Industrial control system communication abnormal state detection method based on time sequence model

Abstract

The invention relates to the technical field of industrial network security, in particular to an industrial control system communication abnormal state detection method based on a time sequence model. According to the method, a plurality of communication data in a database are collected and preprocessed to obtain processed data, feature extraction is performed on the processed data to obtain data capable of reflecting features of a system state, and a training set and a test set are generated based on the data. A plurality of time sequence models are selected according to the processed data in the training set and trained and tested to obtain a test model, the test model periodically monitors the industrial control system to judge whether abnormity exists or not, the number of abnormal data is counted, and whether the industrial control system is attacked or not is determined based on the number of the abnormal data. And determining a corresponding processing mode when attacks are received. Therefore, the detection accuracy of the test model for the abnormal data can be improved, and the recognition capability of the test model for the attack generated by the new threat can be continuously improved, so that the safety of industrial communication is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial network security, and in particular to a method for detecting abnormal communication status of an industrial control system based on a time series model. Background Art

[0002] With the continuous development of network technology, the network security threats faced by industrial control systems are becoming increasingly severe. Communication anomalies, as one of the potential means of attack, may lead to serious consequences such as system paralysis and data leakage. Especially in the energy industry, due to the wide variety of communication protocols used by industrial control systems and the complex protocol structure, traditional network security detection methods often find it difficult to achieve in-depth analysis and anomaly detection of communication data. In addition, new attack modes and abnormal behaviors emerge in an endless stream. Traditional methods often rely on known threat patterns and may not be able to effectively identify these emerging attack methods, and their ability to identify new threats is limited.

[0003] The Chinese patent publication number in the prior art: CN115484102A discloses an anomaly detection system and method for industrial control systems. The method in the technical solution is to collect training data, perform data preprocessing, learn time dimension features and time series correlation, reconstruct multidimensional time series data, and then set an anomaly threshold. The anomaly detection system uses this method to perform real-time detection on the industrial control system. Although the technical solution can detect time series anomaly data by modeling the time series, and uses the extreme value theorem to automatically set the anomaly threshold, thereby improving the accuracy and stability of anomaly detection; however, the technical solution is not sufficiently adaptable to new threats and cannot optimize the model itself based on the detected attack data, thereby improving the model's recognition ability for complex attack environments. Summary of the invention

[0004] To this end, the present invention provides an industrial control system communication abnormal state detection method based on a time series model to solve the problem in the prior art that the industrial control system cannot optimize its own detection model when it is attacked, so as to adapt to new threats.

[0005] To achieve the above object, the present invention provides a method for detecting abnormal communication status of an industrial control system based on a time series model, comprising: collecting a number of communication data and preprocessing the data to obtain processed data; Generate a training set and a test set based on the processed data; Using the training set to train a number of time series models, and using the test set to verify the trained models to obtain corresponding test models; The test model periodically monitors the industrial control system to determine whether there is an abnormality, and counts the number of abnormal data; Based on the comparison result of the number of abnormal data and the preset value, it is determined whether the industrial control system is attacked, and when attacked, corresponding instructions are generated, and preset values ​​are determined, the test model is rebuilt based on the attack data, or the monitoring frequency of the test model for the industrial control system is re-determined.

[0006] Furthermore, the process of determining whether the industrial control system is attacked based on the comparison result of the abnormal data quantity with the preset value includes: Counting the total number of data detected by the test model in a single time interval, and calculating the abnormality ratio based on the number of abnormal data and the total number of data; Determining whether the industrial control system is under attack based on a comparison result of the abnormality ratio with a preset abnormality ratio, or based on the quantity ratio of white noise data in a single time interval; When it is determined that the industrial control system is under attack, a data change curve is drawn according to the detected data, and the data change curve is compared with a preset curve pre-stored in the database to determine the type of attack data.

[0007] Furthermore, the process of determining whether the industrial control system is under attack based on the proportion of the amount of the white noise data in a single time interval includes: Counting the number of white noise data, and calculating the ratio between the number of white noise data and the total number of data, and recording the ratio as the number ratio; Based on the comparison result between the quantity ratio and the preset quantity ratio, it is determined whether the data has a predictable trend.

[0008] Further, the process of determining whether the data has a predictable trend based on the comparison result of the quantity ratio and the preset quantity ratio includes: When it is determined that the data has a predictable trend, a historical anomaly proportion curve is drawn according to the anomaly proportion and several historical anomaly proportions; Based on the historical anomaly proportion curve, a node slope corresponding to a node in the current time interval is obtained; Whether to update the preset value is determined based on a comparison result between the node slope and a preset node slope.

[0009] Further, the process of determining whether to update the preset value based on the comparison result of the node slope and the preset node slope includes: When determining to update the preset value, it is determined to reduce the preset value based on the comparison result of the total number of data and the preset total number of data, and the reduction range of the preset value is proportional to the total number of data.

[0010] Furthermore, the process of determining the type of attack data based on the comparison between the data change curve and the preset curve includes: The database is provided with a plurality of different types of preset curves, and each preset curve can represent a type of attack data; Comparing the data change curve with a plurality of preset curves of different types in sequence, and determining corresponding similarities based on the comparison results; The attack data type is determined based on a comparison result of the similarity with a preset similarity.

[0011] Furthermore, the process of determining the type of the attack data based on the comparison result of the similarity with the preset similarity includes: Calculating the integral values ​​corresponding to the data change curve and the control curve respectively, and calculating the absolute value of the difference between the integral values ​​of the two, and recording the absolute value of the difference as the integral difference, wherein the control curve is the preset curve whose similarity is closest to the preset similarity; Determining a corresponding processing method based on a comparison result between the integral difference and a preset integral difference includes: reconstructing the test model based on the attack data, redetermining the monitoring frequency of the test model for the industrial control system, or redetermining the corresponding processing method.

[0012] Furthermore, the process of reconstructing the test model based on the attack data includes: collecting the attack data and incorporating it into a number of the communication data to regenerate a new data set; Constructing a new training set and a new test set based on the new data set, and constructing a new test model based on the new training set and the new test set; The industrial control system is re-monitored according to the new test model to determine whether there is an abnormality.

[0013] Further, the process of re-determining the monitoring frequency of the test model for the industrial control system includes: Recording the difference between the preset integral difference and the integral difference as integral deviation; Based on the comparison result between the integral deviation and the preset integral deviation, it is determined that the monitoring frequency is increased, and the increase amplitude of the frequency is proportional to the integral deviation.

[0014] Furthermore, the process of redetermining the corresponding processing method includes: Based on the comparison result of the curve intersection points and the preset curve intersection points, determine to reconstruct the test model based on the attack data, or redetermine the monitoring frequency of the test model for the industrial control system, wherein the curve intersection points are the number of intersection points between the data change curve and the control curve.

[0015] Compared with the prior art, the method for detecting abnormal state of communication of industrial control system based on time series model of the present invention has the beneficial effect that the method collects a number of communication data in the database and performs preprocessing to obtain processed data, then extracts features of the processed data to obtain data that can reflect the characteristics of the system state, generates training set and test set based on the collected data, selects a number of time series models according to the processed data in the training set, and performs training and test verification to obtain the test model, the test model can periodically monitor the industrial control system to determine whether there is an abnormality, and count the number of abnormal data, determine whether the industrial control system is attacked based on the comparison result of the number of abnormal data and the preset value, and generate corresponding instructions when attacked, and determine the corresponding processing method, including: determining to update the preset value, reconstructing the training set and the test set based on the attack data, or re-determining the monitoring frequency of the test model for the industrial control system. In this way, the detection accuracy of the test model for abnormal data can be improved, and the recognition ability of the test model for attacks generated by new external threats can be continuously improved to ensure the security of industrial communication.

[0016] Furthermore, the present invention further determines whether the industrial control system is under attack by comparing the abnormality ratio with the preset abnormality ratio, and based on the comparison result, it is determined that when under attack, a data change curve can be drawn based on the detected data, and then the type of attack data can be determined according to the data change curve, thereby improving the detection accuracy of the test model.

[0017] Furthermore, when the present invention cannot accurately determine whether the industrial control system is under attack by comparing the abnormality ratio with the preset abnormality ratio, it can also determine whether the detected data has a predictable trend based on the ratio of the number of white noise data in a single time interval, and then determine to update the test model, thereby improving the detection accuracy of the test model.

[0018] Furthermore, when determining whether there is a predictable trend in the detection data, the present invention also obtains the node slope based on the historical anomaly proportion curve, and determines to update the preset value based on the comparison between the node slope and the preset node slope, thereby optimizing the test model, thereby improving the accuracy of the test model for anomaly detection.

[0019] Furthermore, when determining the type of attack data, the present invention compares the data change curve with several different types of preset curves in sequence to obtain similarity, and determines the type of attack data based on the comparison of the similarity with the preset similarity, and then determines the corresponding processing method, thereby improving the communication security of the industrial control system.

[0020] Furthermore, when the present invention determines that the type of attack data is a new threat, it can also calculate the integral value of the data change curve and the control curve to obtain the integral difference, and determine the corresponding processing method based on the comparison between the integral difference and the preset integral difference, thereby improving the adaptability of the test model to new threats and improving the test model's ability to recognize complex attack scenarios.

[0021] Furthermore, when the present invention cannot determine the corresponding processing method by comparing the integral difference with the preset integral difference, it is also possible to obtain the number of curve intersection points when the data change curve intersects the control curve, and further determine the corresponding processing method based on the comparison between the number of curve intersection points and the preset number of curve intersection points, thereby improving the accuracy of the test model optimization process, thereby improving the communication security of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a module schematic diagram of the method for detecting abnormal communication state of an industrial control system based on a time series model of the present invention; Figure 2 It is a flow chart of a method for detecting abnormal communication state of an industrial control system based on a time series model of the present invention; Figure 3 This is a logic flow chart of the present invention for determining whether an industrial control system is attacked based on the abnormal proportion; Figure 4 A logic flow chart of the present invention for determining the type of attack data when an industrial control system is attacked and the corresponding processing method based on similarity; Figure 5 The present invention is a logic flow chart for redetermining a corresponding processing method based on the integral difference when the industrial control system is subjected to a new attack. DETAILED DESCRIPTION

[0023] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0024] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0025] It should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0026] This embodiment provides a method for detecting abnormal communication status of an industrial control system based on a time series model, which can be applied to the detection of abnormal data or traffic in an industrial communication network. A test model is trained based on the time series model, and the test model is applied to an actual industrial control system to monitor the communication status and accurately determine abnormal data. The method also has self-learning capabilities and can continuously optimize itself to cope with attacks brought by new threats. The method improves the test model's ability to identify complex attack scenarios, thereby ensuring industrial network security.

[0027] See also Figure 1As shown, it is a structural diagram of the method for detecting abnormal communication state of industrial control system based on time series model in this embodiment, and the structure includes data acquisition module, data processing module, feature extraction module, model generation module, monitoring module, analysis module and processing module. The data acquisition module is used to collect several communication data from the database, and then pre-processed by the data processing module connected to the data acquisition module to obtain processed data, wherein the communication data includes abnormal data detected when the industrial control system is monitored in real time; wherein the communication data in the database is the original data collected in real time during the operation of the industrial control system; the pre-processing includes data cleaning and data format conversion, and the cleaning is used to remove noise or duplicate data, and the data format conversion is used to eliminate the dimension difference, and the method of eliminating the dimension mainly includes standardization, normalization, centering or averaging, and the quality and relevance of the input data are improved by data pre-processing, and false positives and false negatives are reduced. Then, the feature extraction module connected to the data processing module uses a machine learning algorithm to automatically extract features from the processed data to obtain data that can reflect the characteristics of the system state, and then generate a training set and a test set. A reasonable training process can avoid overfitting, thereby improving the generalization ability of the model. The training set and the test set are obtained by the model generation module connected to the feature extraction module, and then several suitable time series models are selected according to the periodicity, trend, seasonality and other characteristics of the processed data in the training set, and then the training set is used to train several time series models and the trained models are tested and verified in combination with the test set, and the optimal test model is determined according to the test results. The test model can accurately capture the time series characteristics in the communication data, and can quickly identify and accurately locate the communication anomaly by comparing the normal communication mode with the potential abnormal behavior. The monitoring module is used to receive the test model and use the test model to periodically detect the communication data in the industrial control system to determine whether there is an anomaly, and when it is determined that an anomaly occurs, the corresponding communication data is recorded as abnormal data. More specifically, when the test model is used to monitor the industrial control system, the predicted value of the communication data is obtained, the difference between the predicted value and the actual value corresponding to the communication data is calculated, and then the difference is compared with the set threshold. When the difference exceeds the threshold, it is determined that the current communication data is abnormal, and the communication data is recorded as abnormal data, wherein the difference and the threshold are both absolute values, and the threshold is set using a statistical method. The monitoring module is also used to count the total amount of data monitored in a single time interval and the number of abnormal data.The analysis module is connected to the monitoring module. The analysis module can determine whether the industrial control system is attacked during operation based on the comparison result of the number of abnormal data and the preset value. The attack here refers to the penetration of new threats from the outside into the system and interference with the communication, thereby causing abnormal communication. The abnormal data detected at this time is recorded as attack data; when it is determined that it is attacked, the cause is determined, and the corresponding instructions are generated based on the cause. Then the instructions are input into the processing modules connected to the analysis module, the feature extraction module, and the monitoring module respectively. The processing module determines to re-assign the preset value, re-construct the training set and the test set based on the attack data, and construct a new test model based on the new training set and the new test set, or re-determine the monitoring cycle of the test model for the industrial control system. The corresponding instructions are used to optimize the parameters in the test model, thereby improving the detection accuracy of the test model itself for abnormal data in the industrial control system, and continuously improving the recognition ability of the test model for attacks generated by new external threats, so that the abnormality can be accurately detected in the complex communication environment of the industrial control system to ensure the security of industrial communication.

[0028] In other embodiments, the predictive capability of the time series model can be used to predict the future state of the communication system and issue fault warnings in advance based on the prediction results. By monitoring the dynamic changes of data in real time and using sliding window statistical methods to calculate the short-term and long-term statistical characteristics of the data, the threshold of anomaly detection can be dynamically adjusted based on these characteristics, thereby reducing missed detections and false alarms.

[0029] See also Figure 2 As shown, it is a flow chart of the method for detecting abnormal communication state of industrial control system based on time series model in this embodiment. The process includes the following steps: S1: Collect some communication data and pre-process them to obtain processed data.

[0030] S2: Generate a training set and a test set based on the processed data.

[0031] S3: Use the training set to train several time series models, and use the test set to verify the trained models to obtain corresponding test models.

[0032] S4: The test model periodically monitors the industrial control system to determine whether there is an abnormality, and counts the number of abnormal data.

[0033] S5: Based on the comparison result of the number of abnormal data and the preset value, determine that the industrial control system generates corresponding instructions when it is attacked, and determine the preset value, rebuild the test model based on the attack data, or redetermine the monitoring frequency of the test model for the industrial control system.

[0034] See also Figure 3 As shown, it is a logical flow chart of determining whether the industrial control system is attacked based on the abnormal proportion in this embodiment. The process of determining whether the industrial control system is attacked based on the comparison result of the number of abnormal data and the preset value includes: The total number of data detected by the test model in a single time interval is counted, and the abnormality ratio is calculated based on the number of abnormal data and the total number of data; based on the comparison result of the abnormality ratio with the preset abnormality ratio, or based on the ratio of the number of white noise data in a single time interval, it is determined whether the industrial control system is under attack; when it is determined that the industrial control system is under attack, a data change curve is drawn according to the detected data, and the data change curve is compared with a preset curve pre-stored in a database to determine the type of attack data.

[0035] Specifically, in this embodiment, for several monitoring periods within a single time interval, the data corresponding to each monitoring period is counted, the total number of data and the number of abnormal data are determined, and then the ratio between the number of abnormal data and the total number of data is calculated, and the ratio is recorded as the abnormal proportion W; the preset abnormal proportion W0 can be divided into a first preset abnormal proportion W1 and a second preset abnormal proportion W2, and the preset abnormal proportion standard W3=0.05, W1=W3-0.02, W2=W3+0.02 is set. It should be noted that W3 can also be set to other values ​​and greater than 0.02; the comparison process based on W with W1 and W2 is as follows: If the abnormality proportion W is less than or equal to the first preset abnormality proportion W1, it means that the number of abnormal data in the data detected in the current single time interval is relatively small. Therefore, it can be determined that the current industrial control system is not attacked by new external threats, and the existing abnormal data is caused by network fluctuations.

[0036] If the first preset abnormality proportion W1 is less than the abnormality proportion W and the second preset abnormality proportion W2 is greater than or equal to the abnormality proportion W, it is impossible to accurately determine the number of abnormal data in the total data. Therefore, it is necessary to determine the number of white noise data in the data, calculate the ratio between the number of white noise data and the total data, and record the ratio as the quantity proportion. The comparison result of the quantity proportion and the preset quantity proportion is used to re-determine whether the industrial control system is attacked.

[0037] If the second preset abnormality proportion W2 is less than the abnormality proportion W, it means that the number of abnormal data in the data detected in the current single time interval is relatively large. Therefore, it can be determined that the current industrial control system is attacked by new external threats. When it is determined that it is attacked, a data change curve can be drawn according to the detected data. The data here is all the data in the time interval. The database includes various historical data information obtained under historical monitoring, and uses various historical data information to set several preset curves in advance. Each preset curve can represent a type of attack, and then the data change curve is compared with the preset curve to determine the type of attack.

[0038] Furthermore, the process of determining whether the industrial control system is under attack based on the proportion of the amount of the white noise data in a single time interval includes: The number of white noise data is counted, and the ratio between the number of white noise data and the total number of data is calculated, and the ratio is recorded as the number ratio; based on the comparison result of the number ratio and the preset number ratio, it is determined whether the data has a predictable trend.

[0039] Specifically, in this embodiment, the communication data is preprocessed when setting the training set, and the preprocessing includes denoising. The preprocessed data is used to train the time series model to obtain the test model. Therefore, when white noise data is detected when the test model is used to detect the industrial control system, it is possible to further determine whether the data is abnormal based on the proportion of the white noise data in the total data, so as to determine the corresponding processing method; the preset quantity proportion L0 is set to 0.2. It should be noted that L0 can also be set to other values ​​as needed. The comparison process based on the quantity proportion L and the preset quantity proportion L0 is as follows: If the quantity proportion L is less than or equal to the preset quantity proportion L0, it means that the number of white noise data detected in the current time interval is relatively small. Therefore, it can be determined that there is still a predictable trend in the currently detected data. The historical anomaly proportion curve can be drawn based on the currently detected abnormal data and combined with historical data, and the need to update the test model can be re-determined based on the curve.

[0040] If the preset quantity proportion L0 is less than the quantity proportion L, it means that the number of white noise data detected in the current time interval is relatively large. Therefore, it can be determined that there is no predictable trend in the current data, and it can be directly determined that the industrial control system is attacked by new external threats.

[0041] Further, the process of determining whether the data has a predictable trend based on the comparison result of the quantity ratio and the preset quantity ratio includes: When it is determined that the data has a predictable trend, a historical anomaly proportion curve is drawn according to the anomaly proportion and several historical anomaly proportions; a node slope corresponding to the current time interval node is obtained based on the historical anomaly proportion curve; and whether to update the preset value is determined based on a comparison result of the node slope and the preset node slope.

[0042] Specifically, in this embodiment, the values ​​of the node slope and the preset node slope are both set to absolute values. When it is determined that the detection data in the current time interval has a predictable trend, a historical anomaly proportion curve can be drawn by combining the calculated abnormal proportion value with the values ​​of several historical anomaly proportions counted in the historical monitoring period, and then the node slope P corresponding to the time node is calculated, wherein the historical anomaly proportion is the abnormal proportion when it is detected that the industrial control system has not been attacked by new external threats before the current time interval; the preset node slope P0 is set to 0.5. It should be noted that P0 can also be set to other values. The comparison process based on P and P0 is as follows: If the node slope P is less than or equal to the preset node slope P0, it means that the historical anomaly ratio curve is relatively stable at this time, and then it is determined that the difference between the anomaly ratio in the current time interval and the historical anomaly ratio is relatively small, but there is still a certain amount of white noise data that interferes with the detection process of the test model. Therefore, it is necessary to re-determine a new preset value for comparison and judgment.

[0043] If the preset node slope P0 is smaller than the node slope P, it means that the historical anomaly ratio curve is not stable at this time, and then it is determined that the difference between the anomaly ratio in the current time interval and the historical anomaly ratio is relatively large, and the preset anomaly ratio W0 value is generally set relatively small. Therefore, it can be determined that the anomaly ratio monitored in the current time interval is greater than the historical anomaly ratio, and then it can be determined that the industrial control system has been attacked by new external threats.

[0044] Further, the process of determining whether to update the preset value based on the comparison result of the node slope and the preset node slope includes: When determining to update the preset value, it is determined to reduce the preset value based on the comparison result of the total number of data and the preset total number of data, and the reduction range of the preset value is proportional to the total number of data.

[0045] Specifically, in this embodiment, the total number of preset data K0 can be divided into a first total number of preset data K1 and a second total number of preset data K2, and the total number of preset data standard K3=100 is set, K1=0.9×K3, K2=1.2×K3; the comparison process based on the total number of data K with K1 and K2 is as follows: If the total number of data K is less than or equal to the first preset total number of data K1, the preset value is reduced to 0.95 times the initial value by using the first preset value adjustment coefficient; if the first preset total number of data K1 is less than the total number of data K and the second preset total number of data K2 is greater than or equal to the total number of data K, the preset value is reduced to 0.85 times the initial value by using the second preset value adjustment coefficient; if the second preset total number of data K2 is less than the total number of data K, the preset value is reduced to 0.75 times the initial value by using the third preset value adjustment coefficient; it should be noted that the reduction ratio of the preset value can also be other values, which are not specifically limited here.

[0046] In other embodiments, it is also possible to determine and update the preset abnormality proportion W0, and adjust the determination benchmark by reducing W0. W0 is also reduced based on the comparison results of K with K1 and K2. The comparison process is as follows: If the total number of data K is less than or equal to the first preset total number of data K1, W0 is reduced to 0.9 times the initial value by using the first preset abnormality ratio adjustment coefficient; if the first preset total number of data K1 is less than the total number of data K and the second preset total number of data K2 is greater than or equal to the total number of data K, W0 is reduced to 0.8 times the initial value by using the second preset abnormality ratio adjustment coefficient; if the second preset total number of data K2 is less than the total number of data K, W0 is reduced to 0.7 times the initial value by using the third preset abnormality ratio adjustment coefficient; it should be noted that the reduction ratio of W0 can also be other values, which are not specifically limited here; in this embodiment, W0 is specifically updated by updating W3.

[0047] See also Figure 4 As shown, it is a logic flow chart of determining the type of attack data when the industrial control system is attacked based on similarity and the corresponding processing method in this embodiment. The process of determining the type of attack data based on the comparison of the data change curve with the preset curve includes: Several different types of preset curves are set in the database, and each preset curve can represent a type of attack data; the data change curve is compared with several different types of preset curves in turn, and the corresponding similarity is determined based on the comparison result; the type of attack data is determined based on the comparison result of the similarity and the preset similarity.

[0048] Specifically, in this embodiment, various historical data information obtained in the database during historical monitoring is used to generate several preset curves, and each preset curve can characterize a type of attack, and then a data change curve is drawn according to each data detected in the current time interval, and this data change curve is compared with each preset curve in turn to determine the similarity between the data change curve and each preset curve, and then the type of attack data is determined according to the comparison result of each similarity with the preset similarity, and then processed according to the plan, wherein the time interval between each data in the data change curve is consistent with the time interval between each data in the preset curve, and the number of selected data is also corresponding. In this embodiment, the overlap between the two curves can be determined by similarity; the preset similarity M0=90% is set, and M0 can also be set to other values ​​as needed. The comparison process based on the similarity M and M0 is as follows: If the similarity M is less than or equal to the preset similarity M0, it means that the similarity or overlap between the data change curve and each preset curve is relatively low. Therefore, the type of attack data cannot be determined based on the preset curves in the database. At this time, it is necessary to select a preset curve with the highest similarity to the data change curve from among the preset curves, and redetermine the processing method based on the comparison between the data change curve and the preset curve.

[0049] If the preset similarity M0 is less than the similarity M, it is also necessary to determine the preset curve with the largest M compared with the data change curve among all the preset curves, and determine the specific type of attack data suffered by the industrial control system in the current time interval based on the preset curve, so as to respond to the attack according to the previously arranged plan.

[0050] See also Figure 5 As shown, it is a logical flow of re-determining the corresponding processing method based on the integral difference when the industrial control system is attacked newly in this embodiment. The process of determining the type of the attack data based on the comparison result of the similarity and the preset similarity includes: Calculating the integral values ​​corresponding to the data change curve and the control curve respectively, and calculating the absolute value of the difference between the integral values ​​of the two, and recording the absolute value of the difference as the integral difference, wherein the control curve is the preset curve whose similarity is closest to the preset similarity; Determining a corresponding processing method based on a comparison result between the integral difference and a preset integral difference includes: reconstructing the test model based on the attack data, redetermining the monitoring frequency of the test model for the industrial control system, or redetermining the corresponding processing method.

[0051] Specifically, in this embodiment, when the attack data type cannot be accurately determined in the process of comparing the similarity with the preset similarity, a preset curve with the highest similarity to the data change curve can be selected from a number of preset curves, and then two integral values ​​corresponding to the preset curve and the data change curve are calculated, and then the integral difference is calculated according to the two integral values. The processing method when the attack data type is not retrieved is further found out by comparing the integral difference with the preset integral difference. In this embodiment, the similarity of the two curves can be determined based on the size of the integral difference; the preset integral difference G0 can also be divided into a first preset integral difference G1 and a second preset integral difference G2, and the preset integral difference standard G3=1.25 square meters is set, G1=0.85×G3, G2=1.25×G3. It should be noted that G1, G2 and G3 can be set to other values ​​according to actual conditions. The comparison process based on the integral difference G with G1 and G2 is as follows: If the integral difference G is less than or equal to the first preset integral difference G1, it means that the current integral difference value is relatively small. Therefore, if the type of attack data cannot be accurately determined at this time, it is determined that there is a problem with the test model in actual monitoring. Specifically, the monitoring frequency within a single time interval is relatively low, which causes the data change curve to deviate during the construction process. At this time, it is necessary to redetermine the monitoring frequency of the test model for the industrial control system.

[0052] If the first preset integral difference G1 is smaller than the integral difference G and the second preset integral difference G2 is greater than or equal to G, the current integral difference value cannot be accurately determined, and the corresponding processing method needs to be re-determined.

[0053] If the second preset integral difference G2 is less than the integral difference G, it means that the current integral difference value is relatively large. Therefore, it can be directly determined that the current data change curve cannot be characterized in the same way as the corresponding control curve, and the current attack data type is determined to be a new attack data type generated by a new threat. At this time, it is necessary to reconstruct the training set and test set based on the attack data received in the current time interval, and then construct a new test model based on the new training set and the new test set.

[0054] Furthermore, the process of reconstructing the test model based on the attack data includes: The attack data is collected and incorporated into some of the communication data to regenerate a new data set; a new training set and a new test set are constructed based on the new data set, and a new test model is constructed based on the new training set and the new test set; and the industrial control system is re-monitored according to the new test model to determine whether there is an abnormality.

[0055] Further, the process of re-determining the monitoring frequency of the test model for the industrial control system includes: The difference between the preset integral difference and the integral difference is recorded as the integral deviation; based on the comparison result of the integral deviation and the preset integral deviation, it is determined to increase the monitoring frequency, and the increase amplitude of the frequency is proportional to the integral deviation.

[0056] Specifically, in this embodiment, when it is determined that the type of attack data cannot be accurately determined due to the relatively large monitoring frequency, the increase in the monitoring frequency can be determined based on the comparison result of the integral deviation and the preset integral deviation, that is, the number of monitoring cycles is increased, so that the deviation of the data change curve in the construction process can be eliminated, and the preset integral difference at this time is specifically the first preset integral difference; the preset integral deviation T0 can also be divided into a first preset integral deviation T1 and a second preset integral deviation T2, and the preset integral deviation standard T3=0.6 square meters is set, T1=1.2×T3, T2=1.6×T3, it should be noted that T1, T2 and T3 can all be set according to the specific situation; the comparison process based on the integral deviation T with T1 and T2 is as follows: If the integral deviation T is less than or equal to the first preset integral deviation T1, the monitoring frequency is increased to 1.5 times the initial value by using the first frequency adjustment coefficient; if the first preset integral deviation T1 is less than the integral deviation T and the second preset integral deviation T2 is greater than or equal to the integral deviation T, the monitoring frequency is increased to 2.8 times the initial value by using the second frequency adjustment coefficient; if the second preset integral deviation T2 is less than the integral deviation T, the monitoring frequency is increased to 3.6 times the initial value by using the third frequency adjustment coefficient. Specifically, in this embodiment, the frequency increase ratio can also be set to other values, with the standard that the increase can eliminate the deviation of the data change curve in the construction process.

[0057] Furthermore, the process of redetermining the corresponding processing method includes: Based on the comparison result of the curve intersection points and the preset curve intersection points, determine to reconstruct the test model based on the attack data, or redetermine the monitoring frequency of the test model for the industrial control system, wherein the curve intersection points are the number of intersection points between the data change curve and the control curve.

[0058] Specifically, in this embodiment, the number of intersections generated when the statistical data change curve and the control curve intersect is counted, which are recorded as curve intersection points, and then the processing method is determined according to the comparison results of the curve interaction points and the preset curve intersection points, so that the accuracy of the test model optimization process can be tested and communication anomalies can be detected in time, thereby further improving the communication security of the industrial control system; the number of monitoring cycles in a single time interval is set to 20, and the preset number of curve intersection points B0 is set to 5. It should be noted that the number of monitoring cycles and B0 can be set as needed; the comparison process based on the curve intersection point B and B0 is as follows: If the curve intersection point B is less than or equal to the preset curve intersection point number B0, it means that the current number of curve intersection points is relatively small. At this time, it can be directly determined that the current data change curve cannot be represented in the same way as the corresponding control curve, and the current attack data type is determined to be a new attack data type generated by a new threat. It is determined to reconstruct the training set and test set based on the attack data, and then build a new test model based on the new training set and the new test set.

[0059] If the preset number of curve intersection points B0 is less than the curve intersection point B, it means that the current number of curve intersection points is relatively large. At this time, it can be determined that there is a problem with the test model in actual monitoring, and the monitoring frequency of the test model for the industrial control system needs to be re-determined.

[0060] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0061] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal communication status of industrial control systems based on a time series model, characterized in that: include: collecting a number of communication data and preprocessing the data to obtain processed data; Generate a training set and a test set based on the processed data; Using the training set to train a number of time series models, and using the test set to verify the trained models to obtain corresponding test models; The test model periodically monitors the industrial control system to determine whether there is an abnormality, and counts the number of abnormal data; Based on the comparison result of the number of abnormal data and the preset value, it is determined whether the industrial control system is attacked, and when attacked, corresponding instructions are generated, and preset values ​​are determined, the test model is rebuilt based on the attack data, or the monitoring frequency of the test model for the industrial control system is re-determined.

2. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 1 is characterized in that: The process of determining whether the industrial control system is attacked based on the comparison result of the amount of abnormal data with the preset value includes: Counting the total number of data detected by the test model in a single time interval, and calculating the abnormality ratio based on the number of abnormal data and the total number of data; Determining whether the industrial control system is under attack based on a comparison result of the abnormality ratio with a preset abnormality ratio, or based on the quantity ratio of white noise data in a single time interval; When it is determined that the industrial control system is under attack, a data change curve is drawn according to the detected data, and the data change curve is compared with a preset curve pre-stored in the database to determine the type of attack data.

3. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 2 is characterized in that: The process of determining whether the industrial control system is under attack based on the proportion of the white noise data in a single time interval includes: Counting the number of white noise data, and calculating the ratio between the number of white noise data and the total number of data, and recording the ratio as the number ratio; Based on the comparison result between the quantity ratio and the preset quantity ratio, it is determined whether the data has a predictable trend.

4. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 3 is characterized in that: The process of determining whether the data has a predictable trend based on the comparison result of the quantity ratio and the preset quantity ratio includes: When it is determined that the data has a predictable trend, a historical anomaly proportion curve is drawn according to the anomaly proportion and several historical anomaly proportions; Based on the historical anomaly proportion curve, a node slope corresponding to a node in the current time interval is obtained; Whether to update the preset value is determined based on a comparison result between the node slope and a preset node slope.

5. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 4 is characterized in that: The process of determining whether to update the preset value based on the comparison result of the node slope and the preset node slope includes: When determining to update the preset value, it is determined to reduce the preset value based on the comparison result of the total number of data and the preset total number of data, and the reduction range of the preset value is proportional to the total number of data.

6. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 2, characterized in that: The process of determining the type of attack data based on the comparison between the data change curve and the preset curve includes: The database is provided with a plurality of different types of preset curves, and each preset curve can represent a type of attack data; Comparing the data change curve with a plurality of preset curves of different types in sequence, and determining corresponding similarities based on the comparison results; The attack data type is determined based on a comparison result of the similarity with a preset similarity.

7. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 6 is characterized in that: The process of determining the type of the attack data based on the comparison result of the similarity and the preset similarity includes: Calculating the integral values ​​corresponding to the data change curve and the control curve respectively, and calculating the absolute value of the difference between the integral values ​​of the two, and recording the absolute value of the difference as the integral difference, wherein the control curve is the preset curve whose similarity is closest to the preset similarity; Determining a corresponding processing method based on a comparison result between the integral difference and a preset integral difference includes: reconstructing the test model based on the attack data, redetermining the monitoring frequency of the test model for the industrial control system, or redetermining the corresponding processing method.

8. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 7 is characterized in that: The process of reconstructing the test model based on the attack data includes: collecting the attack data and incorporating it into a number of the communication data to regenerate a new data set; Constructing a new training set and a new test set based on the new data set, and constructing a new test model based on the new training set and the new test set; The industrial control system is re-monitored according to the new test model to determine whether there is an abnormality.

9. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 7, characterized in that: The process of re-determining the monitoring frequency of the test model for the industrial control system includes: Recording the difference between the preset integral difference and the integral difference as integral deviation; Based on the comparison result between the integral deviation and the preset integral deviation, it is determined that the monitoring frequency is increased, and the increase amplitude of the frequency is proportional to the integral deviation.

10. The method for detecting abnormal communication state of an industrial control system based on a time series model according to claim 7, characterized in that: The process of redetermining the corresponding treatment method includes: Based on the comparison result of the curve intersection points and the preset curve intersection points, determine to reconstruct the test model based on the attack data, or redetermine the monitoring frequency of the test model for the industrial control system, wherein the curve intersection points are the number of intersection points between the data change curve and the control curve.

Images