An interpretable fine-grained industrial control network intrusion detection method

Abstract

The application discloses an interpretable fine-grained industrial control network intrusion detection method, which comprises a model structure part and a data processing part, the model structure part comprises a byte-level interpretable module, a packet-level feature extraction module, a flow-level time sequence analysis module and a result output module, the data processing part comprises a network model and a data processing process at the byte level, the packet level and the flow level, and the data processing process comprises data preprocessing, feature extraction and final intrusion detection decision. Compared with the prior art, the application has the advantages that the application proposes a deep learning-based intrusion detection system model for detecting advanced attacks in ICS networks. Through byte, packet and flow level feature extraction and fusion, the accuracy, interpretability and efficiency of intrusion detection are improved, especially in complex attack scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of control network intrusion detection, and in particular to an interpretable fine-grained industrial control network intrusion detection method. Background Art

[0002] Industrial Control Systems (ICS) are computerized systems used to monitor and control industrial processes. They consist of a series of hardware and software components that manage communication between industrial equipment, sensors, and actuators, as well as control production processes. ICS systems are commonly used in factories, manufacturing, and production facilities to ensure the safe, efficient, and reliable operation of production processes. A typical ICS system is shown below, consisting of a control center, an engineering station, and a programmable logic controller.

[0003] An engineering station is a crucial component of industrial control systems, providing a graphical user interface for monitoring and managing the operation of industrial control systems. Engineers typically use an engineering station to write, debug, and modify control logic programs, as well as configure and maintain various parameters of the industrial control network.

[0004] A programmable logic controller (PLC) is a specialized computer control system used to control and automate physical processes in real time. Due to its widespread use in industrial control, PLCs are vulnerable to cyberattacks, making the security of PLC systems crucial for industrial control networks. PLCs have multiple input / output (I / O) ports connected to sensors and actuators, which are used to monitor and control the operation of industrial equipment.

[0005] Two typical network attacks against PLCs: (To help understand the advantages of this method over other intrusion detection solutions)

[0006] 1) Traditional control logic injection attack: This attack transmits malicious control logic to the PLC through the industrial control protocol for execution. There are two main ways to implement this attack. The first is to directly write the control logic into the PLC through the write control logic command. This method can be easily detected by detecting the command to write the control logic command. The second is to write the control logic into the PLC data block through the write data block command. The attacker then further modifies the PLC's control flow to cause the PLC to execute the malicious control logic in the data block. Since the data block often needs to interact with the PLC status of the control service center such as SCADA, it is difficult to detect it by detecting the command to write the data block. However, due to the detection strategy, it is still possible to detect the injection of malicious control logic by capturing the byte characteristics of the malicious control logic.

[0007] 2) Fragmented noise filling attacks are a novel cyberattack that injects malicious control logic into PLCs. The key idea is to fragment the malicious control logic into X different data packets (fragmented), each containing only N bytes of the malicious control logic, with the remainder consisting of 0000 or random noise bytes (noise). Using a write data block command, all bytes of the malicious control logic are injected into the PLC one by one. This makes the control logic injection process appear to be a normal data block exchange. However, because the N bytes transmitted in each data packet are too small, it is difficult to detect by capturing the byte signatures of the malicious control logic.

[0008] In the field of industrial control networks, rule-matching-based methods for detecting industrial control network attacks require a lot of time and manpower to analyze private protocols, making it difficult to update security rules in a timely manner and increasing the risk of network attacks.

[0009] Byte signature matching methods have difficulty detecting attack packets containing smaller attack payloads because these packets tend to be mixed with normal packets. This type of method has low detection accuracy.

[0010] Deep packet inspection methods based on CNN / CNN-RNN can only extract traffic features at the packet level, making it difficult to effectively detect certain attack types such as fragmentation and noise attacks.

[0011] The RNN-based packet flow detection method does not effectively utilize the byte characteristics of the data packets, and it is difficult to detect attacks where the attack payload is concentrated in a small number of data packets (for example, some attacks are completed in a single packet). In addition, the current flow-based attack detection granularity is too large to accurately locate abnormal data packets. Summary of the Invention

[0012] The technical problem to be solved by the present invention is to provide an explainable fine-grained industrial control network intrusion detection method in view of the deficiencies of the existing technology.

[0013] To solve the above technical problems, the present invention provides a technical solution: an interpretable fine-grained industrial control network intrusion detection method, which includes a model structure part and a data processing part;

[0014] The model structure includes a byte-level interpretable module, a packet-level feature extraction module, a flow-level timing analysis module, and a result output module;

[0015] The data processing part includes network models and data processing processes at the byte level, packet level, and flow level. The data processing process includes data preprocessing, feature extraction, and final intrusion detection decision-making;

[0016] The byte level, packet level, and flow level all include network model processing and result output. Ultimately, through processing at the byte level, packet level, and flow level, the model will output its own attack judgment results respectively, and obtain the final intrusion detection conclusion by fusing these results.

[0017] Furthermore, the byte-level interpretable module includes the following contents:

[0018] A: The byte sequence of the input data packet is converted into an embedding vector, including raw byte embedding, position embedding, and segment embedding, and the importance weight of each byte is calculated through the self-attention mechanism;

[0019] B: Self-attention mechanism of shared query vector: This mechanism can calculate the contribution of each byte to the judgment of the entire data packet, improving the byte-level interpretability of the model.

[0020] Furthermore, the packet-level feature extraction module includes the following contents:

[0021] A: The byte features of the input data packet are processed through a convolutional neural network (CNN) to extract spatial features, capture the local dependencies between bytes, and then determine whether the packet is malicious;

[0022] B: This module extracts useful features from data packets through convolution operations, combines the pooling layer to reduce redundant information, and finally outputs packet-level intrusion detection results through the fully connected layer.

[0023] Furthermore, the flow-level timing analysis module includes the following contents:

[0024] A: During stream-level processing, the model uses a multi-head self-attention mechanism to analyze the temporal relationship between data packets and capture malicious disturbances in the stream.

[0025] B: This module predicts whether the entire data flow has abnormal behavior through the timing dependency of traffic, and is particularly suitable for detecting advanced attack patterns.

[0026] Furthermore, the data preprocessing is specifically as follows:

[0027] A: The data flow is divided through the five-tuple to ensure the independence of each connection flow.

[0028] B: Perform flow filtering and packet filtering to remove traffic not related to the ICS system and ensure that only relevant traffic is analyzed.

[0029] C: Data packet content cleaning, zero padding, and truncation operations are performed to unify the input format and adapt it to the requirements of deep learning models.

[0030] D: A sliding window mechanism is introduced to enhance the robustness of the model to changes in attack locations by dynamically adjusting the window size and step size.

[0031] Furthermore, the feature extraction is specifically as follows:

[0032] A: Byte-level features are processed through embedding and self-attention mechanisms;

[0033] B: Packet-level features are extracted using convolutional neural networks;

[0034] C: Stream-level features capture temporal features through a multi-head self-attention mechanism.

[0035] Furthermore, flow-level and packet-level fusion is achieved: the temporal features of flow-level analysis are combined with the spatial features of packet-level analysis to ensure a balance between efficiency and accuracy.

[0036] Furthermore, the byte level complements the packet level and the flow level: the byte level provides detailed explainability, the packet level strengthens feature extraction, and the flow level provides overall timing perception. The combination of these three can ensure that the intrusion detection model has stronger attack identification capabilities.

[0037] The above structure offers the following advantages: This invention proposes a deep learning-based intrusion detection system model for detecting advanced attacks in ICS networks. By extracting and fusing byte, packet, and flow-level features, it improves the accuracy, interpretability, and efficiency of intrusion detection, particularly in complex attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a partial schematic diagram of a model that can explain fine-grained industrial control network intrusion detection methods. DETAILED DESCRIPTION

[0039] The technical problems to be solved by this application proposal are:

[0040] 1) Byte-level interpretability: Through the attention mechanism, this method can analyze the contribution of each byte in the data packet to malicious attacks, thereby facilitating reliable intrusion detection.

[0041] ICS uses numerous proprietary protocols, and these protocols vary significantly between different manufacturers and even different models. Manually analyzing protocol fields is not only time-consuming and labor-intensive, but existing intrusion detection systems (IDS) also have shortcomings in byte-level analysis of data packets and are unable to effectively label and explain the importance of each byte in the data packet. This byte-level interpretability is crucial for security personnel to deeply analyze protocol fields, accurately locate the source of anomalies, and achieve more reliable intrusion detection.

[0042] Because ICS traffic extensively uses proprietary protocols to ensure data confidentiality, it is typically transmitted in plaintext, endowing it with grammatical and semantic features similar to natural language. The attention mechanism in deep learning has been widely used in natural language processing. It assigns weights to each word in a sentence to highlight important terms. In intrusion detection, the attention mechanism can also be applied to ICS traffic analysis. By dynamically assigning weights to each byte, it highlights key bytes that may carry abnormal information. This mechanism not only enables detection models to more accurately focus on important bytes, but also provides security personnel with more granular explanatory information, helping them better understand and respond to complex cyberattacks.

[0043] 2) Packet-granularity detection with flow feature fusion: This method integrates flow-level features into each data packet, achieving packet-granular intrusion detection while ensuring detection accuracy.

[0044] In ICS, some advanced attack methods make single-packet detection ineffective. Attackers can not only spread malicious payloads across multiple packets, making each packet's payload extremely small or even indistinguishable from a normal packet, but they can also exploit process vulnerabilities to insert one or more seemingly normal packets into critical locations within certain operational sequences. The contents of these packets may fall within the register's permitted threshold, making them difficult for traditional detection methods to identify.

[0045] The data streams of these advanced attacks often exhibit strong temporal sequences, meaning that abnormal behavior can be detected by analyzing the temporal relationships between packets. For example, in a fragmented noise attack, the attacker breaks down continuous binary control logic into multiple memory write packets and writes them one by one to the PLC, thereby delivering malicious control logic. Because each packet contains only a small fragment of malicious code, these packets are sometimes virtually indistinguishable from normal physical process data packets exchanged between the HMI (human-machine interface) and the control center, making them difficult to detect through packet-level inspection.

[0046] At the same time, normal traffic on ICS networks also exhibits significant time series characteristics. Because ICS business processes are typically fixed, network traffic exhibits a high degree of periodicity and time series. For example, sensors periodically transmit data, and controllers periodically issue commands, forming a stable traffic pattern. However, when attackers insert packets that conform to normal operations but have abnormal timing, even if the operations themselves are not problematic, the insertion disrupts the time series characteristics of the normal data flow, and this anomaly can be detected and identified by an intrusion detection system (IDS).

[0047] Current intrusion detection systems typically rely on sequential neural networks such as RNNs (recurrent neural networks) to process time series data. By gradually processing a sequence of packets, RNNs can capture the temporal dependencies between packets. However, a major limitation of RNNs is that they require the accumulation of sufficiently long sequence data to make effective inferences, which affects the real-time performance of detection. We hope to be able to perform real-time inference after accumulating as few packets as possible, thereby responding to potential threats more quickly.

[0048] To this end, this method uses a multi-head self-attention mechanism. This mechanism can simultaneously focus on multiple different temporal relationships in ICS network traffic when processing shorter packet sequences, thereby improving inference speed and accuracy. By assigning attention weights to different parts of a packet sequence, it captures key temporal features in a shorter timeframe, achieving faster and more effective intrusion detection than RNNs. Multi-head self-attention performs well in the case of short packet sequences, significantly improving detection accuracy and validating the effectiveness of this method.

[0049] The present invention will be described in further detail below with reference to the accompanying drawings.

[0050] Combined with attachment Figure 1 ,An explainable fine-grained industrial control network intrusion detection method, which includes a model structure part, a data processing part;

[0051] The model structure includes a byte-level interpretable module, a packet-level feature extraction module, a flow-level timing analysis module, and a result output module;

[0052] The byte-level interpretable module includes the following:

[0053] A: The byte sequence of the input data packet is converted into an embedding vector, including raw byte embedding, position embedding, and segment embedding, and the importance weight of each byte is calculated through the self-attention mechanism;

[0054] B: Self-attention mechanism of shared query vector: This mechanism can calculate the contribution of each byte to the judgment of the entire data packet, improving the byte-level interpretability of the model.

[0055] This module uses a self-attention mechanism based on triple embeddings and a shared query vector to deeply analyze the byte-level features of data packets. First, the bytes in the packet are converted into three dimensions: raw byte embedding, position embedding, and segment embedding. Then, the self-attention mechanism is applied to calculate the importance weight of each byte, enhancing the detection of byte-level attacks and providing highly interpretable analysis results. A key technical feature of this module is the generation of byte weight distributions through a shared query vector, which helps security personnel quickly locate attack bytes and improve their understanding and response to abnormal data packets.

[0056]

[0057] Segment Embedding:

[0058] The original bytes are distinguished from the zero-padded bytes by segment embedding, which has a dimension of 2. The segment embedding matrix is:

[0059]

[0060] Finally, each byte in the data packet is triple-embedded into a 3×1 vector, and the total data packet is represented as:

[0061]

[0062] Self-attention mechanism for shared query vectors: The self-attention mechanism has achieved significant success in natural language processing. Typically, self-attention mechanisms generate weights by calculating the relationship between each byte and other bytes. However, in intrusion detection, it is more meaningful to focus on each byte's contribution to the overall detection result of the packet. Therefore, Avocado proposes a self-attention mechanism for shared query vectors, which generates importance weights for each byte using the shared query vector.

[0063] Calculate the K, Q, and V matrices:

[0064] First, the embedding matrix E is transposed and input into the linear transformation matrix W K ,W Q ,W V , generate query, key, and value matrices:

[0065] K=E T W K ,Q=E T W Q ,V=E T W V

[0066] in d is the embedding dimension, which represents the hidden layer dimension of the attention matrix.

[0067] Shared query vector generation:

[0068] To obtain a shared query vector, the model performs a mean operation on the query matrix Q along the byte dimension to generate a packet-level query vector:

[0069]

[0070] in is the mean query vector.

[0071] Shared query vector weight calculation:

[0072] The shared query vector Q packet Multiply it with the key-value matrix K and normalize it through the Softmax function to generate the weight of each byte:

[0073]

[0074] in Indicates the weight of each byte, d k is the K matrix embedding dimension.

[0075] Output calculation:

[0076] The byte attention weight W B Apply element-by-element to the value matrix V and calculate the weighted byte representation:

[0077]

[0078] Then, after a linear change W O The output matrix is ​​the same as the original input E T Perform residual connection to obtain the final byte-level output:

[0079] B=ZW O +E T

[0080] in Keep the same shape as the original input

[0081] The packet-level feature extraction module includes the following contents:

[0082] A: The byte features of the input data packet are processed through a convolutional neural network (CNN) to extract spatial features, capture the local dependencies between bytes, and then determine whether the packet is malicious;

[0083] B: This module extracts useful features from data packets through convolution operations, combines the pooling layer to reduce redundant information, and finally outputs packet-level intrusion detection results through the fully connected layer.

[0084] The flow-level timing analysis module includes the following contents:

[0085] A: During stream-level processing, the model uses a multi-head self-attention mechanism to analyze the temporal relationship between data packets and capture malicious disturbances in the stream.

[0086] B: This module predicts whether the entire data flow has abnormal behavior through the timing dependency of traffic, and is particularly suitable for detecting advanced attack patterns.

[0087] The data processing part includes network models and data processing processes at the byte level, packet level, and flow level. The data processing process includes data preprocessing, feature extraction, and final intrusion detection decision-making;

[0088] The byte level, packet level, and flow level all include network model processing and result output. Ultimately, through processing at the byte level, packet level, and flow level, the model will output its own attack judgment results respectively, and obtain the final intrusion detection conclusion by fusing these results.

[0089] The byte-level processing described:

[0090] At the byte-level processing stage, we focus on every byte in the packet. By incorporating the attention mechanism from deep learning, this stage aims to analyze the contribution of each byte to attack detection, ensuring precise localization of the specific bytes involved in malicious attacks. At this level, the model weights the features of each byte to dynamically highlight attack-related bytes. This approach provides byte-level interpretability, helping security personnel accurately understand potential attack behaviors within anomalous packets.

[0091] A: Network model processing: For each byte, the model first embeds it into a vector representation, and then uses the self-attention mechanism to calculate the correlation between bytes to evaluate the impact of each byte on malicious activities.

[0092] B: Output: The output of this process is the weight of each byte and the corresponding classification result, which helps analyze which bytes play an important role in the entire data packet.

[0093] Packet-level processing:

[0094] During packet-level processing, we expand our focus to the individual packet level. This level of detection incorporates not only byte-level features but also certain temporal features. By using convolutional neural networks (CNNs), the model is able to extract spatial features and temporal dependencies within packets to identify more complex attack patterns, particularly in advanced attacks (such as fragmented noise attacks) where the malicious payload is spread across multiple packets.

[0095] A: Network model processing: The convolutional layer extracts spatial features between bytes within the data packet and uses max pooling to reduce redundant information. The fully connected layer then performs classification to determine whether the packet is malicious.

[0096] B: Output results: Packet-level output is the attack judgment result for each data packet, marking whether each data packet has abnormal behavior.

[0097] This module is designed to extract in-depth features from each packet. Because each packet in an ICS network exhibits complex spatial and temporal correlations, CNNs can effectively capture these local features, particularly the inter-byte dependencies within a packet. Using CNNs to extract spatial features not only improves packet representation but also reduces the number of parameters through its weight-sharing mechanism, thereby lowering computational complexity and meeting the requirements of real-time ICS detection.

[0098] Input transformation: Before the convolution operation, the byte embedding matrix processed by the Byte-Level Interpretable Module needs to be Perform dimension conversion to adapt it to the CNN input format. First, perform the Permute operation to change the input dimension to The 3 is derived from the original byte embedding dimension, which represents the original number of channels of the input convolution, and 1 is the virtual height dimension (used to maintain 1D convolution).

[0099] One-dimensional convolution layer: Next, the data is subjected to two one-dimensional convolution operations to extract spatial local features. Assuming C1 and C2 are the number of output channels of the convolution kernel, k1 and k2 are the sizes of the convolution kernel, and s1 and s2 are the convolution steps, the results X1 and X2 after the two convolutions are expressed as:

[0100] X1=Conv1D(B′,C1,k1,s1)

[0101] X2=Conv1D(X1,C2,k2,s2)

[0102] Max Pooling Layer: The output after convolution is further extracted through the Max Pooling layer. The Max Pooling operation reduces the redundant information by reducing the size of the output feature map, thereby improving the computational efficiency of the model. The result F after pooling is expressed as:

[0103] X=MaxPool(X2)

[0104] This operation helps reduce the dimensionality of features while retaining the most salient features.

[0105] Feature flattening layer: The pooled features are converted into one-dimensional vectors through a flattening operation to generate packet-level feature representations:

[0106] P=Flatten(X)

[0107] This module uses a convolutional neural network to extract local spatial features from each packet. It then uses max pooling to effectively reduce the data dimension, and finally flattens it into a one-dimensional vector for stream feature fusion. The convolutional layer captures the spatial dependencies within the byte sequence. Combined with the pooling layer and flattening, it provides a compact, high-dimensional feature representation for the subsequent stream-level feature fusion module. This extraction method not only improves feature expressiveness but also maintains computational efficiency.

[0108] Stream-level processing:

[0109] Stream-level processing focuses on the temporal characteristics of the entire traffic flow and the dependencies between packets. At this stage, a multi-head self-attention mechanism is used to process the time series features in the data stream. By analyzing the temporal relationships between packets, the model can detect malicious manipulation of the timing by attackers, such as inserting forged packets to disrupt normal industrial control traffic.

[0110] A: Network model processing: The multi-head self-attention mechanism focuses on multiple temporal relationships in parallel, thereby analyzing important flow features in a shorter time. This stage is particularly suitable for advanced attacks with significant temporal features, such as fragment noise filling attacks.

[0111] B: Output results: The flow-level output is a prediction of the attack possibility of the entire flow, which is summarized based on the judgment results at the packet level to ultimately determine whether the entire flow is abnormal.

[0112] This module aims to enhance the model's detection capabilities for advanced industrial control network attacks by integrating the timing characteristics of data packets. Single-packet detection is often ineffective against advanced attacks where malicious payloads are dispersed or embedded within normal traffic. The timing characteristics of data flows are crucial for catching these attacks. Attackers can not only disperse malicious code to make the payload of each packet indistinguishable from a normal one, but they can also insert seemingly normal packets at critical points in the process flow, making it difficult for traditional methods to accurately identify attack behavior.

[0113] In order to effectively capture the temporal characteristics of these advanced attacks, this paper adopts a multi-head self-attention mechanism in the Flow-Level Feature Fusion Module. The input of this part is a set of data packet feature sequences extracted through packet-level features. Assume that a group has n consecutive data packets and the hidden layer dimension of each data packet is d.p , then input

[0114] The self-attention mechanism calculates relevance using the query, key, and value matrices. Unlike 4.4.1, each packet now has a separate query vector, which together form the query matrix Q. By calculating the relevance between packets, self-attention enables each packet to integrate contextual information and capture potential temporal patterns. This mechanism helps the model integrate stream features between packets, incorporating temporal features from the data stream into the features of each packet, effectively identifying complex attack behaviors.

[0115] The query, key, and value matrices are calculated as follows:

[0116] K=FW K ,Q=FW Q ,V=FW V

[0117] Where W K , W Q , W V is a learnable weight matrix.

[0118] Self-attention is calculated by calculating the weighted feature matrix Z between data packets, which is calculated as follows:

[0119]

[0120] Here d k It is the hidden layer dimension of the key vector, which is used for normalization to ensure that the inner product result is not too large.

[0121] Each Z represents an attention head. The multi-head attention mechanism further enhances the model's ability to cope with complex attack scenarios by computing multiple independent attention heads in parallel, each of which observes the temporal relationship between data packets from a different perspective. Each attention head can independently focus on different temporal levels and features, providing the model with more diverse information. Ultimately, the outputs of the multi-head attention are combined through a concatenation operation to form a new feature representation, which is then residually connected to the original input F. The calculation formula is as follows:

[0122] F′=MultiHead(F)+F=Concat(Z1,…,Z h )W O +F

[0123] in, Keep the shape consistent with the original input F, h is the number of attention heads, W O is a linearly changing weight matrix.

[0124] The result output module is specifically:

[0125] The goal of this module is to generate a feature matrix based on the flow-level feature fusion module. Count each packet And finally output the intrusion detection classification probability label of each data packet.

[0126] To classify the feature vectors of each data packet, a set of fully connected neural networks (FFNNs) is first used to perform further nonlinear mapping and feature extraction on the packet features. The FFNN module further enhances the model's expressiveness and helps it capture deeper feature relationships.

[0127] Fully connected network:

[0128] The feature vector P' of each data packet will pass through several fully connected layers in sequence. The output of the kth fully connected layer can be expressed as:

[0129] H k =σ(H k-1 W k +b k )

[0130] Among them, H k-1 is the output of the previous fully connected layer, is the weight matrix of the kth fully connected layer, b k is the bias term, and σ is the activation function. The first fully connected layer receives the input F' from the feature fusion, and the output dimension of the last fully connected layer will be the same as the number of categories of the classification task.

[0131] Softmax:

[0132] After being processed by several fully connected layers, the final output will pass through the Softmax activation function to map the feature vector of each data packet to a classification probability vector. The function of the Softmax function is to convert the output of the FFNN into a probability distribution. Its calculation formula is:

[0133]

[0134] where z j Represents the score of the i-th category, and C represents the number of categories. After Softmax, the output is given as a vector for the classification of each data packet P' Where C is the number of categories in the classification task.

[0135] Final classification results:

[0136] For each data packet, the classification result can be obtained by selecting the category with the highest classification probability as the final predicted label:

[0137]

[0138] in, is the predicted classification label.

[0139] In addition, in Section 4.4.1 is the interpretable weight of each byte of the packet.

[0140] Comprehensive processing and intrusion detection results:

[0141] Ultimately, through processing at the byte, packet, and flow levels, the model outputs its own attack judgment results, which are then integrated to form the final intrusion detection conclusion. In practical applications, this multi-level analysis can effectively improve detection accuracy and robustness, especially in complex attack scenarios.

[0142] Flow-level and packet-level fusion: Combines the temporal features of flow-level analysis with the spatial features of packet-level analysis to ensure a balance between efficiency and accuracy.

[0143] Complementarity between the byte level, packet level, and flow level: The byte level provides detailed explainability, the packet level enhances feature extraction, and the flow level provides overall timing perception. The combination of these three ensures that the intrusion detection model has stronger attack identification capabilities.

[0144] The data preprocessing is specifically as follows:

[0145] A: The data flow is divided through the five-tuple to ensure the independence of each connection flow.

[0146] B: Perform flow filtering and packet filtering to remove traffic not related to the ICS system and ensure that only relevant traffic is analyzed.

[0147] C: Data packet content cleaning, zero padding, and truncation operations are performed to unify the input format and adapt it to the requirements of deep learning models.

[0148] D: A sliding window mechanism is introduced to enhance the robustness of the model to changes in attack locations by dynamically adjusting the window size and step size.

[0149] The feature extraction is specifically as follows:

[0150] A: Byte-level features are processed through embedding and self-attention mechanisms;

[0151] B: Packet-level features are extracted using convolutional neural networks;

[0152] C: Stream-level features capture temporal features through a multi-head self-attention mechanism.

[0153] The above description of the present invention and its embodiments is non-limiting, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by the above, and does not deviate from the purpose of the invention, without creatively designing a structure and embodiment similar to the technical solution, they shall fall within the scope of protection of the present invention.

[0154] The specific contents of the data preprocessing part are:

[0155] Data preprocessing is a key step in converting raw network traffic into input suitable for deep learning models. To improve detection accuracy and efficiency, this paper designs a complete preprocessing process that includes six steps, from data flow diversion to final processing of data format:

[0156] In step one, data flows are divided based on the five-tuple information to uniquely identify each network connection. Communication traffic between different devices in an industrial control network (such as PLCs and HMIs) typically has unique characteristics. Therefore, five-tuple division can effectively distinguish these different network connections. This approach helps improve detection accuracy because it allows for more detailed analysis of traffic on each independent connection, especially during traffic anomaly detection, which can more effectively identify abnormal behavior patterns.

[0157] Step two involves performing flow filtering to retain traffic related to specific industrial control devices. Industrial control system network traffic typically follows specific communication patterns, such as instruction sets and communication cycles between specific devices and controllers. By filtering out traffic not relevant to ICS security, the dimensionality and complexity of the data can be significantly reduced, ensuring that the model focuses on the most relevant traffic. This step reduces false positives and improves detection efficiency.

[0158] Step three: Packet filtering. Certain types of packets (such as DNS, SYN, ACK, and FIN) are typically used to establish and maintain network connections, not for actual data transmission. Although some attacks can be hidden in these packets, in the attack scenario described here, filtering these packets helps model longer control flows and improves detection of critical communication flows. This strategy needs to be adjusted based on the actual attack scenario to ensure that important attack signatures are not filtered out.

[0159] Step 4 cleans the packet content, primarily by masking the IP address and port information and removing the Ethernet header. This eliminates metadata irrelevant to intrusion detection, retaining only the payload information. This allows the model to avoid over-reliance on specific network configuration information and instead focus on learning the actual content features of the packet, improving the model's generalization and enabling it to operate effectively in diverse network environments.

[0160] Step five involves truncation and zero padding to ensure consistent data input format. For overly long data packets, only the critical portion is retained; for undersized data packets, zero padding is used. Deep learning models have strict requirements for input data format, and a fixed data length is crucial for batch processing and memory management. A consistent input size not only ensures stability during model training but also avoids computational complexity issues caused by inconsistent input lengths.

[0161] Step six, a sliding window preprocessing scheme, progressively slides a window over the stream data and groups the processed packets into groups according to a window size N. Each time, N consecutive packets are selected from the stream as input samples, and the window is slid with a step size s to generate new input samples. This approach offers several advantages: First, since industrial control system (ICS) datasets are typically small, the sliding window technique significantly expands the number of training samples, thereby improving the model's generalization. Second, for single-packet attacks, attack packets can appear anywhere in the stream. Simple grouping methods may result in a fixed position within the window, making the detection results dependent on the specific location of the attack packet, which in turn affects the model's detection performance. The sliding window technique avoids this problem by allowing samples to be trained at different locations and contexts, improving robustness to changes in attack packet location. Finally, during real-time inference, the sliding window technique enables the system to rapidly slide through the traffic without waiting for the window to fill completely. The system only needs to wait for packets corresponding to the sliding distance to infer the classification results for the new packet in real time, significantly improving detection efficiency.

[0162] This preprocessing solution successfully converts raw network traffic into a format that can be processed by the deep learning model, ensuring that key signature information relevant to ICS security is preserved. This series of steps complements each other, significantly improving detection accuracy and efficiency while ensuring the model's applicability across a variety of complex industrial control network environments. In specific applications, packet filtering and flow filtering, in particular, may require adjustment and optimization based on actual attack scenarios to ensure optimal detection results.

[0163] After adopting the above method, this application proposal has the following advantages:

[0164] 1. Byte-level interpretability:

[0165] Compared with rule-matching-based methods, it can automatically analyze private protocols. Compared with other deep learning-based methods, it achieves byte interpretability in the field of industrial control intrusion detection, saving manpower analysis costs while achieving reliable intrusion detection.

[0166] 2. Detection accuracy:

[0167] Compared with deep packet inspection methods based on CNN / CNN-RNN, this method integrates flow-level features into each packet, allowing each packet to perceive the flow-level context. This effectively counters single-packet attacks such as fragmentation noise attacks, simulated atomic operations, and tampering with normal process operation sequences. This effectively improves the detection accuracy of these network attacks.

[0168] 3. Detection of particle size:

[0169] Compared with the RNN-based packet flow detection method, on the one hand, due to insufficient extraction of packet features, the accuracy of single-packet attacks is low. On the other hand, although the flow-level detection scheme can detect single-packet attacks caused by fragment noise attacks, simulated positive atomic operations, and tampering with normal process operation sequences, the flow-granularity detection cannot locate which specific data packets have abnormalities, which causes inconvenience for security personnel in subsequent analysis.

Claims

1. An interpretable fine-grained industrial control network intrusion detection method, characterized by: Including model structure part and data processing part; The model structure includes a byte-level interpretable module, a packet-level feature extraction module, a flow-level timing analysis module, and a result output module; The data processing part includes network models and data processing processes at the byte level, packet level, and flow level. The data processing process includes data preprocessing, feature extraction, and final intrusion detection decision-making; The byte level, packet level, and flow level all include network model processing and result output. Ultimately, through the three-level processing of byte level, packet level, and flow level, the network models at the byte level, packet level, and flow level will output their respective attack judgment results, and the final intrusion detection conclusion is obtained by fusing these results. The byte-level interpretable module includes the following: A: The byte sequence of the input data packet is converted into an embedding vector, including raw byte embedding, position embedding, and segment embedding, and the importance weight of each byte is calculated through the self-attention mechanism; B: Self-attention mechanism for shared query vectors: This mechanism calculates the contribution of each byte to the judgment of the entire data packet, improving the byte-level interpretability of the model; The packet-level feature extraction module includes the following contents: A: The byte features of the input data packet are processed through a convolutional neural network (CNN) to extract spatial features, capture the local dependencies between bytes, and then determine whether the packet is malicious; B: The packet-level feature extraction module extracts useful features from data packets through convolution operations, combines it with a pooling layer to reduce redundant information, and finally outputs packet-level intrusion detection results through a fully connected layer. The flow-level timing analysis module includes the following contents: A: During stream-level processing, the model uses a multi-head self-attention mechanism to analyze the temporal relationship between data packets and capture malicious disturbances in the stream. B: The flow-level timing analysis module predicts whether there is abnormal behavior in the entire data flow through the timing dependency of the traffic.

2. The interpretable fine-grained industrial control network intrusion detection method according to claim 1, characterized in that: The data preprocessing is specifically as follows: A: Divert data streams through quintuples; B: Perform flow and packet filtering to remove traffic not related to the ICS system; C: Data packet content cleaning, zero padding, and truncation operations are performed to unify the input format and adapt it to the requirements of deep learning models; D: A sliding window mechanism is introduced to enhance the robustness of the model to changes in attack locations by dynamically adjusting the window size and step size.

3. The interpretable fine-grained industrial control network intrusion detection method according to claim 1, characterized in that: The feature extraction is specifically as follows: A: Byte-level features are processed through embedding and self-attention mechanisms; B: Packet-level features are extracted using convolutional neural networks; C: Stream-level features capture temporal features through a multi-head self-attention mechanism.

4. The interpretable fine-grained industrial control network intrusion detection method according to claim 1, characterized in that: Flow-level and packet-level fusion: Combining the temporal features of flow-level analysis with the spatial features of packet-level analysis.

5. The interpretable fine-grained industrial control network intrusion detection method according to claim 1, characterized in that: Complementarity between byte level, packet level, and stream level: The byte level provides detailed explainability, the packet level enhances feature extraction, and the stream level provides overall timing perception.

Images