Information safety and control safety linkage protection system of water service industrial control system

Abstract

The invention relates to the technical field of information security, and discloses a water service industrial control system information security and control security linkage protection system, which comprises a data acquisition module, an information security risk assessment module, a control security risk assessment module, a linkage decision and a protection execution module. The data acquisition module acquires equipment operation and network data packet data; the information security and control security risk assessment module calculates risk coefficients respectively; the linkage decision module formulates a protection strategy according to the coefficient and the threshold value; and the protection execution module implements the strategy and records a log. The system can accurately monitor information safety risks, reliably assess control safety risks, realize efficient linkage decision of information and control safety, guarantee safety and accuracy of protection strategy execution, give consideration to service priority and recovery cost, improve system health monitoring and risk adjustment mechanisms, effectively improve safety and stability of the water service industrial control system, and improve safety and reliability of the water service industrial control system. And safety protection and economic cost are balanced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a water conservancy industrial control system information security and control security linkage protection system. Background Art

[0002] As a key infrastructure to ensure the rational allocation of water resources, the stable operation of water conservancy facilities, and the effective monitoring and management of water environment, water conservancy industrial control systems are widely used in urban water supply, sewage treatment, flood control irrigation, hydropower generation and other fields. In recent years, with the deep integration of information technology and industrial control technology, the degree of intelligence and networking of water conservancy industrial control systems has been continuously improved. While improving production efficiency and optimizing resource allocation, they are also facing increasingly severe security challenges.

[0003] Traditional water utility industrial control systems are relatively closed and highly isolated from external networks, and security protection mainly focuses on the stability and reliability of the equipment itself. However, in order to achieve remote monitoring, data sharing and intelligent management, water utility industrial control systems are gradually opening up network interfaces and interconnecting with corporate internal networks and the Internet. This change exposes the system to a complex and changing network environment, and security threats such as threat software intrusion and network attacks continue to emerge.

[0004] In terms of information security, water conservancy industrial control systems face many challenges. On the one hand, there are a large number of network devices, sensors and controllers in the system, and the operating systems and applications they run may have security vulnerabilities. For example, the embedded operating systems used in some old equipment have not been updated for a long time and are easily exploited by hackers for attacks. On the other hand, the security of data transmission during network communication is also difficult to guarantee. Traditional encryption methods may not be able to meet the real-time and reliability requirements of water conservancy industrial control systems, and there is a risk of data being stolen and tampered with during transmission. In addition, new types of network attacks are constantly being updated, such as advanced persistent threat (APT) attacks, which are extremely concealed and targeted, and can lurk in the system for a long time to steal key information or destroy system operations. Existing information security protection technologies are difficult to effectively respond to.

[0005] Control safety is also an important concern of water conservancy industrial control systems. Key control indicators such as water level, flow, and water quality are directly related to the normal operation and function realization of the system. However, in actual operation, factors such as equipment failure and changes in the external environment can cause abnormal fluctuations in control indicators. For example, in heavy rain weather, river flow increases rapidly. If the water level control equipment cannot be adjusted in time and accurately, flood disasters may occur; when water quality monitoring equipment fails, if it is not discovered and handled in time, unqualified water may enter the water supply system and endanger the health of residents. In addition, there are also challenges in the collaborative work between different control devices. The communication and control command transmission between devices may be delayed and erroneous, affecting the control accuracy and stability of the entire system.

[0006] At present, most of the security protection measures for water conservancy industrial control systems are carried out separately for information security and control security. Information security protection mainly relies on network security equipment such as firewalls and intrusion detection systems, focusing on preventing external network attacks; control security mainly ensures the normal operation of equipment and the stability of control indicators through technologies such as equipment redundancy and fault diagnosis. This separate protection mode cannot achieve effective coordination between information security and control security, and it is difficult to cope with complex security threat scenarios. For example, when a network attack is detected, it is impossible to adjust the device control strategy in time to reduce the impact of the risk on the system operation; when the device control is abnormal, it is also impossible to detect in time whether there is an attack caused by an information security vulnerability. Summary of the invention

[0007] The purpose of the present invention is to provide a water conservancy industrial control system information security and control safety linkage protection system to solve the problems raised in the above background technology.

[0008] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a water conservancy industrial control system information security and control safety linkage protection system, the system comprising: The data acquisition module is used to collect the operating data of various equipment in the water conservancy industrial control system in real time, including water level sensor data, flow sensor data, water quality monitoring data, and data packet information in the system network, and mark the collected data as original monitoring data; The information security risk assessment module is used to analyze the network data packets in the collected original monitoring data, extract the information security related feature values, and calculate the information security risk coefficient. The specific calculation method is: obtain the feature vector set of normal network connections from the local database , the currently monitored network connection feature vector is t, through the cosine similarity formula Calculate the similarity between t and each normal feature vector, and take the minimum similarity value min(cos(t,s i )), let the information security risk factor R 1 =1-min(cos(t,s i )); The control safety risk assessment module assesses the control safety risk based on the original monitoring data; for the water level sensor data, the normal water level fluctuation range [a, b] is obtained from the local database, and the current water level value is set to h. If h [a, b], calculate the water level deviation coefficient Similarly, calculate the deviation coefficient of flow sensor data and water quality monitoring data, combine the deviation coefficients of various indicators, and calculate the control safety risk coefficient through the weighted average method , where w j is the weight of each indicator, d j is the deviation coefficient of the corresponding indicator; Linkage decision module, used to receive information security risk coefficient R 1 and control safety risk factor R 2 , obtain the risk threshold T from the local database 1 and T 2 If R 1 >T 1 or R 2 >T 2 , formulate linkage protection strategies according to risk types and levels; The protection execution module performs corresponding protection operations according to the protection strategy formulated by the linkage decision module.

[0009] Preferably, when the data acquisition module acquires network data packets, a deep packet inspection method is used, which is specifically implemented as follows: obtaining a signature library of known threat software from a local database , match the collected data packet content byte by byte, if the data packet contains any of the signature codes in the signature library c i , the data packet is marked as a suspected risk data packet and the relevant information is recorded.

[0010] Preferably, the information security risk assessment module calculates the activity index of the network connection when analyzing the network connection characteristics. The specific calculation method is: within a unit time Δt, the number of network connection establishment times n is counted. 1 and disconnection times n 2 , network connection activity , the activity index is incorporated into the calculation of the information security risk coefficient, and the improved information security risk coefficient , where α is the activity influencing factor.

[0011] Preferably, when evaluating the flow control safety risk, the control safety risk assessment module performs a linear regression analysis on the flow data within a period of time, assuming that the flow data sequence is q 1 ,q 2 , ..., q p , establish the linear regression equation , where ω is the time variable, calculate the slope β of the regression equation 1； If |β 1 |Exceeds the normal slope threshold S obtained from the local database 0 , then increase the weight of the flow control safety risk coefficient, and the adjusted control safety risk coefficient , where γ is the weight adjustment factor, sign(β 1 ) is a sign function, according to β 1 The positive and negative value of .

[0012] Preferably, when formulating protection strategies, the linkage decision module obtains a priority list of each business from a local database, and when facing risks, gives priority to ensuring the operation of high-priority businesses; if there are multiple executable protection strategies, the strategy with the least impact on high-priority businesses is selected for execution.

[0013] Preferably, the protection execution module adopts a control instruction verification mechanism when executing the protection strategy of adjusting the equipment control instructions; before sending a new control instruction, the instruction is first simulated and executed in a simulation environment, and the parameters of the simulation environment are consistent with the actual water conservancy industrial control system; by comparing the simulation execution result with the expected result, if the difference exceeds the allowable error range obtained from the local database, the control instruction is regenerated.

[0014] Preferably, the data acquisition module also collects the hardware status data of the equipment in the water conservancy industrial control system and calculates the comprehensive health index of the equipment hardware status. The specific calculation method is: obtain the normal range of each hardware parameter from the local database , Indicates different hardware parameters. The current hardware parameter value is x i , calculate the health sub-index of each hardware parameter , a comprehensive health index of the device hardware status ,in is the weight of each hardware parameter.

[0015] Preferably, the information security risk assessment module and the control security risk assessment module incorporate the comprehensive health index of the device hardware status into the risk assessment system; if the comprehensive health index H is lower than the health threshold H obtained from the local database 0 , then the information security risk factor and control security risk factor are increased, and the adjustment formulas are and , where δ 1 , δ 2 is the adjustment factor.

[0016] Preferably, the linkage decision module considers the system recovery cost when formulating the protection strategy; obtains the list of recovery costs corresponding to different protection strategies from the local database, and gives priority to executing the protection strategy with lower recovery cost on the premise of meeting the risk prevention and control requirements.

[0017] Preferably, the protection execution module records an operation log after executing the protection operation; the operation log includes the protection policy name, execution time, execution result, affected equipment and business information, and the operation log is regularly uploaded to the remote security management center for backup and analysis.

[0018] Compared with the prior art, the present invention has the following beneficial effects: The present invention collects network data packets in real time through the data acquisition module, and uses deep packet inspection technology to match byte by byte with the known threat software feature code library, which can accurately identify suspected risk data packets. For example, in a certain water supply network, data packets containing specific threat software feature codes were detected in time, effectively preventing potential threat software intrusion. When analyzing network connection characteristics, the information security risk assessment module not only extracts network connection and protocol abnormal characteristics, but also calculates network connection activity indicators and incorporates them into the information security risk coefficient calculation. This innovation makes risk assessment more comprehensive and accurate, and can reflect changes in network security status in real time, detect abnormal network behavior in a timely manner, and warn of potential information security threats in advance.

[0019] The control safety risk assessment module calculates the deviation coefficient based on the normal fluctuation range of key control indicators such as water level, flow, and water quality based on the equipment operation data, and obtains the control safety risk coefficient through the weighted average method by combining various indicators. When evaluating the flow control safety risk, the flow change trend is also considered, and the slope is calculated through linear regression analysis. If the slope is abnormal, the risk coefficient weight is adjusted. In the water flow control of the water conservancy hub, this method has been successfully applied to detect the abnormal flow change trend in advance and adjust the control strategy in time, avoiding serious consequences such as damage to water conservancy facilities due to abnormal flow, greatly improving the reliability of control safety risk assessment, and ensuring the stable operation of the water conservancy industrial control system.

[0020] The linkage decision-making module receives the information security risk factor and the control security risk factor, compares them with the preset risk threshold, and formulates a linkage protection strategy based on the risk type and level. This mechanism breaks the limitations of traditional information security and control security separation protection, and realizes the coordinated response of the two. When facing a network attack that causes the information security risk factor to increase, the device control instructions can be quickly adjusted, such as cutting off some non-critical business network connections and starting the backup security system at the same time to ensure that high-priority businesses are not affected; when the control security risk factor exceeds the standard, it can also promptly check whether there is an attack caused by an information security vulnerability, so as to take targeted protection measures and effectively reduce the impact of security risks on the overall system.

[0021] The protection execution module adopts a control instruction verification mechanism when executing the protection strategy of adjusting the equipment control instruction. The instructions are simulated and executed in a simulation environment. The simulation environment parameters are consistent with the actual system. The accuracy of the instructions is ensured by comparing the simulation execution results with the expected results. In the equipment control of the sewage treatment plant, the instruction to adjust the operating frequency of the sewage treatment pump is executed after simulation verification, which avoids the damage to the equipment and system operation caused by erroneous instructions and improves the reliability and security of the protection strategy execution. In addition, the protection execution module records detailed operation logs after executing the operation and uploads them to the remote security management center regularly, which is convenient for retrospective analysis of system operation, timely detection of potential problems, and continuous optimization of protection strategies.

[0022] When formulating protection strategies, the linkage decision-making module fully considers the system business priority and recovery cost. Obtain the priority list of each business from the local database, give priority to the operation of high-priority businesses when facing risks, and select the strategy with the least impact on high-priority businesses for execution. In the urban water supply system, the raw water supply business is a high-priority business, which can be given priority when facing risks to ensure the safety of residents' water use. At the same time, obtain the list of recovery costs corresponding to different protection strategies, and give priority to the strategy with lower recovery cost on the premise of meeting the risk prevention and control requirements, effectively balance the relationship between security protection and economic cost, and improve the comprehensive benefits of system operation. The data acquisition module collects equipment hardware status data, such as temperature, voltage, etc., and calculates the comprehensive health index of the equipment hardware status. The information security risk assessment module and the control security risk assessment module incorporate the comprehensive health index into the risk assessment system. If the comprehensive health index is lower than the health threshold, the information security risk factor and the control security risk factor are appropriately increased. During the operation of equipment in a certain water plant, by monitoring the hardware status of the equipment, potential hardware failure risks were discovered in a timely manner, and the risk factor was adjusted accordingly. Maintenance measures were taken in advance to avoid safety accidents caused by equipment failures, further improving the system's safety protection system and improving the overall reliability and stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a working principle diagram of the water conservancy industrial control system information security and control safety linkage protection system of the present invention; Figure 2 It is a workflow diagram of the deep packet inspection method; Figure 3 Workflow diagram for the control security risk assessment module. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0025] See also Figure 1-3 The present invention provides a technical solution: a water conservancy industrial control system information security and control safety linkage protection system, the system comprising: Data acquisition module: This module is responsible for real-time collection of operating data of various equipment in the water conservancy industrial control system, including water level sensor data, flow sensor data, water quality monitoring data, and data packet information in the system network. The collected data will be marked as original monitoring data.

[0026] Information security risk assessment module: conducts in-depth analysis of network data packets in the collected raw monitoring data and extracts information security related feature values. Obtains a set of feature vectors of normal network connections from the local database , the currently monitored network connection feature vector is t, through the cosine similarity formula Calculate the similarity between t and each normal feature vector, and take the minimum similarity value min(cos(t,s i )), and set the information security risk factor R 1 =1-min(cos(t,s i )) to assess information security risks.

[0027] Control safety risk assessment module: Evaluate control safety risks based on sensor data. Taking water level sensor data as an example, obtain the normal fluctuation range of water level [a, b] from the local database, set the current water level value to h, if h [a, b], calculate the water level deviation coefficient Similarly, calculate the deviation coefficient of flow sensor data and water quality monitoring data, combine the deviation coefficients of various indicators, and calculate the control safety risk coefficient through the weighted average method , where w j is the weight of each indicator, d j is the deviation coefficient of the corresponding indicator.

[0028] Linkage decision module: receiving information security risk coefficient R 1 and control safety risk factor R 2 , and obtain the risk threshold T from the local database 1 and T 2 If R 1 >T 1 or R 2>T 2 , then formulate a linkage protection strategy based on the risk type and level.

[0029] Protection execution module: executes corresponding protection operations according to the protection strategy formulated by the linkage decision-making module to ensure the safe and stable operation of the water conservancy industrial control system.

[0030] The present invention is further described below with reference to specific examples using embodiments 1 to 6:

[0031] Embodiment 1 This embodiment mainly enables the data collection module to more accurately detect risky data packets and collect device hardware status data for evaluating the health status of the device, thereby improving the system's ability to perceive potential threats and fully control the operating status of the device.

[0032] Deep packet inspection implementation: When collecting network data packets, the data collection module uses deep packet inspection methods. Obtain the signature library of known threat software from the local database , and matches the collected data packet content byte by byte. In the actual operation process, when a new data packet enters the system, the data acquisition module will start the matching program, and compare the data packet content with each feature code in the feature code library in units of bytes. 1 Once a data packet is found to contain any of the signature codes in the signature library, the data packet will be immediately marked as a suspected risk data packet, and relevant information will be recorded in detail, such as the source IP address, destination IP address, port number, data packet size, discovery time, etc. This recorded information will provide key clues for subsequent security analysis.

[0033] Hardware status data collection and health index calculation: The data collection module is also responsible for collecting the hardware status data of the equipment in the water conservancy industrial control system and calculating the comprehensive health index of the equipment hardware status. The normal range of each hardware parameter is obtained from the local database. , Indicates different hardware parameters. The current hardware parameter value is x i For each hardware parameter, a health sub-index h is calculated based on whether it is within the normal range. i : For example, for a hardware parameter of a device, the normal range of the CPU temperature is [30°C, 70°C]. If the currently measured CPU temperature is 45°C, since 45°C is within the normal range, the health sub-index h of the hardware parameter is CPU温度 =1; if the current measured value is 80℃, which is not within the normal range, then calculate .

[0034] Comprehensive health index of device hardware status ,in The weight of each hardware parameter. In practical applications, the weight can be reasonably allocated according to the importance of the hardware device to the system operation. For example, the parameter weight of the core processing chip can be set higher, while the parameter weight of some auxiliary hardware is relatively low. By calculating the comprehensive health index, the overall health status of the device hardware can be intuitively understood, providing strong support for early equipment maintenance and fault warning.

[0035] Embodiment 2 This embodiment aims to further optimize the assessment accuracy of the information security risk assessment module by introducing a network connection activity indicator and incorporating the comprehensive health index of the device hardware status into the assessment system, so as to more comprehensively reflect the information security risks faced by the system.

[0036] When analyzing the network connection characteristics, the information security risk assessment module calculates the activity index of the network connection. Within a unit time Δt, the number of network connection establishments n is counted. 1 and disconnection times n 2 , network connection activity , the activity index is incorporated into the calculation of the information security risk coefficient, and the improved information security risk coefficient , where α is the activity influencing factor. In the actual system operation, if the unit time Δt = 1 minute, the number of network connection establishment times n 1 =10 times, disconnection times n 2 =5 times, then the network connection activity times / minute. Assuming that the information security risk factor R 1 =0.3, activity impact factor α=0.01, then the improved information security risk coefficient In this way, the impact of dynamic changes in network connections on information security risks can be more accurately assessed.

[0037] The information security risk assessment module incorporates the comprehensive health index of the device hardware status into the risk assessment system. If the comprehensive health index H is lower than the health threshold H obtained from the local database 0 , then the information security risk factor and control security risk factor are increased, and the adjustment formulas are , where δ 1 is the adjustment factor. For example, assuming R 1 =0.4,H=0.6,H 0 =0.8,δ 1 =0.5, then the adjusted information security risk coefficient This means that when the health of the device hardware is poor, the system will increase its assessment of information security risks accordingly so that more stringent protective measures can be taken in a timely manner.

[0038] Embodiment 3 This embodiment optimizes the control security risk assessment module. By performing linear regression analysis on traffic data and incorporating the comprehensive health index of the device hardware status into the assessment, it can more accurately assess the control security risk and provide a more reliable risk assessment basis for the safe and stable operation of the system.

[0039] When evaluating the flow control safety risk, the control safety risk assessment module performs linear regression analysis on the flow data within a period of time. Suppose the flow data sequence is q 1 ,q 2 , ..., q p , establish the linear regression equation , where ω is the time variable. Using the linear regression algorithm, the slope of the regression equation β is calculated 1 If |β 1 |Exceeds the normal slope threshold S obtained from the local database 0 , then increase the weight of the flow control safety risk coefficient, and the adjusted control safety risk coefficient , where γ is the weight adjustment factor, sign(β 1 ) is a sign function, according to β 1 For example, within a certain period of time, the linear regression analysis of the flow data yields the regression equation q=5+2t, then the slope β 1 = 2. If the normal slope threshold S obtained from the local database 0 =1.5, weight adjustment factor γ=0.2, due to β 1 >0,sign(β 1 )=1, assuming that the original control safety risk factor R 2 =0.3, then the adjusted control safety risk factor This shows that when the trend of traffic data changes beyond the normal range, the system will increase its consideration of traffic control security risks.

[0040] The control security risk assessment module incorporates the comprehensive health index of the device hardware status into the risk assessment system. If the comprehensive health index H is lower than the health threshold H obtained from the local database 0 , then the control safety risk coefficient is improved, and the adjustment formula is , where δ 2 is the adjustment coefficient. Assume R 2 =0.35, H=0.5, H 0 =0.7,δ 2 =0.4, then the adjusted control safety risk factor In this way, the health status of device hardware is closely linked to the control of security risks, making risk assessment more comprehensive and accurate.

[0041] Embodiment 4 This embodiment optimizes the process of formulating protection strategies by the linkage decision module, taking into account business priorities and system recovery costs, to ensure that when faced with risks, a protection strategy that both guarantees key business operations and is cost-effective can be formulated.

[0042] When formulating protection strategies, the linkage decision module obtains the priority list of each business from the local database. When facing risks, priority is given to ensuring the operation of high-priority businesses. For example, in the water industry control system, the water supply business usually has a higher priority, while some auxiliary water quality monitoring data statistics business priorities are relatively low. If the system detects information security risks or control security risks, the linkage decision module will first determine the affected business and its priority. If the risk affects the water supply business, even if other low-priority businesses are affected at the same time, the protection strategy that ensures the normal operation of the water supply business will be prioritized. If there are multiple executable protection strategies, the strategy with the least impact on the high-priority business is selected for execution. Assume that there are currently two protection strategies. Strategy A will cause a brief interruption of the water supply business for 5 minutes, but can quickly restore system security; Strategy B will not interrupt the water supply business, but it will take a longer time to restore system security and may affect other low-priority businesses. In this case, the linkage decision module will prioritize the execution of Strategy B based on the business priority and the degree of impact of the strategy on the business.

[0043] When formulating protection strategies, the linkage decision module considers the system's recovery cost. It obtains a list of recovery costs corresponding to different protection strategies from the local database, and gives priority to protection strategies with lower recovery costs, provided that risk prevention and control requirements are met. For example, for a certain risk situation, there are three protection strategies, with a recovery cost of 1,000 yuan for strategy A, 800 yuan for strategy B, and 1,200 yuan for strategy C. If all three strategies can effectively prevent and control risks, the linkage decision module will give priority to executing strategy B to reduce the cost of system recovery.

[0044] Embodiment 5 This embodiment mainly implements reliability assurance of the protection execution module when executing protection strategies, ensures the correctness of instructions by controlling the instruction verification mechanism, and provides important basis for system security analysis and troubleshooting by recording operation logs.

[0045] The protection execution module adopts the control instruction verification mechanism when executing the protection strategy of adjusting the device control instruction. Before sending a new control instruction, the instruction is simulated and executed in a simulation environment. The parameters of the simulation environment are consistent with the actual water utility industrial control system. The simulation environment will be built according to the parameters of the actual system, including the model, performance parameters, network configuration, operating environment, etc. of the equipment. For example, for the control instruction to adjust the speed of the water pump, the actual operating status of the water pump will be simulated in the simulation environment, the speed of the simulated water pump will be adjusted according to the instruction, and the simulation execution results will be recorded. By comparing the simulation execution results with the expected results, if the difference exceeds the allowable error range obtained from the local database, the control instruction is regenerated. Assume that the instruction to adjust the water pump speed is expected to adjust the water pump speed to 1500 rpm. In the simulation execution, the actual adjusted speed is 1450 rpm, and the allowable error range obtained from the local database is ±30 rpm. Since 1450 rpm is within the allowable error range, the instruction can be sent to the actual system for execution; if the simulation execution result is 1400 rpm, which exceeds the allowable error range, the control instruction needs to be regenerated until the simulation execution result meets the requirements.

[0046] After executing the protection operation, the protection execution module records the operation log. The operation log includes the name of the protection policy, execution time, execution result, affected devices and business information. For example, the name of the protection policy executed in a certain protection operation is "block abnormal network connection", the execution time is "October 15, 2024 10:00:00", the execution result is "successfully blocked abnormal network connection from IP address 192.168.1.100", the affected device is "firewall device FW-01", and the affected business is "some non-critical data transmission business". The protection execution module will regularly upload the operation log to the remote security management center for backup and analysis. In actual application, the upload time window can be set from 2:00 to 3:00 am every day, and the operation logs of the previous day can be packaged and uploaded to the remote security management center. The remote security management center can centrally manage and analyze these logs, and discover potential security threat patterns and system operation problems through technologies such as data mining and machine learning, providing strong support for further optimizing protection strategies and improving system security.

[0047] Embodiment 6 This embodiment takes a water utility industrial control system composed of multiple water plants and sewage treatment plants under a large water utility group as an example to elaborate on the application of the water utility industrial control system information security and control safety linkage protection system of the present invention in actual scenarios. Take two specific scenarios as examples: Scenario 1: Abnormal operation detection of water pumps in the water intake pump room: There are 5 water pumps in the water intake pump room of a water plant. The normal operation pattern recorded in the local database is that 3 to 4 water pumps are usually running in combination, and the rest of the water pumps are in standby state. The data acquisition module collects the operating status data of the water pumps in real time. When it is detected that more than 4 water pumps are turned off at the same time, or all 5 water pumps are turned on, the control safety risk assessment module will calculate a higher control safety risk factor R based on these abnormal data. 2 After the linkage decision module receives the risk factor, it compares it with the risk threshold T 2 For comparison, if R 2 >T 2 , then the possibility of attack is determined, and a protection strategy for alarm and interception of related control instructions is formulated. The protection execution module executes the strategy, sends alarm information to the operation and maintenance personnel, intercepts control instructions that may cause abnormal operations, and records operation logs, including alarm time, intercepted instruction content, affected water pump equipment information, etc., and uploads them to the remote security management center.

[0048] Scenario 2: Abnormal detection of mud discharge operation in sedimentation tank: The mud discharge operation of a sedimentation tank in a water plant has a regular pattern and needs to accumulate enough sludge before it can be started. The relevant operation pattern data is stored in the local database. The data acquisition module collects the instructions for controlling the mud discharge operation and the sludge volume data of the sedimentation tank in real time. When it is detected that there is a large difference between the instructions for controlling the mud discharge operation and the rules, such as receiving the mud discharge instruction when the sludge volume is far from reaching the start-up standard, the control safety risk assessment module calculates a higher control safety risk coefficient. The linkage decision module determines the possibility of attack based on the comparison result of the risk coefficient and the threshold, and formulates corresponding protection strategies, such as alarm and interception of mud discharge instructions. The protection execution module executes the strategy, sends an alarm signal to notify the operation and maintenance personnel, intercepts abnormal mud discharge instructions, records the operation log, and uploads the relevant information to the remote security management center for analysis.

[0049] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0050] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. Water conservancy industrial control system information security and control safety linkage protection system, characterized by: include: The data acquisition module is used to collect the operating data of various equipment in the water conservancy industrial control system in real time, including water level sensor data, flow sensor data, water quality monitoring data, and data packet information in the system network, and mark the collected data as original monitoring data; The information security risk assessment module is used to analyze the network data packets in the collected original monitoring data, extract the information security related feature values, and calculate the information security risk coefficient. The specific calculation method is: obtain the feature vector set of normal network connections from the local database , the currently monitored network connection feature vector is t, through the cosine similarity formula Calculate the similarity between t and each normal feature vector, and take the minimum similarity value min(cos(t,s i )), let the information security risk factor R1=1-min(cos(t,s i )); The control safety risk assessment module assesses the control safety risk based on the original monitoring data; for the water level sensor data, the normal water level fluctuation range [a, b] is obtained from the local database, and the current water level value is set to h. If h [a, b], calculate the water level deviation coefficient ; Similarly, the deviation coefficients of flow sensor data and water quality monitoring data are calculated, and the deviation coefficients of various indicators are combined to calculate the control safety risk coefficient through the weighted average method. , where w j is the weight of each indicator, d j is the deviation coefficient of the corresponding indicator; The linkage decision module is used to receive the information security risk coefficient R1 and the control security risk coefficient R2, and obtain the risk thresholds T1 and T2 from the local database; if R1>T1 or R2>T2, a linkage protection strategy is formulated according to the risk type and level; The protection execution module performs corresponding protection operations according to the protection strategy formulated by the linkage decision module.

2. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: When the data acquisition module collects network data packets, it uses a deep packet inspection method, which is specifically implemented as follows: obtaining a signature library of known threat software from a local database , match the collected data packet content byte by byte, if the data packet contains any of the signature codes in the signature library c i , the data packet is marked as a suspected risk data packet and the relevant information is recorded.

3. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: When analyzing the network connection characteristics, the information security risk assessment module calculates the activity index of the network connection. The specific calculation method is: within a unit time Δt, the number of network connection establishments n1 and disconnection times n2 are counted, and the network connection activity index is calculated. , the activity index is incorporated into the calculation of the information security risk coefficient, and the improved information security risk coefficient , where α is the activity influencing factor.

4. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: When evaluating the flow control safety risk, the control safety risk assessment module performs a linear regression analysis on the flow data within a period of time. Suppose the flow data sequence is q1, q2, ..., q p , establish the linear regression equation , where ω is the time variable, calculate the slope β of the regression equation 1； If |β1| exceeds the normal slope threshold S0 obtained from the local database, the weight of the flow control safety risk coefficient is increased, and the adjusted control safety risk coefficient , where γ is the weight adjustment factor, sign(β1) is the sign function, and takes values ​​according to the positive or negative value of β1.

5. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: When formulating protection strategies, the linkage decision module obtains a priority list of each business from the local database. When facing risks, it gives priority to ensuring the operation of high-priority businesses. If there are multiple executable protection strategies, the strategy with the least impact on high-priority businesses is selected for execution.

6. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: The protection execution module adopts a control instruction verification mechanism when executing the protection strategy of adjusting the equipment control instructions; before sending a new control instruction, the instruction is first simulated and executed in a simulation environment, and the parameters of the simulation environment are consistent with the actual water conservancy industrial control system; by comparing the simulation execution result with the expected result, if the difference exceeds the allowable error range obtained from the local database, the control instruction is regenerated.

7. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: The data acquisition module also collects the hardware status data of the equipment in the water conservancy industrial control system and calculates the comprehensive health index of the equipment hardware status. The specific calculation method is: obtain the normal range of each hardware parameter from the local database , Indicates different hardware parameters. The current hardware parameter value is x i , calculate the health sub-index of each hardware parameter , a comprehensive health index of the device hardware status ,in is the weight of each hardware parameter.

8. The water conservancy industrial control system information security and control safety linkage protection system according to claim 7 is characterized in that: The information security risk assessment module and the control security risk assessment module incorporate the comprehensive health index of the equipment hardware status into the risk assessment system; if the comprehensive health index H is lower than the health threshold H0 obtained from the local database, the information security risk coefficient and the control security risk coefficient are increased, and the adjustment formulas are respectively and , where δ1 and δ2 are adjustment coefficients.

9. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: The linkage decision module considers the system recovery cost when formulating the protection strategy; obtains the recovery cost list corresponding to different protection strategies from the local database, and gives priority to the protection strategy with lower recovery cost on the premise of meeting the risk prevention and control requirements.

10. The water conservancy industrial control system information security and control safety linkage protection system according to claim 1 is characterized in that: After executing the protection operation, the protection execution module records the operation log; the operation log includes the protection policy name, execution time, execution result, affected equipment and business information, and regularly uploads the operation log to the remote security management center for backup and analysis.

Images