Method and device for detecting anomalies of distributed collusion attack means of industrial control system

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an anomaly detection method and device for distributed collusion attack means of an industrial control system. According to the anomaly detection method for the distributed collusion attack means of the industrial control system provided by the invention, the aggregation model is constructed to perform operation sequence aggregation on the set values in the preset time period according to the controlled object; and according to the similarity between the aggregation row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable, whether the entity is subjected to distributed collusion attacks is judged, so that the distributed collusion attacks can be obtained by focusing on the whole network range and based on the service logic and the operation behavior of the industrial control system and the topological structure of the industrial control network. Through monitoring and data fusion of abnormal behavior fragments in a whole network range, distributed abnormal traffic attacks are comprehensively and rapidly identified and found, and an alarm is given.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to an abnormality detection method and device for distributed collusion attack means of an industrial control system. Background Art

[0002] Compared with traditional Internet networks, attacks on industrial control networks are more covert, and they focus on interference and destruction of system business logic. Therefore, it is necessary to understand the semantic information of messages in industrial control networks in order to effectively improve the network security protection capabilities of industrial control systems. Setpoint attacks are attacks on a single device with a large amplitude by manipulating multiple nodes, thereby attacking the stability and reliability of the device. Therefore, the existing single-point abnormal behavior detection technology can no longer effectively protect the network security of nuclear power industrial control systems, and a more comprehensive and accurate abnormal behavior detection method is needed. Summary of the invention

[0003] In order to overcome the problems existing in the related art, a method and device for detecting anomalies of distributed collusion attack means in an industrial control system are provided.

[0004] According to one aspect of an embodiment of the present disclosure, a method for detecting anomalies of distributed collusion attack means in an industrial control system is provided, the method comprising:

[0005] Step 1, obtaining a message in the network and preprocessing the obtained message;

[0006] Step 2, statistically analyze the preprocessed messages, determine the network flow session data corresponding to each entity, and determine the relationship model based on the network session data corresponding to each entity; the network flow session data includes source IP, destination IP, source port, destination port, instruction parameter set, traffic packet data, IP address access frequency, port traffic distribution, and protocol usage ratio; the relationship model includes multiple nodes, each node represents an entity in the network, and the edges between nodes represent the access relationship and traffic flow direction between entities;

[0007] Step 3, according to the relational model, determine the set value operation matrix corresponding to the preset variable of each controlled entity, in which each line is the upper entity that controls the controlled entity, each element is the set value of the preset variable for each upper entity at different times, and each column is the setting time of each set value;

[0008] Step 4, summing the row vectors of the matrix corresponding to each set value operation matrix in the preset time window to obtain an aggregated row vector;

[0009] Step 5, determining the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable;

[0010] Step 6: When the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed the preset threshold, it is determined that the entity is subjected to a distributed collusion attack.

[0011] In a possible implementation, step 2 further includes:

[0012] Step 21, using REST for API to pass in the message, and using the DPKT toolkit to disassemble the incoming message according to the protocol layer, parse the source IP and destination IP of the message at the IP protocol layer, and compare them with the IP lists of each layer in the configuration file IPconfig to determine the communication type to which the message belongs. The communication types include layer 1 communication, layer 1 and 2 communication, and layer 2 communication;

[0013] Step 22: Use a parsing engine to parse the message. Different parsing engines parse different types of messages to obtain network flow session data corresponding to each entity.

[0014] In a possible implementation, in step 5, a DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

[0015] In one possible implementation, in step 3, a sliding window is set for each set value operation matrix, and counting begins when the controlled entity does not receive the set instruction of the preset variable. If the current count reaches the upper limit of the sliding window, the set value operation sequence matrix is ​​cleared, and this step is repeated until the controlled entity receives the preset variable, stops counting, and fills the matrix.

[0016] In a possible implementation, in step 5, the DTW algorithm is parallelized based on the flink model, and the DTW algorithm is used for each distributed entity in the network to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

[0017] In a possible implementation, step 5 also includes step 51, determining the curve average value of the aggregate row vector and the curve average value of the corresponding abnormal template for each entity preset variable, translating the curve average value of the aggregate row vector to be equal to the curve average value of the abnormal template, and using the DTW algorithm to determine the similarity between the aggregate row vector and the corresponding abnormal template.

[0018] In a possible implementation, the method further includes: Step 7, when it is determined that the entity is subjected to a distributed collusion attack, sending an alarm message to an associated account, the alarm message including information of the entity initiating the attack and related network flow session data.

[0019] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies of distributed collusion attack means in an industrial control system is provided, the device comprising:

[0020] An acquisition module is used to acquire messages from the network and pre-process the acquired messages;

[0021] The model determination module is used to perform statistical analysis on the pre-processed messages, determine the network flow session data corresponding to each entity, and determine the relationship model according to the network session data corresponding to each entity; the network flow session includes the source IP, destination IP, source port, destination port, instruction parameter set, flow packet data, access frequency of IP address, flow distribution of port, and usage ratio of protocol; the relationship model includes multiple nodes, each node represents an entity in the network, and the edges between nodes represent the access relationship and flow direction between entities;

[0022] A matrix determination module is used to determine, according to the relational model, a set value operation matrix corresponding to the preset variable of each controlled entity, wherein each line in the set value operation matrix is ​​a superordinate entity for controlling the controlled entity, each element is a set value of the preset variable of each superordinate entity at different times, and each column is a setting time of each set value;

[0023] An aggregation module, used for summing row vectors of matrices corresponding to each set value operation matrix in a preset time window period to obtain an aggregated row vector;

[0024] A similarity determination module, used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable;

[0025] The judgment module is used to judge that the entity is subjected to a distributed collusion attack when the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

[0026] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies of distributed collusion attack means in an industrial control system is provided, the device comprising:

[0027] processor;

[0028] a memory for storing processor-executable instructions;

[0029] Wherein, the processor is configured to execute the above method.

[0030] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0031] The beneficial effect of the present disclosure is that the anomaly detection method for distributed collusion attack means of the industrial control system provided by the present disclosure constructs an aggregation model to aggregate the set values ​​within a preset time period according to the operation sequence of the controlled object, and judges whether the entity is subjected to a distributed collusion attack based on the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable. In this way, the entire network can be focused on, based on the business logic, operation behavior of the industrial control system, and the topological structure of the industrial control network, through the monitoring and data fusion of abnormal behavior fragments within the entire network, distributed abnormal traffic attacks can be comprehensively and quickly identified and discovered, and alarms can be issued. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a flow chart of an abnormality detection method for distributed collusion attack means of an industrial control system shown in an embodiment of the present disclosure.

[0033] Figure 2 It is a schematic diagram of determining a relationship model in an anomaly detection method for distributed collusion attack means in an industrial control system shown in an embodiment of the present disclosure.

[0034] Figure 3 It is a schematic diagram of message parsing in an anomaly detection method for distributed collusion attack means in an industrial control system shown in an embodiment of the present disclosure.

[0035] Figure 4 It is a schematic diagram of determining an aggregated row vector in an anomaly detection method for distributed collusion attack means in an industrial control system shown in an embodiment of the present disclosure.

[0036] Figure 5 It is a schematic diagram of a sliding window processing set value operation matrix in an anomaly detection method for distributed collusion attack means of an industrial control system shown in an embodiment of the present disclosure.

[0037] Figure 6 It is a schematic diagram of data preprocessing of centroid translation in an anomaly detection method for distributed collusion attack means in an industrial control system shown in an embodiment of the present disclosure.

[0038] Figure 7 It is a block diagram of an anomaly detection device for distributed collusion attack means of an industrial control system shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0041] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] Figure 1 This is a flowchart of an abnormality detection method for distributed collusion attack means of an industrial control system shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, a laptop computer, a tablet computer, etc. The terminal device can also be, for example, a user device, a vehicle-mounted device or a wearable device, etc. The embodiment of the present disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0043] Step 1: The terminal device obtains messages in the network and preprocesses the obtained messages.

[0044] In step 1, the terminal device can monitor and capture messages in the industrial control network, and clean and organize the captured messages to remove invalid and redundant data.

[0045] Step 2: The terminal device performs statistical analysis on the pre-processed messages to determine the network flow session data corresponding to each entity, and determines the relationship model based on the network session data corresponding to each entity. Figure 2 ,Network flow session data includes source IP, destination IP, source port, destination port, ,command parameter set, traffic packet data, access frequency of IP address, ,traffic distribution of port, and usage ratio of protocol;,The relational model includes multiple nodes, each node represents an ,entity in the network (such as IP address, port number, etc.), and the edges between ,nodes represent the access relationship and traffic flow direction between entities.

[0046] Reference Figure 3 , step 2 also includes steps 21 to 23.

[0047] In step 21, the terminal device uses REST for API to transmit the message, and uses the DPKT toolkit to disassemble the incoming message according to the protocol layer, parses the source IP and destination IP of the message at the IP protocol layer, and compares them with the IP lists of each layer in the configuration file IPconfig to determine the communication type to which the message belongs. The communication types include layer 1 communication, layer 1 and 2 communication, and layer 2 communication.

[0048] Step 22: The terminal device uses a parsing engine to parse the message. Different parsing engines parse different types of messages to obtain network flow session data corresponding to each entity.

[0049] Step 3, according to the relational model, determine the set value operation matrix corresponding to the preset variables of each controlled entity, in which each row is the upper entity that controls the controlled entity, each element is the set value of the preset variable of each upper entity at different times, and each column is the setting time of each set value.

[0050] Step 4: sum the row vectors of each set value operation matrix corresponding to the preset time window period to obtain an aggregate row vector, see Figure 4 , thereby aggregating the same controlled variables of the same controlled device to build an operation curve for the instructions within the time window.

[0051] Step 5: Determine the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

[0052] For example, for the aggregate row vector X={x1,x2,…,xn} corresponding to each entity preset variable and the normal trajectory curve Y={y1,y2,…,ym} corresponding to the entity preset variable, the similarity of the two curves X and Y is calculated to determine the shortest distance between the X and Y curves. If it is lower than the threshold between normal values, Y is an abnormal curve.

[0053] In one possible implementation, in step 5, the DTW algorithm is used to determine the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable. Among them, the DTW (Dynamic Time Warping) algorithm is an algorithm for comparing the similarity between two time series. Its principle is to minimize the total distance between the two sequences by finding the best matching path between the two time series. The core idea of ​​the DTW algorithm is to regularize the two time series so that similar parts can be aligned.

[0054] The advantage of the DTW algorithm is that it can handle situations where the lengths of time series are different, and it has good robustness to some deformations such as distortion, scaling, and translation. In general, commonly used distance metrics include Euclidean distance, Manhattan distance, and Minkowski distance. Taking Euclidean distance as an example, the formula for calculating the distance between two time series is:

[0055] d(i,j)=(x(i)-y(j)) 2

[0056] Among them, x(i) represents the i-th element of the first time series, and y(j) represents the j-th element of the second time series. The algorithm needs to calculate the value of each matrix element. The specific formula is as follows:

[0057] D(i,j)=d(i,j)+min(D(i-1,j),D(i,j-1),D(i-1,j-1))

[0058] Among them, D(i,j) represents the element value at the (i,j)th position in the matrix, and min represents the minimum value. Through dynamic programming, the value of the entire matrix is ​​calculated step by step. Finally, the minimum distance between the two time series can be obtained by the matrix element value at the bottom right corner of the matrix.

[0059] In a possible implementation, step 5 also includes step 51, determining the curve average value of the aggregate row vector and the curve average value of the corresponding abnormal template for each entity preset variable, translating the curve average value of the aggregate row vector to be equal to the curve average value of the abnormal template, and using the DTW algorithm to determine the similarity between the aggregate row vector and the corresponding abnormal template.

[0060] Step 6: when the similarity between the aggregated row vector corresponding to the entity preset variable and the normal template curve corresponding to the entity preset variable exceeds a preset threshold, repeat steps 1 to 5;

[0061] When the similarity between the aggregate row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed the preset threshold, it is determined that the entity is subjected to a distributed collusion attack.

[0062] In one possible implementation, see Figure 5In step 3, the terminal device sets a sliding window for each set value operation matrix, and starts counting when the controlled entity does not receive the set instruction of the preset variable. If the current count reaches the upper limit of the sliding window, it indicates that the preset variable is stable within a certain range, and the set value operation sequence matrix can be cleared. Repeat the above steps until the controlled entity receives the preset variable, stops counting, and fills the matrix. In this way, invalid data in the steady-state period of the controlled entity can be effectively removed, reducing the amount of data processing and calculation.

[0063] In a possible implementation, in step 5, in order to cope with the massive computing requirements of different variables and different time windows, the present disclosure adopts a streaming computing model, and parallelizes the DTW algorithm based on the flink model. The DTW algorithm is used in each distributed entity to perform similarity calculations on the set value trajectory monitoring algorithm to determine whether the joint setting is a malicious collusion attack.

[0064] In a possible implementation, since the traditional DTW algorithm takes the distance between curves and trend changes as common calculation factors, this calculation method will have a large error when judging the same change trend but with a large distance difference. In view of this, the present disclosure proposes a data preprocessing method based on centroid translation, which can solve this problem well. Figure 6 , the two curves on the left side of the figure are translated to the same horizontal line based on the centroid method, that is, the average value of each curve is calculated, and the average value of the measured curve is translated to be equal to the average value of the benchmark curve, and then the calculation is performed, which can minimize the influence of the distance between the lines on the judgment of the similarity of the change trend.

[0065] According to another aspect of an embodiment of the present disclosure, a device for detecting anomalies of distributed collusion attack means in an industrial control system is provided, the device comprising:

[0066] An acquisition module is used to acquire messages from the network and pre-process the acquired messages;

[0067] The model determination module is used to perform statistical analysis on the pre-processed messages, determine the network flow session data corresponding to each entity, and determine the relationship model according to the network session data corresponding to each entity; the network flow session includes the source IP, destination IP, source port, destination port, instruction parameter set, flow packet data, access frequency of IP address, flow distribution of port, and usage ratio of protocol; the relationship model includes multiple nodes, each node represents an entity in the network, and the edges between nodes represent the access relationship and flow direction between entities;

[0068] A matrix determination module is used to determine, according to the relational model, a set value operation matrix corresponding to the preset variable of each controlled entity, wherein each line in the set value operation matrix is ​​a superordinate entity for controlling the controlled entity, each element is a set value of the preset variable of each superordinate entity at different times, and each column is a setting time of each set value;

[0069] An aggregation module, used for summing row vectors of matrices corresponding to each set value operation matrix in a preset time window period to obtain an aggregated row vector;

[0070] A similarity determination module, used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable;

[0071] The judgment module is used to judge that the entity is subjected to a distributed collusion attack when the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

[0072] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0073] Figure 7 1900 is a block diagram of an abnormality detection device for distributed collusion attack means of an industrial control system shown in an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Figure 7 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0074] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0075] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0076] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0077] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0078] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0079] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0080] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0081] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0082] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0083] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0084] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting anomalies of distributed collusion attacks in industrial control systems, characterized in that: The method comprises: Step 1, obtaining a message in the network and preprocessing the obtained message; Step 2, statistically analyze the preprocessed messages, determine the network flow session data corresponding to each entity, and determine the relationship model based on the network session data corresponding to each entity; the network flow session data includes source IP, destination IP, source port, destination port, instruction parameter set, traffic packet data, IP address access frequency, port traffic distribution, and protocol usage ratio; the relationship model includes multiple nodes, each node represents an entity in the network, and the edges between nodes represent the access relationship and traffic flow direction between entities; Step 3, according to the relational model, determine the set value operation matrix corresponding to the preset variable of each controlled entity, in which each line is the upper entity that controls the controlled entity, each element is the set value of the preset variable for each upper entity at different times, and each column is the setting time of each set value; Step 4, summing the row vectors of the matrix corresponding to each set value operation matrix in the preset time window to obtain an aggregated row vector; Step 5, determining the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable; Step 6: When the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed the preset threshold, it is determined that the entity is subjected to a distributed collusion attack.

2. The method according to claim 1, characterized in that Step 2 also includes: Step 21, using REST for API to pass in the message, and using the DPKT toolkit to disassemble the incoming message according to the protocol layer, parse the source IP and destination IP of the message at the IP protocol layer, and compare them with the IP lists of each layer in the configuration file IPconfig to determine the communication type to which the message belongs. The communication types include layer 1 communication, layer 1 and 2 communication, and layer 2 communication; Step 22: Use a parsing engine to parse the message. Different parsing engines parse different types of messages to obtain network flow session data corresponding to each entity.

3. The method according to claim 1, characterized in that In step 5, the DTW algorithm is used to determine the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

4. The method according to claim 1, characterized in that: In step 3, a sliding window is set for each set value operation matrix, and counting starts when the controlled entity does not receive the set instruction of the preset variable. If the current count reaches the upper limit of the sliding window, the set value operation sequence matrix is ​​cleared, and this step is repeated until the controlled entity receives the preset variable, stops counting, and fills the matrix.

5. The method according to claim 1, characterized in that In step 5, the DTW algorithm is parallelized based on the flink model, and the DTW algorithm is used for each distributed entity in the network to determine the similarity between the aggregate row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

6. The method according to claim 1, characterized in that Step 5 also includes step 51, determining the curve average value of the aggregated row vector and the curve average value of the corresponding abnormal template for the aggregated row vector corresponding to each entity preset variable, translating the curve average value of the aggregated row vector to be equal to the curve average value of the abnormal template, and using the DTW algorithm to determine the similarity between the aggregated row vector and the corresponding abnormal template.

7. The method according to claim 1, characterized in that The method further includes: step 7, when it is determined that the entity is subjected to a distributed collusion attack, sending an alarm message to a related account, the alarm message including information of the entity initiating the attack and related network flow session data.

8. An abnormality detection device for distributed collusion attack means in industrial control systems, characterized in that: The device comprises: An acquisition module is used to acquire messages from the network and pre-process the acquired messages; The model determination module is used to perform statistical analysis on the pre-processed messages, determine the network flow session data corresponding to each entity, and determine the relationship model according to the network session data corresponding to each entity; the network flow session includes the source IP, destination IP, source port, destination port, instruction parameter set, flow packet data, access frequency of IP address, flow distribution of port, and usage ratio of protocol; the relationship model includes multiple nodes, each node represents an entity in the network, and the edges between nodes represent the access relationship and flow direction between entities; A matrix determination module is used to determine, according to the relational model, a set value operation matrix corresponding to the preset variable of each controlled entity, wherein each line in the set value operation matrix is ​​a superordinate entity for controlling the controlled entity, each element is a set value of the preset variable of each superordinate entity at different times, and each column is a setting time of each set value; An aggregation module, used for summing row vectors of matrices corresponding to each set value operation matrix in a preset time window period to obtain an aggregated row vector; A similarity determination module, used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable; The judgment module is used to judge that the entity is subjected to a distributed collusion attack when the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

9. An abnormality detection device for distributed collusion attack means in industrial control systems, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 7.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images