Abnormality detection method and device for distributed collusion attack means of industrial control system

Abstract

The present disclosure belongs to the technical field of nuclear power and particularly relates to an abnormality detection method and device for distributed collusion attack means of an industrial control system. The abnormality detection method for distributed collusion attack means of the industrial control system provided by the present disclosure constructs an aggregation model to aggregate the operating sequence of the set value in a preset time period according to the controlled object, and judges whether an entity is subjected to a distributed collusion attack according to the similarity between the aggregation row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity, so that the distributed abnormal traffic attack can be comprehensively and rapidly identified and alarmed based on the business logic, operating behavior and topology structure of the industrial control system through the monitoring and data fusion of the abnormal behavior fragments in the whole network range.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of nuclear power, and particularly relates to an abnormality detection method and device for a distributed collusion attack means of an industrial control system. BACKGROUND

[0002] Compared with a traditional interconnected network, an attack form for an industrial control network is more concealed, and the attack form focuses on interference and destruction of system business logic, so semantic information of a message in the industrial control network needs to be understood to effectively improve network security protection capability of the industrial control system. A set value attack is an attack on a single device with a large amplitude by manipulating multiple nodes, so that stability and reliability of the device are attacked. Therefore, existing single-point abnormal behavior detection technology cannot effectively protect network security of a nuclear power industrial control system, and a more comprehensive and accurate abnormal behavior detection method is needed. SUMMARY

[0003] To overcome problems in the related art, an abnormality detection method and device for a distributed collusion attack means of an industrial control system are provided.

[0004] According to an aspect of an embodiment of the present disclosure, an abnormality detection method for a distributed collusion attack means of an industrial control system is provided, and the method comprises the following steps.

[0005] Step 1, messages in a network are acquired, and the acquired messages are preprocessed;

[0006] Step 2, the preprocessed messages are statistically analyzed, network flow session data corresponding to each entity is determined, and a relationship model is determined according to the network flow session data corresponding to each entity; the network flow session data comprises a source IP, a destination IP, a source port, a destination port, an instruction parameter set, flow packet data, an access frequency of an IP address, a flow distribution of a port, and a use ratio of a protocol; the relationship model comprises multiple nodes, each node represents an entity in a network, and an edge between the nodes represents an access relationship and a flow direction between entities;

[0007] Step 3, according to the relationship model, a set value operation matrix corresponding to a preset variable of each controlled entity is determined, each row in the set value operation matrix is an upper entity controlling the controlled entity, each element is a set value of the preset variable at different time instants by each upper entity, and each column is a set time of each set value;

[0008] Step 4, a row vector summation is performed on a matrix corresponding to a preset time window period of each set value operation matrix, and an aggregated row vector is obtained;

[0009] Step 5, similarity between the aggregated row vector corresponding to the preset variable of each entity and a normal template curve corresponding to the preset variable of the entity is determined;

[0010] Step 6, in the case that the similarity between the aggregated row vector corresponding to the entity preset variable and the normal template curve corresponding to the entity preset variable does not exceed the preset threshold, it is determined that the entity is subjected to a distributed collusion attack.

[0011] In a possible implementation, step 2 further includes:

[0012] Step 21, the incoming message is transmitted in the form of RESTful API, and the incoming message is disassembled according to the protocol hierarchy by using the DPKT toolkit, the source IP and the destination IP of the message are parsed at the IP protocol layer, and the communication type to which the message belongs is judged by comparing with the IP list of each layer in the configuration file IPconfig, the communication type includes one-layer communication, one-two-layer communication and two-layer communication.

[0013] Step 22, the message is parsed by using the parsing engine, and different parsing engines parse different types of messages to obtain the network flow session data corresponding to each entity.

[0014] In a possible implementation, in step 5, the DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

[0015] In a possible implementation, in step 3, a sliding window is set for each set value operation matrix, and the counting starts when the controlled entity does not receive the set value of the preset variable, if the current counting reaches the upper limit of the sliding window, the set value operation sequence matrix is emptied, and the step is repeated until the controlled entity receives the preset variable to stop counting and fill the matrix.

[0016] In a possible implementation, in step 5, the DTW algorithm is parallelized based on the flink model, and the DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable for each entity in the network.

[0017] In a possible implementation, step 5 further includes step 51, for the aggregated row vector corresponding to each entity preset variable, the curve average value of the aggregated row vector and the curve average value of the corresponding normal template are determined, and after the curve average value of the aggregated row vector is translated to be equal to the curve average value of the normal template, the similarity between the aggregated row vector and the corresponding normal template is determined by using the DTW algorithm.

[0018] In a possible implementation, the method further includes: step 7, in the case that it is determined that the entity is subjected to a distributed collusion attack, sending alarm information to the associated account, the alarm information includes the entity information initiating the attack and the related network flow session data.

[0019] According to another aspect of the embodiments of the present disclosure, an abnormality detection device for a distributed collusion attack means of an industrial control system is provided, and the device comprises:

[0020] An acquisition module is configured to acquire a packet in a network and pre-process the acquired packet.

[0021] A model determination module is configured to statistically analyze the pre-processed packet, determine network flow session data corresponding to each entity, and determine a relationship model according to the network flow session data corresponding to each entity. The network flow session comprises a source IP, a destination IP, a source port, a destination port, an instruction parameter set, traffic packet data, an access frequency of an IP address, a traffic distribution of a port, and a usage ratio of a protocol. The relationship model comprises a plurality of nodes, each node representing an entity in the network, and an edge between the nodes representing an access relationship and a traffic flow direction between entities.

[0022] A matrix determination module is configured to determine a set value operation matrix corresponding to a preset variable of each controlled entity according to the relationship model. Each row in the set value operation matrix controls a superior entity of the controlled entity, each element is a set value of the preset variable at different time instants by each superior entity, and each column is a set time of each set value.

[0023] An aggregation module is configured to perform row vector summation on a matrix corresponding to a preset time window period for each set value operation matrix to obtain an aggregated row vector.

[0024] A similarity determination module is configured to determine a similarity between an aggregated row vector corresponding to a preset variable of each entity and a normal template curve corresponding to the preset variable of the entity.

[0025] A judgment module is configured to determine that the entity is subjected to a distributed collusion attack in a case where the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

[0026] According to another aspect of the embodiments of the present disclosure, an abnormality detection device for a distributed collusion attack means of an industrial control system is provided, and the device comprises:

[0027] A processor;

[0028] A memory for storing processor-executable instructions;

[0029] The processor is configured to execute the above method.

[0030] According to another aspect of the embodiments of the present disclosure, a non-volatile computer readable storage medium having computer program instructions stored thereon is provided, and the computer program instructions are executed by a processor to implement the above method.

[0031] The beneficial effects of the present disclosure are that the abnormality detection method of the industrial control system distributed collusion attack means provided by the present disclosure constructs an aggregation model to aggregate the operating sequence of the set value in the preset period according to the controlled object, and judges whether the entity is subjected to the distributed collusion attack according to the similarity between the aggregation row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable, so that the whole network range can be considered, the business logic, operation behavior of the industrial control system, and the topology structure of the industrial control network, the abnormal behavior fragments in the whole network range are monitored and data fusion is performed, the distributed abnormal flow attack is comprehensively and quickly identified and discovered, and alarm is performed. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is a flowchart of an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0033] Figure 2 is a schematic diagram of determining a relationship model in an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0034] Figure 3 is a schematic diagram of packet analysis in an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0035] Figure 4 is a schematic diagram of determining an aggregation row vector in an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0036] Figure 5 is a schematic diagram of processing the set value operation matrix by using a sliding window in an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0037] Figure 6 is a schematic diagram of data preprocessing of centroid translation in an abnormality detection method of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure.

[0038] Figure 7 is a block diagram of an abnormality detection device of an industrial control system distributed collusion attack means according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] The present disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs; the terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure; the use of the term "including," "comprising" and variations thereof, in the present disclosure is meant to encompass the items listed thereafter, and equivalents thereof, as well as additional items. It is expressly understood that the embodiments described in the present disclosure are only examples of the embodiments of the present disclosure and are not the only embodiments that can be used to implement the present disclosure. Based on the embodiments in the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of the present disclosure.

[0041] Reference to "an embodiment" or "the embodiment" in this disclosure means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearances of the phrase that the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of other embodiments. It is expressly understood that the embodiments described herein can be combined with other embodiments in their various permutations and combinations.

[0042] Figure 1 is a flowchart of an abnormality detection method for a distributed collusion attack means of an industrial control system, which is shown by an embodiment of the present disclosure. The method can be executed by a terminal device, where the terminal device can be a server, a desktop computer, a notebook computer, a tablet computer, etc., and the terminal device can also be, for example, a user device, a vehicle-mounted device, or a wearable device, etc., and the type of the terminal device is not limited by the embodiments of the present disclosure. As shown in Figure 1 , the method comprises:

[0043] Step 1: The terminal device acquires messages in the network, and pre-processes the acquired messages.

[0044] In step 1, the terminal device can listen to and capture messages in the industrial control network, and clean and arrange the captured messages to remove invalid and redundant data.

[0045] Step 2: The terminal device performs statistical analysis on the pre-processed messages, determines network flow session data corresponding to each entity, and determines a relationship model according to the network flow session data corresponding to each entity. Referring to Figure 2 , the network flow session data includes source IP, destination IP, source port, destination port, instruction parameter set, traffic packet data, access frequency of IP address, traffic distribution of port, and usage ratio of protocol; the relationship model includes multiple nodes, each node representing an entity in the network (such as IP address, port number, etc.), and the edges between the nodes representing the access relationship and traffic flow direction between the entities.

[0046] Referring to Figure 3 , step 2 further comprises steps 21 to 23.

[0047] Step 21, the terminal device transmits the incoming message in the form of RESTful API, and uses the DPKT toolkit to disassemble the incoming message according to the protocol hierarchy. The source IP and destination IP of the message are parsed at the IP protocol layer, and the communication type to which the message belongs is determined by comparing with the IP list of each layer in the configuration file IPconfig. The communication type includes one-layer communication, one-two-layer communication, and two-layer communication.

[0048] Step 22, the terminal device parses the message using a parsing engine. Different parsing engines parse different types of messages to obtain network flow session data corresponding to each entity.

[0049] Step 3, according to the relationship model, determine the set value operation matrix corresponding to each preset variable of the controlled entity. Each row in the set value operation matrix controls the superior entity of the controlled entity, each element is the set value of each superior entity to the preset variable at different time, and each column is the setting time of each set value.

[0050] Step 4, for each set value operation matrix, perform row vector summation on the matrix corresponding to the preset time window period to obtain an aggregated row vector, see Figure 4 Thus, the same controlled variable of the same controlled device is aggregated, and the operation curve of the instructions within the time window is constructed.

[0051] Step 5, determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable.

[0052] For example, for the aggregated row vector X = { x1, x2,…,xn} corresponding to each entity preset variable and the normal trajectory curve Y = { y1, y2, …, ym} corresponding to the entity preset variable, the similarity of the two curves X and Y is calculated to determine the shortest distance between the curves X and Y. If it is lower than the threshold value between the normal values, Y is an abnormal curve.

[0053] In one possible implementation, in step 5, the DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to each entity preset variable and the normal template curve corresponding to the entity preset variable. The DTW (Dynamic Time Warping) algorithm is an algorithm for comparing the similarity between two time series. Its principle is to find the best matching path between two time series to minimize the total distance between the two sequences. The core idea of the DTW algorithm is to normalize two time series so that similar parts can be aligned.

[0054] The advantage of the DTW algorithm is that it can handle different lengths between time series, and has good robustness for some deformations such as distortion, scaling and translation. In general, commonly used distance metrics include Euclidean distance, Manhattan distance and Minkowski distance. Taking the Euclidean distance as an example, the distance formula between two time series is as follows:

[0055]

[0056] Where x(i) represents the i-th element of the first time series, and y(j) represents the j-th element of the second time series. The algorithm needs to calculate the value of each matrix element, and the specific formula is as follows:

[0057]

[0058] Where D(i,j) represents the element value at the (i,j) position in the matrix, and min represents the minimum value. By dynamic programming, the values of the entire matrix are calculated step by step, and finally the minimum distance between the two time series can be obtained by the matrix element value at the right bottom corner of the matrix.

[0059] In a possible implementation, step 5 further includes step 51, for each entity preset variable corresponding aggregated row vector, determining the curve average value of the aggregated row vector and the curve average value of the corresponding normal template, and after the curve average value of the aggregated row vector is translated to be equal to the curve average value of the normal template, the similarity between the aggregated row vector and the corresponding normal template is determined by using the DTW algorithm.

[0060] Step 6, in the case that the similarity between the entity preset variable corresponding aggregated row vector and the entity preset variable corresponding normal template curve exceeds the preset threshold, repeating steps 1 to 5;

[0061] In the case that the similarity between the entity preset variable corresponding aggregated row vector and the entity preset variable corresponding normal template curve does not exceed the preset threshold, it is determined that the entity is subjected to a distributed collusion attack.

[0062] In a possible implementation, referring to Figure 5 In step 3, the terminal device sets a sliding window for each set value operation matrix, and starts counting when the controlled entity does not receive the set value of the preset variable. If the current count reaches the upper limit of the sliding window, it indicates that the preset variable is stable within a certain range, and the set value operation sequence matrix can be emptied. Repeat the above steps until the controlled entity receives the preset variable to stop counting and fill the matrix. In this way, invalid data during the stable period of the controlled entity can be effectively removed, and the processing and calculation amount of data can be reduced.

[0063] In a possible implementation, in step 5, in order to cope with different variables and the mass calculation requirements of different time windows, the disclosure adopts a streaming calculation model, parallelizes the DTW algorithm based on the flink model, and uses the DTW algorithm to perform the set value trajectory monitoring algorithm to perform similarity calculation on each entity in the distributed manner, so as to determine whether the joint setting is a malicious collusion attack.

[0064] In a possible implementation, since the traditional DTW algorithm takes the distance and trend change between curves as a common calculation factor, this calculation method will have a large error in the case of judging the same change trend but having a large distance difference. In view of this, the disclosure proposes a data preprocessing method based on centroid translation, which can well solve this problem, as shown in Figure 6 The two curves on the left side of the figure are translated to the same horizontal line based on the centroid method, that is, the average value of each curve is calculated, so that the average value of the measured curve is translated to be equal to the average value of the reference curve, and then calculation is performed, which can maximize the influence of the distance between lines on the judgment of the similarity of the change trend.

[0065] According to another aspect of the embodiments of the disclosure, an abnormality detection device for a distributed collusion attack means of an industrial control system is provided, and the device comprises:

[0066] The acquisition module is configured to acquire messages in a network and pre-process the acquired messages.

[0067] The model determination module is configured to statistically analyze the pre-processed messages, determine network flow session data corresponding to each entity, and determine a relationship model according to the network flow session data corresponding to each entity. The network flow session includes a source IP, a destination IP, a source port, a destination port, an instruction parameter set, traffic packet data, an access frequency of an IP address, a traffic distribution of a port, and a usage ratio of a protocol. The relationship model includes a plurality of nodes, each node represents an entity in the network, and an edge between the nodes represents an access relationship and a traffic flow direction between entities.

[0068] The matrix determination module is configured to determine a set value operation matrix corresponding to a preset variable of each controlled entity according to the relationship model. Each row in the set value operation matrix is an upper entity controlling the controlled entity, each element is a set value of the preset variable at different time instants by each upper entity, and each column is a set time of each set value.

[0069] The aggregation module is configured to perform row vector summation on a matrix corresponding to a preset time window period for each set value operation matrix, to obtain an aggregated row vector.

[0070] The similarity determination module is configured to determine a similarity between the aggregated row vector corresponding to the preset variable of each entity and a normal template curve corresponding to the preset variable of the entity.

[0071] a judging module, configured to determine that the entity is subjected to the distributed collusion attack when a similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

[0072] The above description of the apparatus has been described in detail in the description of the above method, and will not be repeated here.

[0073] Figure 7 is a block diagram of an abnormality detection apparatus for a distributed collusion attack means of an industrial control system according to an embodiment of the present disclosure. For example, the apparatus 1900 can be provided as a server. Referring to Figure 7 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932, for storing instructions, such as an application program, executable by the processing component 1922. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0074] The apparatus 1900 can also include a power supply component 1926 configured to perform power management of the apparatus 1900, a wired or wireless network interface 1950 configured to connect the apparatus 1900 to a network, and an input / output (I / O) interface 1958. The apparatus 1900 can operate based on an operating system stored in the memory 1932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM or the like.

[0075] In an exemplary embodiment, a non-volatile computer readable storage medium, such as the memory 1932 including computer program instructions executable by the processing component 1922 of the apparatus 1900 to perform the above method is also provided.

[0076] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0077] Computer readable storage media can be tangible storage media which can retain and store instructions for use by an instruction execution device. Computer readable storage media can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer readable storage media include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0078] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0079] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0080] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0081] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other data storage device. When the computer readable program instructions are loaded into the computer and other programmable data processing apparatus, a series of operational steps are implemented that provide processes such that the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0082] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0083] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0084] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative, and not restrictive, of the disclosed embodiments. Many modifications and variations of the described embodiments are possible, and all such modifications and variations are intended to be within the scope of the described embodiments. The description used herein is intended to be illustrative, and not restrictive, of the described embodiments. The scope of the described embodiments is not limited to the examples and / or embodiments described herein but only by the claims and their equivalents.

Claims

1. A method for detecting anomalies of means of distributed collusion attack of an industrial control system, characterized in that, The method comprises: Step 1, obtaining a message in a network, and preprocessing the obtained message; Step 2, performing statistical analysis on the preprocessed message, determining network flow session data corresponding to each entity, and determining a relationship model according to the network session data corresponding to each entity; the network flow session data comprises source IP, destination IP, source port, destination port, instruction parameter set, traffic packet data, access frequency of IP address, traffic distribution of port, and usage ratio of protocol; the relationship model comprises a plurality of nodes, each node representing an entity in the network, and an edge between the nodes representing an access relationship and a traffic flow direction between entities; Step 3, determining a set value operation matrix corresponding to a preset variable of each controlled entity according to the relationship model, each row in the set value operation matrix being an upper entity controlling the controlled entity, each element being a set value of the preset variable at different time instants by each upper entity, and each column being a set time instant of each set value; Step 4, performing row vector summation on a matrix corresponding to a preset time window period of each set value operation matrix to obtain an aggregated row vector; Step 5, determining a similarity between the aggregated row vector corresponding to the preset variable of each entity and a normal template curve corresponding to the preset variable of the entity; Step 6, in a case where the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold, determining that the entity is subjected to a distributed conspiracy attack.

2. The method of claim 1, wherein, Step 2 further comprises: Step 21, transmitting a message in the form of a RESTful API, and using a DPKT toolkit to disassemble the transmitted message according to protocol levels, to obtain source IP and destination IP of the message at the IP protocol layer, and to determine a communication type to which the message belongs by comparing each layer IP list in an IP configuration file IPconfig, the communication type comprising one-layer communication, one-two-layer communication, and two-layer communication; Step 22, using a parsing engine to parse the message, different parsing engines being used to parse different types of messages to obtain network flow session data corresponding to each entity.

3. The method of claim 1, wherein, In step 5, a DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to the preset variable of each entity and the normal template curve corresponding to the preset variable of the entity.

4. The method of claim 1, wherein, In step 3, a sliding window is set for each set value operation matrix, counting is started when the controlled entity does not receive a set instruction of the preset variable, the set value operation sequence matrix is emptied if the current count reaches the upper limit of the sliding window, and the step is repeated until the controlled entity receives the preset variable to stop counting and the matrix is filled.

5. The method of claim 1, wherein, In step 5, the DTW algorithm is parallelized based on a flink model, and the DTW algorithm is used to determine the similarity between the aggregated row vector corresponding to the preset variable of each entity and the normal template curve corresponding to the preset variable of the entity for each entity in the network.

6. The method of claim 1, wherein, The step 5 further comprises a step 51 of determining, for each entity, a curve average of the aggregated row vector corresponding to the preset variable, and a curve average of the corresponding normal template, and determining a similarity between the aggregated row vector and the corresponding normal template by using the DTW algorithm after the curve average of the aggregated row vector is translated to be equal to the curve average of the normal template.

7. The method of claim 1, wherein, The method further comprises a step 7 of sending, in a case where it is determined that the entity is subjected to the distributed collusion attack, an alarm information to an associated account, the alarm information comprising entity information initiating the attack and related network flow session data.

8. An abnormality detection device of a means of distributed collusion attack of an industrial control system, characterized by, The apparatus comprises: An acquisition module configured to acquire a message in a network and pre-process the acquired message; A model determination module configured to statistically analyze the pre-processed message, determine network flow session data corresponding to each entity, and determine a relationship model according to the network flow session data corresponding to each entity; the network flow session comprises a source IP, a destination IP, a source port, a destination port, an instruction parameter set, traffic packet data, an access frequency of an IP address, a traffic distribution of a port, and a usage ratio of a protocol; the relationship model comprises a plurality of nodes, each node representing an entity in the network, and an edge between the nodes representing an access relationship and a traffic flow direction between entities; A matrix determination module configured to determine, according to the relationship model, a set value operation matrix corresponding to a preset variable of each controlled entity, each row in the set value operation matrix representing a superior entity controlling the controlled entity, each element being a set value of the preset variable at different time instants by each superior entity, and each column being a set time instant of each set value; An aggregation module configured to perform row vector summation on a matrix corresponding to a preset time window period for each set value operation matrix to obtain an aggregated row vector; A similarity determination module configured to determine a similarity between the aggregated row vector corresponding to the preset variable of each entity and a normal template curve corresponding to the preset variable of the entity; A determination module configured to determine that the entity is subjected to the distributed collusion attack in a case where the similarity between the aggregated row vector corresponding to the preset variable of the entity and the normal template curve corresponding to the preset variable of the entity does not exceed a preset threshold.

9. An abnormality detection device of a means of distributed collusion attack of an industrial control system, characterized by, The apparatus comprises: A processor; A memory for storing processor-executable instructions; The processor is configured to execute the method of any one of claims 1 to 7.

10. A non-transitory computer readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions, when executed by the processor, implement the method of any one of claims 1 to 7.

Images