Artificial intelligence enhanced block chain intelligent defense system and method for CPS network security enhancement

Abstract

The invention relates to an artificial intelligence enhanced block chain intelligent defense system and method for CPS network security enhancement. The system comprises a block chain, state estimation and AI classification. Wherein the block chain is used for storing detected CPS real-time data; the state estimator is used for verifying whether the detection quantity accords with a state variable based on a CPS structure and parameters, and ensuring that a residual error is within a threshold range; aI classification is carried out to identify hidden residual errors which are difficult to detect by a traditional state estimator, and whether the hidden residual errors are from malicious data injection or not is judged. The invention further provides an artificial intelligence enhanced block chain intelligent defense method for CPS network security enhancement. According to the AI enhanced intelligent defense system, a workload proving mechanism is enhanced, the stored data becomes unchangeable, an attack-free AI proxy training process is ensured, and the problem that spam results are output due to spam data input in a block chain DTs / simple DTs circulation state updating process is solved by the provided AI enhanced intelligent defense system.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an artificial intelligence-enhanced blockchain intelligent defense system and method for enhancing CPS network security. Background Art

[0002] To ensure the security of cyber-physical systems, the industry uses pure digital twin technology, such as monitoring manufacturing processes (such as Cisco security for IoT), power grid operations (such as supervisory control and data acquisition systems [SCADA systems]), and building performance monitoring (such as building information modeling [BIM systems]). In academia, some researchers have recently begun to realize the advantages of developing blockchain-based trusted digital twins (DTs) (such as immutability), which rely on assumptions about data integrity and trustworthiness. Some of these ideas have been commercialized and industrialized, such as the Hyperledger Foundation and Alibaba Cloud blockchain service.

[0003] However, the study pointed out that the blockchain-based digital twin mechanism cannot guarantee the credibility of the data at the source of the information. These digital twins may become a potential source of data leakage, leading to the abuse of digital twins. In addition, in some literature, the authors added additional AI verification at the edge of the CPS to combat cyber threats, and based on the assumption that the attack only occurs at the edge, they believe that the structure they proposed is unbreakable. However, hidden data can be injected from multiple dimensions, such as attacks on the edge of the CPS, the blockchain body, and the cyclic update process. In particular, federal / permissioned / alliance / hybrid / private blockchains are vulnerable to various attacks, such as 51% attacks, identity theft, etc. Therefore, the defense mechanism based on separated multi-factor authentication, which believes that the blockchain is 100% anti-attack, may lead to another vulnerability. Summary of the invention

[0004] The purpose of the present invention is to provide an artificial intelligence enhanced blockchain intelligent defense system and method for CPS network security enhancement to solve the above-mentioned technical problems.

[0005] To achieve the above object, the present invention provides the following technical solutions: An artificial intelligence-enhanced blockchain intelligent defense system for CPS network security enhancement, including blockchain, state estimation and AI classification; wherein the blockchain is used to save the real-time data of the detected CPS; the state estimator is used to verify whether the detected quantity conforms to the state variables based on the CPS structure and parameters, and ensure that the residual is within the threshold range; AI classification is used to identify hidden residuals that are difficult to detect with traditional state estimators, and to determine whether the hidden residuals come from malicious data injection.

[0006] The present invention is further arranged that the system distributes data among at least three participants, wherein the participants include CPS nodes, operator nodes and digital twin nodes, wherein the CPS nodes collect data at the network security layer through sensors / RTUs and store the data on the CPS server; the digital twin nodes serve as supporting images / platforms to reflect actual CPS operations, and the operator nodes are responsible for receiving information or alarms from the digital twin nodes, sending operation instructions to the CPS, and storing data in the corresponding servers.

[0007] The present invention further provides that any new data modification or addition must obtain full consensus from all participants before being uploaded to the chain.

[0008] The present invention also provides an artificial intelligence-enhanced blockchain intelligent defense method for enhancing CPS network security. Through the system implementation, data collection and generation include the following steps: collecting preprocessed data that has not been attacked in the CPS system; structuring and converting the preprocessed data; using different types of injection methods to evenly divide the vectors, including random injections representing normal data measurements and linearly related vectors representing abnormal or malicious injections by skilled attackers; applying principal component analysis to the preprocessed data to reduce the dimension of the preprocessed data; training the AI ​​agent to identify the source of hidden residuals when a real attack occurs.

[0009] The present invention is further configured to include mining, linking and communicating steps; During the mining process, the specified block is searched / mined through a brute force solution to obtain a temporary hash value, which is generated by horizontally splicing transactions to generate its own hash value. When a block that meets the requirements is mined, the block header authentication is completed; During the linking process, new transactions in the mined blocks are further verified through state estimation and AI agents; The communication between different nodes adopts the common datagram protocol, using the Ethernet board as the physical layer, where each common datagram protocol data packet contains data provided by the CPS.

[0010] The present invention further provides that the state estimator performs state estimation in the following manner: according to the number m of state variables and the measurement n, an mXn matrix H is established to calculate and with the threshold For comparison, if , then it is inferred that there are bad measurements or malicious injections.

[0011] The present invention further arranges that, in the data generation step, two sets of data are generated based on metrological measurements, estimated values ​​obtained using a classification learner, and matrix H information, and the two sets of data are then marked as "0" and "1", respectively representing binary indications of bad data or malicious injection, and the measurement residual τ is set to follow a normal distribution with a range of ±0.1 times the basic load, and the attack vector a is added to the two sets of corresponding basic loads; wherein (-τ <a<τ│ ), for the set marked as “1”, the system state is recalculated or re-estimated, and all corresponding line features are updated as hidden injection vectors; for the group marked as “0”, the error vector e randomly generated according to the normal distribution is added to the branch features, where the elements exceeding the residual τ limit should be marked as alarms.

[0012] The present invention further provides that the normal distribution has a 95% confidence interval.

[0013] Beneficial effects of the present invention: The enhanced proof-of-work mechanism, the stored data becomes unchangeable, ensuring an attack-free AI agent training process, and at the same time, the proposed AI-enhanced intelligent defense system solves the "Garbage Data In Leads to Garbage Results Out" (GIGO) problem that occurs during the blockchain DTs / simple DTs cyclic state update process. Compared with the defense based on independent multi-factor authentication, which verifies the source information externally at the CPS edge (during the mining process), the proposed AI-BC system strengthens the internal structure by performing additional two authentications (AI classification and state estimation) on the block body (transaction) when linking blocks. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 This is a complementary triangle relationship diagram of the blockchain, state estimation and AI classification of the present invention.

[0015] Figure 2 A schematic diagram of link / data storage enhanced for verification of the present invention.

[0016] Figure 3It is an overall view of the AI-BC defense system of the present invention.

[0017] Figure 4 The covert data of the present invention is injected into the CPS data link with and without AI+SE (state estimation) diagram.

[0018] Figure 5 This is an example smart grid test system (IEEE 57 node) equipped with sensors in the application example of the present invention.

[0019] Figure 6 This is the confusion matrix of the cubic support vector machine (Cubic SVM) model used in the application example of the present invention.

[0020] Figure 7 It is a schematic diagram of mining data in an application example of the present invention.

[0021] Figure 8 It is the graphical user interface (GUI) of AI-BC in the application example of the present invention. DETAILED DESCRIPTION

[0022] The following will describe the implementation methods of the present application in detail with the help of accompanying drawings and examples, so that the implementation process of how the present application uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.

[0023] The terms involved in the present invention are explained as follows: CPS: Physical-Cyber ​​System.

[0024] BC: Hybrid blockchain.

[0025] SE: Status evaluation.

[0026] PMU: Phase Measurement Unit.

[0027] RTUs: Remote Terminal Units.

[0028] selfHash: self-hash value.

[0029] previousHash: The previous hash value.

[0030] SCADA: Supervisory Control and Data Acquisition.

[0031] DTs: Digital Twins.

[0032] Apache JMeter is a Java-based stress testing tool developed by the Apache organization and is used to perform stress testing on software.

[0033] PCA: Principal component analysis technique.

[0034] Strcat: string concatenation.

[0035] Instrument Control Toolbox™ for Simulink® Real-Time™ is a powerful tool set provided by MathWorks, which enables users to control various instruments, collect data, and communicate with external systems in the Simulink environment.

[0036] Now the present invention is described as follows: First, we elaborate on the interdependencies between blockchain, state estimation, and AI classification, and refer to Figure 1 . Compared with model-driven methods that require known system information, data-driven methods can use big data to obtain system characteristics that cannot be described by the model. However, they abandon existing knowledge of the system and rely too much on data. When the data is insufficient or of low quality (for example, continuously injected errors may lead the agent in the wrong direction), the results may be inferior to traditional model-driven estimation methods. Given that both methods have their own advantages and disadvantages, it is crucial to effectively combine model-driven and data-driven methods to improve the trust of source information. Therefore, this project adopts a hybrid-driven authentication method (AI+state estimation).

[0037] Figure 1 The internal and interdependencies between the hybrid-driven authentication method and blockchain are demonstrated: 1) The "Garbage Input Leads to Garbage Output" (GIGO) problem is solved by combining state estimation (SE) and AI authentication; 2) Due to the tamper-proof nature of blockchain, the preservation of training resources is guaranteed; 3) State estimation (SE, model-driven) ensures that the residual is within the threshold range to avoid physical violations of the system; 4) The AI ​​agent detects whether the deviation that bypasses the state estimation is deliberately injected by a hacker or is just a measurement error.

[0038] The proposed AI-enhanced blockchain (AI-BC) smart defense system for CPS network security enhancement combines hybrid blockchain, state estimation, and AI classification techniques to form a powerful chain against cyber threats at the CPS edge, periodic update process, and blockchain itself. Traditionally, during the mining and linking process, the blockchain consensus mechanism only checks the hash value in the block header ( Figure 2 A hash authentication is a specific type of message authentication code (MAC) that involves a cryptographic hash function and a secret encryption key to verify the integrity and immutability of data (rather than the authenticity of the input data).

[0039] The AI-BC defense system adds two additional authentications to the block body (transaction): Figure 2The red arrow in the figure includes state estimation, which is used to verify whether the claimed metrological measurements conform to the state variables estimated based on the CPS structure; and an AI classification-based certification method, which provides a robust and efficient data-driven method to identify whether the hidden residuals between the traditional estimated and measured system states are injected by skilled hackers or caused by random measurement errors. Therefore, this mechanism avoids the "garbage data input leads to garbage results output" (GIGO) problem that occurs during the periodic state update process of blockchain DTs or simple DTs, and prevents vulnerabilities that hybrid blockchains may suffer (such as 51% attacks or private key theft).

[0040] The so-called "stronger" chain refers to the following mechanism: 1) the self-hash value (selfHash) of the previous block is stored in the previous hash (previousHash) attribute of the next block; 2) the new data follows the physical rules of the system; 3) there is no sign of malicious hidden injection. It should be noted that another difference between traditional authentication and the proposed authentication is that the content in the hash authentication needs to be completely consistent, while the transactions between the previous block and the next block are usually inconsistent.

[0041] The system currently operates between three parties: 1) CPS nodes are responsible for generating data at the physical layer, collecting data at the cybersecurity layer through sensors / PMUs, and storing data on the CPS server (node ​​in the blockchain); 2) Digital twin nodes serve as supporting mirrors / platforms that accurately reflect actual CPS operations while avoiding any interference or side effects when testing real-time systems; 3) Operator nodes are responsible for receiving alerts from digital twin nodes, sending operational instructions to CPS, and storing data in distributed table storage. Any new updates must obtain full consensus from all participants before being added as new transactions. The internal chain connection establishment mechanism is as described above Figure 3 shown.

[0042] Test results and analysis: An IEEE 57-node 80-branch system with 39 pre-installed sensors was used as a test CPS to validate the proposed AI-BC scheme. From the perspective of economy and reliability, it is not necessary to place sensors on every node, as all nodes can be observed by self-installed sensors or sensors of neighboring nodes. In addition, the measurement equipment (such as PMU) has enough channels to measure / modify the (transmission) line status of the node where it is located. The test was carried out on a desktop computer equipped with an Intel Core i9-10940X processor (3.30 GHz) and 128 GB of memory. The commercial tool used is a "classification learner" based on the MATLAB platform.

[0043] 1) Model-driven authentication - state estimation: To measure the "inconsistency" of transactions, the project uses the calculation of measurement residuals (i.e., the observed measurement vector and the estimated measurement vector ). These Instrument measurements and The relationship between the state variables can be expressed as matrix To express. With threshold For comparison, if , then it is inferred that there are bad measurements / malicious injections.

[0044] For each test case, the state variable is the actual power flow in the branch, and the metering measurement is the actual power injection into the bus. During data generation, each group collects active power values ​​from 57 bus measurements (length of metering measurement). =57), and the state variables of 80 transmission lines (the length of the state variables =80), there are 137 features in each group. If necessary, other features can be collected as input data in future research, such as reactive power.

[0045] 2) Data-driven certification - AI classification: In the data generation step, the data are generated based on metrological measurements (input) and estimates (output) obtained using MATPOWER (‌MATPOWER‌ is an open source toolkit for MATLAB and Octave) and combined with the same matrix as for the IEEE 57-node network information, two sets of 10,000 simulated data points each were created (20,000 simulations total). These two sets of data were then labeled as either “0” or “1”, representing binary indications of bad data or malicious injection, respectively. The project set out to measure the residual Follows a normal distribution with a range of ±0.1 times the base load, and the attack vector Added to the two corresponding base loads. Attack Vector The total number and position of the elements (affected sensors) in are randomly selected. Therefore, for the set marked as “1”, the system state is recalculated or re-estimated, and all corresponding line features are updated as covert injection vectors. For the control group (the group marked as “0”), according to the normal distribution ( , with a 95% confidence interval) is a randomly generated error vector are added to the branch features but do not exhibit unusual behavior patterns. Elements that exceed the residual limit should be flagged as alarms.

[0046] 3) Hash encryption authentication: A hash algorithm can be understood as a mapping algorithm that maps a string of characters to another fixed-length string. This project uses the DataHash (SHA-256, ASCII, SHA-256 is a cryptographic hash function that belongs to the SHA-2 family. It works by converting the input data into a binary string of the corresponding ASCII code and padding it to ensure that the data length is constant. Finally, SHA-256 outputs a 256-bit hash value, which is widely used in data integrity verification, digital signatures, and password storage.) function from Mathworks File Exchange as a hash algorithm. Of course, any other cryptographic hash algorithm is also applicable.

[0047] This section presents the AI-BC model ( Figure 4 ). The hacker's goal is to bootstrap the system into a state where the injected data is stored in a new block. The hacked blocks are linked without violating any hash authentication, such as Figure 4 As shown in Figure 1, the previousHash of BLK:2* matches the selfHash of BLK:1. Without internal verification assisted by the hybrid drive method (AI+SE), when covert data injection occurs at the edge of the CPS sensor or on the blockchain, stakeholders will complete the proof of work and allow the block (or new transaction) to proceed as expected. Figure 4 The red path / abnormal chain (BLK:0→BLK:1→BLK:2*→BLK:3*) in the chain is added. However, the AI-BC embedded system (whether through state estimation or artificial intelligence) detects the abnormal behavior and alerts the operator. After the fault is cleared and the isolated communication channel is restored, the chaining process will return to normal and follow the blue path / good behavior chain (BLK:0→BLK:1→BLK:2→BLK:3) again.

[0048] Table 2 Accuracy comparison between different machine learning models Model Alarm accuracy (with state estimation applied) Cubic SVM (Cubic Support Vector Machine) 92.7% (97.6%) Medium KNN (K-Nearest Neighbors) 60.3% (63.3%) Bi-layered 86.5% (90.9%) Fine Tree (decision tree model) 61.1% (64.0%) The results of four typical classification methods are listed in Table 2 to evaluate the effectiveness of machine learning-based techniques in detecting covert attacks after state estimation. and , the pure state estimator believed that these were real measurements. However, the trained agents were able to produce a good approximation of the classification in a short time. Among these agents, the support vector machine (SVM) showed the highest relative classification accuracy (97.6% after applying SE). The results verify that machine learning-based classification is able to identify the difference between malicious injections and random data measurements even after state estimation detection, while hybrid-driven detection (AI+SE) further improves the accuracy or alarm rate.

[0049] Table 3 AI-BC communication performance No.Of request / sec (number of requests processed per second) Throughput ReceivedKB / sec (the amount of data received from the server per second) Sent KB / sec (the amount of data sent from the client to the server per second) Avg. Bytes 100 15.6 3.4 5.8 227 200 48.7 10.7 18.2 227 300 48.5 15.2 18.1 321 400 60.2 18.6 22.5 321 500 76.9 38.9 26.4 518 600 83.9 73.6 23.7 898 700 89.4 110.1 20.2 1262 800 123.8 175.9 25.1 1447 900 142.8 213.0 26.0 1528 1000 147.0 237.1 24.0 1659 Scalability testing was conducted in a hybrid blockchain network with three mining nodes to test the ability to communicate in real time, using Apache JMeter™. The performance metric was throughput (number of packets successfully sent per second), and the workload (total number of transactions) was increased in each case. Table 3 shows the performance evaluation results obtained from 5 independent runs for each workload size. As can be seen from the table, as the workload provided increases linearly, the throughput also increases linearly until it gradually reaches saturation. With three nodes in the blockchain network, AI-BC can handle 1,000 requests per second with an average throughput of 147.

[0050] Due to the enhanced proof-of-work mechanism, the stored data becomes immutable, ensuring an attack-free AI agent training process. At the same time, the proposed AI-enhanced smart defense system solves the "Garbage Input Leads to Garbage Output" (GIGO) problem that occurs during the blockchain DTs / simple DTs cyclic state update process. Compared with the defense based on independent multi-factor authentication, which verifies the source information externally at the CPS edge (during the mining process), the proposed AI-BC system strengthens the internal structure by performing additional two authentications (AI classification and state estimation) on the block body (transaction) when linking blocks.

[0051] The present invention will now be further described with reference to a specific case; 1. Data collection / generation: like Figure 5-Figure 8As shown, an application example is described here, elaborating on one of the innovative applications - AI-BC embedded smart grid network security enhancement. First, historical data is collected from the SCADA / PMU of the power station control center. The generation and processing of historical data in the implementation process include: 1) collecting data within the threshold from the SCADA system, which means that the data is not attacked; 2) data structuring, transformation and enrichment; 3) evenly dividing the vector using two different types of injection methods: random (linearly independent) injection representing normal data measurements and linearly related vectors representing abnormal / malicious injections by skilled attackers; finally, as the scale of the power grid increases, the dimension of the measurement data increases, resulting in increased computational complexity; 4) applying principal component analysis (PCA) to the preprocessed data to reduce the dimension relative to the original data. PCA performs a linear transformation to transform the original feature set into a new space that emphasizes the main components. In some cases, the attacker has limited access to all CPS components in the system. 5) To simulate this feature, the agent is trained to be able to identify with different numbers of damaged sensors so that it can still identify when a real attack occurs.

[0052] 2. AI Agent Training: For each training case, the state variable is the power flow in the branch, while the metering measurement is the actual power injection into the bus. During the data generation process, each group collects active power values ​​from 57 bus measurements, as well as state variables of 80 transmission lines, for a total of 137 features. If necessary, other features can also be collected as input data in future projects, such as reactive power. The commercial tool used is the “Classification Learner” based on the MATLAB platform. In the data generation step, two sets of data are generated based on metering measurements (input) and estimates obtained from MATPOWER (output), where the underlying information (such as topology) is the same as that of the specified smart grid network.

[0053] The two groups of data were subsequently labeled as “0” or “1”, representing a binary indication of a bad measurement or malicious injection, respectively. The measurement residuals follow a uniform distribution within the base load range and the attack vectors are added to the corresponding base loads of the two groups. The total number and location of elements (affected sensors) in the attack vectors are randomly selected under the constraints considered. Therefore, for the group labeled as “1”, we recalculate / estimate the system state and update all corresponding line features as covert injection vectors. For the control group (the group labeled as “0”), randomly generated error vectors are added to the branch features that do not exceed the threshold and do not exhibit abnormal patterns. PCA with 95% explained variance was enabled. No feature selection was involved as the implemented PCA itself already achieves dimensionality reduction (the total number of feature variables is reduced from 137 to 70).

[0054] 3. Mining, linking and communication: During the mining process, it is not easy to find a block header that fully matches the given index, previous hash value (previousHash) and data; we need to search / mine the specified block through a brute force solution to obtain a temporary hash value, which is generated by horizontally splicing transactions (strcat, i.e. string concatenation) to generate its own hash value (selfHash). When a block that meets the requirements is successfully "mined", the block header authentication is completed. However, if the linking process starts here, the hybrid blockchain is still vulnerable to 51% attacks, private key theft and other problems, and the credibility of the data cannot be guaranteed.

[0055] During the linking process, we need to further verify the new transactions in the mined blocks through the state estimator and the trained neural network function. Only blocks that meet all the regulations can be added to the current chain. Therefore, the blocks are connected in a "stronger" structure. If any transaction fails to pass this process, the transaction will be marked as invalid in the block where it is located.

[0056] For the communication problem between nodes, although there are various protocols designed to solve this problem, the simpler and faster Universal Datagram Protocol (UDP) was used in the experimental stage. Universal Datagram Protocol (UDP) is a packet-based protocol that uses an Ethernet board as the physical layer. Each UDP packet contains data provided by the CPS. The communication between nodes in this article is performed through Instrument Control Toolbox™ based on Simulink® Real-Time™, which supports dedicated Ethernet networks or shared Ethernet networks. Other protocols, such as the Inter-Blockchain Communication (IBC) protocol, the Transmission Control Protocol (TCP), etc., can also be applied according to business, industrial or personal purposes.

[0057] 4. Verification and Authentication: The current user interface is developed by APP Designer ( Figure 8 ), the operation steps of AI-BC are as follows: the first step is to start three blockchain graphical user interfaces to execute the servers of the three parties; the second step is to enter data in the data editing box of the CPS server to simulate the CPS data generation process; the third step is to click "Mine Block" and wait until it is completed. If the block fails to be added (that is, the block is not successfully mined), it means that the hash authentication (proof of work) is not recognized, and other servers or nodes will also reject new transactions. The same mechanism also applies to state estimation (SE) and artificial intelligence (AI) checks (steps 4 and 5). As long as there is a rejection or violation in any verification process, the new transaction cannot be stored, and AI-BC will send an alarm to the utility department.

[0058] For additional parties, Step 6: Click "Add Client" and edit the remote / local port numbers accordingly. At this point the participant will be aware of the newly added node and exchange / certify any changes to its own blockchain. Step 7: Click "Print Blockchain" on both the Twin and Operator servers. The new block should now have been copied to these chains. Note that all output will be displayed in the MATLAB Command Window.

[0059] For example, certain words are used in the specification and claims to refer to specific components. Those skilled in the art should understand that hardware manufacturers may use different terms to refer to the same component. This specification and claims do not use differences in names as a way to distinguish components, but use differences in the functions of components as the criteria for distinction. For example, "including" mentioned throughout the specification and claims is an open term, so it should be interpreted as "including but not limited to". "Approximately" means that within an acceptable error range, those skilled in the art can solve technical problems within a certain error range and basically achieve technical effects.

[0060] It should be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a product or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such product or system. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the product or system including the elements.

[0061] The above description shows and describes several preferred embodiments of the present invention, but as before, it should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the invention concept of this article through the above teachings or the technology or knowledge of the relevant field. And the changes and modifications made by those skilled in the art do not depart from the spirit and scope of the present invention, and should be within the scope of protection of the claims attached to the present invention.

Claims

1. An artificial intelligence enhanced blockchain intelligent defense system for CPS network security enhancement, characterized in that: It includes blockchain, state estimation and AI classification; blockchain is used to save the real-time data of CPS that has been detected; the state estimator is used to verify whether the detected quantity conforms to the state variables based on the CPS structure and parameters, and ensure that the residual is within the threshold range; AI classification is used to identify hidden residuals that are difficult to detect with traditional state estimators, and determine whether the hidden residuals come from malicious data injection.

2. According to claim 1, an artificial intelligence enhanced blockchain intelligent defense system for CPS network security enhancement is characterized in that: The system distributes data among at least three participants, including CPS nodes, operator nodes and digital twin nodes. The CPS nodes collect data at the network security layer through sensors / RTUs and store the data on the CPS server. The digital twin nodes serve as supporting images / platforms to reflect actual CPS operations. The operator nodes are responsible for receiving information or alarms from the digital twin nodes, sending operation instructions to the CPS, and storing data in the corresponding servers.

3. According to claim 2, an artificial intelligence enhanced blockchain intelligent defense system for CPS network security enhancement is characterized in that: Any new data modification or addition must obtain full consensus from all participants before being uploaded to the chain.

4. An artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement, characterized in that: Implemented by the system according to any one of claims 1 to 3, data collection and generation comprises the following steps: collecting pre-processed data that has not been attacked in the CPS system; Structuring and transforming the preprocessed data; evenly partitioning the vectors using different types of injection methods, including random injections representing normal data measurements and linearly correlated vectors representing abnormal or malicious injections by skilled attackers; Apply principal component analysis to the preprocessed data to reduce the dimensionality of the preprocessed data; Train AI agents to identify sources of hidden residuals when real attacks occur.

5. According to claim 4, an artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement is characterized in that: It also includes mining, linking, and communication steps; During the mining process, the specified block is searched / mined through a brute force solution to obtain a temporary hash value, which is generated by horizontally splicing transactions to generate its own hash value. When a block that meets the requirements is mined, the block header authentication is completed; During the linking process, new transactions in the mined blocks are further verified through state estimation and AI agents; The communication between different nodes adopts the common datagram protocol, using the Ethernet board as the physical layer, where each common datagram protocol data packet contains data provided by the CPS.

6. The artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement according to claim 4 is characterized in that: The state estimator performs state estimation in the following way: according to the number of state variables m and the measurement n, an m×n matrix H is established and the calculation and with the threshold For comparison, if , then it is inferred that there are bad measurements or malicious injections.

7. The artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement according to claim 4 is characterized in that: In the data generation step, two sets of data are generated based on metrological measurements, estimates obtained using a classification learner, and matrix H information. These two sets of data are then labeled as "0" and "1", representing binary indications of bad data or malicious injection, respectively. The measurement residual τ is set to follow a normal distribution with a range of ±0.1 times the base load. The attack vector a is added to the corresponding base loads of the two sets; Where (-τ <a<τ│ ), for the set marked as "1", the system state is recalculated or re-estimated, and all corresponding line features are updated as hidden injection vectors; for the group marked as "0", the error vector e randomly generated according to the normal distribution is added to the branch features, where the elements exceeding the residual τ limit should be marked as alarms.

8. The artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement according to claim 7 is characterized in that: The normal distribution has a 95% confidence interval.

Images