step 3: Calculate the basic reproduction number; .

[0027] For example: the infection rate of a node 2 (i.e. each infected node is infected every day 2 new nodes), node recovery rate 1 (i.e. each infected node has 1 probability recovery), we can calculate: 10 days, 2; That is, in this example, the basic reproduction number It is 2, which means that each infected node can infect 3 new nodes on average during the corresponding infection period.

[0028] In the virus reproducibility analysis unit 301, the virus propagation range is based on the SIR model, and the specific estimation method is as follows: ; in, is the total number of network nodes, is the basic reproduction number, is the final number of infected nodes, the basic reproduction number is a threshold parameter, when The virus can spread in the network when The virus will gradually die out.

[0029] It should be noted that the above estimation method is only applicable to simple cases and assumes that the network is uniformly mixed (that is, each node has an equal chance of contacting other nodes).

[0030] Calculation by Example , assuming the infection rate of the node is 2. Node recovery rate 1. Total number of network nodes 1000, the final number of infected nodes can be calculated to estimate the spread of the virus in the network: 98; Then the calculated basic reproduction number and the final number of infected nodes are integrated in time series to construct a sequence of changes in virus propagation in the network and form a data set, and a virus propagation sequence chart is constructed based on the data set.

[0031] The steps of constructing a virus propagation sequence graph in the virus reproducibility analysis unit 301 are as follows: The basic reproduction number of the virus and the final number of infected nodes are used as the data sources of two dimensions respectively, and the virus propagation sequence chart is constructed with time as the coordinate; first, when constructing the virus propagation sequence chart, it is necessary to determine the basic reproduction number of the data source and the final number of infected nodes, and then determine the time coordinate. The time coordinate is used to represent the time series of virus propagation, usually in days, hours or other time units. By recording the virus propagation at each time point, the time series data of virus propagation can be constructed. Set the coordinate axis, X-axis: represents the time coordinate, in days, hours or other time units, Y-axis: the left axis represents the basic reproduction number ( ), the right axis represents the final number of infected nodes (can be adjusted as needed).

[0032] The basic reproduction number and the final number of infected nodes of the virus at different times are marked and connected to form a line chart, which reflects the change curve of the spread range of the virus; and the historical virus parameter information in the rule library is also marked in the chart; Historical virus parameter information includes virus type, basic reproduction number, final number of infected nodes, and time.

[0033] By comparing historical virus parameters, it is easier to identify the characteristics and types of the current virus, which helps to more accurately classify and name it, as well as conduct subsequent analysis of the virus.

[0034] Furthermore, the regenerated virus in-depth analysis module 300 includes establishing a data storage unit 302. The method of establishing an index mechanism in the data storage unit 302 is shown as follows: Based on hash index, the data source in the virus propagation sequence chart is replaced with a fixed-length hash value through a hash function; the hash value is used as the index key, and the historical virus parameter information and the storage location of the chart in the virus library are used as the index value to build a hash index table. Suppose there is a virus whose basic reproduction number R0_T1 at a certain time point T1 is 3.5, and the final number of infected nodes N_T1 is 1000. We use the SHA-256 hash function to convert it into a hash value: Hash(R0_T1)= SHA-256("3.5")="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"; Hash(N_T1)=SHA-256("1000")="5eb63bbbe01eeed093cb22bb8f5acdc33dc222c0b0d8606f6084e0b5b6d4c745"; We then create two entries in the hash index table: Index key: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855; Index value: {Virus type: "VirusA", time point: "T1", basic reproduction number: "3.5", final number of infected nodes hash value: "5eb63bbbe01eeed093cb22bb8f5acdc33dc222c0b0d8606f6084e0b5b6d4c745", chart storage location: " / path / to / virusA_T1_chart"}.

[0035] The regenerated virus in-depth analysis module 300 includes a virus evaluation unit 303. The virus propagation sequence chart in the virus evaluation unit 303 is compared with the historical virus propagation sequence chart. The comparison steps are as follows: Based on the dynamic time warping algorithm, the time dimension of the virus propagation sequence graph and the historical virus graph are compared through dynamic programming to find the best matching path between the two time series and calculate the similarity between them. Based on the Euclidean distance measurement method, the basic reproduction number similarity and the final number of infected nodes similarity are calculated respectively. For example: Virus A: [(2.5,100), (3.0,200), (2.8,150)]; Historical virus B: [(2.4,90), (2.9,190), (2.7,140), (3.1,210)]; Step 1: Construct distance matrices D_R0 and D_N (only part is shown): D_R0:[0,0.1,0.2,0.3] [0.1,0,0.1,0.2] [0.2,0.1,0,0.1];; D_N:[0,10,20,30] [10,0,10,20] [20,10,0,10]; Step 2: Use dynamic programming to solve the best matching path (simplified process, not showing the complete matrix); Step 3: Backtrack to the best matching path (e.g. [(1,1), (2,2), (3,3)]); Step 4: Calculate the cumulative distance and similarity (this is just an example); Calculate separate Euclidean distances for the basic reproduction number and the final number of infected nodes (aggregated for the entire sequence): Basic reproduction number Euclidean distance: sqrt ...; Final number of infected nodes Euclidean distance: sqrt ...; The preset range of similarity of the basic reproduction number and the preset range of similarity of the final number of infected nodes are set respectively, and then compared. If the similarity falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a historical virus. If only one of the similarities or neither of them falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a mutant virus.

[0036] Suppose there is a virus to be identified. The value is 3.2, and the final number of infected nodes is 6000. At the same time, we have a historical virus database that records the R0 values ​​and final number of infected nodes of various historical viruses. If the historical virus The value is mostly between 2 and 4, we can set The preset range of similarity is ±0.5 (i.e., 1.5 to 4.5 is considered similar); The final number of infected nodes is mostly between 1,000 and 10,000, and the preset range of similarity of the final number of infected nodes is ±2%, that is, between 800 and 12,000; calculate Similarity: Assume that the number of viruses in the historical virus database is The average value is 3, then the virus to be determined The similarity is |(3.2-3) / 3|≈0.067, which is less than the preset The similarity range is ±0.5 (i.e. similarity within 0.5), so The similarity falls within the preset range; Calculate the similarity of the final number of infected nodes: Assuming that the average number of final infected nodes of each virus in the historical virus database is 5000, the similarity of the final number of infected nodes of the virus to be determined is |(6000-5000) / 5000|=0.2, which is less than the preset similarity range of the final number of infected nodes of ±20% (i.e., similarity within 0.2), so the similarity of the final number of infected nodes also falls within the preset range.

[0037] The early prevention module 400 uses the extracted virus features and corresponding labels (i.e., virus types or variants) to train the neural network model based on the neural network model in the deep learning algorithm. During the training process, the recognition performance of the model is optimized by adjusting the model parameters and the learning rate parameters, and the cross-validation method is used to evaluate the generalization ability of the model. Combined with the extracted virus features and corresponding labels, these features are converted into rules using a rule generation algorithm, and are updated in real time to the rule base of the intrusion detection system. In this way, the virus regeneration situation is judged based on the virus regeneration analysis unit 301 based on the numerical estimation method, and the regenerated and mutated viruses are prevented in advance. The virus propagation sequence chart is constructed through the basic regeneration number and the final number of infected nodes, and the new virus performance characteristics and information are compared with the historical virus propagation sequence chart, and the historical virus or new virus is judged based on the comparison results. According to the analysis of the new virus, the analysis data is imported into the established neural network model, and the rule generation algorithm is used to convert these features into rules, and they are updated in real time to the rule base of the intrusion detection system, thereby expanding the rule base of the intrusion detection system, improving the detection efficiency and accuracy of the intrusion detection system, and ensuring the smooth operation of the pump gate.

[0038] like Figure 2 As shown, a method for intrusion detection and defense of a water conservancy industry gate pump industrial control network is shown, including the following method steps: S1. Obtain the data parameters sent in the information honeypot environment through the intrusion detection system and pre-process them; S2. Analyze the acquired data parameters to obtain virus parameters, match and identify the virus parameters with the existing intrusion detection system rule library, and confirm whether to remove the virus based on the matching and identification results; S3. Obtain the status of all nodes in the network, calculate the reproduction number and virus propagation range of each virus in the network through a numerical estimation method based on the node infection rate, node recovery rate and node average infection period, and construct a virus propagation sequence chart, store the virus propagation sequence chart and historical virus data in the virus library, establish an index mechanism, compare the virus propagation sequence chart with the historical virus propagation sequence chart, and determine whether the current virus belongs to the historical virus based on the comparison result; S4. Perform analysis based on the deep learning algorithm based on the evaluation results, and update the rule base of the intrusion detection system according to the analysis results.

[0039] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. The intrusion detection and defense system for the industrial control network of the water conservancy industry's gate pumps is characterized by: It comprises an intrusion detection module (100), a virus cleaning module (200), a regenerated virus in-depth analysis module (300) and an advance prevention module (400); The intrusion detection module (100) is used to obtain data parameters sent in the information honeypot environment through an intrusion detection system, and pre-process the data parameters; The virus cleaning module (200) analyzes the acquired data parameters, obtains virus parameters, combines the virus parameters with an existing intrusion detection system rule library for matching and identification, and determines whether to remove the virus based on the matching and identification results; The regeneration virus in-depth analysis module (300) obtains the status of all nodes in the network, calculates the number of regenerations and virus propagation range of each virus in the network based on the node infection rate, node recovery rate and node average infection period through a numerical estimation method, and constructs a virus propagation sequence chart, stores the virus propagation sequence chart and historical virus data in a virus library, establishes an index mechanism, compares the virus propagation sequence chart with the historical virus propagation sequence chart, and determines whether the current virus belongs to a historical virus based on the comparison result; The early prevention module (400) performs analysis based on a deep learning algorithm in combination with the evaluation results, and updates a rule base of the intrusion detection system according to the analysis results.

2. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The intrusion detection module (100) obtains data parameters sent in the information honeypot environment, the data parameters including network traffic data, system logs, file content, and user behavior data, analyzes the obtained data parameters, removes irrelevant and redundant information through data cleaning, and converts the cleaned data into a unified standard format using data standardization technology.

3. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The regenerated virus deep analysis module (300) first establishes a method for obtaining the states of all nodes in the network and divides the node states into normal state, infected state, isolated state and recovered state.

4. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 3 is characterized by: The regenerative virus depth analysis module (300) comprises a virus regenerative analysis unit (301), and the specific steps of the numerical estimation method in the virus regenerative analysis unit (301) are as follows: Step 1: Set parameters, node infection rate ( ) represents the average number of other nodes infected by each infected node per unit time; Node recovery rate ( ): The probability of each infected node recovering within a unit time; Average infection period of nodes ( ): The average time that an infected node remains infected; Step 2: Set the basic reproduction number of the virus is the average number of new nodes that an infected node can infect during its entire infection period in an environment where all nodes are uninfected; Step 3: Calculate the basic reproduction number; 。 5. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: In the virus reproducibility analysis unit (301), the virus propagation range is based on the SIR model, and the specific estimation method is as follows: ； in, is the total number of network nodes, is the basic reproduction number, is the final number of infected nodes, the basic reproduction number is a threshold parameter, when The virus can spread in the network when The virus will gradually die out; Then the calculated basic reproduction number and the final number of infected nodes are integrated in time series to construct a sequence of changes in virus propagation in the network and form a data set, and a virus propagation sequence chart is constructed based on the data set.

6. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The steps of constructing a virus propagation sequence diagram in the virus reproducibility analysis unit (301) are specifically as follows: The basic reproduction number of the virus and the final number of infected nodes are used as the data sources of two dimensions respectively, and the virus propagation sequence chart is constructed with time as the coordinate; The basic reproduction number and the final number of infected nodes of the virus at different times are marked and connected to form a line chart, which reflects the change curve of the spread range of the virus; and the historical virus parameter information in the rule library is also marked in the chart; The historical virus parameter information includes virus type, basic reproduction number, final number of infected nodes and time.

7. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The regenerated virus in-depth analysis module (300) includes a data storage unit (302). The method of establishing an index mechanism in the data storage unit (302) is shown as follows: Based on hash index, the data source in the virus propagation sequence chart is replaced with a fixed-length hash value through a hash function; The hash value is used as the index key, and the storage location of the historical virus parameter information and the chart in the virus library is used as the index value to construct a hash index table.

8. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The regenerated virus in-depth analysis module (300) comprises a virus evaluation unit (303), wherein the virus propagation sequence chart in the virus evaluation unit (303) is compared with the historical virus propagation sequence chart, and the comparison steps are as follows: Based on the dynamic time warping algorithm, the time dimension of the virus propagation sequence graph and the historical virus graph are compared through dynamic programming to find the best matching path between the two time series and calculate the similarity between them. Based on the Euclidean distance measurement method, the basic reproduction number similarity and the final number of infected nodes similarity are calculated respectively. The preset range of similarity of the basic reproduction number and the preset range of similarity of the final number of infected nodes are set respectively, and then compared. If the similarity falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a historical virus. If only one of the similarities or neither of them falls within the preset range of similarity of the basic reproduction number and the final number of infected nodes, it is determined to be a mutant virus.

9. The intrusion detection and defense system for the water conservancy industry gate pump industrial control network according to claim 1 is characterized by: The early prevention module (400) is based on a neural network model in a deep learning algorithm, and uses the extracted virus features and corresponding labels to train the neural network model. During the training process, the recognition performance of the model is optimized by adjusting the model parameters and the learning rate parameters, and a cross-validation method is used to evaluate the generalization ability of the model. Combining the extracted virus features and corresponding labels, the rule generation algorithm is used to convert these features into rules and update them to the rule base of the intrusion detection system in real time.

10. A method for intrusion detection and defense of industrial control networks of water conservancy industry sluice pumps, characterized in that: The method comprises the following steps: S1. Obtain the data parameters sent in the information honeypot environment through the intrusion detection system and pre-process them; S2. Analyze the acquired data parameters to obtain virus parameters, match and identify the virus parameters with the existing intrusion detection system rule library, and confirm whether to remove the virus based on the matching and identification results; S3. Obtain the status of all nodes in the network, calculate the reproduction number and virus propagation range of each virus in the network through a numerical estimation method based on the node infection rate, node recovery rate and node average infection period, and construct a virus propagation sequence chart, store the virus propagation sequence chart and historical virus data in the virus library, establish an index mechanism, compare the virus propagation sequence chart with the historical virus propagation sequence chart, and determine whether the current virus belongs to the historical virus based on the comparison result; S4. Perform analysis based on the deep learning algorithm based on the evaluation results, and update the rule base of the intrusion detection system according to the analysis results.

Images