Industrial control network monitoring method, electronic equipment, readable medium and program product

Abstract

The invention provides an industrial control network monitoring method, which comprises the following steps: extracting features from original flow data of an industrial control network, and generating feature vectors; training the feature vectors through a machine learning algorithm to construct an industrial control baseline model; dynamically adjusting a baseline threshold value of each feature in the industrial control baseline model based on the flow data in the plurality of monitoring periods; monitoring the real-time flow data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold; and if the monitoring result is judged as an abnormal behavior, making a protection strategy. The disclosure also provides an electronic device, a computer readable medium, and a computer program product. By dynamically adjusting the baseline threshold value and the industrial control baseline model based on the feature vector, the real-time flow data of the industrial control network are accurately monitored, abnormal behaviors are effectively detected, and by combining the protection strategy, potential threats can be quickly responded, the flexibility and accuracy of safety protection are improved, and the safety of the industrial control network is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of industrial control network security, and in particular to an industrial control network monitoring method, an electronic device, a computer-readable medium, and a computer program product. Background Art

[0002] As an important part of the country's critical information infrastructure, industrial control systems are increasingly integrated with the Internet as emerging businesses develop rapidly. However, this integration also brings serious security risks. In recent years, cyber attacks on industrial control systems have occurred frequently, posing a major threat to many key industries and fields such as energy, transportation, water conservancy, steel, and manufacturing. These industries are highly dependent on the stable operation of industrial control systems. Once the system is attacked, it may lead to serious consequences such as production interruption and data leakage, which not only endangers the production operation and data security of the enterprise, but also directly affects the security and stability of the country's critical infrastructure. Therefore, strengthening the security protection of industrial control systems has become an urgent task faced by enterprises and governments.

[0003] However, the security protection of industrial control systems usually relies on the operator's experience and is highly subjective. Summary of the invention

[0004] The embodiments of the present disclosure provide an industrial control network monitoring method, an electronic device, a computer-readable medium, and a computer program product.

[0005] In a first aspect, an embodiment of the present disclosure provides an industrial control network monitoring method, comprising: extracting features from raw traffic data of the industrial control network to generate feature vectors; training the feature vectors through a machine learning algorithm to construct an industrial control baseline model; dynamically adjusting the baseline threshold of each feature in the industrial control baseline model based on traffic data within multiple monitoring cycles; monitoring real-time traffic data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold; and formulating a protection strategy if the monitoring result is determined to be abnormal behavior.

[0006] In some embodiments, features are extracted from raw traffic data of an industrial control network to generate feature vectors, including: obtaining raw traffic data from the industrial control network; cleaning and formatting the obtained raw traffic data; extracting features from the processed traffic data to generate feature vectors.

[0007] In some embodiments, features are extracted from processed traffic data to generate feature vectors, including: dividing the processed traffic data into a training set and a validation set; extracting feature values ​​of five dimensions, namely, traffic features, protocol features, system features, network topology features, and time features from the training set and the validation set; and combining the extracted feature values ​​of each dimension to generate a feature vector for the training set and a feature vector for the validation set, respectively.

[0008] In some embodiments, the feature vectors are trained through a machine learning algorithm to construct an industrial control baseline model, including: combining the feature vectors of the training set with different machine learning algorithms for model training to obtain multiple candidate industrial control baseline models; evaluating the performance of the multiple candidate industrial control baseline models through the feature vectors of the validation set; judging whether it is necessary to optimize the feature vectors of the training set based on the evaluation results; when it is necessary to optimize the feature vectors of the training set, optimizing the feature vectors of the training set and re-combining them with different machine learning algorithms for model training to obtain multiple new candidate industrial control baseline models, and returning to the evaluation step; when it is not necessary to optimize the feature vectors of the training set, selecting the combination of the feature vector and the machine learning algorithm with the best performance based on the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

[0009] In some embodiments, based on the traffic data in multiple monitoring cycles, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including: based on the traffic data in the previous n monitoring cycles, obtaining the baseline threshold of each feature through the industrial control baseline model; for the baseline value of each feature in the current monitoring cycle, judging whether it meets the setting rules of the corresponding baseline threshold; if the baseline value of a certain feature does not meet the setting rules of the corresponding baseline threshold, based on the traffic data in the most recent n monitoring cycles, obtaining the statistical value of the baseline value of the certain feature through the industrial control baseline model; based on the statistical value, adjusting the baseline threshold of the certain feature.

[0010] In some embodiments, based on the industrial control baseline model and the adjusted baseline threshold, the real-time traffic data of the industrial control network is monitored, including: deploying the industrial control baseline model to the actual operating environment of the industrial control network; continuously monitoring the traffic data of the industrial control network to extract feature vectors of the traffic data; based on the extracted feature vectors, using the industrial control baseline model and the adjusted baseline threshold, monitoring whether there is abnormal behavior.

[0011] In some embodiments, the protection strategy includes: one or more of an audit alarm, a blocking strategy, or a configuration strategy, wherein the audit alarm includes triggering an audible and visual alarm, prompting abnormal behavior in a pop-up window on the management page, and generating log records; the blocking strategy includes limiting abnormal traffic, isolating suspicious devices, or blocking abnormal connections; the configuration strategy includes dynamically adjusting baseline model parameters or adjusting the system alert level.

[0012] In a second aspect, an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a memory on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure.

[0013] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure is implemented.

[0014] In a fourth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure.

[0015] The present invention accurately monitors the real-time traffic data of the industrial control network and effectively detects abnormal behavior by dynamically adjusting the baseline threshold and the industrial control baseline model based on the feature vector. Combined with the protection strategy, it can quickly respond to potential threats, thereby improving the security and reliability of the industrial control network, adapting to the dynamic changes of the network environment, reducing the operator's experience, and improving the flexibility and accuracy of the security protection of the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a flow chart of an industrial control network monitoring method according to an embodiment of the present disclosure;

[0017] Figure 2 is a schematic diagram of the composition of an electronic device according to an embodiment of the present disclosure;

[0018] Figure 3 It is a block diagram of an industrial control network monitoring system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the technical solution of the present disclosure, the technical solution of the present disclosure is described in detail below with reference to the accompanying drawings.

[0020] Example embodiments will be described more fully below with reference to the accompanying drawings, but the example embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. On the contrary, the purpose of providing these embodiments is to make the present disclosure thorough and complete and to enable those skilled in the art to fully understand the scope of the present disclosure.

[0021] In the absence of conflict, the various embodiments of the present disclosure and the various features therein may be combined with each other.

[0022] As used herein, the term "and / or" includes any and all combinations of one or more of the associated listed items.

[0023] The terms used herein are only used to describe specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are also intended to include the plural forms, unless the context clearly indicates otherwise. It will also be understood that when the terms "comprising" and / or "made of" are used in this specification, the presence of the features, wholes, steps, operations, elements and / or components is specified, but the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof is not excluded.

[0024] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted as having an idealized or overly formal meaning unless explicitly defined as such herein.

[0025] In this disclosure, unless otherwise specified, the following technical terms should be understood as follows:

[0026] Industrial control network is a data communication network used for industrial automation and process control systems, and is commonly used in industrial scenarios such as electric power, petrochemical, manufacturing, etc.; it consists of industrial protocols (such as Modbus, DNP3, etc.) and control equipment (such as PLC, SCADA system).

[0027] Raw Network Traffic Data refers to unprocessed communication data packets collected from network devices (such as switches and routers), which contain information such as source IP, destination IP, protocol type, packet size, etc.; it is used to analyze network communication behavior and detect abnormal activities.

[0028] Data cleaning refers to the processing of raw data to remove invalid, duplicate, or erroneous data to ensure data quality.

[0029] A feature vector is a numerical representation of multiple features extracted from data, usually organized in the form of a vector. It is the input of a machine learning model and describes the key features of a data sample.

[0030] The industrial control baseline model is a model built through machine learning algorithms to describe the normal behavior patterns of industrial control networks.

[0031] Baseline Threshold refers to the upper and lower limit parameter range that describes normal behavior in the industrial control baseline model.

[0032] Sliding window is an analytical method for processing time series data. It sets a window of fixed length and slides continuously to obtain the latest data.

[0033] Machine Learning Algorithm refers to a technical method that builds models for prediction or classification by learning data features.

[0034] In some related technologies, the construction technology based on the baseline reference table is used to strengthen the security of industrial control networks. However, the construction technology of the baseline reference table usually has certain limitations. On the one hand, by parsing the industrial network data and combining the industrial protocol behavior and the industrial behavior model library for analysis, it is possible to determine whether there is an anomaly. However, it is limited by the lack of unified standards for the industrial behavior model library, which makes it difficult to cover all application scenarios and cannot effectively handle the situation where the protocol behavior or device response value gradually becomes abnormal over time. In the process of deep protocol analysis, malformed data packets may be encountered, thereby reducing the detection accuracy. On the other hand, the generation of security baselines through traffic self-learning for anomaly detection has certain adaptability and flexibility, but in actual applications, the time period of self-learning lacks clear standards, and the learning results depend on the traffic captured during the learning cycle. The implementation process is complex and time-consuming, and it is difficult to quickly respond to dynamically changing security needs. The adjustment of the security baseline depends to a certain extent on the experience of the operator and is highly subjective.

[0035] The present disclosure aims to solve the following technical problems:

[0036] Most existing industrial control data security monitoring methods rely on pre-set static security rules or manual configuration for monitoring. This approach is not only inflexible and difficult to adapt to the dynamically changing industrial control network environment, but also highly dependent on the operator's experience, increasing the complexity of configuration and maintenance, and unable to meet the increasingly complex security needs of industrial control systems;

[0037] In view of the complex and ever-changing industrial control network environment, existing technologies often lag behind in developing baselines due to the lack of effective automated tools, making it difficult to generate and adjust applicable baselines in a timely manner. This limitation makes it difficult for the system to cope with security challenges brought about by changes in protocol behavior, abnormal device response values, and dynamic changes in the network environment, resulting in insufficient coverage and accuracy of anomaly detection.

[0038] The present invention aims to solve the above-mentioned problems through an industrial control network monitoring method, realize the automatic generation and dynamic adjustment of the industrial control network security baseline, thereby improving the adaptability, efficiency and accuracy of anomaly detection and meeting the security needs of complex industrial environments.

[0039] The present invention proposes an industrial control network monitoring method. Compared with the traditional rule-based detection method, the present method can adaptively learn the normal behavior patterns of the network, effectively identify and respond to complex network security threats, and detect abnormal behaviors on this basis.

[0040] Figure 1 It is a flow chart of an industrial control network monitoring method according to an embodiment of the present disclosure.

[0041] First, refer to Figure 1 The present disclosure provides an industrial control network monitoring method, including:

[0042] S11, extracting features from the original traffic data of the industrial control network and generating feature vectors;

[0043] S12, training the feature vector by a machine learning algorithm to construct an industrial control baseline model;

[0044] S13, dynamically adjusting the baseline threshold of each feature in the industrial control baseline model based on the flow data in multiple monitoring cycles;

[0045] S14, monitoring the real-time traffic data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold;

[0046] S15. If the monitoring result is determined to be abnormal behavior, a protection strategy is formulated.

[0047] The machine learning-based industrial control network monitoring method proposed in the present invention automatically generates a security baseline within a specified period and dynamically fine-tunes the baseline threshold by introducing a machine learning model, thereby improving the efficiency and accuracy of industrial control network anomaly detection, covering a wider range of application scenarios, enhancing the adaptability and robustness of the system, simplifying the operating process, and reducing dependence on personnel experience.

[0048] In some embodiments, extracting features from the original traffic data of the industrial control network to generate a feature vector includes:

[0049] Get raw traffic data from industrial control networks;

[0050] Clean and format the acquired raw traffic data;

[0051] Extract features from the processed traffic data and generate feature vectors.

[0052] In some embodiments, extracting features from the processed traffic data to generate a feature vector includes:

[0053] Divide the processed traffic data into a training set and a validation set;

[0054] Extracting feature values ​​of five dimensions, namely, traffic feature, protocol feature, system feature, network topology feature and time feature, from the training set and the validation set respectively;

[0055] The extracted eigenvalues ​​of each dimension are combined to generate the feature vector of the training set and the feature vector of the validation set respectively.

[0056] In the disclosed embodiments, raw traffic data is acquired from an industrial control network; the acquired raw traffic data is cleaned to remove invalid, duplicate, or erroneous data to ensure data reliability and consistency; the cleaned data is formatted to unify data standards; the cleaned and formatted traffic data enters a feature extraction stage to provide support for subsequent model learning.

[0057] In the disclosed embodiment, the extraction of feature vectors is a key step in industrial control network detection, and the quality of features directly affects the performance of the model and the detection effect. From the processed original traffic data packets, features are extracted from five dimensions: traffic features, protocol features, system features, network topology features, and time features. Traffic features describe the behavior of communication traffic, including: packet size, transmission rate, connection duration, packet interval, etc.; protocol features describe the behavior characteristics related to the communication protocol, including: protocol type (such as TCP, UDP, etc.), command type (such as instruction type in industrial control protocol), response time, etc.; system features monitor the operating status of the industrial control system, including: CPU usage, memory usage, disk I / O frequency, etc.; network topology features describe the network connection relationship between devices, including: source IP and MAC address, destination IP and MAC address, source port and destination port, number of session connections, etc.; time features reflect the timing characteristics of communication, including: timestamp of data packets. The feature values ​​of the above five dimensions are combined to generate a complete feature vector; the feature vector is used to construct an industrial control baseline model as a reference standard for normal behavior; in actual applications, not all extracted features are necessarily used, and some feature values ​​can be selected to form a feature vector according to specific scenarios.

[0058] Here we only list the commonly used and representative features in each dimension. The selection of eigenvalues ​​is not fixed. Users can adjust the combination of eigenvalues ​​according to data characteristics and actual needs; select different combinations of eigenvalues ​​to generate eigenvectors for model construction and learning; compare the modeling effects of different eigenvectors, and perform feature tuning to improve model performance and detection effects.

[0059] In some embodiments, the feature vector is trained by a machine learning algorithm to construct an industrial control baseline model, including:

[0060] Combining different feature vectors of the training set with different machine learning algorithms to perform model training to obtain multiple candidate industrial control baseline models;

[0061] Evaluate the performance of the plurality of candidate industrial control baseline models through feature vectors of a validation set;

[0062] Based on the evaluation results, the best-performing combination of feature vectors and machine learning algorithms is selected to build an industrial control baseline model.

[0063] In some embodiments, the feature vector is trained by a machine learning algorithm to construct an industrial control baseline model, including:

[0064] The feature vectors of the training set are combined with different machine learning algorithms to perform model training to obtain multiple candidate industrial control baseline models;

[0065] Evaluate the performance of the plurality of candidate industrial control baseline models through feature vectors of a validation set;

[0066] According to the evaluation result, determining whether it is necessary to optimize the feature vector of the training set;

[0067] When it is necessary to optimize the feature vector of the training set, optimize the feature vector of the training set and re-combine different machine learning algorithms to perform model training, obtain multiple new candidate industrial control baseline models, and return to the evaluation step;

[0068] When there is no need to optimize the feature vector of the training set, a combination of the feature vector and the machine learning algorithm with the best performance is selected according to the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

[0069] In the embodiments of the present disclosure, the machine learning algorithm may adopt a supervised learning algorithm (such as random forest and support vector machine) or an unsupervised learning algorithm (such as K-means clustering), etc., and the most appropriate model may be selected according to the specific application scenario.

[0070] Select a supervised learning algorithm, such as random forest, as the core algorithm of the baseline model. Random forest has strong classification and regression capabilities and can handle high-dimensional feature data. Divide the data into a training set and a validation set in a set ratio (for example, 8:2). The training set is used to train the model and learn normal behavior patterns; the validation set is used to evaluate the performance of the model and verify its generalization ability. Construct feature engineering from multiple dimensions (such as traffic characteristics, protocol characteristics, system characteristics, etc.) to ensure that the model can learn normal behavior patterns. Use methods such as cross-validation to adjust the hyperparameters of the model. Improve the performance of the model by optimizing these parameters. Evaluate the performance of the model on the validation set to ensure the accuracy and generalization ability of the model. Ensure that the model can not only accurately identify normal behavior, but also effectively detect abnormal behavior.

[0071] In the embodiments of the present disclosure, an example of a machine learning modeling and optimization process in an industrial control scenario is as follows:

[0072] 1. When learning for the first time, extract all possible features and construct feature vectors, for example, feature vector 1 = [packet size, transmission rate, protocol type, CPU usage, disk I / O usage]; use feature vector 1 as input, select a machine learning algorithm (such as random forest) for training, and use 8:2 partitioning of the data set (80% as training set, 20% as validation set); use cross-validation (such as 10-fold cross-validation) to optimize the hyperparameters of the random forest, and train to obtain the initial model model_1, that is, model model_1 = feature vector 1 + random forest training. Evaluate model_1 on the validation set and find that the validation set accuracy is 70%. Based on the experience of researchers and the performance of the validation set, it may be believed that "disk I / O usage" contributes little to the performance of the model, and may even introduce noise, resulting in overfitting.

[0073] 2. Feature optimization, remove redundant features, and build an optimized model. In the second learning, remove "disk I / O usage" and adjust to the optimized feature vector, that is, feature vector 2 = [packet size, transmission rate, protocol type, CPU usage]. Re-use the random forest algorithm, use the same cross-validation method to optimize hyperparameters, and train a new model, that is, model model_2 = feature vector 2 + random forest training. Evaluate model_2 on the validation set and find that the validation set accuracy is increased to 80%.

[0074] Therefore, it can be considered that feature vector 2 performs better than feature vector 1, indicating that removing the feature of "disk I / O usage rate" improves the generalization ability of the model. Model model_2 is retained and model_1 is discarded.

[0075] 3. Compare multiple machine learning algorithms and select the best model

[0076] We tried various machine learning algorithms (such as random forest and support vector machine) for feature vector 1 and feature vector 2, and evaluated the performance of the model through the validation set. The results are as follows:

[0077] Eigenvector algorithm Model Validation set accuracy Eigenvector 1 Random Forest r_model_1 80％ Eigenvector 2 Random Forest r_model_2 85％ Eigenvector 1 Support Vector Machine s_model_1 75％ Eigenvector 2 Support Vector Machine s_model_2 80％

[0078] Considering the performance of the validation set, feature vector 2 + random forest (r_model_2) was selected as the final model, with a validation set accuracy of 85% and the best performance.

[0079] In the embodiments of the present disclosure, the optimization strategy can be flexibly adjusted according to the needs of different scenarios, including but not limited to the following situations: in some scenarios, the feature vector is fixed, and the model performance is optimized by adjusting the machine learning algorithm; in some scenarios, the algorithm is determined, and the model performance is improved by adjusting the selection and combination of feature vectors; in some scenarios, multiple feature vectors are combined with multiple machine learning algorithms to conduct comprehensive model training and evaluation, and finally the feature vector and algorithm combination with the best performance is selected; in some scenarios, a feature vector is used in combination with multiple machine learning algorithms for initial model training, and the feature vector is iteratively optimized and the model is retrained according to the evaluation results until the optimal result is obtained.

[0080] In the disclosed embodiment, in order to evaluate the model performance and avoid overfitting, cross-validation is used as a training method, and the specific steps are as follows: divide the training set into 10 subsets, use 9 subsets for training each time, and use the remaining 1 subset as a validation set; alternately use each subset as a validation set, repeat 10 times, and obtain 10 sets of model performance results; take the average of the results of 10 validations as an evaluation indicator of model performance; the validation set is 20% of the data divided from the original data set, which is only used to test the model performance and does not participate in training to avoid overfitting; commonly used evaluation indicators include accuracy, recall rate and F1 score, which are important measures of machine learning model performance.

[0081] In some embodiments, based on the flow data in multiple monitoring cycles, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including:

[0082] Based on the flow data of multiple monitoring cycles, the statistical characteristics of the baseline value of each feature are obtained through the industrial control baseline model;

[0083] Based on the statistical characteristics, the baseline threshold of each feature is dynamically adjusted.

[0084] In some embodiments, based on the flow data in multiple monitoring cycles, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including:

[0085] Based on the flow data in the first n monitoring cycles, a baseline threshold of each feature is obtained through the industrial control baseline model;

[0086] For each feature baseline value in the current monitoring period, determine whether it meets the setting rules of the corresponding baseline threshold;

[0087] If the baseline value of a certain feature does not meet the setting rule of the corresponding baseline threshold, based on the flow data of the latest n monitoring cycles, the statistical value of the baseline value of the certain feature is obtained through the industrial control baseline model;

[0088] Based on the statistical value, a baseline threshold of the certain feature is adjusted.

[0089] In the disclosed embodiments, the baseline threshold can be adjusted according to the specific application scenario, including but not limited to the following: flow baseline threshold, session baseline threshold, protocol baseline threshold, time baseline threshold and system baseline threshold. Different threshold types can be flexibly adjusted according to real-time monitoring needs to adapt to different industrial control network scenarios and performance requirements; for features such as flow, a double boundary threshold is usually set, and the rule is that the baseline value is within the upper and lower limits; for features such as sessions and protocols, a single threshold is usually set, and the rule is that the baseline value does not exceed the single threshold.

[0090] Baseline threshold adjustment is an important step to ensure that the system can adapt to changes in the network environment. By dynamically adjusting the baseline threshold, the accuracy and effectiveness of anomaly detection can be improved while balancing detection stability and response speed. The baseline threshold can be periodically adjusted using dynamic adjustment methods such as the sliding window mechanism. The choice of sliding window length depends on the dynamics of the network environment and the response speed requirements. Generally, shorter windows can quickly adapt to environmental changes, but may introduce more noise; longer windows are stable but have a slower response speed. The period for adjusting the baseline is, for example, set to 5 minutes. After traffic access, a baseline value is output through the model at short intervals (such as 10 seconds) to form multiple baseline values, which are used to calculate the characteristic statistics of the monitoring period (for example, mean, maximum, minimum, etc.).

[0091] The baseline adjustment process is as follows: In the first monitoring cycle, traffic data is extracted and a set of baseline values ​​are obtained through model learning; the maximum and minimum values ​​of the baseline values ​​are calculated as the initial baseline upper threshold and the initial baseline lower threshold; this threshold is only applicable to the first cycle and is used to start baseline monitoring. Starting from the second monitoring cycle, decide whether to adjust the threshold based on the relationship between the baseline value of the current cycle and the current baseline threshold range; if all baseline values ​​of the current cycle fall within the existing threshold range, keep the baseline threshold unchanged; if the baseline value of the current cycle exceeds the existing threshold range, adjust the baseline threshold. The baseline adjustment rule can be: collect the baseline value sequence of the last n monitoring cycles (including the baseline value of the current cycle), calculate the mean M; use the mean M to adjust the upper and lower thresholds, that is, M×(1±3%). After the baseline adjustment is completed, record the baseline value of each monitoring cycle and its adjustment; display the changing trend of the baseline value and threshold through a line chart to analyze the dynamic characteristics of the network environment.

[0092] For example, assume the following conditions: the monitoring cycle is set to be one cycle every 5 minutes; the data of the most recent n=5 cycles are used for adjustment and comparison each time; the mean value is output as the baseline value for each monitoring cycle. The baseline values ​​of the most recent 6 cycles are: the first cycle=15, the second cycle=18, the third cycle=14, the fourth cycle=16, the fifth cycle=17, and the sixth cycle=20. The threshold judgment and adjustment of the sixth cycle include: the current baseline value (20) exceeds the threshold range (14.55-15.45) determined by the first 5 cycles; calculate the mean value of the most recent n=5 cycles, that is, M=(the second cycle+the third cycle+the fourth cycle+the fifth cycle+the sixth cycle) / 5=(18+14+16+17+20) / 5=17; adjust the threshold value, that is, the upper threshold value is 17×(1+3%)=17.5; the lower threshold value is 17×(1-3%)=16.49.

[0093] In some embodiments, based on the industrial control baseline model and the adjusted baseline threshold, real-time traffic data of the industrial control network is monitored, including:

[0094] Deploy the industrial control baseline model to the actual operating environment of the industrial control network;

[0095] Continuously monitoring the flow data of the industrial control network to extract a feature vector of the flow data;

[0096] Based on the extracted feature vectors, the industrial control baseline model and the adjusted baseline threshold are used to monitor whether there is abnormal behavior.

[0097] In the disclosed embodiment, the trained security baseline model is deployed in a production environment; the model is integrated with a monitoring system to analyze and detect the traffic behavior of the industrial control network in real time; the industrial control network traffic data is continuously monitored to extract feature vectors of the access data; the baseline model is used to determine whether the traffic behavior is abnormal to ensure real-time response to potential threats.

[0098] Specifically, the trained industrial control baseline model (such as the model.pkl file) can be deployed to the production environment for real-time monitoring of industrial control network traffic. Place the model file in the specified directory of the production environment; access the model in the traffic monitoring system to ensure that data features can be extracted in real time and fed into the model for analysis. Extract feature values ​​from the traffic data accessed by the production environment; input the feature vector into the deployed model for real-time anomaly detection.

[0099] In some embodiments, the protection strategy includes: one or more of an audit alert, a blocking strategy, or a configuration strategy.

[0100] The audit alarm includes triggering sound and light alarms, popping up windows on the management page to prompt abnormal behavior, and generating log records;

[0101] The blocking strategy includes limiting abnormal traffic, isolating suspicious devices, or blocking abnormal connections;

[0102] The configuration strategy includes dynamically adjusting baseline model parameters or adjusting system alert levels.

[0103] In the disclosed embodiment, the feature vector extracted in real time is input into the industrial control baseline model, and the model calculates the baseline value of each feature; the baseline value is compared with the corresponding baseline threshold, and if the baseline value does not meet the setting rules of the baseline threshold, it is judged as abnormal behavior; if the baseline value meets the setting rules of the baseline threshold, it is judged as normal behavior. When it is judged as abnormal behavior, a protection strategy is formulated and executed; the protection strategy includes audit alarm, blocking strategy, configuration strategy, etc.; normal behavior does not take protection operations and allows communication to continue.

[0104] Specifically, the protection strategy includes: audit alarms, such as triggering sound and light alarms, pop-up windows on the management page to prompt abnormal behavior, and generate log records; blocking strategies, such as limiting abnormal traffic, isolating suspicious devices, and blocking abnormal connections; configuration strategies, such as dynamically adjusting baseline model parameters or adjusting system alert levels. The protection strategy can be pre-set and deployed to the production environment together with the industrial control baseline model; parameters can be dynamically adjusted through the policy interface, such as: adding specific traffic thresholds to trigger alarm rules; customizing alarm priorities; adjusting the trigger conditions of the protection strategy (such as baseline thresholds). The system records alarm information and protection operations in real time, and records specific abnormal behaviors and processing results in the form of logs; provides a visual interface to support security personnel to view abnormal traffic, baseline change trends, and the execution effect of protection strategies; the management interface can support rapid policy adjustments and support the addition or modification of traffic monitoring rules. Through the real-time application of the industrial control baseline model in the production environment, abnormal behaviors are promptly handled in combination with protection strategies to ensure the safe and stable operation of the industrial control network.

[0105] In some embodiments, the industrial control network monitoring method further includes:

[0106] Regularly obtain the latest traffic data of the industrial control network;

[0107] Based on the latest traffic data, generate a new feature vector;

[0108] Training the new feature vector by a machine learning algorithm to construct a new industrial control baseline model;

[0109] The existing industrial control baseline model is replaced with the new industrial control baseline model, and steps S14 and S15 are continued.

[0110] In the disclosed embodiment, new data is collected regularly for retraining the model to ensure that the model adapts to the latest network environment and behavior characteristics. Retraining includes: obtaining new data and preprocessing; extracting feature vectors and optimizing feature engineering; using new data to train the model and generate an updated industrial control baseline model. The trained model is directly deployed to the production environment. For example, traffic data for a recent period of time can be collected monthly to retrain the industrial control baseline model to ensure that the model accurately reflects the current network behavior. Baseline adjustments in the production environment can be triggered by real-time traffic data to maintain a dynamic adjustment mechanism.

[0111] Through the above steps, the present disclosure realizes efficient monitoring and anomaly detection of industrial control networks, can dynamically adapt to complex and changing network environments, and effectively improve the security protection capabilities of industrial control systems.

[0112] Figure 2 It is a schematic diagram of the composition of an electronic device according to an embodiment of the present disclosure.

[0113] Second, refer to Figure 2 , an embodiment of the present disclosure provides an electronic device, comprising:

[0114] One or more processors 201;

[0115] A memory 202 storing one or more programs, which, when executed by one or more processors, enables the one or more processors to implement the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure;

[0116] One or more I / O interfaces 203 are connected between the processor and the memory and are configured to implement information exchange between the processor and the memory.

[0117] Among them, the processor 201 is a device with data processing capabilities, including but not limited to a central processing unit (CPU) and the like; the memory 202 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 203 is connected between the processor 201 and the memory 202, and can realize information interaction between the processor 201 and the memory 202, including but not limited to a data bus (Bus) and the like.

[0118] In some embodiments, the processor 201 , the memory 202 , and the I / O interface 203 are connected to each other via a bus 204 , and further connected to other components of the computing device.

[0119] In a third aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, and when the program is executed by a processor, the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure is implemented.

[0120] In a fourth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program or instructions, which, when executed by a processor, implements the industrial control network monitoring method described in the first aspect of the embodiment of the present disclosure.

[0121] Figure 3 It is a block diagram of an industrial control network monitoring system according to an embodiment of the present disclosure.

[0122] Fifth, refer to Figure 3 The present disclosure provides an industrial control network monitoring system, including:

[0123] The feature vector generation module 301 is configured to extract features from the original traffic data of the industrial control network and generate a feature vector;

[0124] A model building module 302 is configured to train the feature vector through a machine learning algorithm to build an industrial control baseline model;

[0125] A threshold adjustment module 303 is configured to dynamically adjust the baseline threshold of each feature in the industrial control baseline model based on the flow data in multiple monitoring cycles;

[0126] A real-time monitoring module 304, configured to monitor the real-time flow data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold;

[0127] The protection strategy module 305 is configured to formulate a protection strategy if the monitoring result is determined to be an abnormal behavior.

[0128] In some embodiments, the feature vector generation module 301 includes:

[0129] An acquisition module configured to acquire raw flow data from the industrial control network;

[0130] A processing module configured to clean and format the acquired raw traffic data;

[0131] The generation module is configured to extract features from the processed traffic data and generate feature vectors.

[0132] In some embodiments, the generating module comprises:

[0133] a partitioning module configured to partition the processed traffic data into a training set and a validation set;

[0134] An extraction module is configured to extract feature values ​​of five dimensions, namely, traffic feature, protocol feature, system feature, network topology feature and time feature, from the training set and the validation set respectively;

[0135] The combination module is configured to combine the extracted feature values ​​of each dimension to generate a feature vector of the training set and a feature vector of the validation set respectively.

[0136] In some embodiments, the model building module 302 includes:

[0137] A first candidate model acquisition module is configured to perform model training on the feature vectors of the training set in combination with different machine learning algorithms to obtain multiple candidate industrial control baseline models;

[0138] An evaluation module configured to evaluate the performance of the plurality of candidate industrial control baseline models through feature vectors of a validation set;

[0139] An optimization judgment module, configured to judge whether it is necessary to optimize the feature vector of the training set according to the evaluation result;

[0140] A second candidate model acquisition module is configured to optimize the feature vector of the training set and re-combine different machine learning algorithms to perform model training when it is necessary to optimize the feature vector of the training set, obtain multiple new candidate industrial control baseline models, and return to the evaluation step;

[0141] The selection module is configured to select a combination of the feature vector and the machine learning algorithm with the best performance to construct the industrial control baseline model according to the evaluation results of all candidate industrial control baseline models when there is no need to optimize the feature vector of the training set.

[0142] In some embodiments, the threshold adjustment module 303 includes:

[0143] A threshold acquisition module, configured to obtain a baseline threshold of each feature through the industrial control baseline model based on the flow data in the first n monitoring cycles;

[0144] A judgment module is configured to judge whether the baseline value of each feature in the current monitoring period meets the setting rule of the corresponding baseline threshold;

[0145] A statistical value acquisition module, configured to obtain a statistical value of the baseline value of a certain feature through the industrial control baseline model based on the flow data of the latest n monitoring cycles if the baseline value of the certain feature does not meet the setting rule of the corresponding baseline threshold;

[0146] The baseline threshold adjustment module is configured to adjust the baseline threshold of the certain feature based on the statistical value.

[0147] In some embodiments, the real-time monitoring module 304 includes:

[0148] A deployment module, configured to deploy the industrial control baseline model into an actual operating environment of the industrial control network;

[0149] The monitoring module is configured to continuously monitor the flow data of the industrial control network to extract the feature vector of the flow data; the abnormal monitoring module is configured to monitor whether there is abnormal behavior based on the extracted feature vector, using the industrial control baseline model and the adjusted baseline threshold.

[0150] In some embodiments, the protection strategy includes: one or more of an audit alert, a blocking strategy, or a configuration strategy.

[0151] The audit alarm includes triggering sound and light alarms, popping up windows on the management page to prompt abnormal behavior, and generating log records;

[0152] The blocking strategy includes limiting abnormal traffic, isolating suspicious devices, or blocking abnormal connections;

[0153] The configuration strategy includes dynamically adjusting baseline model parameters or adjusting system alert levels.

[0154] In order to enable those skilled in the art to more clearly understand the technical solution provided by the embodiment of the present disclosure, the industrial control network monitoring method provided by the embodiment of the present disclosure is described in detail below through specific embodiments:

[0155] Embodiment 1

[0156] This example is based on a data security industrial control security audit monitoring product, and explains a machine learning-based industrial control network anomaly monitoring method proposed by the present invention to improve security capabilities.

[0157] According to the method described in detail in this disclosure, the specific process is as follows:

[0158] 1) Set the data collection frequency. According to the network scale and performance requirements, set the data collection frequency reasonably. In this example application environment, network traffic data can be collected once every minute; system status information can be collected once every 5 minutes;

[0159] 2) Data collection. Collect traffic packets from network devices (such as switches, routers, firewalls, etc.) and collect system performance indicators, including CPU utilization, memory usage, disk I / O, etc.;

[0160] 3) Clean the collected data, exclude obviously irrelevant, duplicate or missing data, and ensure the quality and integrity of the data; standardize the cleaned data to improve the effect of subsequent model training. Standardization methods include but are not limited to: Z-Score standardization, converting the data into a standard normal distribution with a mean of 0 and a standard deviation of 1, which is suitable for situations where the data is close to a normal distribution; Min-Max standardization, mapping the data to the [0,1] interval, which is suitable for models that are sensitive to boundaries; other methods, depending on specific needs, can use logarithmic transformation, normalization to a specific range or quantile scaling;

[0161] 4) By constructing feature engineering, the following feature values ​​are extracted from the preprocessed traffic data and system indicators: the number of bytes of a single data packet, the amount of data transmitted per unit time, the connection duration, the packet interval, the protocol type, the command type of the specific protocol (read or write), the response time, the CPU usage, the memory usage, the disk I / O frequency, the source IP and MAC address, the destination IP and MAC address, the source port and the destination port, and the number of session connections;

[0162] 5) Through model evaluation indicators and multiple machine learning algorithms, the industrial control baseline model is learned, trained and evaluated to select the model with the best performance. Model evaluation indicators can use accuracy, recall and F1 score as the main evaluation indicators. These three indicators are widely used evaluation standards in machine learning and can comprehensively measure the performance of the model. According to the needs of specific scenarios, other indicators (such as precision, ROC-AUC, etc.) can also be selected for supplementary evaluation. Use common algorithms such as K-means clustering, random forest and support vector machine to train and evaluate the model; according to the needs of the scenario, other algorithms (such as logistic regression, decision tree, etc.) can also be tried, but it is recommended to give priority to the above three algorithms to obtain more stable performance.

[0163] For example, the following model selection process can be adopted: perform model training for different machine learning algorithms separately; use accuracy, recall rate and F1 score to evaluate the industrial control baseline model generated by each algorithm; comprehensively consider the performance of various indicators and select the model with the best performance as the final industrial control baseline model.

[0164] 6) Sliding window baseline generation. Set the sliding window length to 5 minutes. In the first monitoring cycle, give a baseline threshold value Th. Next, collect relevant network traffic data in the second monitoring cycle, extract the required feature vectors from it, and use the model to obtain the baseline value in the monitoring cycle. Repeat this process to obtain the baseline sequence X.

[0165] 7) Dynamic adjustment of baseline threshold. Calculate the mean M of the baselines of the first n monitoring periods, and set the upper baseline threshold to M×(1+3%) and the lower baseline threshold to M×(1-3%). If the baseline value within the monitoring period exceeds the threshold range, adjust the baseline; otherwise, keep it unchanged;

[0166] 8) Set the length of the sliding window to 5 minutes, and initialize the baseline threshold based on the network traffic data in the first monitoring cycle, that is, in the first monitoring cycle, extract the traffic data, and obtain the baseline value of the monitoring cycle through model learning; the maximum and minimum values ​​of the baseline value are used as the initial baseline upper threshold and the initial baseline lower threshold respectively; the initial baseline threshold is only applicable to the first monitoring cycle as the starting baseline monitoring.

[0167] 9) Dynamically adjust the baseline threshold based on the data of multiple consecutive monitoring cycles. Starting from the second monitoring cycle, the network traffic data within the monitoring cycle is continuously collected, the feature vector is extracted, and the baseline value of each monitoring cycle is calculated through the model; the baseline value constitutes the baseline sequence X = [X1, X2, ..., X n ], where X iRepresents the baseline value of the ith monitoring cycle; starting from the n+1th monitoring cycle, the mean M is calculated based on the baseline values ​​of the previous n monitoring cycles; a new baseline upper and lower thresholds are set, that is, the upper threshold = M×(1+3%), the lower threshold = M×(1-3%); if the baseline value of the current monitoring cycle falls within the above threshold range, the threshold is kept unchanged; if the baseline value exceeds the range, the threshold is adjusted.

[0168] Baseline updates include indicators in multiple dimensions, such as traffic baselines, which generate upper and lower thresholds based on traffic characteristics (such as bandwidth); session baselines, which set a single threshold based on the number of session connections; and instruction baselines, which do not require thresholds for protocol types and only set a single threshold for the number of protocols. The learning interval can be dynamically adjusted based on the network environment and device performance, such as generating a baseline value every 5 or 10 seconds; the threshold adjustment period matches the length of the sliding window (for example, adjustment every 5 minutes).

[0169] For example, assuming that the sliding window length is 5 minutes, the baseline values ​​of the most recent 6 monitoring cycles are: X2=18 in the 2nd cycle, X3=14 in the 3rd cycle, X4=16 in the 4th cycle, X5=17 in the 5th cycle, and X6=20 in the 6th cycle.

[0170] Calculate the mean value M with n=5 = (X2+X3+X4+X5+X6) / 5 = (18+14+16+17+20) / 5 = 17

[0171] Upper threshold = 17 × (1 + 3%) = 17.51, lower threshold = 17 × (1-3%) = 16.49

[0172] Determine whether the baseline value of the 7th cycle falls within the range of [16.49,17.51]. If it exceeds, adjust the threshold.

[0173] 10) Model integration. Deploy the model into the existing monitoring system to process and analyze network traffic data in real time and detect abnormal behavior;

[0174] 11) Protection strategy is an important measure in industrial control network security, which is used to respond quickly when abnormal behavior is detected. The following are examples of specific protection strategies: blocking abnormal connections. When serious threatening traffic behavior or illegal access behavior is detected, the firewall rules are modified or the session is terminated to prevent further threat propagation; logging, recording detailed information of abnormal behavior (such as timestamps, abnormal characteristics) for subsequent analysis or tracing by the administrator; sound and light alarms. When the traffic characteristics exceed the threshold range, the system triggers the sound and light alarm device to alert the administrator; pop-up prompts. When abnormal traffic behavior is detected, an alarm window pops up on the management web page to prompt the administrator with specific abnormal information; isolation and restricted access. Network isolation of abnormal devices or restrictions on their access rights.

[0175] 12) The purpose of model retraining is to adapt to the dynamic changes in the industrial control network environment and ensure the accuracy and reliability of the industrial control baseline model. The retraining steps include: obtaining the traffic data of the industrial control network again and extracting feature vectors; generating new training sets and validation sets; and retraining the machine learning model based on the new data. The trained model can be directly deployed for online monitoring. The trigger conditions for retraining may include: periodic retraining (such as monthly or quarterly); triggering retraining when significant changes in the network environment are detected (such as the addition of new equipment, abnormal fluctuations in traffic patterns); triggering retraining after collecting enough new data from the production environment.

[0176] The above steps systematically describe the industrial control network anomaly monitoring method based on machine learning, from data collection to model integration and protection strategy, which fully reflects the process of improving security capabilities.

[0177] This paper uses machine learning algorithms to comprehensively analyze industrial control network traffic, builds feature models from multiple dimensions, and implements real-time traffic monitoring and abnormal behavior detection for industrial control networks, preventing malicious attacks and internal threats, and ensuring the security and reliability of industrial control networks. The main application areas include industrial environments such as electricity, oil, natural gas, and the Internet of Things. The key technical points involved are as follows:

[0178] 1) Construction and optimization of feature engineering

[0179] Extract key information from dimensions such as traffic characteristics, protocol characteristics, system characteristics, network topology characteristics and time characteristics; screen and optimize different feature dimensions and different feature values ​​to ensure that the extracted features can effectively characterize network behavior.

[0180] 2) Model algorithm and parameter optimization

[0181] Select machine learning algorithms suitable for industrial control network scenarios, including: K-means clustering for unsupervised detection of abnormal behavior; random forest (RF) for classification and feature importance analysis; support vector machine (SVM) for accurate classification of high-dimensional data. Use hyperparameter tuning techniques (such as grid search or cross-validation) to improve the performance and accuracy of the model.

[0182] 3) Model optimization and generalization capability improvement

[0183] Continuously save previous network traffic data as a training set to improve the model's adaptability to environmental changes. Optimize the model's learning ability, enhance its generalization performance, and ensure the model's stability and effectiveness in different network environments.

[0184] By building comprehensive feature engineering, selecting appropriate machine learning algorithms and continuously optimizing models, this paper provides an efficient and secure real-time monitoring and anomaly detection solution for industrial control networks, which is suitable for complex network environments in various industrial fields.

[0185] The present disclosure has the following beneficial effects:

[0186] 1) Use a powerful algorithm system with high anti-cracking capabilities; the various parts of the system are highly coupled to improve overall security and reliability.

[0187] 2) Reduce the need for manual intervention through automated models; achieve real-time network abnormal status monitoring and significantly improve network security.

[0188] 3) The baseline model can be used as an authoritative reference standard for network anomaly detection, and combined with technologies such as traffic self-learning, it can further improve the reliability and accuracy of network monitoring.

[0189] The present disclosure effectively improves the security capabilities of industrial control networks and provides an efficient and reliable solution for detecting and responding to abnormal behaviors.

[0190] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0191] Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should be interpreted only in a general illustrative sense and not for limiting purposes. In some instances, it will be apparent to those skilled in the art that, unless otherwise expressly noted, features, characteristics, and / or elements described in conjunction with a particular embodiment may be used alone or in combination with features, characteristics, and / or elements described in conjunction with other embodiments. Therefore, those skilled in the art will appreciate that various changes in form and detail may be made without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

1. A method for monitoring an industrial control network, comprising: Extract features from the original traffic data of the industrial control network and generate feature vectors; Training the feature vectors by a machine learning algorithm to build an industrial control baseline model; Dynamically adjusting the baseline threshold of each feature in the industrial control baseline model based on the flow data in multiple monitoring cycles; Based on the industrial control baseline model and the adjusted baseline threshold, real-time traffic data of the industrial control network is monitored; If the monitoring results are determined to be abnormal behavior, a protection strategy will be formulated.

2. The industrial control network monitoring method according to claim 1, wherein: Extract features from the original traffic data of the industrial control network and generate feature vectors, including: Get raw traffic data from industrial control networks; Clean and format the acquired raw traffic data; Extract features from the processed traffic data and generate feature vectors.

3. The industrial control network monitoring method according to claim 2, wherein: Extract features from the processed traffic data and generate feature vectors, including: Divide the processed traffic data into a training set and a validation set; Extracting feature values ​​of five dimensions, namely, traffic feature, protocol feature, system feature, network topology feature and time feature, from the training set and the validation set respectively; The extracted eigenvalues ​​of each dimension are combined to generate the feature vector of the training set and the feature vector of the validation set respectively.

4. The industrial control network monitoring method according to claim 3, wherein: The feature vector is trained by a machine learning algorithm to construct an industrial control baseline model, including: The feature vectors of the training set are combined with different machine learning algorithms to perform model training to obtain multiple candidate industrial control baseline models; Evaluate the performance of the plurality of candidate industrial control baseline models through feature vectors of a validation set; According to the evaluation result, determining whether it is necessary to optimize the feature vector of the training set; When it is necessary to optimize the feature vector of the training set, optimize the feature vector of the training set and re-combine different machine learning algorithms to perform model training, obtain multiple new candidate industrial control baseline models, and return to the evaluation step; When there is no need to optimize the feature vector of the training set, a combination of the feature vector and the machine learning algorithm with the best performance is selected according to the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

5. The industrial control network monitoring method according to claim 4, wherein: Based on the flow data in multiple monitoring cycles, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including: Based on the flow data in the first n monitoring cycles, a baseline threshold of each feature is obtained through the industrial control baseline model; For each feature baseline value in the current monitoring period, determine whether it meets the setting rules of the corresponding baseline threshold; If the baseline value of a certain feature does not meet the setting rule of the corresponding baseline threshold, based on the flow data of the latest n monitoring cycles, the statistical value of the baseline value of the certain feature is obtained through the industrial control baseline model; Based on the statistical value, a baseline threshold of the certain feature is adjusted.

6. The industrial control network monitoring method according to claim 5, wherein: Based on the industrial control baseline model and the adjusted baseline threshold, real-time traffic data of the industrial control network is monitored, including: Deploy the industrial control baseline model to the actual operating environment of the industrial control network; Continuously monitoring the flow data of the industrial control network to extract a feature vector of the flow data; Based on the extracted feature vectors, the industrial control baseline model and the adjusted baseline threshold are used to monitor whether there is abnormal behavior.

7. The industrial control network monitoring method according to any one of claims 1 to 6, wherein: The protection strategy includes: one or more of audit alarm, blocking strategy or configuration strategy, The audit alarm includes triggering sound and light alarms, popping up windows on the management page to prompt abnormal behavior, and generating log records; The blocking strategy includes limiting abnormal traffic, isolating suspicious devices, or blocking abnormal connections; The configuration strategy includes dynamically adjusting baseline model parameters or adjusting system alert levels.

8. An electronic device comprising: one or more processors; A memory having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the industrial control network monitoring method according to any one of claims 1 to 7.

9. A computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the industrial control network monitoring method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program or an instruction, wherein when the computer program or the instruction is executed by a processor, the industrial control network monitoring method according to any one of claims 1 to 7 is implemented.

Images