An industrial control network monitoring method, electronic device, readable medium, and program product.

Abstract

This disclosure provides a method for monitoring industrial control networks (ICS) networks, comprising: extracting features from raw traffic data of the ICS network to generate feature vectors; training the feature vectors using a machine learning algorithm to construct an ICS baseline model; dynamically adjusting the baseline threshold of each feature in the ICS baseline model based on traffic data over multiple monitoring periods; monitoring real-time traffic data of the ICS network based on the ICS baseline model and the adjusted baseline thresholds; and formulating protection strategies if the monitoring results indicate abnormal behavior. This disclosure also provides an electronic device, a computer-readable medium, and a computer program product. This disclosure, through dynamically adjusting baseline thresholds and using a feature vector-based ICS baseline model, enables precise monitoring of real-time traffic data of ICS networks, effectively detecting abnormal behavior. Combined with protection strategies, it can quickly respond to potential threats, improve the flexibility and accuracy of security protection, and enhance the security of ICS networks.

Description

Technical Field

[0001] This disclosure relates to the field of industrial control network security technology, and in particular to an industrial control network monitoring method, an electronic device, a computer-readable medium, and a computer program product. Background Technology

[0002] As a crucial component of the nation's critical information infrastructure, industrial control systems are increasingly integrating with the internet, driven by the rapid development of emerging businesses. However, this integration also brings serious security risks. In recent years, cyberattacks targeting industrial control systems have been frequent, posing a significant threat to several key industries and sectors, including energy, transportation, water conservancy, steel, and manufacturing. These industries heavily rely on the stable operation of industrial control systems; attacks on these systems can lead to serious consequences such as production disruptions and data breaches, endangering not only the production operations and data security of enterprises but also directly impacting the security and stability of the nation's critical infrastructure. Therefore, strengthening the security of industrial control systems has become an urgent task for both enterprises and governments.

[0003] However, the security protection of industrial control systems usually relies on the operator's experience, which is highly subjective. Summary of the Invention

[0004] This disclosure provides an industrial control network monitoring method, an electronic device, a computer-readable medium, and a computer program product.

[0005] In a first aspect, embodiments of this disclosure provide an industrial control network monitoring method, comprising: extracting features from raw traffic data of the industrial control network to generate feature vectors; training the feature vectors using a machine learning algorithm to construct an industrial control baseline model; dynamically adjusting the baseline threshold of each feature in the industrial control baseline model based on traffic data within multiple monitoring periods; monitoring the real-time traffic data of the industrial control network based on the industrial control baseline model and the adjusted baseline thresholds; and formulating a protection strategy if the monitoring results indicate abnormal behavior.

[0006] In some embodiments, extracting features from raw traffic data of an industrial control network to generate feature vectors includes: acquiring raw traffic data from the industrial control network; cleaning and formatting the acquired raw traffic data; and extracting features from the processed traffic data to generate feature vectors.

[0007] In some embodiments, extracting features from the processed traffic data to generate feature vectors includes: dividing the processed traffic data into a training set and a validation set; extracting feature values ​​of five dimensions—traffic features, protocol features, system features, network topology features, and time features—from the training set and validation set respectively; and combining the extracted feature values ​​of each dimension to generate feature vectors for the training set and validation set respectively.

[0008] In some embodiments, training the feature vectors using machine learning algorithms to construct an industrial control baseline model includes: combining the feature vectors of the training set with different machine learning algorithms to train the model, obtaining multiple candidate industrial control baseline models; evaluating the performance of the multiple candidate industrial control baseline models using the feature vectors of the validation set; determining whether the feature vectors of the training set need to be optimized based on the evaluation results; when the feature vectors of the training set need to be optimized, optimizing the feature vectors of the training set and re-combining them with different machine learning algorithms to train the model, obtaining multiple new candidate industrial control baseline models, and returning to the evaluation step; when the feature vectors of the training set do not need to be optimized, selecting the combination of the feature vector and machine learning algorithm with the best performance based on the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

[0009] In some embodiments, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted based on traffic data within multiple monitoring periods, including: obtaining the baseline threshold of each feature through the industrial control baseline model based on traffic data within the previous n monitoring periods; determining whether the baseline value of each feature in the current monitoring period conforms to the setting rules of the corresponding baseline threshold; if the baseline value of a certain feature does not conform to the setting rules of the corresponding baseline threshold, obtaining a statistical value of the baseline value of the certain feature through the industrial control baseline model based on traffic data from the most recent n monitoring periods; and adjusting the baseline threshold of the certain feature based on the statistical value.

[0010] In some embodiments, monitoring the real-time traffic data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold includes: deploying the industrial control baseline model to the actual operating environment of the industrial control network; continuously monitoring the traffic data of the industrial control network to extract feature vectors of the traffic data; and monitoring for abnormal behavior based on the extracted feature vectors using the industrial control baseline model and the adjusted baseline thresholds.

[0011] In some embodiments, the protection strategy includes one or more of the following: audit alerts, blocking strategies, or configuration strategies, wherein the audit alerts include triggering audible and visual alarms, displaying abnormal behavior prompts in a pop-up window on the management page, and generating log records; the blocking strategies include limiting abnormal traffic, isolating suspicious devices, or blocking abnormal connections; and the configuration strategies include dynamically adjusting baseline model parameters or adjusting the system alert level.

[0012] In a second aspect, embodiments of this disclosure provide an electronic device, including: one or more processors; and a memory storing one or more programs thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the industrial control network monitoring method described in the first aspect of this disclosure.

[0013] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the industrial control network monitoring method described in the first aspect of embodiments of this disclosure.

[0014] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the industrial control network monitoring method described in the first aspect of this disclosure.

[0015] This disclosure enables precise monitoring of real-time traffic data in industrial control networks by dynamically adjusting baseline thresholds and using a feature vector-based industrial control baseline model, effectively detecting abnormal behavior. Combined with protection strategies, it allows for rapid response to potential threats, thereby improving the security and reliability of industrial control networks, adapting to dynamic changes in the network environment, reducing reliance on operator experience, and enhancing the flexibility and accuracy of security protection for industrial control systems. Attached Figure Description

[0016] Figure 1 This is a flowchart of an industrial control network monitoring method according to an embodiment of the present disclosure;

[0017] Figure 2 This is a schematic diagram of the composition of an electronic device according to an embodiment of the present disclosure;

[0018] Figure 3 This is a block diagram of an industrial control network monitoring system according to an embodiment of the present disclosure. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions of this disclosure will be described in detail below with reference to the accompanying drawings.

[0020] Exemplary embodiments will be described more fully below with reference to the accompanying drawings; however, these exemplary embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will enable those skilled in the art to fully understand the scope of this disclosure.

[0021] Where there is no conflict, the various embodiments of this disclosure and the features thereof in the embodiments may be combined with each other.

[0022] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. As used herein, the singular forms “a” and “the” are also intended to include the plural forms unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded.

[0024] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant art and this disclosure, and will not be interpreted as having an idealized or overly formal meaning, unless expressly so defined herein.

[0025] Unless otherwise specified in this disclosure, the following technical terms shall be interpreted as follows:

[0026] Industrial control networks are data communication networks used in industrial automation and process control systems. They are commonly used in industrial settings such as power, petrochemical, and manufacturing. They consist of industrial protocols (such as Modbus and DNP3) and control devices (such as PLCs and SCADA systems).

[0027] Raw network traffic data is unprocessed communication data packets collected by network devices (such as switches and routers), containing information such as source IP, destination IP, protocol type, and packet size; it is used to analyze network communication behavior and detect abnormal activity.

[0028] Data cleaning refers to the process of handling raw data to remove invalid, duplicate, or erroneous data in order to ensure data quality.

[0029] A feature vector is a numerical representation of multiple features extracted from data, usually organized in vector form; it serves as input to machine learning models and describes the key features of a data sample.

[0030] The industrial control baseline model is a model built using machine learning algorithms to describe the normal behavior patterns of industrial control networks.

[0031] Baseline threshold refers to the upper and lower limit parameters in an industrial control baseline model that describe normal behavior.

[0032] A sliding window is an analytical method for processing time series data. It involves continuously sliding a window of a fixed length to obtain the latest data.

[0033] Machine learning algorithms are technical methods that learn data features to build models for prediction or classification.

[0034] In some related technologies, baseline benchmark table construction techniques enhance the network security of industrial control systems. However, these techniques typically have limitations. On one hand, analyzing industrial network data and combining it with industrial protocol behavior and industrial behavior model libraries to determine anomalies is limited by the lack of a unified standard for industrial behavior model libraries, making it difficult to cover all application scenarios and effectively handle situations where protocol behavior or device response values ​​gradually become abnormal over time. Furthermore, malformed data packets may be encountered during deep protocol parsing, reducing detection accuracy. On the other hand, generating security baselines through traffic self-learning for anomaly detection offers some adaptability and flexibility. However, in practical applications, the self-learning time period lacks a clear standard, and the learning results depend on the traffic captured within the learning period. This process is complex and time-consuming, making it difficult to quickly respond to dynamically changing security needs. Adjusting security baselines also relies to some extent on operator experience, making it highly subjective.

[0035] This disclosure aims to solve the following technical problems:

[0036] Existing industrial control data security monitoring methods mostly rely on pre-set static security rules or manual configuration for monitoring. This approach is not only inflexible and unable to adapt to the dynamically changing industrial control network environment, but also highly dependent on the experience of operators, increasing the complexity of configuration and maintenance, and failing to meet the increasingly complex security requirements of industrial control systems.

[0037] In the face of complex and ever-changing industrial control network environments, existing technologies often lag behind in establishing baseline benchmarks due to a lack of effective automated tools, making it difficult to generate and adjust applicable baseline benchmarks in a timely manner. This limitation makes it difficult for systems to cope with security challenges brought about by changes in protocol behavior, abnormal device response values, and dynamic changes in the network environment, resulting in insufficient coverage and accuracy of anomaly detection.

[0038] This disclosure aims to solve the above-mentioned problems through an industrial control network monitoring method, realize the automatic generation and dynamic adjustment of the industrial control network security baseline, thereby improving the adaptability, efficiency and accuracy of anomaly detection and meeting the security needs of complex industrial environments.

[0039] This disclosure proposes an industrial control network monitoring method. Compared with traditional rule-based detection methods, this method can adaptively learn the normal behavior patterns of the network, effectively identify and respond to complex network security threats, and detect abnormal behavior based on this.

[0040] Figure 1 This is a flowchart of an industrial control network monitoring method according to an embodiment of the present disclosure.

[0041] Firstly, referring to Figure 1 This disclosure provides an industrial control network monitoring method, including:

[0042] S11. Extract features from the raw traffic data of the industrial control network and generate feature vectors;

[0043] S12. The feature vectors are trained using machine learning algorithms to construct an industrial control baseline model;

[0044] S13. Based on the flow data within multiple monitoring periods, dynamically adjust the baseline threshold of each feature in the industrial control baseline model;

[0045] S14. Based on the industrial control baseline model and the adjusted baseline threshold, monitor the real-time traffic data of the industrial control network;

[0046] S15. If the monitoring results indicate abnormal behavior, then formulate a protection strategy.

[0047] The machine learning-based industrial control network monitoring method proposed in this disclosure automatically generates a safety baseline within a specified period by introducing a machine learning model and dynamically fine-tunes the baseline threshold, thereby improving the efficiency and accuracy of anomaly detection in industrial control networks, covering a wider range of application scenarios, enhancing the adaptability and robustness of the system, simplifying the operation process, and reducing reliance on human experience.

[0048] In some embodiments, features are extracted from raw traffic data of the industrial control network to generate a feature vector, including:

[0049] Obtain raw traffic data from the industrial control network;

[0050] The acquired raw traffic data is cleaned and formatted.

[0051] Features are extracted from the processed traffic data to generate feature vectors.

[0052] In some embodiments, features are extracted from the processed traffic data to generate a feature vector, including:

[0053] The processed traffic data is divided into a training set and a validation set;

[0054] Feature values ​​of five dimensions—traffic features, protocol features, system features, network topology features, and time features—are extracted from the training set and validation set, respectively.

[0055] The extracted feature values ​​from each dimension are combined to generate feature vectors for the training set and the validation set, respectively.

[0056] In this embodiment of the disclosure, raw traffic data is obtained from an industrial control network; the obtained raw traffic data is cleaned to remove invalid, duplicate, or incorrectly formatted data to ensure data reliability and consistency; the cleaned data is formatted to unify data standards; the cleaned and formatted traffic data enters the feature extraction stage to support subsequent model learning.

[0057] In this embodiment, feature vector extraction is a crucial step in industrial control network (ICS) detection, as the quality of the features directly impacts the model's performance and detection effectiveness. Features are extracted from the processed raw traffic data packets across five dimensions: traffic features, protocol features, system features, network topology features, and time features. Traffic features describe the behavior of communication traffic, including packet size, transmission rate, connection duration, and packet interval. Protocol features describe behavioral characteristics related to communication protocols, including protocol type (e.g., TCP, UDP), command type (e.g., instruction types in ICS protocols), and response time. System features monitor the operating status of the ICS system, including CPU utilization, memory utilization, and disk I / O frequency. Network topology features describe the network connection relationships between devices, including source IP and MAC addresses, destination IP and MAC addresses, source and destination ports, and the number of session connections. Time features reflect the timing characteristics of communication, including data packet timestamps. The feature values ​​from these five dimensions are combined to generate a complete feature vector. This feature vector is used to construct the ICS baseline model as a reference standard for normal behavior. In practical applications, not all extracted features are necessarily used; some feature values ​​can be selected to form the feature vector based on the specific scenario.

[0058] This section only lists commonly used and representative features for each dimension. The selection of feature values ​​is not fixed. Users can adjust the combination of feature values ​​according to data characteristics and actual needs. Different combinations of feature values ​​are selected to generate feature vectors for model construction and learning. The modeling effects of different feature vectors are compared, and feature tuning is performed to improve model performance and detection results.

[0059] In some embodiments, the feature vectors are trained using machine learning algorithms to construct an industrial control baseline model, including:

[0060] The different feature vectors of the training set are combined with different machine learning algorithms to train the model, thereby obtaining multiple candidate industrial control baseline models.

[0061] The performance of the multiple candidate industrial control baseline models is evaluated using the feature vectors of the validation set.

[0062] Based on the evaluation results, the best-performing feature vector and machine learning algorithm combination are selected to construct the industrial control baseline model.

[0063] In some embodiments, the feature vectors are trained using machine learning algorithms to construct an industrial control baseline model, including:

[0064] The feature vectors of the training set are combined with different machine learning algorithms to train the model, thereby obtaining multiple candidate industrial control baseline models.

[0065] The performance of the multiple candidate industrial control baseline models is evaluated using the feature vectors of the validation set.

[0066] Based on the evaluation results, determine whether it is necessary to optimize the feature vectors of the training set;

[0067] When it is necessary to optimize the feature vectors of the training set, the feature vectors of the training set are optimized and different machine learning algorithms are re-integrated for model training to obtain multiple new candidate industrial control baseline models, and the evaluation step is returned.

[0068] When it is not necessary to optimize the feature vectors of the training set, the combination of the feature vectors and machine learning algorithms with the best performance is selected based on the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

[0069] In the embodiments of this disclosure, the machine learning algorithm may be a supervised learning algorithm (e.g., random forest and support vector machine) or an unsupervised learning algorithm (e.g., K-means clustering), and the most suitable model shall be selected according to the specific application scenario.

[0070] A supervised learning algorithm, such as random forest, is selected as the core algorithm for the baseline model. Random forest has strong classification and regression capabilities and can handle high-dimensional feature data. The data is divided into training and validation sets in a set ratio (e.g., 8:2). The training set is used to train the model and learn normal behavior patterns; the validation set is used to evaluate the model's performance and verify its generalization ability. Feature engineering is constructed from multiple dimensions (such as traffic features, protocol features, system features, etc.) to ensure that the model can learn normal behavior patterns. The model's hyperparameters are tuned using methods such as cross-validation. By optimizing these parameters, the model's performance is improved. The model's performance is evaluated on the validation set to ensure the model's accuracy and generalization ability. The goal is to ensure that the model can not only accurately identify normal behavior but also effectively detect abnormal behavior.

[0071] In this embodiment of the disclosure, an example of the machine learning modeling and optimization process in an industrial control scenario is as follows:

[0072] 1. During initial learning, all possible features are extracted to construct a feature vector. For example, feature vector 1 = [data packet size, transmission rate, protocol type, CPU utilization, disk I / O utilization]. Using feature vector 1 as input, a machine learning algorithm (e.g., random forest) is selected for training. The dataset is split into an 8:2 ratio (80% as the training set and 20% as the validation set). Cross-validation (e.g., 10-fold cross-validation) is used to optimize the hyperparameters of the random forest, resulting in the initial model model_1. That is, model_1 = feature vector 1 + random forest training. Model_1 is evaluated on the validation set, showing an accuracy of 70%. Based on the researchers' experience and validation set performance, it might be considered that "disk I / O utilization" contributes little to model performance and may even introduce noise, leading to overfitting.

[0073] 2. Feature optimization: Redundant features were removed, and an optimized model was built. In the second learning iteration, "disk I / O utilization" was removed and replaced with an optimized feature vector, i.e., Feature Vector 2 = [packet size, transmission rate, protocol type, CPU utilization]. The random forest algorithm was reused, and the same cross-validation method was used to optimize hyperparameters, training a new model, i.e., model_2 = Feature Vector 2 + Random Forest training. Model_2 was evaluated on the validation set, showing an improvement in validation accuracy to 80%.

[0074] Therefore, it can be concluded that feature vector 2 performs better than feature vector 1, indicating that removing the feature "disk I / O utilization" improves the generalization ability of the model. Therefore, model_2 should be retained and model_1 should be discarded.

[0075] 3. Compare various machine learning algorithms and select the best model.

[0076] We tried various machine learning algorithms (such as random forest and support vector machine) on feature vector 1 and feature vector 2 respectively, and evaluated the model's performance using a validation set. The results are as follows:

[0077] Feature vector algorithm Model Validation set accuracy Feature vector 1 Random Forest r_model_1 80％ Feature vector 2 Random Forest r_model_2 85％ Feature vector 1 Support Vector Machine s_model_1 75％ Feature vector 2 Support Vector Machine s_model_2 80％

[0078] Taking into account the performance of the validation set, Feature Vector 2 + Random Forest (r_model_2) was selected as the final model, with a validation set accuracy of 85%, which is the best performance.

[0079] In the embodiments of this disclosure, the optimization strategy can be flexibly adjusted according to the needs of different scenarios, including but not limited to the following: In some scenarios, the feature vectors are fixed, and the model performance is optimized by adjusting the machine learning algorithm; in some scenarios, the algorithm is determined, and the model performance is improved by adjusting the selection and combination of feature vectors; in some scenarios, multiple feature vectors are combined with multiple machine learning algorithms for comprehensive model training and evaluation, and finally the feature vector and algorithm combination with the best performance is selected; in some scenarios, a feature vector is combined with multiple machine learning algorithms for initial model training, and the feature vector is iteratively optimized and the model is retrained based on the evaluation results until the optimal result is obtained.

[0080] In this embodiment of the disclosure, cross-validation is used as a training method to evaluate model performance and avoid overfitting. The specific steps are as follows: the training set is divided into 10 subsets, 9 subsets are used for training each time, and the remaining subset is used as the validation set; each subset is used alternately as the validation set, and this is repeated 10 times to obtain 10 sets of model performance results; the average of the 10 validation results is taken as the evaluation metric for model performance; the validation set is 20% of the data divided from the original dataset, used only for testing model performance and not participating in training, in order to avoid overfitting; commonly used evaluation metrics include accuracy, recall, and F1 score, which are important metrics for measuring the performance of machine learning models.

[0081] In some embodiments, based on traffic data over multiple monitoring periods, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including:

[0082] Based on traffic data from multiple monitoring periods, the statistical characteristics of the baseline values ​​of each feature are obtained through the industrial control baseline model.

[0083] Based on the aforementioned statistical characteristics, the baseline threshold for each feature is dynamically adjusted.

[0084] In some embodiments, based on traffic data over multiple monitoring periods, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted, including:

[0085] Based on the flow data within the first n monitoring periods, the baseline threshold for each feature is obtained through the industrial control baseline model.

[0086] For the baseline value of each feature in the current monitoring period, determine whether it meets the set rules of the corresponding baseline threshold;

[0087] If the baseline value of a certain feature does not meet the setting rules of the corresponding baseline threshold, the statistical value of the baseline value of the certain feature is obtained through the industrial control baseline model based on the traffic data of the most recent n monitoring periods.

[0088] Based on the statistical values, the baseline threshold of a certain feature is adjusted.

[0089] In this embodiment of the disclosure, the baseline threshold can be adjusted according to specific application scenarios, including but not limited to the following: traffic baseline threshold, session baseline threshold, protocol baseline threshold, time baseline threshold, and system baseline threshold. Different threshold types can be flexibly adjusted according to real-time monitoring needs to adapt to different industrial control network scenarios and performance requirements; for features such as traffic, dual-boundary thresholds are usually set, with the rule that the baseline value is within the upper and lower limits; for features such as sessions and protocols, a single threshold is usually set, with the rule that the baseline value does not exceed the single threshold.

[0090] Baseline threshold adjustment is a crucial step in ensuring the system can adapt to changes in the network environment. Dynamically adjusting the baseline threshold can improve the accuracy and effectiveness of anomaly detection while balancing detection stability and response speed. Dynamic adjustment methods, such as sliding window mechanisms, can be used to periodically adjust the baseline threshold. The choice of sliding window length depends on the dynamism of the network environment and the required response speed. Generally, shorter windows adapt quickly to environmental changes but may introduce more noise; longer windows offer stable adjustment but slower response times. The baseline adjustment period can be set, for example, to 5 minutes. After traffic access, a baseline value is output by the model at short intervals (e.g., 10 seconds), forming multiple baseline values ​​used to calculate characteristic statistics (e.g., mean, maximum, minimum, etc.) for that monitoring period.

[0091] The baseline adjustment process is as follows: In the first monitoring period, traffic data is extracted, and a set of baseline values ​​is obtained through model learning. The maximum and minimum values ​​of the baselines are calculated as the initial upper and lower baseline thresholds. These thresholds are only applicable to the first period and are used to initiate baseline monitoring. Starting from the second monitoring period, the relationship between the current period's baseline value and the current baseline threshold range is used to determine whether to adjust the thresholds. If all baseline values ​​in the current period fall within the existing threshold range, the baseline thresholds remain unchanged. If the current period's baseline value exceeds the existing threshold range, the baseline thresholds are adjusted. The baseline adjustment rule can be: collect the baseline value sequence (including the current period's baseline value) from the most recent n monitoring periods and calculate the mean M. Use the mean M to adjust the upper and lower thresholds, i.e., M × (1 ± 3%). After baseline adjustment is completed, the baseline values ​​and their adjustment status for each monitoring period are recorded. The changing trends of baseline values ​​and thresholds are displayed using a line graph to analyze the dynamic characteristics of the network environment.

[0092] For example, assume the following conditions: the monitoring cycle is set to 5 minutes per cycle; the data from the most recent n=5 cycles are used for adjustment and comparison each time; the average value of each monitoring cycle is output as the baseline value. The baseline values ​​of the most recent 6 cycles are: cycle 1 = 15, cycle 2 = 18, cycle 3 = 14, cycle 4 = 16, cycle 5 = 17, cycle 6 = 20. The threshold judgment and adjustment for cycle 6 includes: the current baseline value (20) exceeds the threshold range (14.55~15.45) determined by the previous 5 cycles; calculate the average value of the most recent n=5 cycles, that is, M = (cycle 2 + cycle 3 + cycle 4 + cycle 5 + cycle 6) / 5 = (18 + 14 + 16 + 17 + 20) / 5 = 17; adjust the threshold, that is, the upper limit threshold is 17 × (1 + 3%) = 17.5; the lower limit threshold is 17 × (1 - 3%) = 16.49.

[0093] In some embodiments, real-time traffic data of the industrial control network is monitored based on an industrial control baseline model and an adjusted baseline threshold, including:

[0094] Deploy the aforementioned industrial control baseline model into the actual operating environment of the industrial control network;

[0095] Continuously monitor the traffic data of the industrial control network to extract the feature vector of the traffic data;

[0096] Based on the extracted feature vectors, the industrial control baseline model and the adjusted baseline threshold are used to monitor for abnormal behavior.

[0097] In this embodiment of the disclosure, the trained security baseline model is deployed to the production environment; the model is integrated with the monitoring system for real-time analysis and detection of traffic behavior in the industrial control network; the industrial control network traffic data is continuously monitored, and feature vectors of the access data are extracted; the baseline model is used to determine whether the traffic behavior is abnormal, ensuring real-time response to potential threats.

[0098] Specifically, a trained industrial control baseline model (such as a model.pkl file) can be deployed to the production environment for real-time monitoring of industrial control network traffic. The model file is placed in a designated directory within the production environment; the model is then integrated into the traffic monitoring system to ensure that data features can be extracted in real-time and fed into the model for analysis. Feature values ​​are extracted from the traffic data accessed from the production environment; the feature vectors are then input into the deployed model for real-time anomaly detection.

[0099] In some embodiments, the protection strategy includes one or more of the following: audit alerts, blocking strategies, or configuration strategies.

[0100] The audit alerts include triggering audible and visual alarms, displaying abnormal behavior notifications in a pop-up window on the management page, and generating log records.

[0101] The blocking strategies include restricting abnormal traffic, isolating suspicious devices, or blocking abnormal connections;

[0102] The configuration strategy includes dynamically adjusting baseline model parameters or adjusting the system alert level.

[0103] In this embodiment, the real-time extracted feature vectors are input into the industrial control baseline model, and the model calculates the baseline value for each feature. The baseline value is compared with the corresponding baseline threshold. If the baseline value does not conform to the set rules of the baseline threshold, it is judged as abnormal behavior; if the baseline value conforms to the set rules of the baseline threshold, it is judged as normal behavior. When abnormal behavior is judged, a protection strategy is formulated and executed. The protection strategy includes audit alarms, blocking strategies, configuration strategies, etc. No protection operation is taken for normal behavior, and communication is allowed to continue.

[0104] Specifically, the protection strategies include: auditing and alarming, such as triggering audible and visual alarms, displaying pop-up alerts on the management page to indicate abnormal behavior, and generating log records; blocking strategies, such as limiting abnormal traffic, isolating suspicious devices, and blocking abnormal connections; and configuration strategies, such as dynamically adjusting baseline model parameters or adjusting system alert levels. Protection strategies can be pre-defined and deployed to the production environment along with the industrial control baseline model. Parameters can be dynamically adjusted through the strategy interface, for example, adding specific traffic thresholds to trigger alarm rules; customizing alarm priorities; and adjusting the triggering conditions of protection strategies (such as baseline thresholds). The system records alarm information and protection operations in real time, recording specific abnormal behaviors and processing results in log form; it provides a visual interface, allowing security personnel to view abnormal traffic, baseline change trends, and the execution effect of protection strategies; the management interface supports rapid policy adjustments and allows adding or modifying traffic monitoring rules. Through the real-time application of the industrial control baseline model in the production environment, combined with protection strategies, abnormal behaviors are handled promptly, ensuring the safe and stable operation of the industrial control network.

[0105] In some embodiments, the industrial control network monitoring method further includes:

[0106] Periodically obtain the latest traffic data of the industrial control network;

[0107] Based on the latest traffic data, a new feature vector is generated;

[0108] The new feature vectors are trained using machine learning algorithms to construct a new industrial control baseline model;

[0109] Replace the existing industrial control baseline model with the new industrial control baseline model, and continue with steps S14 and S15.

[0110] In this embodiment, new data is periodically collected for model retraining to ensure the model adapts to the latest network environment and behavioral characteristics. Retraining includes: acquiring and preprocessing new data; extracting feature vectors and optimizing feature engineering; training the model using the new data to generate an updated industrial control baseline model. The trained model is then directly deployed to the production environment. For example, traffic data from the most recent period can be collected monthly to retrain the industrial control baseline model, ensuring the model accurately reflects current network behavior. Baseline adjustments in the production environment can be triggered by real-time traffic data, maintaining a dynamic adjustment mechanism.

[0111] Through the above steps, this disclosure achieves efficient monitoring and anomaly detection of industrial control networks, can dynamically adapt to complex and ever-changing network environments, and effectively improves the security protection capabilities of industrial control systems.

[0112] Figure 2 This is a schematic diagram of the composition of an electronic device according to an embodiment of the present disclosure.

[0113] Secondly, referring to Figure 2 This disclosure provides an electronic device, which includes:

[0114] One or more processors 201;

[0115] The memory 202 stores one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the industrial control network monitoring method described in the first aspect of the present disclosure.

[0116] One or more I / O interfaces 203 are connected between the processor and the memory and configured to enable information exchange between the processor and the memory.

[0117] Among them, processor 201 is a device with data processing capabilities, including but not limited to central processing unit (CPU); memory 202 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); I / O interface (read-write interface) 203 is connected between processor 201 and memory 202, and can realize information interaction between processor 201 and memory 202, including but not limited to data bus (Bus).

[0118] In some embodiments, the processor 201, memory 202, and I / O interface 203 are interconnected via bus 204, and thus connected to other components of the computing device.

[0119] Thirdly, embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the industrial control network monitoring method described in the first aspect of embodiments of this disclosure.

[0120] Fourthly, embodiments of this disclosure provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the industrial control network monitoring method described in the first aspect of this disclosure.

[0121] Figure 3 This is a block diagram of an industrial control network monitoring system according to an embodiment of the present disclosure.

[0122] Fifthly, refer to Figure 3 This disclosure provides an industrial control network monitoring system, including:

[0123] The feature vector generation module 301 is configured to extract features from the raw traffic data of the industrial control network and generate feature vectors.

[0124] The model building module 302 is configured to train the feature vectors using machine learning algorithms to build an industrial control baseline model;

[0125] The threshold adjustment module 303 is configured to dynamically adjust the baseline threshold of each feature in the industrial control baseline model based on the flow data within multiple monitoring periods.

[0126] The real-time monitoring module 304 is configured to monitor the real-time traffic data of the industrial control network based on the industrial control baseline model and the adjusted baseline threshold.

[0127] The protection strategy module 305 is configured to formulate a protection strategy if the monitoring results determine abnormal behavior.

[0128] In some embodiments, the feature vector generation module 301 includes:

[0129] The acquisition module is configured to acquire raw traffic data from the industrial control network;

[0130] The processing module is configured to clean and format the acquired raw traffic data.

[0131] The generation module is configured to extract features from the processed traffic data and generate feature vectors.

[0132] In some embodiments, the generation module includes:

[0133] The partitioning module is configured to divide the processed traffic data into a training set and a validation set.

[0134] The extraction module is configured to extract feature values ​​from five dimensions—traffic features, protocol features, system features, network topology features, and time features—from the training set and validation set, respectively.

[0135] The combination module is configured to combine the extracted feature values ​​from each dimension to generate feature vectors for the training set and the validation set, respectively.

[0136] In some embodiments, the model building module 302 includes:

[0137] The first candidate model acquisition module is configured to combine the feature vectors of the training set with different machine learning algorithms to train the model and obtain multiple candidate industrial control baseline models.

[0138] The evaluation module is configured to evaluate the performance of the multiple candidate industrial control baseline models using the feature vectors of the validation set;

[0139] The optimization judgment module is configured to determine whether the feature vectors of the training set need to be optimized based on the evaluation results.

[0140] The second candidate model acquisition module is configured to optimize the feature vectors of the training set and retrain the model by combining different machine learning algorithms when it is necessary to optimize the feature vectors of the training set, obtain multiple new candidate industrial control baseline models, and return to the evaluation step.

[0141] The selection module is configured to select the combination of the best-performing feature vector and machine learning algorithm to construct the industrial control baseline model based on the evaluation results of all candidate industrial control baseline models when it is not necessary to optimize the feature vector of the training set.

[0142] In some embodiments, the threshold adjustment module 303 includes:

[0143] The threshold acquisition module is configured to obtain the baseline threshold for each feature based on the traffic data within the previous n monitoring periods through the industrial control baseline model;

[0144] The judgment module is configured to determine whether the baseline value of each feature in the current monitoring period meets the set rules of the corresponding baseline threshold.

[0145] The statistical value acquisition module is configured to obtain the statistical value of the baseline value of a certain feature based on the traffic data of the most recent n monitoring periods and through the industrial control baseline model if the baseline value of a certain feature does not meet the set rules of the corresponding baseline threshold.

[0146] The baseline threshold adjustment module is configured to adjust the baseline threshold of a certain feature based on the statistical value.

[0147] In some embodiments, the real-time monitoring module 304 includes:

[0148] The deployment module is configured to deploy the industrial control baseline model to the actual operating environment of the industrial control network.

[0149] The monitoring module is configured to continuously monitor the traffic data of the industrial control network to extract the feature vector of the traffic data; the anomaly monitoring module is configured to monitor for abnormal behavior based on the extracted feature vector, using the industrial control baseline model and the adjusted baseline threshold.

[0150] In some embodiments, the protection strategy includes one or more of the following: audit alerts, blocking strategies, or configuration strategies.

[0151] The audit alerts include triggering audible and visual alarms, displaying abnormal behavior notifications in a pop-up window on the management page, and generating log records.

[0152] The blocking strategies include restricting abnormal traffic, isolating suspicious devices, or blocking abnormal connections;

[0153] The configuration strategy includes dynamically adjusting baseline model parameters or adjusting the system alert level.

[0154] To enable those skilled in the art to more clearly understand the technical solutions provided by the embodiments of this disclosure, the industrial control network monitoring method provided by the embodiments of this disclosure will be described in detail below through specific embodiments:

[0155] Example 1

[0156] This example, based on a data security industrial control network security audit and monitoring product, illustrates a machine learning-based anomaly monitoring method for industrial control networks proposed in this invention, thereby enhancing security capabilities.

[0157] The specific process, as described in detail in this disclosure, is as follows:

[0158] 1) Set the data collection frequency. Based on network size and performance requirements, set the data collection frequency appropriately. In this example application environment, network traffic data can be collected once per minute; system status information can be collected once every 5 minutes.

[0159] 2) Data Collection. Collect traffic data packets from network devices (such as switches, routers, firewalls, etc.) and collect system performance metrics, including CPU utilization, memory usage, disk I / O, etc.

[0160] 3) Clean the collected data, removing obviously irrelevant, duplicate, or missing data to ensure data quality and integrity; standardize the cleaned data to improve the effectiveness of subsequent model training. Standardization methods include, but are not limited to: Z-Score standardization, which transforms the data into a standard normal distribution with a mean of 0 and a standard deviation of 1, suitable for data that is close to a normal distribution; Min-Max standardization, which maps the data to the [0,1] interval, suitable for boundary-sensitive models; other methods, depending on specific needs, may include logarithmic transformation, normalization to a specific range, or quantile scaling.

[0161] 4) By constructing feature engineering, the following feature values ​​are extracted from the preprocessed traffic data and system indicators: number of bytes per data packet, amount of data transmitted per unit time, connection duration, data packet interval, protocol type, command type of specific protocol (read or write), response time, CPU utilization, memory utilization, disk I / O frequency, source IP and MAC address, destination IP and MAC address, source port and destination port, and number of session connections.

[0162] 5) The industrial control baseline model is learned, trained, and evaluated using model evaluation metrics and various machine learning algorithms to select the best-performing model. Accuracy, recall, and F1 score are the primary evaluation metrics, as these three metrics are widely used in machine learning and can comprehensively measure model performance. Depending on the specific scenario, other metrics (such as precision, ROC-AUC, etc.) can be selected for supplementary evaluation. Common algorithms such as K-means clustering, random forest, and support vector machines are used for model training and evaluation. Depending on the scenario requirements, other algorithms (such as logistic regression, decision trees, etc.) can also be tried, but it is recommended to prioritize the above three algorithms to obtain more stable performance.

[0163] For example, the following model selection process can be adopted: train models for different machine learning algorithms separately; evaluate the industrial control baseline model generated by each algorithm using accuracy, recall, and F1 score; and select the model with the best performance as the final industrial control baseline model based on the overall performance of various indicators.

[0164] 6) Sliding window baseline generation. The sliding window length is set to 5 minutes. In the first monitoring period, an initial baseline threshold value of Th is given. Next, relevant network traffic data is collected in the second monitoring period, and the required feature vectors are extracted from them. The baseline value for this monitoring period is obtained through the model, and this process is repeated to obtain the baseline sequence X.

[0165] 7) Dynamic adjustment of baseline thresholds. Calculate the mean M of the baselines for the previous n monitoring periods, and set the upper baseline threshold to M×(1+3%) and the lower baseline threshold to M×(1-3%). If the baseline value exceeds the threshold range within a monitoring period, adjust the baseline; otherwise, leave it unchanged.

[0166] 8) Set the sliding window length to 5 minutes and initialize the baseline threshold based on the network traffic data in the first monitoring period. That is, in the first monitoring period, extract the traffic data and learn the baseline value of the monitoring period through model learning. The maximum and minimum values ​​of the baseline value are used as the initial baseline upper limit threshold and the initial baseline lower limit threshold, respectively. The initial baseline threshold is only applicable to the first monitoring period and is used to start baseline monitoring.

[0167] 9) Dynamically adjust the baseline threshold based on data from multiple consecutive monitoring periods. Starting from the second monitoring period, continuously collect network traffic data within the monitoring period, extract feature vectors, and calculate the baseline value for each monitoring period using a model; the baseline values ​​constitute the baseline sequence X = [X1, X2, ..., X...]. n ], where X iThis represents the baseline value for the i-th monitoring period. Starting from the (n+1)-th monitoring period, the mean M is calculated based on the baseline values ​​of the previous n monitoring periods. New upper and lower baseline thresholds are set, i.e., upper threshold = M × (1 + 3%), lower threshold = M × (1 - 3%). If the baseline value of the current monitoring period falls within the above threshold range, the threshold remains unchanged. If the baseline value exceeds the range, the threshold is adjusted.

[0168] Baseline updates include metrics across multiple dimensions, such as a traffic baseline, which generates upper and lower limit thresholds based on traffic characteristics (e.g., bandwidth); a session baseline, which sets a single threshold based on the number of session connections; and a command baseline, which sets a single threshold only for the number of protocols, without requiring a threshold for the protocol type. The learning interval can be dynamically adjusted based on network conditions and device performance, for example, generating a baseline value every 5 or 10 seconds; the threshold adjustment period matches the length of the sliding window (e.g., adjusted every 5 minutes).

[0169] For example, assuming the sliding window length is 5 minutes, the baseline values ​​for the most recent 6 monitoring periods are: Period 2 X2 = 18, Period 3 X3 = 14, Period 4 X4 = 16, Period 5 X5 = 17, Period 6 X6 = 20.

[0170] The mean, calculated with n=5, is M = (X2 + X3 + X4 + X5 + X6) / 5 = (18 + 14 + 16 + 17 + 20) / 5 = 17

[0171] Upper threshold = 17 × (1 + 3%) = 17.51, Lower threshold = 17 × (1 - 3%) = 16.49

[0172] Determine if the baseline value of the 7th cycle falls within the range of [16.49, 17.51]. If it does, adjust the threshold.

[0173] 10) Model Integration. Deploy the model into existing monitoring systems to process and analyze network traffic data in real time and detect abnormal behavior;

[0174] 11) Protection strategies are crucial measures in industrial control system network security, used to respond quickly when abnormal behavior is detected. Here are some examples of specific protection strategies: Blocking abnormal connections: When serious threatening traffic or illegal access behavior is detected, modify firewall rules or terminate the session to prevent further threat propagation; Logging: Record detailed information about abnormal behavior (such as timestamps and abnormal characteristics) for administrators to analyze or trace the source; Audible and visual alarms: When traffic characteristics exceed threshold ranges, the system triggers audible and visual alarms to alert the administrator; Pop-up notifications: After abnormal traffic behavior is detected, an alarm window pops up on the management web page, notifying the administrator of specific abnormal information; Isolation and access restrictions: Isolate abnormal devices from the network or restrict their access permissions.

[0175] 12) Model retraining is to adapt to the dynamic changes in the industrial control network environment and ensure the accuracy and reliability of the industrial control baseline model. The retraining steps include: reacquiring traffic data from the industrial control network and extracting feature vectors; generating new training and validation sets; and retraining the machine learning model based on the new data. The trained model can be directly deployed for online monitoring. Retraining can be triggered by: periodic retraining (e.g., monthly or quarterly); when significant changes in the network environment are detected (e.g., new equipment added, abnormal fluctuations in traffic patterns); or after collecting sufficient new production environment data.

[0176] The above steps systematically describe the machine learning-based industrial control network anomaly monitoring method, from data acquisition to model integration and protection strategies, fully demonstrating the process of improving security capabilities.

[0177] This disclosure utilizes machine learning algorithms to comprehensively analyze industrial control network traffic, constructing feature models from multiple dimensions to achieve real-time traffic monitoring and abnormal behavior detection of industrial control networks. This prevents malicious attacks and internal threats, ensuring the security and reliability of industrial control networks. Major application areas include industrial environments such as power, oil, natural gas, and the Internet of Things (IoT). The key technical points involved are as follows:

[0178] 1) Construction and optimization of feature engineering

[0179] Key information is extracted from dimensions such as traffic characteristics, protocol characteristics, system characteristics, network topology characteristics, and time characteristics; different feature dimensions and feature values ​​are filtered and optimized to ensure that the extracted features can effectively characterize network behavior.

[0180] 2) Model Algorithm and Parameter Optimization

[0181] Choose machine learning algorithms suitable for industrial control network scenarios, including: K-means clustering for unsupervised detection of abnormal behavior; Random Forest (RF) for classification and feature importance analysis; and Support Vector Machine (SVM) for accurate classification of high-dimensional data. Utilize hyperparameter tuning techniques (such as grid search or cross-validation) to improve model performance and accuracy.

[0182] 3) Model optimization and generalization ability improvement

[0183] Continuously store historical network traffic data as a training set to improve the model's adaptability to environmental changes. Optimize the model's learning ability, enhance its generalization performance, and ensure the model's stability and effectiveness in different network environments.

[0184] By constructing comprehensive feature engineering, selecting appropriate machine learning algorithms, and continuously optimizing models, this disclosure provides an efficient and secure real-time monitoring and anomaly detection solution for industrial control networks, applicable to complex network environments in various industrial fields.

[0185] This disclosure has the following beneficial effects:

[0186] 1) It uses a powerful algorithm system and has a high resistance to cracking; the various parts of the system are highly coupled, which improves the overall security and reliability.

[0187] 2) By using automated models, the need for manual intervention is reduced; real-time monitoring of abnormal network conditions is achieved, significantly improving network security.

[0188] 3) Baseline models can serve as authoritative reference standards for network anomaly detection. Combined with technologies such as traffic self-learning, they can further improve the reliability and accuracy of network monitoring.

[0189] This disclosure effectively enhances the security capabilities of industrial control networks and provides an efficient and reliable solution for detecting and responding to abnormal behavior.

[0190] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0191] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in connection with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in connection with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of this disclosure as set forth by the appended claims.

Claims

1. A method for monitoring industrial control networks, comprising: Features are extracted from the raw traffic data of the industrial control network to generate feature vectors; The feature vectors are trained using machine learning algorithms to construct an industrial control baseline model; Based on traffic data from multiple monitoring periods, the baseline threshold of each feature in the industrial control baseline model is dynamically adjusted. Based on the industrial control baseline model and the adjusted baseline threshold, the real-time traffic data of the industrial control network is monitored; If the monitoring results indicate abnormal behavior, then a protection strategy will be developed. The processed traffic data is divided into a training set and a validation set; the feature vectors are trained using machine learning algorithms to construct an industrial control baseline model, including: The feature vectors of the training set are combined with different machine learning algorithms to train the model, thereby obtaining multiple candidate industrial control baseline models. The performance of the multiple candidate industrial control baseline models is evaluated using the feature vectors of the validation set. Based on the evaluation results, determine whether it is necessary to optimize the feature vectors of the training set; When it is necessary to optimize the feature vectors of the training set, the feature vectors of the training set are optimized and different machine learning algorithms are re-integrated for model training to obtain multiple new candidate industrial control baseline models, and the evaluation step is returned. When it is not necessary to optimize the feature vectors of the training set, the combination of the feature vectors and machine learning algorithms with the best performance is selected based on the evaluation results of all candidate industrial control baseline models to construct the industrial control baseline model.

2. The industrial control network monitoring method according to claim 1, wherein, Features are extracted from the raw traffic data of the industrial control network to generate feature vectors, including: Obtain raw traffic data from the industrial control network; The acquired raw traffic data is cleaned and formatted. Features are extracted from the processed traffic data to generate feature vectors.

3. The industrial control network monitoring method according to claim 2, wherein, Features are extracted from the processed traffic data to generate a feature vector, including: The processed traffic data is divided into a training set and a validation set; Feature values ​​of five dimensions—traffic features, protocol features, system features, network topology features, and time features—are extracted from the training set and validation set, respectively. The extracted feature values ​​from each dimension are combined to generate feature vectors for the training set and the validation set, respectively.

4. The industrial control network monitoring method according to claim 1, wherein, Based on traffic flow data across multiple monitoring periods, the baseline threshold for each feature in the industrial control baseline model is dynamically adjusted, including: Based on the flow data within the first n monitoring periods, the baseline threshold for each feature is obtained through the industrial control baseline model. For the baseline value of each feature in the current monitoring period, determine whether it meets the set rules of the corresponding baseline threshold; If the baseline value of a certain feature does not meet the setting rules of the corresponding baseline threshold, the statistical value of the baseline value of the certain feature is obtained through the industrial control baseline model based on the traffic data of the most recent n monitoring periods. Based on the statistical values, the baseline threshold of a certain feature is adjusted.

5. The industrial control network monitoring method according to claim 4, wherein, Based on the industrial control baseline model and the adjusted baseline threshold, the real-time traffic data of the industrial control network is monitored, including: Deploy the aforementioned industrial control baseline model into the actual operating environment of the industrial control network; Continuously monitor the traffic data of the industrial control network to extract the feature vector of the traffic data; Based on the extracted feature vectors, the industrial control baseline model and the adjusted baseline threshold are used to monitor for abnormal behavior.

6. The industrial control network monitoring method according to any one of claims 1-5, wherein, The protection strategy includes one or more of the following: auditing alerts, blocking strategies, or configuration strategies. The audit alerts include triggering audible and visual alarms, displaying abnormal behavior notifications in a pop-up window on the management page, and generating log records. The blocking strategies include restricting abnormal traffic, isolating suspicious devices, or blocking abnormal connections; The configuration strategy includes dynamically adjusting baseline model parameters or adjusting the system alert level.

7. An electronic device, comprising: One or more processors; A memory having stored one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the industrial control network monitoring method according to any one of claims 1 to 6.

8. A computer-readable medium having a computer program stored thereon, the computer program being executed by a processor to implement the industrial control network monitoring method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program or instructions, wherein the computer program or instructions, when executed by a processor, implement the industrial control network monitoring method according to any one of claims 1 to 6.

Images