Industrial control communication behavior pattern baseline library construction method based on deep learning algorithm

Abstract

The invention relates to the field of industrial control communication security, in particular to an industrial control communication behavior pattern baseline library construction method based on a deep learning algorithm, which comprises the following steps: under a training execution condition, determining a data baseline state of target update data according to fluctuation data dispersity and a key data proportion, determining a training data analysis strategy according to the data baseline state; when change reproduction analysis is carried out, a similar reproduction set of target update data in a current update interval stage is obtained, and a data extraction mode is determined according to a fluctuation reproduction period proportion; when distribution feature analysis is carried out, whether data compensation extraction is carried out on the key training data or not is determined based on the equipment operation data corresponding to the key analysis set; under the condition that extraction is completed, the baseline model is updated based on the obtained key training data so as to obtain the model difference threshold value of the target updating data, updating training of the safety baseline model is completed, and the monitoring capacity of the constructed mode baseline library for the safety of industrial control communication behaviors is improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial control communication security, and in particular to a method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm. Background Art

[0002] By constructing a pattern baseline library to conduct security monitoring of the communication behavior of the industrial control system to identify abnormal traffic and external network attacks, the security performance of data communication within the industrial control system can be effectively guaranteed, thereby ensuring the safe and stable operation of the industrial control system. In addition, compared with the traditional method of constructing a behavioral pattern baseline library based on statistical analysis, the deep learning algorithm is used to continuously adjust the pattern baseline library, which can better adapt to the changes in the industrial control system under different production conditions, and further improve the ability to monitor the security of industrial control communication behavior. However, the acquired model training data is the basis for the effectiveness of the constructed pattern baseline library. Therefore, how to determine the targeted training data extraction method according to the actual situation of the industrial control system to ensure the effectiveness of the extracted training data, and then improve the constructed pattern baseline library for the security of industrial control communication behavior Monitoring ability is a problem that needs to be urgently solved by technical personnel in this field.

[0003] Chinese patent publication number CN118631569A discloses an industrial control system anomaly detection method based on session feature continuity, comprising the following steps: when the industrial control system is operating normally, continuously collect the traffic in the industrial control network, obtain the data packet pcap file, extract the network data packet, and construct a training data set according to the characteristics of the continuous session feature. Use a convolutional neural network to build a twin network, train the twin network with the training data set, and obtain a trained industrial control anomaly detection model. In the anomaly detection stage, the traffic in the industrial control network is collected in real time, the network data packets in the traffic are extracted, and a combined sample is constructed according to the characteristics of the continuous session feature, and the combined sample is output to the industrial control anomaly detection model. If the output value of the model is greater than the set threshold, it indicates that the current system is abnormal, otherwise it is normal. However, the above scheme has the following problems: it fails to determine the targeted training data extraction process according to the time series characteristics of the data packets with analysis features obtained in the actual communication security monitoring process, resulting in low effectiveness of the acquired training data, and then resulting in the constructed pattern baseline library for the security of industrial control communication behavior. Monitoring capability is low. Summary of the invention

[0004] To this end, the present invention provides a method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm, so as to overcome the problem in the prior art that a targeted training data extraction process is not determined according to the time series characteristics of the communication segments with analysis characteristics obtained during the actual communication security monitoring process, resulting in low effectiveness of the acquired training data, and further leading to the problem of the constructed pattern baseline library's ability to monitor the security of industrial control communication behavior.

[0005] To achieve the above object, the present invention provides a method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm, comprising: Under the training execution conditions, update training is performed on the security baseline model corresponding to the target update data. The data baseline status of the target update data is determined based on the dispersion of the fluctuating data and the proportion of key data. The training data analysis strategy is determined based on the data baseline status. The training data analysis strategy is to perform change recurrence analysis or distribution feature analysis on the target update data. When performing change recurrence analysis, obtain a similar recurrence set of target update data within the current update interval, and determine a data extraction method based on the fluctuation recurrence period ratio. The data extraction method is to determine a window extraction parameter and a window sliding index based on similar recurrence parameters and recurrence duration parameters, or to determine a window extraction parameter and a window sliding index based on a recurrence stability coefficient and a recurrence duration parameter. When performing distribution feature analysis, determine the key analysis set of the target update data based on the change interval duration and key paragraph parameters, and determine whether to perform data compensation extraction for key training data based on the associated running data corresponding to the key analysis set; Under the extraction completion condition, the baseline model is updated based on the acquired key training data to obtain the model difference threshold of the target update data and complete the update training of the security baseline model; Under the baseline update condition, the security warning communication segment is determined based on the comparison result of the abnormal security assessment score and the model difference threshold of the target update data, and whether the communication behavior of the target update data is abnormal is determined based on the proportion of the warning segment.

[0006] Furthermore, under the training execution condition, update training is performed on the security baseline model corresponding to the target update data, the monitoring communication segments of the target update data in the update interval phase are obtained, and the monitoring communication segments whose data change degree is greater than the preset data change degree are recorded as key analysis communication segments; Update data for a single target, The dispersion of the fluctuation data is determined based on the time stamp difference parameter between the key analysis communication segments; The key data ratio is the ratio of the number of key analysis communication segments of the target update data to the number of monitoring communication segments during the update interval; The training execution condition is that if the update interval of an industrial control monitoring data is longer than the preset update interval or the data fluctuation parameter is larger than the preset data fluctuation parameter, the industrial control monitoring data is recorded as the target update data.

[0007] Furthermore, for a single target update data, if the target update data is in a data baseline state where the key data ratio is greater than the preset key data ratio or the fluctuation data dispersion is greater than the preset fluctuation data dispersion, a change recurrence analysis is performed on the target update data, including: Based on the analysis of the change interval length of the communication segments and the degree of data change in each communication segment set, a recurring segment combination is determined, and the communication segment set included in the recurring segment combination is recorded as a similar recurring set; Detect the fluctuation recurrence period ratio of the project target update data, and determine the setting method of data extraction parameters according to the fluctuation recurrence period ratio; The fluctuation recurrence period ratio is the ratio of the sum of the durations of the similar recurrence sets to the duration of the current update interval.

[0008] Furthermore, when the fluctuation recurrence period ratio of the target update data is greater than the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the similar recurrence parameter and the recurrence duration parameter of the target update data, and whether to reduce and adjust the window sliding index is determined according to the timestamp interval stability coefficient of each similar recurrence set; If the timestamp interval stability coefficient is less than the preset timestamp interval stability coefficient, the window sliding index is reduced and adjusted according to the timestamp interval stability coefficient; The decrease value of the window sliding index is negatively correlated with the timestamp interval stability coefficient.

[0009] Furthermore, when the fluctuation recurrence period ratio of the target update data is less than or equal to the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the recurrence stability coefficient and the recurrence duration parameter, and the window extraction parameter is reduced and adjusted according to the set recurrence duration difference; The reduction value of the window extraction parameter is negatively correlated with the set recurrence continuous difference; The reproduction stability coefficient is determined according to the similar reproduction coefficients of each reproduction segment combination of the target update data in the current update interval stage.

[0010] Furthermore, for a single target update data, if the target update data is in a second-class data baseline state where the key data ratio is less than or equal to the preset key data ratio and the fluctuation data dispersion is less than or equal to the preset fluctuation data dispersion, a distribution characteristic analysis is performed on the target update data, including: Determine a key analysis set according to the change interval duration and key segment parameters in the distribution analysis phase of each key analysis communication segment; Whether to perform data compensation extraction for key training data is determined according to the difference in operation data of associated production equipment corresponding to target update data within the industrial control production cycle corresponding to each key analysis set.

[0011] Further, if the running data difference of the target update data in the current update interval stage is less than the preset running data difference, data compensation extraction is performed for the key training data of the target update data; Based on the operation difference coefficient and the key distribution coefficient of each key analysis set, the window sliding parameter of the time range covered by the associated production set is reduced and adjusted; The decrease value of the window sliding parameter is negatively correlated with the operation difference coefficient, and the decrease value of the window sliding parameter is positively correlated with the key distribution coefficient.

[0012] Further, the key distribution coefficient of any key analysis set is greater than a preset key distribution coefficient, and the key distribution coefficient is determined according to the change interval duration and the key segment parameters of each key analysis communication segment; For a single key analysis set, any focused analysis communication segment exists in at least one distribution analysis phase of a focused analysis communication segment in the key analysis set.

[0013] Furthermore, under the condition that the extraction is completed, the baseline model is updated based on the acquired key training data, and the updating process includes: Using the key training data as input data of the baseline encoder corresponding to the target update data to obtain low-dimensional data features of the target update data; According to the baseline decoder, the low-dimensional data features are restored to the initial dimension to obtain reconstructed training data; Update training of the security baseline model for target update data based on low-dimensional data features; Determine a model difference threshold of target update data based on key training data and reconstructed training data; The extraction completion condition is that the key training data of the target update data is extracted.

[0014] Furthermore, under the baseline update condition, based on the security baseline model that has completed the update training, the abnormal safety assessment scores of each monitoring communication segment are obtained for the target update data within the current update interval stage, and the monitoring communication segment whose abnormal safety assessment score is greater than the model difference threshold of the target update data is defined as a security warning communication segment; If the proportion of warning paragraphs is greater than the preset proportion of warning paragraphs, it is determined that the communication behavior of the target updating data is abnormal; The baseline update condition is that the security baseline model of the target update data completes update training.

[0015] Compared with the prior art, the beneficial effect of the present invention lies in that the technical solution of the present invention determines the training data analysis strategy according to the dispersion of fluctuation data and the proportion of key data in the update interval stage of the target update data that needs to be updated and trained according to the security baseline model, so that the extraction process of the training data is more in line with the distribution characteristics of the actual data at the time of change, and the representativeness of the acquired training data for the data characteristics is improved, thereby improving the effectiveness of the update training results of the security baseline model. The present invention ensures the monitoring capability of the constructed pattern baseline library for the security of industrial control communication behavior.

[0016] Furthermore, the present invention continuously learns based on the monitoring data of the monitored industrial control system based on the autoencoder model, continuously optimizes the adaptability of the security baseline model of various industrial control monitoring data to the operating status of the industrial control system, avoids the constructed behavior pattern baseline library being unable to reflect the current industrial control system status in real time, and while improving the monitoring capability of the constructed behavior pattern baseline library on data communication security, avoids the probability of false alarms for abnormal behavior. The present invention improves the monitoring effect of the constructed pattern baseline library on the security of industrial control communication behavior.

[0017] Furthermore, the present invention determines the data baseline state of the target update data based on the fluctuation data dispersion and the key data proportion of the key analysis communication segments, which is used to characterize the time series characteristics of the key analysis communication segments of the target update data, so as to determine whether the time corresponding to the key analysis communication segments of the target update data within the update interval stage exists in a time range or has a distribution regularity, and provides an analysis basis for determining the subsequent training data extraction method, so that the training data extraction process is more in line with the actual data situation. The present invention improves the effectiveness of the acquired training data, and thereby improves the monitoring capability of the determined security baseline model for data communication security.

[0018] Furthermore, in the present invention, for target update data in a type of data baseline state, a change recurrence analysis is performed on the target update data. Since such target update data often has more key analysis communication segments or the distribution of timestamps corresponding to the key analysis communication segments is relatively scattered, a similar recurrence set is determined based on the timestamps of the key analysis communication segments and the change characteristics, which further characterizes the regularity of changes in the target update data within the update interval stage, and determines a targeted extraction method based on the specific change regularity obtained from the analysis, thereby improving the representativeness of the acquired training data for data features. The present invention improves the effectiveness of the update training results for the security baseline model. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of a method for constructing a baseline library of industrial control communication behavior patterns based on a deep learning algorithm of the present invention; Figure 2 This is a flow chart of the present invention for determining the data baseline state of target update data according to the dispersion of fluctuating data and the proportion of key data; Figure 3 A flow chart of the present invention for determining a training data analysis strategy based on a data baseline state; Figure 4 The present invention is a flow chart for determining whether to perform data compensation extraction on key training data according to the difference of running data. DETAILED DESCRIPTION

[0020] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0021] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0022] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0023] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] See also Figures 1 to 4 As shown, an embodiment of the present invention provides a method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm, comprising: Under the training execution conditions, update training is performed on the security baseline model corresponding to the target update data. The data baseline status of the target update data is determined based on the dispersion of the fluctuating data and the proportion of key data. The training data analysis strategy is determined based on the data baseline status. The training data analysis strategy is to perform change recurrence analysis or distribution feature analysis on the target update data. When performing change recurrence analysis, obtain a similar recurrence set of target update data within the current update interval, and determine a data extraction method based on the fluctuation recurrence period ratio. The data extraction method is to determine a window extraction parameter and a window sliding index based on similar recurrence parameters and recurrence duration parameters, or to determine a window extraction parameter and a window sliding index based on a recurrence stability coefficient and a recurrence duration parameter. When performing distribution feature analysis, determine the key analysis set of the target update data based on the change interval duration and key paragraph parameters, and determine whether to perform data compensation extraction for key training data based on the associated running data corresponding to the key analysis set; Under the extraction completion condition, the baseline model is updated based on the acquired key training data to obtain the model difference threshold of the target update data and complete the update training of the security baseline model; Under the baseline update condition, the security warning communication segment is determined based on the comparison result of the abnormal security assessment score and the model difference threshold of the target update data, and whether the communication behavior of the target update data is abnormal is determined based on the proportion of the warning segment.

[0025] Among them, the application scenario of the present invention is the construction of a communication behavior pattern baseline library for industrial control systems. The monitored industrial control system is recorded as the target monitoring system, and the data that need to complete communication transmission in the target monitoring system is recorded as industrial control monitoring data. Any industrial control monitoring data in the present invention corresponds to associated production equipment. For a single industrial control monitoring data, the production equipment that needs the industrial control monitoring data to complete data upload is recorded as the associated production equipment of the industrial control monitoring data. The data content transmitted by the industrial control monitoring data is the data that needs to be uploaded by the associated production equipment. In the present invention, each industrial control monitoring data corresponds to a security baseline model, which is used to determine the abnormal security assessment score of each monitoring communication section of the corresponding industrial control monitoring data. The abnormal security assessment score is the reconstruction error between the original data of the monitoring communication section and the reconstructed data obtained through the security baseline model. This is content that is easy for technical personnel in this field to understand and will not be repeated here. Several system monitoring records are applied in the present invention, and any system monitoring record records the update interval duration, data fluctuation parameters, data change degree, key data proportion, fluctuation data dispersion, similarity recurrence coefficient, fluctuation recurrence period proportion, timestamp interval stability coefficient and operation data difference in at least one update training process for the security baseline model corresponding to the target update data, and each system monitoring record corresponds to a qualified mark, which records whether the effectiveness of the user's update training results for the security baseline model meets the user's needs. It can be understood that the user can determine whether the effectiveness of the user's update training results for the security baseline model meets the needs based on self-set indicators. For example, the self-set indicators can be but are not limited to the abnormal behavior false alarm rate, and the abnormal behavior false alarm rate = the number of false alarms for abnormal communication behavior / the number of judgments of abnormal communication behavior.

[0026] Specifically, under the training execution condition, the security baseline model corresponding to the target update data is updated and trained, the monitoring communication segments of the target update data in the update interval phase are obtained, and the monitoring communication segments whose data change degree is greater than the preset data change degree are recorded as key analysis communication segments; Update data for a single target, The dispersion of the fluctuation data is determined based on the time stamp difference parameter between the key analysis communication segments; The key data ratio is the ratio of the number of key analysis communication segments of the target update data to the number of monitoring communication segments during the update interval; The training execution condition is that there is an item of industrial control monitoring data whose update interval duration is greater than the preset update interval duration or whose data fluctuation parameter is greater than the preset data fluctuation parameter, and the industrial control monitoring data is recorded as the target update data.

[0027] Among them, for a single industrial control monitoring data, the update interval duration is the interval duration between the time when the security baseline model corresponding to the industrial control monitoring data was updated and trained most recently and the current time, and the time period between the time when the security baseline model corresponding to the industrial control monitoring data was updated and trained and the current time is recorded as the update interval stage, the data fluctuation parameter is the sum of the fluctuation focus parameter and the focus fluctuation difference index of the industrial control monitoring data, the fluctuation focus parameter is the number of key analysis communication sections in the update interval stage, the focus fluctuation difference index = the maximum value of the absolute value of the difference between the data change degree of each key analysis communication section and the reference change degree / reference change degree, the reference change degree is the average value of the data change degree of each key analysis communication section in the update interval stage, if the industrial control monitoring data meets the training execution conditions, the part of the industrial control monitoring data obtained in the current update interval stage is recorded as the target update data; The preset update interval duration and the value of the preset data fluctuation parameter can be determined by the user according to the actual working scenario. For example, the user can set them according to the system monitoring record. The higher the user's requirements for the effectiveness of the updated training results of the security baseline model, the smaller the value of the preset update interval duration and the smaller the value of the preset data fluctuation parameter. A method for determining the value of the preset update interval duration is provided, and the average value of the update interval duration of each target updated data in the system monitoring record that meets the user's requirements for the effectiveness of the updated training results of the security baseline model is recorded as the preset update interval duration. A method for determining the value of the preset data fluctuation parameter is provided, and the average value of the data fluctuation parameter of each target updated data in the system monitoring record that meets the user's requirements for the effectiveness of the updated training results of the security baseline model is recorded as the preset data fluctuation parameter. For single-item target update data, the corresponding update interval phase is divided to obtain monitoring communication segments, and the time ranges corresponding to the obtained monitoring communication segments are the same. For a single monitoring communication segment, the data change degree is determined according to the transmission content length change degree and the data packet transmission change degree. The data change degree is the sum of the transmission content length change degree and the data packet transmission change degree. The transmission content length change degree = the absolute value of the difference between the transmission content reference length of the monitoring communication segment and the previous monitoring communication segment / the transmission content reference length of the previous monitoring communication segment. The transmission content reference length is the average value of the transmission content lengths of each monitoring communication segment within the corresponding time range. The data packet transmission change degree = the absolute value of the difference between the data packet transmission parameters of the monitoring communication segment and the previous monitoring communication segment / the data packet transmission parameters of the previous monitoring communication segment. The data packet transmission parameters are the number of data packets sent by the monitoring communication segment within the corresponding time range; The value of the preset data change degree can be determined by the user according to the actual working scenario. For example, the user can set it according to the system monitoring record. The higher the user's requirement for the effectiveness of the updated training result of the security baseline model, the smaller the value of the preset data change degree is. A method for determining the value of the preset data change degree is provided, and the minimum value of the data change degree of each key analysis communication segment in the system monitoring record that meets the user's requirement for the effectiveness of the updated training result of the security baseline model is recorded as the preset data change degree. For single-item target update data, the key data proportion = the number of key analysis communication sections of the target update data in the update interval stage / the number of monitoring communication sections of the target update data in the update interval stage, the fluctuation data dispersion = ln (key section coverage / key timestamp difference of target update data), the key section coverage = the duration of the key coverage section / the update interval duration corresponding to the target update data, the starting time of the key coverage section is the starting time of the first key analysis communication section in the update interval stage, the ending time of the key coverage section is the ending time of the last key analysis communication section in the update interval stage, the key timestamp difference parameter , t is the number of communication segments monitored during the update interval of the target update data, The i-th timestamp difference parameter of the target update data during the update interval phase. It is the average value of each time stamp difference parameter of the target update data in the update interval phase, and the time stamp difference parameter is the time interval between the end times of any two adjacent key analysis communication segments.

[0028] Specifically, for the single-project target update data, if the target update data is in a data baseline state where the key data ratio is greater than the preset key data ratio or the fluctuation data dispersion is greater than the preset fluctuation data dispersion, a change recurrence analysis is performed on the target update data, including: Based on the analysis of the change interval length of the communication segments and the degree of data change in each communication segment set, a recurring segment combination is determined, and the communication segment set included in the recurring segment combination is recorded as a similar recurring set; Detect the fluctuation recurrence period ratio of the project target update data, and determine the setting method of data extraction parameters according to the fluctuation recurrence period ratio; The fluctuation recurrence period ratio is the ratio of the sum of the durations of the similar recurrence sets to the duration of the current update interval.

[0029] Among them, the values ​​of the preset key data ratio and the preset fluctuation data dispersion can be determined by the user according to the actual work scenario. For example, the user can set them according to the system monitoring record, and a method for determining the value of the preset key data ratio is provided, and the system monitoring record for the change reproduction analysis of the project target update data is recorded as the initial evaluation record, and the minimum value of the key data ratio of the target update data in the initial evaluation record that meets the user's requirements for the effectiveness of the updated training results of the security baseline model is recorded as the preset key data ratio, and a value of the preset key data ratio is provided, and the value of the preset key data ratio is 0.45. A method for determining the value of the preset fluctuation data dispersion is provided, and the minimum value of the fluctuation data dispersion of the target update data in the initial evaluation record that meets the user's requirements for the effectiveness of the updated training results of the security baseline model is recorded as the preset fluctuation data dispersion; For single target update data, the fluctuation recurrence period ratio = the sum of the durations corresponding to each similar recurrence set of the target update data in the current update interval phase / the duration corresponding to the current update interval phase. The communication segment set is composed of a number of monitored communication segments. The similarity recurrence coefficient of any recurrence segment combination is greater than the preset similarity recurrence coefficient. For a single recurrence segment combination, the number of key analysis communication segments in each communication segment set contained therein is the same, and the similarity recurrence coefficient , is the number of communication paragraphs to be analyzed in each communication paragraph set in the recurring paragraph combination, Dn is the nth change interval difference value of each communication paragraph set in the recurring paragraph combination, , h is the number of communication paragraph sets in the recurring paragraph combination, is the nth change interval duration of the ath communication segment set in the recurring segment combination, is the average value of the nth change interval duration of each communication paragraph set in the recurring paragraph combination, wherein the change interval duration is the interval duration between the end times of two adjacent communication paragraphs for key analysis, and Bn is the nth change degree difference value of each communication paragraph set in the recurring paragraph combination. , The data change degree of the nth focused communication paragraph of the ath communication paragraph set in the recurring paragraph combination is analyzed, The average value of the data change degree of the nth focused analysis communication paragraph of each communication paragraph set in the recurring paragraph combination; The value of the preset similarity recurrence coefficient can be determined by the user according to the actual working scenario. For example, the user can set it according to the system monitoring record. The higher the user's requirement for the effectiveness of the updated training results of the security baseline model, the larger the value of the preset similarity recurrence coefficient. A method for determining the value of the preset similarity recurrence coefficient is provided, and the average value of the similarity recurrence coefficient of each combination of recurring paragraphs in the system monitoring record that meets the user's requirement for the effectiveness of the updated training results of the security baseline model is recorded as the preset similarity recurrence coefficient.

[0030] Specifically, when the fluctuation recurrence period ratio of the target update data is greater than the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the similar recurrence parameters and the recurrence duration parameters of the target update data, and whether to reduce the window sliding index is determined according to the timestamp interval stability coefficient of each similar recurrence set; If the timestamp interval stability coefficient is less than the preset timestamp interval stability coefficient, the window sliding index is reduced and adjusted according to the timestamp interval stability coefficient; The decrease value of the window sliding index is negatively correlated with the timestamp interval stability coefficient.

[0031] Among them, the value of the preset recurrence cycle ratio can be determined by the user according to the actual work scenario. For example, the user can set it according to the system monitoring record, and a method for determining the value of the preset recurrence cycle ratio is provided, and the system monitoring record for determining the window extraction parameter and the window sliding index based on the similarity recurrence parameter and the recurrence duration parameter of the target update data is recorded as the recurrence reference record, and the minimum value of the fluctuation recurrence cycle ratio of the target update data in the recurrence reference record that meets the user's requirements for the effectiveness of the update training results of the security baseline model is recorded as the preset recurrence cycle ratio; For a single target update data, if the fluctuation recurrence period ratio is greater than the preset recurrence period ratio, it indicates that the target update data has more reproducible data change characteristics. The window extraction parameter and the window sliding parameter are determined based on the similar recurrence parameter and the recurrence duration parameter of the target update data. The window extraction parameter is positively correlated with the reference recurrence set coefficient. The reference recurrence set coefficient is determined according to the similar recurrence parameter and the reference recurrence duration parameter. The reference recurrence set coefficient = similar recurrence parameter / reference recurrence duration parameter. The similar recurrence parameter = the number of recurrence paragraph combinations of the target update data + the average value of the number of similar recurrence sets contained in each recurrence paragraph combination. The reference recurrence duration parameter is the average value of the recurrence duration parameters of the recurrence paragraph combination of the target update data. For a single recurrence paragraph combination, the recurrence duration parameter is the average value of the duration of the set coverage range corresponding to the similar recurrence set contained in the recurrence paragraph combination. The starting time of the set coverage range is the starting time of the first focused analysis communication segment contained in it, and the ending time of the set coverage range is the ending time of the last focused analysis communication segment contained in it. The window sliding index is negatively correlated with the recurrence duration difference. The recurrence duration difference is the average value of the absolute value of the difference between the recurrence duration parameter of each recurrence paragraph combination and the reference recurrence duration parameter. In the present invention, key training data is extracted by sliding window, the window extraction parameter is the duration covered by the single data extraction of the extraction window, the window sliding parameter is the single moving distance of the extraction window, and the moving distance is the interval between the last moment of the data segment extracted in the previous extraction process and the starting moment of the data segment extracted in the next extraction process. How to extract key training data according to the sliding window technology is easy to understand for those skilled in the art, and will not be elaborated here; For single-item target update data, the timestamp interval stability coefficient , e is the sum of the number of similar recurrence sets contained in each recurrence paragraph combination in the target update data, Lf is the length of the fth recurrence interval, L0 is the average length of each recurrence interval, for any two adjacent similar recurrence sets, the recurrence interval length is the interval length between the end time of the previous similar recurrence set of the above two similar recurrence sets and the start time of the next similar recurrence set of the two similar recurrence sets, the value of the preset timestamp interval stability coefficient can be determined by the user according to the actual working scenario, for example, the user can set it according to the system monitoring record, the higher the user's requirement for the validity of the update training result of the security baseline model, the larger the value of the preset timestamp interval stability coefficient is, and a method for determining the value of the preset timestamp interval stability coefficient is provided, the system monitoring record that is reduced and adjusted according to the timestamp interval stability coefficient for the window sliding index is recorded as a sliding adjustment record, and the maximum value of the timestamp interval stability coefficient of each target update data in the sliding adjustment record that meets the user's requirement for the validity of the update training result of the security baseline model is recorded as the preset timestamp interval stability coefficient.

[0032] Specifically, when the fluctuation recurrence period ratio of the target update data is less than or equal to the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the recurrence stability coefficient and the recurrence duration parameter, and the window extraction parameter is reduced and adjusted according to the set recurrence duration difference; The reduction value of the window extraction parameter is negatively correlated with the set recurrence continuous difference; The reproduction stability coefficient is determined according to the similar reproduction coefficients of each reproduction segment combination of the target update data in the current update interval stage.

[0033] Among them, for a single target update data, if the fluctuation recurrence cycle ratio is less than or equal to the preset recurrence cycle ratio, it indicates that there are fewer reproducible data change features in the target update data, and the window extraction parameter is positively correlated with the recurrence stability coefficient, the recurrence stability coefficient=the sum of the products of the similar recurrence coefficients of each recurrence paragraph combination and the corresponding evaluation weight coefficient / the number of recurrence paragraph combinations, for a single recurrence paragraph combination, its corresponding evaluation weight coefficient is positively correlated with the number of similar recurrence sets contained in the recurrence paragraph combination, the window sliding index is negatively correlated with the recurrence continuous difference, the set recurrence continuous difference is the maximum value of the absolute value of the difference between the recurrence parameter of each similar recurrence set and the reference recurrence parameter, the reference recurrence parameter is the average value of the recurrence parameter of each similar recurrence set, for a single similar recurrence set, the recurrence parameter is the duration of the set coverage range corresponding to the similar recurrence set, the starting time of the set coverage range is the starting time of the first monitoring communication segment in the similar recurrence set, and the ending time of the set coverage range is the ending time of the last monitoring communication segment in the similar recurrence set.

[0034] Specifically, for a single target update data, if the target update data is in the second category of data baseline state where the key data ratio is less than or equal to the preset key data ratio and the fluctuation data dispersion is less than or equal to the preset fluctuation data dispersion, the distribution characteristics analysis of the target update data is performed, including: Determine a key analysis set according to the change interval duration and key segment parameters in the distribution analysis phase of each key analysis communication segment; Whether to perform data compensation extraction for key training data is determined according to the difference in operation data of associated production equipment corresponding to target update data within the industrial control production cycle corresponding to each key analysis set.

[0035] Among them, for the single-item target update data, if the target update data of the project is in the second-category data baseline state, it indicates that the key analysis communication sections of the target update data are concentratedly distributed within the change interval stage. By analyzing the production operation conditions corresponding to the concentrated distribution range of the key analysis communication sections, it is determined whether the data change is related to the actual production situation; In the present invention, a cyclic equipment monitoring cycle is applied. The duration of the equipment monitoring cycle can be determined by the user. The higher the user's requirements for the effectiveness of the updated training results of the security baseline model, the shorter the duration of the equipment monitoring cycle. A duration of an equipment monitoring cycle is provided. The duration of the equipment monitoring cycle is 30s. At the end of each equipment monitoring cycle, various types of operating data of each production equipment in the target monitoring system are collected. The categories of the operating data of the production equipment in the present invention include but are not limited to: sensor monitoring data, PLC operating data and power output data; For a single target update device, the operation data difference = ln (reference operation difference coefficient / associated production interval ratio), the reference operation difference coefficient is the average value of the operation difference coefficients between the key analysis sets in the associated production set, the associated production interval ratio = the time length covered by the associated production set / the update interval length, the associated production set is determined based on the associated operation data within the time range corresponding to the key analysis set, for the determined associated production set, the operation difference coefficients between any two key analysis sets contained therein are greater than the preset operation difference coefficient, for any two key analysis sets, the operation difference coefficient is the average value of the absolute value of the difference between the change parameters of the associated operation data of each category corresponding to the above two key analysis sets, the associated operation data is the operation data of the associated generation device of the target update data, for any category of the associated operation data of a single key analysis set, the change parameter = [|the value of the associated operation data obtained each time within the time range corresponding to the key analysis set - the average value of the value of the associated operation data obtained each time| / the number of times the associated operation data is obtained within the time range corresponding to the key analysis set] / the average value of the value of the associated operation data obtained each time.

[0036] Specifically, if the running data difference of the target update data in the current update interval stage is less than the preset running data difference, data compensation extraction is performed for the key training data of the target update data; Based on the operation difference coefficient and the key distribution coefficient of each key analysis set, the window sliding parameter of the time range covered by the associated production set is reduced and adjusted; The decrease value of the window sliding parameter is negatively correlated with the operation difference coefficient, and the decrease value of the window sliding parameter is positively correlated with the key distribution coefficient.

[0037] Among them, the value of the preset operating data difference can be determined by the user according to the actual working scenario. For example, the user can set it according to the system monitoring records. The higher the user's requirements for the effectiveness of the updated training results of the security baseline model, the larger the value of the preset operating data difference. The system monitoring records for data compensation extraction of the key training data of the target updated data are recorded as compensation reference records, and the average value of the operating data difference of the target updated data in the compensation reference records that meet the user's requirements for the effectiveness of the updated training results of the security baseline model is recorded as the preset operating data difference. The reduction value of the window sliding parameter is positively correlated with the production key coefficient, and the production key coefficient = the average value of the key distribution coefficients of each key analysis set in the associated production set / the average value of the operating difference coefficients between each key analysis set in the associated production set.

[0038] Specifically, the key distribution coefficient of any key analysis set is greater than a preset key distribution coefficient, and the key distribution coefficient is determined according to the change interval duration and the key segment parameters of each key analysis communication segment; For a single key analysis set, any key analysis communication segment in the set exists in the distribution analysis phase of at least one key analysis communication segment in the key analysis set; The key distribution coefficient is negatively correlated with the reference change interval duration; The key distribution coefficient is positively correlated with the key paragraph parameters of each key analysis communication paragraph.

[0039] Among them, for a single key analysis set, the key distribution coefficient = the average value of the key segment parameters of each key analysis communication segment in the key analysis set / the reference change interval duration of the key analysis set, the reference change interval duration is the average value of the change interval duration between two adjacent key analysis communication segments in the key analysis set, for a single key analysis communication segment, the key segment parameter is the number of key analysis communication segments in the distribution analysis phase of the key analysis communication segment, the middle moment of the distribution analysis phase is the middle moment of the key analysis communication segment, and the duration of the distribution analysis phase is positively correlated with the degree of data change of the key analysis communication segment; The value of the preset key distribution coefficient can be determined by the user according to the actual working scenario. For example, the user can set it according to the system monitoring record. The higher the user's requirement for the effectiveness of the updated training results of the security baseline model, the larger the value of the preset key distribution coefficient. A method for determining the value of the preset key distribution coefficient is provided, and the minimum value of the key distribution coefficient of each key analysis set in the system monitoring record that meets the user's requirement for the effectiveness of the updated training results of the security baseline model is recorded as the preset key distribution coefficient.

[0040] Specifically, under the condition that the extraction is completed, the baseline model is updated based on the key training data obtained. The updating process includes: Using the key training data as input data of the baseline encoder corresponding to the target update data to obtain low-dimensional data features of the target update data; According to the baseline decoder, the low-dimensional data features are restored to the initial dimension to obtain reconstructed training data; Update training of the security baseline model for target update data based on low-dimensional data features; Determine a model difference threshold of target update data based on key training data and reconstructed training data; The extraction completion condition is that the key training data of the target update data is extracted.

[0041] Specifically, under the baseline update condition, based on the security baseline model that has completed the update training, the abnormal security assessment scores of each monitoring communication segment are obtained for the target update data within the current update interval stage, and the monitoring communication segment whose abnormal security assessment score is greater than the model difference threshold of the target update data is regarded as a security warning communication segment; If the proportion of warning paragraphs is greater than the preset proportion of warning paragraphs, it is determined that the communication behavior of the target updating data is abnormal; The baseline update condition is that the security baseline model of the target update data completes update training.

[0042] Among them, for a single monitoring communication section, the difference threshold between the data corresponding to the monitoring communication section and the corresponding model reconstruction data is recorded as the abnormal safety assessment score, and the process of obtaining the model reconstruction data includes: taking the data corresponding to the monitoring communication section as the input data of the baseline encoder corresponding to the target update data, obtaining the low-dimensional data features of the data corresponding to the monitoring communication section, and restoring the low-dimensional data features of the data corresponding to the monitoring communication section to the initial dimension according to the baseline decoder, that is, recording it as the model reconstruction data of the monitoring communication section, and the model difference threshold is the difference threshold between the key training data and the reconstructed training data; How to obtain low-dimensional data features through conversion by the baseline encoder, how to restore the low-dimensional data features to the initial dimension according to the baseline decoder, how to perform update training for the security baseline model of the target update data based on the low-dimensional data features, and how to determine the difference threshold between the initial input data of the baseline encoder and the reconstructed data finally obtained are contents that are easy to understand by those skilled in the art and will not be elaborated here; The warning paragraph ratio = the number of security warning communication paragraphs of the target update data / the number of monitoring communication paragraphs of the target update data. The value of the preset warning paragraph ratio can be determined by the user according to the actual working scenario. For example, the user can set it according to the system monitoring records. The higher the user's requirement for the effectiveness of the updated training results of the security baseline model, the smaller the value of the preset warning paragraph ratio. A value of the preset warning paragraph ratio is provided, and the value of the preset warning paragraph ratio is 0.35.

[0043] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0044] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for constructing a baseline library of industrial control communication behavior patterns based on a deep learning algorithm, characterized in that: include: Under the training execution conditions, update training is performed on the security baseline model corresponding to the target update data. The data baseline status of the target update data is determined based on the dispersion of the fluctuating data and the proportion of key data. The training data analysis strategy is determined based on the data baseline status. The training data analysis strategy is to perform change recurrence analysis or distribution feature analysis on the target update data. When performing change recurrence analysis, obtain a similar recurrence set of target update data within the current update interval, and determine a data extraction method based on the fluctuation recurrence period ratio. The data extraction method is to determine a window extraction parameter and a window sliding index based on similar recurrence parameters and recurrence duration parameters, or to determine a window extraction parameter and a window sliding index based on a recurrence stability coefficient and a recurrence duration parameter. When performing distribution feature analysis, determine the key analysis set of the target update data based on the change interval duration and key paragraph parameters, and determine whether to perform data compensation extraction for key training data based on the associated running data corresponding to the key analysis set; Under the extraction completion condition, the baseline model is updated based on the acquired key training data to obtain the model difference threshold of the target update data and complete the update training of the security baseline model; Under the baseline update condition, the security warning communication segment is determined based on the comparison result of the abnormal security assessment score and the model difference threshold of the target update data, and whether the communication behavior of the target update data is abnormal is determined based on the proportion of the warning segment.

2. According to the method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 1, it is characterized in that: Under the training execution condition, update training is performed on the security baseline model corresponding to the target update data, and the monitoring communication segments of the target update data in the update interval phase are obtained, and the monitoring communication segments whose data change degree is greater than the preset data change degree are recorded as key analysis communication segments; Update data for a single target, The dispersion of the fluctuation data is determined based on the time stamp difference parameter between the key analysis communication segments; The key data ratio is the ratio of the number of key analysis communication segments of the target update data to the number of monitoring communication segments during the update interval; The training execution condition is that if the update interval of an industrial control monitoring data is longer than the preset update interval or the data fluctuation parameter is larger than the preset data fluctuation parameter, the industrial control monitoring data is recorded as the target update data.

3. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 2 is characterized in that: For the updated data of a single target, if the updated data of the target is in a data baseline state where the proportion of key data is greater than the preset proportion of key data or the dispersion of fluctuating data is greater than the preset dispersion of fluctuating data, a change recurrence analysis is performed on the updated data of the target, including: Based on the analysis of the change interval of the communication segments and the degree of data change in each communication segment set, a recurring segment combination is determined, and the communication segment set included in the recurring segment combination is recorded as a similar recurring set; Detect the fluctuation recurrence period ratio of the project target update data, and determine the setting method of data extraction parameters according to the fluctuation recurrence period ratio; The fluctuation recurrence period ratio is the ratio of the sum of the durations of the similar recurrence sets to the duration of the current update interval.

4. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 3 is characterized in that: When the fluctuation recurrence period ratio of the target update data is greater than the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the similar recurrence parameters and the recurrence duration parameters of the target update data, and whether to reduce the window sliding index is determined according to the timestamp interval stability coefficient of each similar recurrence set; If the timestamp interval stability coefficient is less than the preset timestamp interval stability coefficient, the window sliding index is reduced and adjusted according to the timestamp interval stability coefficient; The decrease value of the window sliding index is negatively correlated with the timestamp interval stability coefficient.

5. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 4 is characterized in that: When the fluctuation recurrence period ratio of the target update data is less than or equal to the preset recurrence period ratio, the window extraction parameter and the window sliding index are determined based on the recurrence stability coefficient and the recurrence duration parameter, and the window extraction parameter is reduced and adjusted according to the set recurrence duration difference; The reduction value of the window extraction parameter is negatively correlated with the set recurrence continuous difference; The reproduction stability coefficient is determined according to the similar reproduction coefficients of each reproduction segment combination of the target update data in the current update interval stage.

6. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 5 is characterized in that: For the single-project target update data, if the target update data is in the second-class data baseline state where the key data ratio is less than or equal to the preset key data ratio and the fluctuation data dispersion is less than or equal to the preset fluctuation data dispersion, the distribution characteristics analysis of the target update data is performed, including: Determine a key analysis set according to the change interval duration and key segment parameters of each key analysis communication segment; Whether to perform data compensation extraction for key training data is determined according to the difference in operation data of associated production equipment corresponding to target update data within the industrial control production cycle corresponding to each key analysis set.

7. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 6 is characterized in that: If the running data difference of the target update data in the current update interval stage is less than the preset running data difference, data compensation extraction is performed for the key training data of the target update data; Based on the operation difference coefficient and the key distribution coefficient of each key analysis set, the window sliding parameter of the time range covered by the associated production set is reduced and adjusted; The decrease value of the window sliding parameter is negatively correlated with the operation difference coefficient, and the decrease value of the window sliding parameter is positively correlated with the key distribution coefficient.

8. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 7 is characterized in that: The key distribution coefficient of any key analysis set is greater than a preset key distribution coefficient, and the key distribution coefficient is determined according to the change interval time and the key segment parameters of each key analysis communication segment; For a single key analysis set, any focused analysis communication segment exists in at least one distribution analysis phase of a focused analysis communication segment in the key analysis set.

9. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 8, characterized in that: When the extraction is complete, the baseline model is updated based on the key training data obtained. The update process includes: Using the key training data as input data of the baseline encoder corresponding to the target update data to obtain low-dimensional data features of the target update data; According to the baseline decoder, the low-dimensional data features are restored to the initial dimension to obtain reconstructed training data; Update training of the security baseline model for target update data based on low-dimensional data features; Determine a model difference threshold of target update data based on key training data and reconstructed training data; The extraction completion condition is that the key training data of the target update data is extracted.

10. The method for constructing an industrial control communication behavior pattern baseline library based on a deep learning algorithm according to claim 9, characterized in that: Under the baseline update condition, based on the security baseline model that has completed the update training, the abnormal security assessment scores of each monitoring communication segment are obtained for the target update data within the current update interval phase, and the monitoring communication segment whose abnormal security assessment score is greater than the model difference threshold of the target update data is defined as the security warning communication segment; If the proportion of warning paragraphs is greater than the preset proportion of warning paragraphs, it is determined that the communication behavior of the target updating data is abnormal; The baseline update condition is that the security baseline model of the target update data completes update training.

Images