Industrial control system intrusion detection method and system based on Mama model

Abstract

The invention relates to the technical field of industrial measurement and control system intrusion detection, in particular to an industrial control system intrusion detection method and system based on a Mama model. The method comprises the following steps: carrying out clustering analysis on traffic logs to obtain initial traffic log data, calculating to obtain a data frequency sequence of the initial traffic log data, and recording the initial traffic log data corresponding to first G sequence values as to-be-analyzed traffic log data; analyzing the to-be-analyzed traffic log data to obtain a traffic actual load value and a traffic preload value, calculating to obtain a ratio of the traffic actual load value to the traffic preload value, and judging whether to input the to-be-analyzed traffic log data into a Mamba model or not based on a comparison result of the ratio and a preset ratio threshold value; and inputting the to-be-analyzed flow log data into the Mamba model, and outputting an intrusion detection result, so that the detection efficiency and the detection accuracy of the network intrusion behavior of the industrial measurement and control system can be improved, and the safety and the stability of the industrial measurement and control system are improved and guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection of industrial measurement and control systems, and in particular to an industrial control system intrusion detection method and system based on a Mamba model. Background Art

[0002] At present, the security of industrial measurement and control systems mainly relies on traditional security protection measures, such as firewalls, intrusion detection systems, etc., but these methods have great limitations when facing new network attacks. Traditional methods usually match and detect based on known attack features, which makes it difficult to effectively deal with unknown attack methods. In addition, the industrial measurement and control system network is highly complex and real-time. Traditional methods are often inefficient when processing large-scale data and high-concurrency requests, and cannot meet the needs of practical applications.

[0003] In order to overcome the limitations of traditional methods, intrusion detection methods based on machine learning have gradually attracted attention in recent years. This type of method uses training models to identify abnormal patterns of network traffic, thereby detecting intrusion behaviors. However, there are still some problems in the application of existing intrusion detection methods based on machine learning in the security of industrial measurement and control systems. For example, the training of the model requires a large amount of historical data, while the historical data of the industrial measurement and control system network is often difficult to obtain and there is a problem of data imbalance; in addition, its application in industrial measurement and control systems is mainly affected by various factors such as the performance of the model, such as computational complexity, the number of model parameters and accuracy, etc., which require continuous optimization and adjustment.

[0004] In view of the above problems, the present invention proposes an industrial control system intrusion detection method and system based on the Mamba model to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide an industrial control system intrusion detection method and system based on the Mamba model: to solve the technical problems of low stability of the industrial measurement and control system due to low detection efficiency and accuracy of intrusion behavior in production equipment control and production task scheduling systems in the data transmission of the prior art.

[0006] The purpose of the present invention can be achieved by the following technical solutions: On the one hand, an industrial control system intrusion detection method based on the Mamba model includes: Obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, perform cluster analysis on the traffic log to obtain initial traffic log data, calculate the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; Analyze the traffic log data to be analyzed to obtain the actual traffic load value and the traffic preload value, calculate the ratio of the actual traffic load value to the traffic preload value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold; The traffic log data to be analyzed is input into the Mamba model, and the intrusion detection result is output.

[0007] Furthermore, the initial traffic log data is obtained after cluster analysis of the traffic logs, which specifically includes the following process: All the data of the traffic log is taken as a data set; Set the K value according to the size and shape of the data set; Randomly select a data point in the data set as the initial centroid; When the number of initial centroids is less than K, set is the data in the dataset, , n is the number of data in the traffic log, is the initial centroid, ; Based on the objective function Calculate the distance D(x) between each data point in the data set and the existing initial centroid; Take the data point corresponding to the maximum value in D(x) as the next initial centroid; K initial centroids are obtained in turn, and the data set is clustered based on the K initial centroids, and the data that is not in the clustering range of the initial centroids is eliminated to obtain the initial traffic log data.

[0008] Furthermore, calculating the data frequency sequence of the initial traffic log data specifically includes the following process: Generate the maximum frequent pattern set of initial traffic log data according to the frequent pattern tree algorithm; Based on the management sequence, the maximum frequent pattern set is traversed in sequence, and the data frequency sequence value of each initial traffic log data is calculated; All initial traffic log data are sorted in descending order according to the data frequency sequence values, and a sequence is generated after sorting. The sequence is recorded as the data frequency sequence of the initial traffic log data.

[0009] Furthermore, obtaining the management sequence specifically includes the following process: Number each piece of initial traffic log data to obtain M number values; Obtain first traffic log status information corresponding to the first initial traffic log data, second traffic log status information corresponding to the second initial traffic log data, and so on until the Mth traffic log status information corresponding to the Mth initial traffic log data, wherein the first traffic log status information includes a first data packet size, a first transmission success rate, and a first transmission duration, and the Mth traffic log status information includes an Mth data packet size, an Mth transmission success rate, and an Mth transmission duration, the data packet size is the traffic data packet size corresponding to the traffic log, the transmission success rate is the probability of successful transmission of the traffic log, and the transmission duration is the duration of transmitting the traffic log; The first management coefficient is obtained by multiplying the first data packet size, the first transmission success rate and the first transmission duration until the Mth management coefficient is obtained; All initial traffic log data are sorted in descending order according to the value of the management coefficient, and a sequence is generated after sorting, which is recorded as the management sequence.

[0010] Furthermore, calculating the data frequency sequence value of each initial traffic log data specifically includes the following process: Calculate the information entropy of each initial traffic log data, set the frequent information entropy value, when the information entropy is greater than or equal to the frequent information entropy value, mark the initial traffic log data as frequent data, when the information entropy is less than the frequent information entropy value, mark the initial traffic log data as non-frequent data, match all frequent data into a frequent data group, obtain the frequent linkage value of each frequent data group, set the frequent linkage limit, when the frequent linkage value is greater than or equal to the frequent linkage limit, mark the frequent data group as a normal linkage group, mark the total number of normal linkage groups as ZCY, and mark the total number of non-frequent data as YCY, using the formula Calculate the data frequency sequence value of each initial traffic log data ,in, is the normal linkage group coefficient, is the infrequent data coefficient.

[0011] Furthermore, obtaining the frequent linkage value of each frequent data group specifically includes the following process: Obtain the data packet timestamps corresponding to two frequent data in each frequent data group, calculate the time interval corresponding to the two timestamps, and record the time interval as the frequent linkage value of each frequent data group.

[0012] Furthermore, analyzing the traffic log data to be analyzed to obtain the actual traffic load value and the preload traffic value specifically includes the following process: Perform real-time detection on the transmission speed of the traffic log data to be analyzed, obtain the transmission speed of the traffic log data to be analyzed from the transmission start time to the transmission end time, establish a rectangular coordinate system with the transmission time from the transmission start time to the transmission end time as the X-axis and the transmission speed as the Y-axis, draw a transmission curve in the rectangular coordinate system through the transmission speed value, draw two truncated line segments from the two end points of the transmission curve to the X-axis, form a transmission graph by the transmission curve, the two truncated line segments and the X-axis, multiply the area value of the transmission graph by the data packet size corresponding to the traffic log data to be analyzed, obtain a first product value, and record the first product value as the actual traffic load value; The transmission speed of the traffic log data to be analyzed is detected in real time, and the maximum transmission speed and the minimum transmission speed of the traffic log data to be analyzed from the start time to the end time of transmission are obtained, the difference between the maximum transmission speed and the minimum transmission speed is calculated, and the difference is multiplied by the data packet size corresponding to the traffic log data to be analyzed to obtain a second product value, and the second product value is recorded as the traffic preload value.

[0013] Further, determining whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result between the ratio and the preset ratio threshold specifically includes the following process: The preset ratio threshold is loaded, and it is determined whether the ratio exceeds the preset ratio threshold. If so, the traffic log data to be analyzed is input into the Mamba model; otherwise, the traffic log data to be analyzed is not input into the Mamba model.

[0014] Furthermore, the traffic log data to be analyzed is input into the Mamba model, and the intrusion detection result output specifically includes the following process: Extracting feature vectors of the traffic log data to be analyzed, wherein the feature vectors include source IP address, destination IP address, port number, data packet size, number of data packets, and protocol type; The dataset is divided into training set, validation set and test set for training, validation and testing of Mamba model; Use the Mamba model to infer the input data and determine whether there is intrusion behavior: Forward propagation: pass the input data through the model's forward propagation network to obtain the output result; Result analysis: Based on the output of the model, which includes probability distribution and category labels, it is determined whether there is intrusion behavior.

[0015] On the other hand, an industrial control system intrusion detection system based on the Mamba model is applicable to any of the above-mentioned industrial control system intrusion detection methods based on the Mamba model, and the system comprises: The traffic log preprocessing module is used to obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, obtain the initial traffic log data after clustering analysis on the traffic log, calculate the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; The traffic log analysis and processing module is used to analyze the traffic log data to be analyzed to obtain the actual traffic load value and the traffic preload value, calculate the ratio of the actual traffic load value to the traffic preload value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold; The intrusion detection module is used to input the traffic log data to be analyzed into the Mamba model and output the intrusion detection result.

[0016] Compared with the existing solutions, the present invention achieves the following beneficial effects: The present invention obtains the flow log corresponding to the network transmission data of the industrial measurement and control system, performs cluster analysis on the flow log to obtain initial flow log data, calculates the data frequency sequence of the initial flow log data, selects the initial flow log data corresponding to the first G sequence values ​​in the data frequency sequence, and records the initial flow log data corresponding to the first G sequence values ​​as the flow log data to be analyzed; analyzes the flow log data to be analyzed to obtain the actual flow load value and the pre-flow load value, calculates the ratio of the actual flow load value to the pre-flow load value, determines whether to input the flow log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold value; inputs the flow log data to be analyzed into the Mamba model, and outputs the intrusion detection result, which can improve the detection efficiency and detection accuracy of the intrusion behavior of the industrial measurement and control system, and improve the security and stability of the industrial measurement and control system.

[0017] The detection method based on the Mamba model can realize real-time analysis and processing of network traffic, and timely detect and respond to potential intrusion behaviors. This real-time response capability helps reduce the impact of attacks on the system and ensure the stable operation of industrial measurement and control systems. Through sophisticated feature engineering and model optimization, the Mamba model can reduce the occurrence of false positives and false negatives. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0019] Figure 1This is a workflow diagram of a first Mamba model-based industrial control system intrusion detection method according to an embodiment of the present invention; Figure 2 It is a workflow diagram of a second industrial control system intrusion detection method based on the Mamba model according to an embodiment of the present invention; Figure 3 The system block diagram of an industrial control system intrusion detection system based on the Mamba model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] In addition, the described features, structures or characteristics may be combined in one or more example embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the example embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, steps, etc. may be adopted. In other cases, well-known structures, methods, implementations or operations are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0022] This embodiment provides an industrial control system intrusion detection method based on the Mamba model. Figure 1 is a flowchart of the first Mamba model-based industrial control system intrusion detection method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps: Step S101: Obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, and obtain initial traffic log data after clustering analysis on the traffic log; Step S102: Calculate and obtain the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; Step S103: Analyze the traffic log data to be analyzed to obtain the actual traffic load value and the pre-load traffic value, calculate the ratio of the actual traffic load value to the pre-load traffic value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and a preset ratio threshold; Step S104: input the traffic log data to be analyzed into the Mamba model, and output the intrusion detection result.

[0023] In summary, the present invention obtains the traffic log corresponding to the network transmission data of the industrial measurement and control system, obtains the initial traffic log data after clustering analysis on the traffic log, calculates the data frequency sequence of the initial traffic log data, selects the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and records the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; analyzes the traffic log data to be analyzed to obtain the actual traffic load value and the pre-traffic load value, calculates the ratio of the actual traffic load value to the pre-traffic load value, and determines whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold; inputs the traffic log data to be analyzed into the Mamba model, and outputs the intrusion detection result, which can improve the detection efficiency and accuracy of the network intrusion behavior of the industrial measurement and control system, and improve the security and stability of the industrial measurement and control system.

[0024] In some embodiments, obtaining initial traffic log data after cluster analysis of the traffic logs specifically includes the following process: All the data of the traffic log is taken as a data set; Set the K value according to the size and shape of the data set; Randomly select a data point in the data set as the initial centroid; When the number of initial centroids is less than K, set is the data in the dataset, , n is the number of data in the traffic log, is the initial centroid, ; Based on the objective function Calculate the distance D(x) between each data point in the data set and the existing initial centroid; Take the data point corresponding to the maximum value in D(x) as the next initial centroid; K initial centroids are obtained in turn, and the data set is clustered based on the K initial centroids, and the data that is not in the clustering range of the initial centroids is eliminated to obtain the initial traffic log data.

[0025] In some embodiments, Figure 2 is a flowchart of the industrial control system intrusion detection method based on the Mamba model according to an embodiment of the present invention, such as Figure 2 As shown, calculating the data frequency sequence of the initial traffic log data specifically includes the following steps: Step S201: Generate a maximum frequent pattern set of initial traffic log data according to a frequent pattern tree algorithm; Specifically, data preprocessing First, it is necessary to collect traffic log data from industrial measurement and control systems or other related systems.

[0026] Set minimum support: According to actual needs and the size of the data set, set a reasonable minimum support threshold. This threshold is used to determine whether an item set is a frequent item set.

[0027] First scan of the data set: count the number of times each item appears in the data set, that is, the item support. Delete those items whose support is less than the minimum support to obtain frequent 1-item sets.

[0028] Scan the data set for the second time: Arrange the items in each transaction in descending order according to the support of the frequent 1-item set, and build a FP-Tree (frequent pattern tree). At the same time, generate an item header table to record the position of each item in the FP-Tree.

[0029] Start mining from the bottom of the header table: For each item in the header table, find its conditional pattern base (CPB). The conditional pattern base is the FP subtree corresponding to the item as a leaf node. The count of each node in the subtree is set to the count of the leaf node, and the nodes with counts lower than the support are deleted.

[0030] Recursive mining: Starting from the conditional pattern base, recursively build the conditional FP-Tree and mine the frequent itemsets in it. Repeat this process until a single-path tree structure is formed or no more itemsets that meet the minimum support can be found.

[0031] Determine the maximum frequent itemsets: Among the mined frequent itemsets, find all the itemsets that cannot be turned into more frequent itemsets by adding other items. These itemsets are the maximum frequent itemsets.

[0032] Output results: The maximum frequent itemsets are used as the final output of the algorithm. These itemsets represent the most frequent item sets in the traffic log data and cannot be expanded any further.

[0033] Step S202: traverse the maximum frequent pattern set in sequence based on the management sequence, and calculate the data frequency sequence value of each initial traffic log data; Step S203: sorting all the initial traffic log data in descending order according to the values ​​of the data frequency sequence values, and generating a sequence after sorting, which is recorded as the data frequency sequence of the initial traffic log data.

[0034] In some embodiments, obtaining the management sequence specifically includes the following process: Number each piece of initial traffic log data to obtain M number values; Obtain first traffic log status information corresponding to the first initial traffic log data, second traffic log status information corresponding to the second initial traffic log data, and so on until the Mth traffic log status information corresponding to the Mth initial traffic log data, wherein the first traffic log status information includes a first data packet size, a first transmission success rate, and a first transmission duration, and the Mth traffic log status information includes an Mth data packet size, an Mth transmission success rate, and an Mth transmission duration, the data packet size is the traffic data packet size corresponding to the traffic log, the transmission success rate is the probability of successful transmission of the traffic log, and the transmission duration is the duration of transmitting the traffic log; The first management coefficient is obtained by multiplying the first data packet size, the first transmission success rate and the first transmission duration until the Mth management coefficient is obtained; All initial traffic log data are sorted in descending order according to the value of the management coefficient, and a sequence is generated after sorting, which is recorded as the management sequence.

[0035] In some embodiments, calculating the data frequency sequence value of each piece of initial traffic log data specifically includes the following process: Calculate the information entropy of each initial traffic log data, set the frequent information entropy value, when the information entropy is greater than or equal to the frequent information entropy value, mark the initial traffic log data as frequent data, when the information entropy is less than the frequent information entropy value, mark the initial traffic log data as non-frequent data, match all frequent data into a frequent data group, obtain the frequent linkage value of each frequent data group, set the frequent linkage limit, when the frequent linkage value is greater than or equal to the frequent linkage limit, mark the frequent data group as a normal linkage group, mark the total number of normal linkage groups as ZCY, and mark the total number of non-frequent data as YCY, using the formula Calculate the data frequency sequence value of each initial traffic log data ,in, is the normal linkage group coefficient, is the infrequent data coefficient.

[0036] In some embodiments, obtaining the frequent linkage value of each frequent data group specifically includes the following process: Obtain the data packet timestamps corresponding to two frequent data in each frequent data group, calculate the time interval corresponding to the two timestamps, and record the time interval as the frequent linkage value of each frequent data group.

[0037] In some embodiments, analyzing the traffic log data to be analyzed to obtain the actual traffic load value and the pre-load traffic value specifically includes the following process: Perform real-time detection on the transmission speed of the traffic log data to be analyzed, obtain the transmission speed of the traffic log data to be analyzed from the transmission start time to the transmission end time, establish a rectangular coordinate system with the transmission time from the transmission start time to the transmission end time as the X-axis and the transmission speed as the Y-axis, draw a transmission curve in the rectangular coordinate system through the transmission speed value, draw two truncated line segments from the two end points of the transmission curve to the X-axis, form a transmission graph by the transmission curve, the two truncated line segments and the X-axis, multiply the area value of the transmission graph by the data packet size corresponding to the traffic log data to be analyzed, obtain a first product value, and record the first product value as the actual traffic load value; The transmission speed of the traffic log data to be analyzed is detected in real time, and the maximum transmission speed and the minimum transmission speed of the traffic log data to be analyzed from the start time to the end time of transmission are obtained, the difference between the maximum transmission speed and the minimum transmission speed is calculated, and the difference is multiplied by the data packet size corresponding to the traffic log data to be analyzed to obtain a second product value, and the second product value is recorded as the traffic preload value.

[0038] In some embodiments, determining whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result between the ratio and the preset ratio threshold specifically includes the following process: The preset ratio threshold is loaded, and it is determined whether the ratio exceeds the preset ratio threshold. If so, the traffic log data to be analyzed is input into the Mamba model; otherwise, the traffic log data to be analyzed is not input into the Mamba model.

[0039] In some embodiments, the traffic log data to be analyzed is input into the Mamba model, and outputting the intrusion detection result specifically includes the following process: Extracting feature vectors of the traffic log data to be analyzed, wherein the feature vectors include source IP address, destination IP address, port number, data packet size, number of data packets, and protocol type; The dataset is divided into training set, validation set and test set for training, validation and testing of Mamba model; Use the Mamba model to infer the input data and determine whether there is intrusion behavior: Forward propagation: pass the input data through the model's forward propagation network to obtain the output result; Result analysis: Based on the output of the model, which includes probability distribution and category labels, it is determined whether there is intrusion behavior.

[0040] In some embodiments, Figure 3 is a system block diagram of an industrial control system intrusion detection system based on the Mamba model according to an embodiment of the present invention. Figure 3 As shown, the system includes: The traffic log preprocessing module is used to obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, obtain the initial traffic log data after clustering analysis on the traffic log, calculate the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; The traffic log analysis and processing module is used to analyze the traffic log data to be analyzed to obtain the actual traffic load value and the traffic preload value, calculate the ratio of the actual traffic load value to the traffic preload value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold; The intrusion detection module is used to input the traffic log data to be analyzed into the Mamba model and output the intrusion detection result.

[0041] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0042] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0043] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0044] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only for some logical functions. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0045] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0046] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for intrusion detection of industrial control systems based on the Mamba model, characterized in that: Methods include: Obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, perform cluster analysis on the traffic log to obtain initial traffic log data, calculate the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; Analyze the traffic log data to be analyzed to obtain the actual traffic load value and the traffic preload value, calculate the ratio of the actual traffic load value to the traffic preload value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and a preset ratio threshold; The traffic log data to be analyzed is input into the Mamba model, and the intrusion detection result is output.

2. According to claim 1, a method for detecting intrusion in industrial control systems based on the Mamba model is characterized in that: The initial traffic log data is obtained after cluster analysis of the traffic logs, which specifically includes the following process: All the data of the traffic log is taken as a data set; Set the K value according to the size and shape of the data set; Randomly select a data point in the data set as the initial centroid; When the number of initial centroids is less than K, set is the data in the dataset, , n is the number of data in the traffic log, is the initial centroid, ; Based on the objective function Calculate the distance D(x) between each data point in the data set and the existing initial centroid; Take the data point corresponding to the maximum value in D(x) as the next initial centroid; K initial centroids are obtained in turn, and the data set is clustered based on the K initial centroids, and the data that is not in the clustering range of the initial centroids is eliminated to obtain the initial traffic log data.

3. According to the Mamba model-based industrial control system intrusion detection method of claim 1, it is characterized in that: Calculate the data frequency sequence of the initial traffic log data The process includes: Generate the maximum frequent pattern set of initial traffic log data according to the frequent pattern tree algorithm; Based on the management sequence, the maximum frequent pattern set is traversed in sequence, and the data frequency sequence value of each initial traffic log data is calculated; All initial traffic log data are sorted in descending order according to the data frequency sequence values, and a sequence is generated after sorting. The sequence is recorded as the data frequency sequence of the initial traffic log data.

4. According to claim 3, a method for detecting intrusion in industrial control systems based on the Mamba model is characterized in that: The acquisition management sequence specifically includes the following processes: Number each piece of initial traffic log data to obtain M number values; Obtain first traffic log status information corresponding to the first initial traffic log data, second traffic log status information corresponding to the second initial traffic log data, and so on until the Mth traffic log status information corresponding to the Mth initial traffic log data, wherein the first traffic log status information includes a first data packet size, a first transmission success rate, and a first transmission duration, and the Mth traffic log status information includes an Mth data packet size, an Mth transmission success rate, and an Mth transmission duration, the data packet size is the traffic data packet size corresponding to the traffic log, the transmission success rate is the probability of successful transmission of the traffic log, and the transmission duration is the duration of transmitting the traffic log; The first management coefficient is obtained by multiplying the first data packet size, the first transmission success rate and the first transmission duration until the Mth management coefficient is obtained; All initial traffic log data are sorted in descending order according to the value of the management coefficient, and a sequence is generated after sorting, which is recorded as the management sequence.

5. The industrial control system intrusion detection method based on the Mamba model according to claim 1 is characterized in that: Calculate the data frequency sequence value of each initial traffic log data The process includes: Calculate the information entropy of each initial traffic log data, set the frequent information entropy value, when the information entropy is greater than or equal to the frequent information entropy value, mark the initial traffic log data as frequent data, when the information entropy is less than the frequent information entropy value, mark the initial traffic log data as non-frequent data, match all frequent data into a frequent data group, obtain the frequent linkage value of each frequent data group, set the frequent linkage limit, when the frequent linkage value is greater than or equal to the frequent linkage limit, mark the frequent data group as a normal linkage group, mark the total number of normal linkage groups as ZCY, and mark the total number of non-frequent data as YCY, using the formula Calculate the data frequency sequence value of each initial traffic log data ,in, is the normal linkage group coefficient, is the infrequent data coefficient.

6. The industrial control system intrusion detection method based on the Mamba model according to claim 5 is characterized in that: Get the frequent linkage value of each frequent data group The process includes: Obtain the data packet timestamps corresponding to two frequent data in each frequent data group, calculate the time interval corresponding to the two timestamps, and record the time interval as the frequent linkage value of each frequent data group.

7. The industrial control system intrusion detection method based on the Mamba model according to claim 1 is characterized in that: Analyzing the traffic log data to be analyzed to obtain the actual traffic load value and the preload traffic value specifically includes the following process: Perform real-time detection on the transmission speed of the traffic log data to be analyzed, obtain the transmission speed of the traffic log data to be analyzed from the transmission start time to the transmission end time, establish a rectangular coordinate system with the transmission time from the transmission start time to the transmission end time as the X-axis and the transmission speed as the Y-axis, draw a transmission curve in the rectangular coordinate system through the transmission speed value, draw two truncated line segments from the two end points of the transmission curve to the X-axis, form a transmission graph by the transmission curve, the two truncated line segments and the X-axis, multiply the area value of the transmission graph by the data packet size corresponding to the traffic log data to be analyzed, obtain a first product value, and record the first product value as the actual traffic load value; The transmission speed of the traffic log data to be analyzed is detected in real time, and the maximum transmission speed and the minimum transmission speed of the traffic log data to be analyzed from the start time to the end time of transmission are obtained, the difference between the maximum transmission speed and the minimum transmission speed is calculated, and the difference is multiplied by the data packet size corresponding to the traffic log data to be analyzed to obtain a second product value, and the second product value is recorded as the traffic preload value.

8. The industrial control system intrusion detection method based on the Mamba model according to claim 1 is characterized in that: Based on the comparison result between the ratio and the preset ratio threshold, it is determined whether to input the traffic log data to be analyzed into the Mamba model. The process includes: The preset ratio threshold is loaded, and it is determined whether the ratio exceeds the preset ratio threshold. If so, the traffic log data to be analyzed is input into the Mamba model; otherwise, the traffic log data to be analyzed is not input into the Mamba model.

9. The industrial control system intrusion detection method based on the Mamba model according to claim 1 is characterized in that: Input the traffic log data to be analyzed into the Mamba model and output the specific intrusion detection results. The process includes: Extracting feature vectors of the traffic log data to be analyzed, wherein the feature vectors include source IP address, destination IP address, port number, data packet size, number of data packets, and protocol type; The dataset is divided into training set, validation set and test set for training, validation and testing of Mamba model; Use the Mamba model to infer the input data and determine whether there is intrusion behavior: Forward propagation: pass the input data through the model's forward propagation network to obtain the output result; Result analysis: Based on the output of the model, which includes probability distribution and category labels, it is determined whether there is intrusion behavior.

10. An industrial control system intrusion detection system based on the Mamba model, characterized in that: An industrial control system intrusion detection method based on a Mamba model applicable to any one of claims 1 to 9, the system comprising: The traffic log preprocessing module is used to obtain the traffic log corresponding to the network transmission data of the industrial measurement and control system, obtain the initial traffic log data after clustering analysis on the traffic log, calculate the data frequency sequence of the initial traffic log data, select the initial traffic log data corresponding to the first G sequence values ​​in the data frequency sequence, and record the initial traffic log data corresponding to the first G sequence values ​​as the traffic log data to be analyzed; The traffic log analysis and processing module is used to analyze the traffic log data to be analyzed to obtain the actual traffic load value and the traffic preload value, calculate the ratio of the actual traffic load value to the traffic preload value, and determine whether to input the traffic log data to be analyzed into the Mamba model based on the comparison result of the ratio and the preset ratio threshold; The intrusion detection module is used to input the traffic log data to be analyzed into the Mamba model and output the intrusion detection result.

Images