A blockchain intelligent defense system and method for CPS network security enhancement

Abstract

The application discloses an artificial intelligence enhanced blockchain intelligent defense system and method for CPS network security enhancement, which comprises a blockchain, state estimation and AI classification; the blockchain is used for storing detected CPS real-time data; a state estimator is used for verifying whether the detected quantity conforms to a state variable based on a CPS structure and parameters, and ensuring that a residual error is within a threshold range; the AI classification is used for identifying hidden residual errors which are difficult to be detected by a traditional state estimator, and judging whether the hidden residual error is from malicious data injection; the application further provides an artificial intelligence enhanced blockchain intelligent defense method for CPS network security enhancement; the enhanced proof of work mechanism is used, stored data becomes unchangeable, an attack-free AI agent training process is ensured, and the proposed AI enhanced intelligent defense system solves a problem of "garbage data input leading to garbage result output" in a blockchain DTs / simple DTs cyclic state updating process.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an artificial intelligence-enhanced blockchain intelligent defense system and method for enhancing CPS network security. Background Art

[0002] To ensure the security of cyber-physical systems, the industry is using pure digital twin technology, for example, to monitor manufacturing processes (e.g., Cisco Security for IoT), power grid operations (e.g., Supervisory Control and Data Acquisition (SCADA) systems), and building performance monitoring (e.g., Building Information Modeling (BIM) systems). In academia, some researchers have recently begun to realize the advantages (e.g., immutability) of developing trusted digital twins (DTs) based on blockchain. These efforts rely on assumptions about data integrity and trustworthiness. Some of these concepts have already been commercialized and industrialized, such as by the Hyperledger Foundation and Alibaba Cloud Blockchain Service.

[0003] However, research indicates that blockchain-based digital twin mechanisms cannot guarantee the credibility of data at the source. These digital twins may become a potential source of data leaks, leading to the misuse of digital twins. Furthermore, some authors have added additional AI verification at the edge of the CPS to combat cyber threats, assuming that attacks only occur at the edge. However, hidden data can be injected from multiple dimensions, such as attacks targeting the CPS edge, the blockchain itself, and the cyclic update process. In particular, federal / permissioned / consortium / hybrid / private blockchains are vulnerable to various attacks, such as 51% attacks and identity theft. Therefore, the assumption that blockchains are 100% attack-proof based on separate multi-factor authentication defense mechanisms may lead to another vulnerability. Summary of the Invention

[0004] The purpose of the present invention is to provide an artificial intelligence-enhanced blockchain intelligent defense system and method for enhancing CPS network security to solve the above-mentioned technical problems.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] An artificial intelligence-enhanced blockchain intelligent defense system for enhancing CPS network security includes blockchain, state estimation and AI classification; the blockchain is used to store real-time data of detected CPS; the state estimator is used to verify whether the detected quantity conforms to the state variables based on the CPS structure and parameters, and ensure that the residual is within the threshold range; the AI ​​classification is used to identify hidden residuals that are difficult to detect with traditional state estimators, and to determine whether the hidden residuals come from malicious data injection.

[0007] The present invention is further provided that the system distributes data among at least three participants, including CPS nodes, operator nodes and digital twin nodes, wherein the CPS nodes collect data at the network security layer through sensors or RTUs and store the data on the CPS server; the digital twin nodes serve as supporting mirrors or platforms, reflecting the actual CPS operations, and the operator nodes are responsible for receiving information or alarms from the digital twin nodes, sending operation instructions to the CPS, and storing data in the corresponding servers.

[0008] The present invention further provides that any new data modification or addition must obtain full consensus from all participants before being uploaded to the chain.

[0009] The present invention also provides an artificial intelligence-enhanced blockchain intelligent defense method for enhancing CPS network security. Through the system implementation, data collection and generation include the following steps: collecting pre-processed data that has not been attacked in the CPS system; structuring and converting the pre-processed data; using different types of injection methods to evenly divide the vectors, including random injections representing normal data measurements and linearly related vectors representing abnormal or malicious injections by skilled attackers; applying principal component analysis to the pre-processed data to reduce the dimension of the pre-processed data; and training the AI ​​agent to identify the source of hidden residuals when a real attack occurs.

[0010] The present invention is further configured to include the steps of mining, linking and communicating;

[0011] During the mining process, a specified block is searched or mined through a brute force solution to obtain a temporary hash value. This hash value is generated by horizontally splicing transactions to generate its own hash value. When a block that meets the requirements is mined, the block header authentication is completed;

[0012] During the linking process, new transactions in the mined blocks are further verified through state estimation and AI agents;

[0013] The communication between different nodes adopts the common datagram protocol, using the Ethernet board as the physical layer, where each common datagram protocol packet contains data provided by the CPS.

[0014] The present invention further provides that the state estimator performs state estimation in the following manner: according to the number m of state variables and the measurement n, an m×n matrix is ​​established H ,calculate and with the threshold For comparison, if , then it is inferred that there are bad measurements or malicious injections.

[0015] The present invention further provides that, in the data generation step, two sets of data are generated based on the metrological measurements, the estimated values ​​obtained using the classification learner, and the matrix H information. The two sets of data are then marked as "0" and "1", respectively representing binary indications of bad data or malicious injection, and the measurement residual τ is set to follow a normal distribution with a range of ±0.1 times the basic load, and the attack vector a is added to the two corresponding sets of base loads; where ( -τ <a<τ │ ), for the set marked as "1", the system state is recalculated or re-estimated, and all corresponding line features are updated as hidden injection vectors; for the group marked as "0", the error vector e randomly generated according to the normal distribution is added to the branch feature, where the residual τ Restricted elements should be marked as alerts.

[0016] The present invention further provides that the normal distribution has a 95% confidence interval.

[0017] The present invention offers the following benefits: The enhanced proof-of-work mechanism renders stored data immutable, ensuring an attack-free AI agent training process. Furthermore, the proposed AI-enhanced intelligent defense system addresses the "Garbage In, Garbage Out" (GIGO) problem that occurs during the cyclic state update process of blockchain DTs and simple DTs. Compared to defenses based on independent multi-factor authentication, which verify source information externally at the CPS edge (during the mining process), the proposed AI-BC system strengthens its internal structure by performing two additional authentications of the block body (transactions) during block chaining: AI classification and state estimation. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 This is a complementary triangle relationship diagram of the blockchain, state estimation, and AI classification of the present invention.

[0020] Figure 2 Schematic diagram of link / data storage enhanced for verification of the present invention.

[0021] Figure 3 This is an overall view of the AI-BC defense system of the present invention.

[0022] Figure 4 The covert data of the present invention is injected into the CPS data link with and without AI+SE (state estimation) diagram.

[0023] Figure 5 This is an example smart grid test system (IEEE 57 nodes) equipped with sensors in the application example of the present invention.

[0024] Figure 6 This is the confusion matrix of the cubic support vector machine (Cubic SVM) model used in the application example of the present invention.

[0025] Figure 7 This is a schematic diagram of data mining in an application example of the present invention.

[0026] Figure 8 This is the graphical user interface (GUI) of the AI-BC in the application example of the present invention. DETAILED DESCRIPTION

[0027] The following will describe the implementation methods of the present application in detail with reference to the accompanying drawings and examples, so that the implementation process of how the present application applies technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.

[0028] The terms involved in the present invention are explained as follows:

[0029] CPS: Physical-cyber system.

[0030] BC: Hybrid blockchain.

[0031] SE: Status evaluation.

[0032] PMU: Phase Measurement Unit.

[0033] RTUs: Remote Terminal Units.

[0034] selfHash: self-hash value.

[0035] previousHash: previous hash value.

[0036] SCADA: Supervisory Control and Data Acquisition System.

[0037] DTs: Digital Twins.

[0038] Apache JMeter is a Java-based stress testing tool developed by the Apache organization and is used to perform stress testing on software.

[0039] PCA: Principal component analysis technique.

[0040] Strcat: string concatenation.

[0041] Instrument Control Toolbox™ for Simulink® Real-Time™ is a powerful toolset from MathWorks that enables users to control various instruments, acquire data, and communicate with external systems within the Simulink environment.

[0042] Now make the following description about the present invention:

[0043] First, we elaborate on the interdependencies among blockchain, state estimation, and AI classification. Figure 1 . Compared with model-driven methods that require known system information, data-driven methods can use big data to obtain system characteristics that cannot be described by the model. However, they abandon existing knowledge of the system and rely too much on data. When the data is insufficient or of low quality (for example, continuously injected errors may lead the agent in the wrong direction), the results may be inferior to traditional model-driven estimation methods. Given that both methods have their own advantages and disadvantages, it is crucial to effectively combine model-driven and data-driven methods to improve the trust of source information. Therefore, this project adopts a hybrid-driven authentication method (AI+state estimation).

[0044] Figure 1 The internal and interdependencies between the hybrid-driven authentication method and blockchain are demonstrated: 1) The "garbage input, garbage output" (GIGO) problem is solved by combining state estimation (SE) and AI authentication; 2) Due to the tamper-proof nature of blockchain, the preservation of training resources is guaranteed; 3) State estimation (SE, model-driven) ensures that the residual is within the threshold range to avoid physical violations of the system; 4) The AI ​​agent detects whether the deviation that bypasses the state estimation is deliberately injected by a hacker or is just a measurement error.

[0045] The proposed AI-BC intelligent defense system for CPS network security enhancement combines hybrid blockchain, state estimation and AI classification technology to form a strong chain against cyber threats at the edge of CPS, periodic update process and blockchain itself. Traditionally, during the mining and linking process, the blockchain consensus mechanism only checks the hash value in the block header ( Figure 2 A hash authentication is a specific type of message authentication code (MAC) that involves a cryptographic hash function and a secret encryption key to verify the integrity and immutability of data (rather than the authenticity of the input data).

[0046] The AI-BC defense system adds two additional authentications to the block body (transaction): Figure 2 The red arrow in the figure (shown) includes state estimation, used to verify that claimed metrological measurements conform to state variables estimated based on the CPS structure; and an AI-based classification-based authentication method, which provides a robust and efficient data-driven approach to identify whether hidden residuals between traditional estimates and measurements of system states are injected by skilled hackers or caused by random measurement errors. This mechanism thus avoids the "garbage in, garbage out" (GIGO) problem that arises during the periodic state updates of blockchain DTs or simple DTs, and prevents vulnerabilities that hybrid blockchains may suffer (such as 51% attacks or private key theft).

[0047] A "stronger" chain is defined as follows: 1) the previous block's self-hash (selfHash) is stored in the next block's previousHash attribute; 2) new data adheres to the physical rules of the system; and 3) there are no signs of malicious covert injection. It's important to note that another difference between traditional authentication and the proposed authentication is that the content in the hash authentication must be completely consistent, while transactions between the previous and next blocks are often inconsistent.

[0048] The system currently operates between three parties: 1) CPS nodes are responsible for generating data at the physical layer, collecting data at the cybersecurity layer through sensors / PMUs, and storing data on the CPS server (node ​​in the blockchain); 2) Digital twin nodes serve as supporting mirrors / platforms, accurately reflecting actual CPS operations while avoiding any interference or side effects when testing real-time systems; 3) Operator nodes are responsible for receiving alerts from digital twin nodes, sending operational instructions to CPS, and storing data in distributed table storage. Any new update must obtain full consensus from all participants before being added as a new transaction. The internal chain connection establishment mechanism is as described above Figure 3 shown.

[0049] Test results and analysis:

[0050] An IEEE 57-node, 80-branch system equipped with 39 pre-installed sensors served as a test CPS to validate the proposed AI-BC scheme. From a cost-effective and reliable perspective, it is not necessary to place sensors at every node, as all nodes can be observed via their own sensors or sensors from neighboring nodes. Furthermore, measurement devices (such as PMUs) have sufficient channels to measure / modify the (transmission) line status at their respective nodes. Testing was conducted on a desktop computer equipped with an Intel Core i9-10940X processor (3.30 GHz) and 128 GB of RAM. The commercial tool used was a "Classification Learner" based on the MATLAB platform.

[0051] 1) Model-driven authentication - state estimation:

[0052] To measure the "inconsistency" of transactions, the project uses the calculation of measurement residuals (i.e., the observation measurement vector and the estimated measurement vector The differences between Instrument measurements and The relationship between the state variables can be expressed as matrix To express. With threshold For comparison, if , then it is inferred that there are bad measurements / malicious injections.

[0053] For each test case, the state variable is the actual power flow in the branch, and the metering measurement is the actual power injection into the bus. During data generation, each group collected active power values ​​from 57 bus measurements (the length of the metering measurement is =57), and the state variables of 80 transmission lines (the length of the state variables =80), there are 137 features in each group. If necessary, other features can be collected as input data in future studies, such as reactive power.

[0054] 2) Data-driven certification - AI classification:

[0055] In the data generation step, the data are generated based on metrological measurements (input) and estimates (output) obtained using MATPOWER (MATPOWER is an open source toolkit for MATLAB and Octave) and combined with the same matrix as for the IEEE 57-node network The project set up a measurement residual error (Rx) to measure the residual error. Follows a normal distribution with a range of ±0.1 times the base load, and the attack vector Added to the two corresponding base loads. Attack Vector The total number and position of the elements (affected sensors) in are randomly selected. Therefore, for the set marked as “1”, the system state is recalculated or re-estimated, and all corresponding line features are updated as covert injection vectors. For the control group (the group marked as “0”), according to the normal distribution ( , with a 95% confidence interval) randomly generated error vector are added to the branch features but do not exhibit unusual behavior patterns. Elements exceeding the residual limit should be flagged as alarms.

[0056] 3) Hash encryption authentication:

[0057] A hash algorithm can be thought of as a mapping algorithm that maps a string of characters to another string of fixed length. This project uses the DataHash (SHA-256, ASCII) function from MathWorks File Exchange. SHA-256 is a cryptographic hash function that belongs to the SHA-2 family. It works by converting the input data into a binary string corresponding to the ASCII code and padding it to ensure the data length remains constant. Ultimately, SHA-256 outputs a 256-bit hash value, which is widely used in areas such as data integrity verification, digital signatures, and password storage. Of course, any other cryptographic hash algorithm is also applicable.

[0058] This section presents the AI-BC model ( Figure 4 The hacker's goal is to guide the system to a state where the injected data is stored in a new block. The hacked blocks are linked without violating any hash authentication, such as Figure 4 As shown in Figure 2, the previousHash of BLK:2* matches the selfHash of BLK:1. Without internal verification assisted by the hybrid driving method (AI+SE), when covert data injection occurs at the edge of the CPS sensor or on the blockchain, the stakeholders will complete the proof of work and allow the block (or new transaction) to proceed as expected. Figure 4 The red path / abnormal chain (BLK:0 → BLK:1 → BLK:2* → BLK:3*) in the diagram is added. However, the AI-BC embedded system (either through state estimation or artificial intelligence) detects the abnormal behavior and alerts the operator. After the fault is cleared and the isolated communication channel is restored, the chaining process returns to normal and follows the blue path / good behavior chain (BLK:0 → BLK:1 → BLK:2 → BLK:3).

[0059] Table 2 Accuracy comparison between different machine learning models

[0060] Model Alarm accuracy (with state estimation applied) Cubic SVM (Cubic Support Vector Machine) 92.7% (97.6%) Medium KNN (K-Nearest Neighbors) 60.3% (63.3%) Bi-layered 86.5% (90.9%) Fine Tree (decision tree model) 61.1% (64.0%) The results of four typical classification methods are listed in Table 2 to evaluate the effectiveness of machine learning-based techniques in detecting covert attacks after state estimation. and , pure state estimators believe these are true measurements. However, trained agents are able to produce a good approximation of the classification in a short period of time. Among these agents, support vector machines (SVMs) demonstrated the highest relative classification accuracy (97.6% after applying SE). The results demonstrate that machine learning-based classification can distinguish between malicious injections and random data measurements, even those that pass state estimation detection. Hybrid-driven detection (AI + SE) further improves accuracy or alert rates.

[0061] Table 3 AI-BC communication performance

[0062]

[0063] Scalability testing was conducted on a hybrid blockchain network consisting of three mining nodes to test its real-time communication capabilities using Apache JMeter™. The performance metric was throughput (the number of successfully sent packets per second), with the workload (total number of transactions) increasing in each case. Table 3 shows the performance evaluation results from five independent runs for each workload size. As can be seen, throughput increases linearly with increasing workload until saturation. With three nodes in the blockchain network, AI-BC can handle 1,000 requests per second, with an average throughput of 147.

[0064] Thanks to the enhanced proof-of-work mechanism, stored data becomes immutable, ensuring an attack-free AI agent training process. Furthermore, the proposed AI-enhanced intelligent defense system addresses the "Garbage In, Garbage Out" (GIGO) problem that occurs during the cyclic state update process of blockchain DTs / simple DTs. Compared to defenses based on independent multi-factor authentication, which verify source information externally at the CPS edge (during the mining process), the proposed AI-BC system strengthens its internal structure by performing two additional authentications of the block body (transactions) when linking blocks (AI classification and state estimation). The present invention is further described using a specific case study.

[0065] 1. Data Collection / Generation:

[0066] like Figure 5-Figure 8As shown, this paper describes an application example, detailing one of the innovative applications—AI-BC embedded smart grid cybersecurity enhancement. First, historical data is collected from the SCADA / PMU in the power station control center. The implementation involves the following steps: 1) collecting data from the SCADA system that falls within a threshold, meaning it is unattacked; 2) structuring, transforming, and enriching the data; 3) evenly partitioning the vectors using two different types of injection methods: random (linearly independent) injections representing normal data measurements, and linearly correlated vectors representing anomalous / malicious injections by a skilled attacker. Finally, as the scale of the power grid increases, the dimensionality of the measurement data increases, leading to increased computational complexity; 4) principal component analysis (PCA) is applied to the preprocessed data to reduce the dimensionality relative to the original data. PCA performs a linear transformation, transforming the original feature set into a new space that emphasizes the principal components. In some cases, an attacker has limited access to all CPS components in the system. 5) To simulate this characteristic, an intelligent agent is trained to recognize different numbers of compromised sensors, enabling it to identify real-world attacks.

[0067] 2. AI Agent Training

[0068] For each training case, the state variable is the branch power flow, while the meter measurement is the actual power injection into the bus. During data generation, each set of active power values ​​is collected from 57 bus measurements, along with state variables from 80 transmission lines, for a total of 137 features. If necessary, additional features, such as reactive power, could be collected as input data in future projects. The commercial tool used is the "Classification Learner" tool based on the MATLAB platform. During the data generation step, two sets of data are generated based on meter measurements (inputs) and estimates obtained from MATPOWER (outputs). The underlying information, such as the topology, is the same as for a given smart grid network.

[0069] The two sets of data were then labeled "0" or "1," representing binary indications of bad measurements or malicious injection, respectively. The measurement residuals followed a uniform distribution within the baseload range, and the attack vectors were added to the corresponding baseloads for both sets. The total number and locations of elements (affected sensors) in the attack vectors were randomly selected within the constraints. Therefore, for the set labeled "1," the system state was recalculated / estimated and all corresponding line features were updated as covert injection vectors. For the control group (the set labeled "0"), randomly generated error vectors were added to the branch features that did not exceed the threshold and did not exhibit unusual patterns. PCA with a 95% explained variance was applied. Since the implemented PCA already achieved dimensionality reduction (reducing the total number of feature variables from 137 to 70), no feature selection was involved.

[0070] 3. Mining, Linking and Communication:

[0071] During the mining process, finding a block header that fully matches a given index, previous hash value (previousHash), and data is not easy; a brute-force approach is required to search / mine the specified block to obtain a temporary hash value. This hash value is generated by horizontally concatenating transactions (strcat, i.e., string concatenation) to generate its own hash value (selfHash). Once a matching block is successfully "mined," block header authentication is complete. However, if the linking process begins at this point, the hybrid blockchain remains vulnerable to 51% attacks and private key theft, and the data's credibility cannot be guaranteed.

[0072] During the linking process, new transactions in mined blocks are further verified using a state estimator and a trained neural network function. Only blocks that meet all requirements are added to the chain. This creates a more robust structure for the blocks. If any transaction fails this process, it is marked as invalid in the block it belongs to.

[0073] While various protocols exist to address inter-node communication, the simpler and faster Universal Datagram Protocol (UDP) was used during the experimental phase. UDP is a packet-based protocol that uses an Ethernet board as the physical layer. Each UDP packet contains data provided by the CPS. In this paper, inter-node communication is performed using Instrument Control Toolbox™ for Simulink® Real-Time™, which supports dedicated or shared Ethernet networks. Other protocols, such as Inter-Blockchain Communication (IBC) and Transmission Control Protocol (TCP), can also be used for business, industrial, or personal purposes.

[0074] 4. Verification and Authentication:

[0075] The current user interface is developed by APP Designer ( Figure 8The AI-BC operation steps are as follows: First, launch the three blockchain graphical user interfaces to execute the three-party servers; second, enter data in the data edit box of the CPS server to simulate the CPS data generation process; third, click "Mine Block" and wait until completion. If block addition fails (i.e., the block is not successfully mined), it means that the hash authentication (proof of work) is not recognized, and other servers or nodes will reject the new transaction. The same mechanism applies to state estimation (SE) and artificial intelligence (AI) checks (steps 4 and 5). If any rejection or violation occurs in any verification process, the new transaction cannot be stored, and AI-BC will send an alert to the utility.

[0076] For additional participants, in step 6, click "Add Client" and edit the remote / local port numbers accordingly. The participant will now be aware of the newly added node and will exchange / certify any changes to its own blockchain. In step 7, click "Print Blockchain" on both the twin and operator servers. The new block should now be copied to these chains. Note that all output will be displayed in the MATLAB command window.

[0077] For example, certain words are used in the specification and claims to refer to specific components. Those skilled in the art should understand that hardware manufacturers may use different terms to refer to the same component. This specification and claims do not use differences in names as a way to distinguish components, but use differences in the functions of the components as the criteria for distinction. For example, "including" mentioned throughout the specification and claims is an open term and should be interpreted as "including but not limited to". "Approximately" means that within an acceptable error range, those skilled in the art can solve technical problems within a certain error range and basically achieve technical effects.

[0078] It should be noted that the terms "include," "comprises," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a product or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such product or system. In the absence of further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the product or system comprising the element.

[0079] The foregoing description shows and describes several preferred embodiments of the present invention. However, as previously mentioned, it should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. Rather, the present invention can be used in various other combinations, modifications, and environments and can be modified within the scope of the present invention through the above teachings or through technology or knowledge in the relevant field. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention are intended to be protected by the appended claims.

Claims

1. An artificial intelligence-enhanced blockchain intelligent defense method for CPS network security enhancement, characterized in that: Collect pre-processed data from the CPS system that has not been attacked; Structuring and transforming the preprocessed data; evenly partitioning the vectors using different types of injection methods, including random injections representing normal data measurements and linearly correlated vectors representing abnormal or malicious injections by skilled attackers; Apply principal component analysis to the preprocessed data to reduce the dimensionality of the preprocessed data; Training AI agents to identify the source of hidden residuals when a real attack occurs; also includes mining, linking, and communication steps; During the mining process, a brute force solution is used to search and mine the specified block to obtain a temporary hash value. This hash value is generated by horizontally splicing transactions to generate its own hash value. When a block that meets the requirements is mined, the block header authentication is completed; During the linking process, new transactions in the mined blocks are further verified through state estimation and AI agents; The communication between different nodes adopts the Universal Datagram Protocol, using the Ethernet board as the physical layer, where each Universal Datagram Protocol packet contains data provided by the CPS; The state estimator performs state estimation in the following way: according to the number of state variables m and measurement n, an m×n matrix is ​​established H ,calculate and with the threshold For comparison, if , it is inferred that there are bad measurements or malicious injections; is the observation measurement vector, is the estimated measurement vector; In the data generation step, based on the measurement, the estimated values ​​obtained using the classification learner and the matrix H The information is used to generate two sets of data, which are then marked as "0" and "1", representing binary indications of bad data or malicious injection, respectively, and the measurement residual is set τ Following a normal distribution with a range of ±0.1 times the base load, the attack vector a are added to the two corresponding sets of base loads; where - τ < a < τ │ ,For the set marked as "1", the system state is recalculated or re-estimated, and all corresponding line features are updated as covert injection vectors; for the group marked as "0", the error vector e randomly generated according to the normal distribution is added to the branch features, where the elements exceeding the residual τ limit should be marked as alarms.

2. The artificial intelligence-enhanced blockchain intelligent defense method for CPS network security enhancement according to claim 1 is characterized in that: The normal distribution has a 95% confidence interval.

3. An artificial intelligence-enhanced blockchain intelligent defense system for CPS network security enhancement, characterized by: Used to implement the method described in any one of claims 1-2, including blockchain, state estimation and AI classification; wherein the blockchain is used to store real-time data of the detected CPS; the state estimator is used to verify whether the detected quantity conforms to the state variables based on the CPS structure and parameters, and ensure that the residual is within the threshold range; AI classification is used to identify hidden residuals that are difficult to detect with traditional state estimators, and to determine whether the hidden residuals come from malicious data injection.

4. The artificial intelligence-enhanced blockchain intelligent defense system for CPS network security enhancement according to claim 3 is characterized in that: The system distributes data among at least three participants, including CPS nodes, operator nodes, and digital twin nodes. The CPS nodes collect data at the network security layer through sensors or RTUs and store the data on the CPS server. The digital twin nodes serve as supporting images or platforms, reflecting actual CPS operations. The operator nodes are responsible for receiving information or alarms from the digital twin nodes, sending operation instructions to the CPS, and storing data on the corresponding servers.

5. The artificial intelligence-enhanced blockchain intelligent defense system for CPS network security enhancement according to claim 4 is characterized in that: Any new data modification or addition must obtain full consensus from all participants before being uploaded to the chain.

Images