A water plant network security early warning method and system

Abstract

The application relates to the technical field of network security, and discloses a water production plant network security early warning method and system. The method comprises the following steps: collecting historical network data of a water production plant network; establishing a network behavior baseline of the water production plant network based on the historical network data; capturing protocol instruction sequences of the water production plant network in real time, performing abnormal index analysis on the protocol instruction sequences by using the network behavior baseline, and obtaining abnormal network indexes of the water production plant network; synchronously monitoring network traffic of the water production plant network, obtaining equipment flow data of the water production plant network, and generating a vulnerability threat value of the water production plant network based on the equipment flow data; performing weighted summation on the abnormal indexes and the vulnerability threat value, and obtaining a weighted comprehensive value of the water production plant network; generating an early warning level of the water production plant network according to the weighted comprehensive value and a preset weighted threshold value; and deploying a security protection strategy of the water production plant network according to the early warning level. The application can improve the efficiency of water production plant network security early warning.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security early warning method and system for water treatment plants. Background Technology

[0002] With the widespread application of information technology, water treatment plant networks face increasingly complex and diverse security threats. Traditional network security protection methods are often based on rule matching or post-event detection, which cannot detect potential security risks in a timely and accurate manner, resulting in a slow response to network attacks and making it difficult to ensure the stable operation of water treatment plant networks.

[0003] For example, some covert attacks may exploit unusual protocol command interactions to infiltrate networks without triggering conventional detection mechanisms. Simultaneously, abnormal fluctuations in network traffic may indicate security vulnerabilities, but current technologies struggle to accurately assess them. Furthermore, the lack of comprehensive analysis and quantitative evaluation of network behavior, coupled with the absence of unified standards for judging network security status, makes it difficult for network administrators to quickly and accurately understand the network's security level and take timely and effective protective measures. Therefore, improving the efficiency of network security early warning systems for water treatment plants and promptly identifying and responding to potential security threats has become an urgent problem to be solved. Summary of the Invention

[0004] This invention provides a method and system for network security early warning in water treatment plants, the main purpose of which is to solve the problem of low efficiency in network security early warning in water treatment plants.

[0005] To achieve the above objectives, the present invention provides a network security early warning method for water treatment plants, comprising:

[0006] Collect historical network data of the water treatment plant network, wherein the historical network data includes: user behavior data and program running status;

[0007] A network behavior baseline for the water treatment plant network is established based on the user behavior data and the program running status.

[0008] The protocol command sequence of the water treatment plant network is captured in real time, and the abnormal index of the protocol command sequence is analyzed using the network behavior baseline to obtain the abnormal network index of the water treatment plant network.

[0009] The network traffic of the water treatment plant network is monitored synchronously to obtain the device traffic data of the water treatment plant network, and a vulnerability threat value of the water treatment plant network is generated based on the device traffic data.

[0010] The weighted sum of the abnormal indicators and the vulnerability threat values ​​is used to obtain the weighted comprehensive value of the water treatment plant network.

[0011] The water treatment plant network is given an early warning level based on the weighted composite value and a preset weighted threshold. Security protection strategies are then deployed for the water treatment plant network based on the early warning level.

[0012] Optionally, the collection of historical network data of the water treatment plant network includes:

[0013] Obtain user behavior data from the water treatment plant network, wherein the user behavior data includes: user operation records in the water treatment plant network, login and logout times, and access resource paths;

[0014] Collect the program running status of the water treatment plant network, wherein the program running status includes: the runtime, CPU utilization, memory usage and error logs of each application in the water treatment plant network;

[0015] The user behavior data and the program running status are aligned by timestamps to generate the historical network dataset of the water treatment plant network.

[0016] Optionally, establishing the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status includes:

[0017] Based on the user behavior data, the access path characteristics of the water treatment plant network are extracted;

[0018] Extract the duration distribution characteristics of the water treatment plant network based on the program's running status;

[0019] The Weibull distribution parameters of the water treatment plant network are obtained by fitting the parameters of the duration distribution characteristics.

[0020] By integrating the access path characteristics and the Weibull distribution parameters, a network behavior baseline for the water treatment plant network is generated.

[0021] Optionally, the step of extracting access path features of the water treatment plant network based on the user behavior data includes:

[0022] A directed graph of the water treatment plant network is constructed based on the resource access paths in the user behavior data. , wherein the nodes in the directed graph Representing resources, the edges in the directed graph This indicates the jump relationship of the access path;

[0023] Calculate the degree centrality of each node in the directed graph, filter nodes with a degree centrality higher than a preset degree centrality threshold as popular resources, and extract the shortest path between nodes to form the critical path.

[0024] The access path characteristics of the water treatment plant network are generated based on the critical path and the popular resources.

[0025] Optionally, the step of extracting the time distribution characteristics of the water treatment plant network based on the program's running state includes:

[0026] Based on the runtime of each application in the water treatment plant network, a runtime histogram and a cumulative runtime distribution function of the water treatment plant network are generated, wherein the cumulative runtime distribution function is:

[0027] in, It is the cumulative distribution function of duration. It is the total number of times the application has been run. It is an index variable used by the application during runtime. The limit for measuring the duration of a single run. It is an indicator function. It is the first The runtime of a single application session;

[0028] The duration distribution characteristics of the water treatment plant network are generated based on the duration histogram and the duration cumulative distribution function.

[0029] Optionally, the step of using the network behavior baseline to perform anomaly index analysis on the protocol command sequence to obtain the abnormal network index of the water treatment plant network includes:

[0030] Calculate the probability distribution of each protocol instruction in the protocol instruction sequence;

[0031] The dispersion of the protocol instructions is quantified based on the probability distribution and a preset Shannon entropy algorithm, wherein the preset Shannon entropy algorithm is as follows: in, It is the dispersion of the protocol instructions. It is the number of protocol command types. It is the identifier of the protocol instruction in the protocol instruction sequence. The first one is determined based on the probability distribution. The probability of occurrence of protocol-like instructions;

[0032] The Shannon entropy is numerically compared with the historical entropy value in the network behavior baseline. Based on the comparison result, the entropy deviation of the Shannon entropy is determined, wherein the formula for calculating the entropy deviation is as follows: in, It is the entropy deviation of the Shannon entropy. It is the Shannon entropy, It is the historical entropy value in the aforementioned network behavior baseline;

[0033] The abnormal protocols of the water treatment plant network are obtained by filtering the protocol instruction sequence based on the entropy deviation.

[0034] Aggregate the entropy deviation of all the aforementioned abnormal protocols to generate the abnormal network index of the water treatment plant network.

[0035] Optionally, generating the vulnerability threat value of the water treatment plant network based on the device traffic data includes:

[0036] Based on the device traffic data, redundant devices in the water treatment plant network are identified, and threat coefficient attenuation factors are configured for the redundant devices.

[0037] The flow deviation of the water treatment plant network is generated based on the device flow data and a preset flow deviation algorithm, wherein the preset flow deviation algorithm is:

[0038] in, It is the flow deviation of the water treatment plant network. It refers to the inbound traffic in the device traffic data. It is the historical average of inbound traffic. It refers to the outbound traffic in the device traffic data. This is the historical average of outbound traffic. It is the peak flow rate in the device flow data. It is the historical average of the peak traffic volume. It is the historical standard deviation of inbound traffic. It is the historical standard deviation of outbound traffic;

[0039] The vulnerability threat value of the water treatment plant network is generated based on the flow deviation and threat coefficient attenuation factor.

[0040] Optionally, generating the early warning level of the water treatment plant network based on the weighted composite value and a preset weighted threshold includes:

[0041] The weighted composite value The result is compared with a preset weighted threshold, wherein the preset weighted threshold is... and ,and ;

[0042] when When, a Level 1 warning is triggered, when At that time, a level-two warning was triggered.

[0043] Optionally, the deployment of security protection strategies for the water treatment plant network based on the early warning level includes:

[0044] The security protection strategy of the water treatment plant network is adjusted according to the warning level. The security protection strategy is as follows: when a Level 1 warning is triggered, abnormal devices in the water treatment plant network are isolated and traffic scrubbing is enabled. When a Level 2 warning is triggered, access to non-critical resources in the water treatment plant network is restricted and log monitoring is enhanced.

[0045] The warning level and the security protection strategy are dynamically updated to the security control center of the water treatment plant network.

[0046] To address the aforementioned problems, the present invention also provides a network security early warning system for water treatment plants, the system comprising:

[0047] The data acquisition module is used to collect historical network data of the water treatment plant network, wherein the historical network data includes: user behavior data and program running status;

[0048] The baseline establishment module is used to establish the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status.

[0049] An anomaly index analysis module is used to capture the protocol instruction sequence of the water treatment plant network in real time, and to perform anomaly index analysis on the protocol instruction sequence using the network behavior baseline to obtain the anomaly network index of the water treatment plant network.

[0050] The vulnerability threat value generation module is used to synchronously monitor the network traffic of the water treatment plant network, obtain the device traffic data of the water treatment plant network, and generate the vulnerability threat value of the water treatment plant network based on the device traffic data.

[0051] The weighted summation module is used to perform a weighted summation of the abnormal indicators and the vulnerability threat values ​​to obtain the weighted summation value of the water treatment plant network.

[0052] The strategy deployment module is used to generate an early warning level for the water treatment plant network based on the weighted comprehensive value and a preset weighted threshold, and to deploy security protection strategies for the water treatment plant network based on the early warning level.

[0053] This invention establishes a network behavior baseline by collecting historical network data from the water treatment plant network, captures protocol command sequences in real time, analyzes abnormal indicators in conjunction with the baseline, and simultaneously monitors network traffic to generate vulnerability threat values. It provides comprehensive and detailed monitoring of the network status from multiple dimensions, enabling precise identification of potential security risks. A weighted composite value is obtained by weighting and summing abnormal indicators and vulnerability threat values, providing a unified quantitative standard for network security status. Different warning levels are generated based on the weighted composite value and preset thresholds, and corresponding security protection strategies are formulated for each level of warning. This tiered warning and targeted protection mechanism avoids the limitations of a single warning method. It can quickly take strong measures to ensure network security and stability when the network faces serious threats, and can also mitigate risks in a gentle way when minor network anomalies occur, reducing the impact on normal network operation. This greatly improves the efficiency of network security warnings for water treatment plants, effectively reduces network security risks, and truly ensures the stable and reliable operation of the water treatment plant network. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating a network security early warning method for water treatment plants according to an embodiment of the present invention.

[0055] Figure 2 A functional block diagram of a water treatment plant network security early warning system provided in an embodiment of the present invention;

[0056] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0057] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0058] This application provides a method for network security early warning of a water treatment plant. The executing entity of the method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the method can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cluster of cloud servers. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0059] Reference Figure 1The diagram shown is a flowchart illustrating a network security early warning method for water treatment plants according to an embodiment of the present invention. In this embodiment, the network security early warning method for water treatment plants includes:

[0060] S1. Collect historical network data of the water treatment plant network.

[0061] In this embodiment of the invention, the collection of historical network data of the water treatment plant network includes:

[0062] Obtain user behavior data from the water treatment plant network, wherein the user behavior data includes: user operation records in the water treatment plant network, login and logout times, and access resource paths;

[0063] Collect the program running status of the water treatment plant network, wherein the program running status includes: the runtime, CPU utilization, memory usage and error logs of each application in the water treatment plant network;

[0064] The user behavior data and the program running status are aligned by timestamps to generate the historical network dataset of the water treatment plant network.

[0065] In detail, user behavior data records user operations (such as login, file access), timestamps, and access paths (such as accessing the water quality monitoring server from the console); program running status monitoring records program running parameters (such as reverse osmosis control software runtime and CPU utilization) and error logs (such as water pump control program crashes).

[0066] Furthermore, user operation and program execution data are integrated by timestamp (for example, when a user accesses the server at 10:00, the CPU usage of the reverse penetration software during that time period is also recorded).

[0067] In detail, user A logged into the system at 8:00 and accessed the system via the path "Console → Water Quality Monitoring Server → Water Pump Control Interface"; the reverse osmosis program ran from 8:00 to 8:30, with a peak CPU usage of 85% and memory usage of 1.2GB, during which no error logs were recorded.

[0068] In detail, after data alignment, a record is generated: {Time: 8:00, User action: Login, Program: Reverse osmosis control, CPU: 85%, Memory: 1.2GB}.

[0069] In detail, user behavior data is obtained, which reflects the user's operation trajectory and time information in the water treatment plant network, such as when the user logged in, what operations were performed, and which resource paths were accessed. This is a record of network activities from the user's perspective.

[0070] In detail, program runtime status data is collected. This data records the running parameters and error conditions of each application in the water treatment plant network at the system level, such as runtime, CPU utilization, memory usage, and error logs, which helps to understand the running status of programs in the network.

[0071] Furthermore, by aligning timestamps, user actions can be correlated with the program's running state at the same moment, forming a complete historical network dataset with time-series relationships.

[0072] S2. Establish the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status.

[0073] In this embodiment of the invention, establishing the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status includes:

[0074] Based on the user behavior data, the access path characteristics of the water treatment plant network are extracted;

[0075] Extract the duration distribution characteristics of the water treatment plant network based on the program's running status;

[0076] The Weibull distribution parameters of the water treatment plant network are obtained by fitting the parameters of the duration distribution characteristics.

[0077] By integrating the access path characteristics and the Weibull distribution parameters, a network behavior baseline for the water treatment plant network is generated.

[0078] In detail, a directed graph is constructed to represent the relationship between resources and access paths. Based on this, the degree centrality of nodes is calculated to identify popular resources, and the shortest paths between nodes are extracted to form critical paths, ultimately yielding access path features. This step starts from the user's operational perspective, mining features at the network resource access level.

[0079] In detail, the program runtime data covers the runtime of each application, CPU utilization, memory usage, and error logs. Runtime is a crucial metric; by generating duration histograms and cumulative duration distribution functions, the distribution of program runtime can be visually displayed. Based on these charts and functions, duration distribution characteristics can be extracted, reflecting the overall pattern of program runtime. This step involves mining network features from the time dimension of program execution.

[0080] In detail, after obtaining the duration distribution characteristics, a parameter fitting method is used to fit the program runtime distribution pattern more accurately, employing the Weibull distribution. The Weibull distribution is a commonly used probability distribution, and fitting it yields the corresponding distribution parameters, which can further quantify the distribution characteristics of the program runtime.

[0081] In detail, access path characteristics obtained from the perspective of user behavior and Weibull distribution parameters obtained from the perspective of program execution time are fused. This is because a complete network behavior baseline needs to comprehensively consider the characteristics of both user operations and program execution. The network behavior baseline generated after fusion can comprehensively and accurately represent the normal behavior pattern of the water treatment plant network.

[0082] Specifically, the extraction of access path features of the water treatment plant network based on the user behavior data includes:

[0083] A directed graph of the water treatment plant network is constructed based on the resource access paths in the user behavior data. , wherein the nodes in the directed graph Representing resources, the edges in the directed graph This indicates the jump relationship of the access path;

[0084] Calculate the degree centrality of each node in the directed graph, filter nodes with a degree centrality higher than a preset degree centrality threshold as popular resources, and extract the shortest path between nodes to form the critical path.

[0085] The access path characteristics of the water treatment plant network are generated based on the critical path and the popular resources.

[0086] In detail, a directed graph is constructed, and the degree centrality of nodes is calculated. For example, the water quality monitoring server is accessed 100 times, so its degree centrality is the highest.

[0087] Furthermore, Weibull distribution fitting refers to fitting parameters using the distribution of historical runtime, for example, a shape parameter of 1.5 and a scale parameter of 25.

[0088] In detail, in the directed graph, the degree centrality of the "Water Quality Monitoring Server" node is 0.8, where the preset degree centrality threshold is 0.5. Therefore, the "Water Quality Monitoring Server" is marked as a popular resource; the critical path is "Control Panel → Water Quality Monitoring Server → Water Pump Control Interface".

[0089] Specifically, when the scaling parameter of the Weibull distribution is 25, it means that the program runtime is concentrated around 25 minutes.

[0090] In detail, the access resource paths in the user behavior data record the process by which a user accesses resources from one resource to another within the water treatment plant network.

[0091] In detail, after constructing the directed graph, the degree centrality of each node is calculated. Degree centrality is an indicator of a node's importance in the graph, reflecting the strength of its connections with other nodes. By setting a preset degree centrality threshold, nodes with degree centrality higher than this threshold are selected as popular resources. These popular resources are typically critical resources that are frequently accessed in the network. Simultaneously, the shortest paths between nodes are extracted; these shortest paths represent the most direct and frequently used access paths between resources, forming the critical paths.

[0092] In detail, critical paths and popular resources reflect the main patterns and important nodes of resource access in the water treatment plant network. Combining these characteristics generates the access path features of the water treatment plant network. These features can summarize the patterns and characteristics of resource access in the network, providing an important basis for subsequent network behavior analysis and security early warning.

[0093] Specifically, the extraction of the time distribution characteristics of the water treatment plant network based on the program's running state includes:

[0094] Based on the runtime of each application in the water treatment plant network, a runtime histogram and a cumulative runtime distribution function of the water treatment plant network are generated, wherein the cumulative runtime distribution function is:

[0095] in, It is the cumulative distribution function of duration. It is the total number of times the application has been run. It is an index variable used by the application during runtime. The limit for measuring the duration of a single run. It is an indicator function. It is the first The runtime of a single application session;

[0096] The duration distribution characteristics of the water treatment plant network are generated based on the duration histogram and the duration cumulative distribution function.

[0097] In detail, the cumulative distribution of program runtime is statistically analyzed, for example: 90% of reverse osmosis programs have a runtime of ≤30 minutes.

[0098] In detail, the duration histogram graphically and intuitively displays the distribution of application runtime. It divides runtime into different intervals and counts the frequency of runtime occurrence in each interval, allowing you to quickly understand the concentration of runtime in each interval.

[0099] In detail, the cumulative runtime distribution function describes the distribution of runtime from another perspective. It indicates that the application runtime is less than or equal to... The probability, as The change in this value yields the cumulative probability at different time limits. By calculating this function, we can more accurately grasp the overall distribution characteristics of the application's runtime.

[0100] For example, the histogram can reveal the main concentrated intervals of runtime and whether there are abnormal long-tailed distributions; the cumulative distribution function can reveal the probability of different runtime limits.

[0101] Furthermore, some malware or attacks may cause application runtime to increase or decrease abnormally. For example, hackers may implant malicious code to trap an application in an infinite loop, resulting in a significant increase in runtime; or malicious programs may rapidly exhaust system resources, causing the application to terminate prematurely. Duration distribution characteristics can help detect these potential anomalies in a timely manner, providing important clues for cybersecurity early warning.

[0102] Furthermore, when network anomalies occur, the duration distribution characteristics can serve as an important reference for fault diagnosis and problem localization. By comparing the runtime distribution characteristics during anomalies with those during normal runtimes, the scope of investigation can be narrowed down, and potentially problematic applications or system components can be quickly identified. For example, if the runtime of multiple related applications is abnormal within a specific time period, it may indicate a widespread problem in the network environment or system during that period.

[0103] S3. Capture the protocol instruction sequence of the water treatment plant network in real time, and use the network behavior baseline to perform anomaly index analysis on the protocol instruction sequence to obtain the abnormal network index of the water treatment plant network.

[0104] In this embodiment of the invention, after capturing the protocol instruction sequence of the water treatment plant network in real time, it is necessary to perform statistical analysis on the frequency of each protocol instruction. The probability distribution of each type of protocol instruction in the sequence is calculated one by one, which forms the basis for subsequent quantitative analysis. By counting the number of occurrences of different protocol instructions and dividing by the total number of protocol instructions, the probability of occurrence of each protocol instruction is obtained, clearly showing the distribution of protocol instructions in the sequence.

[0105] In this embodiment of the invention, the step of using the network behavior baseline to perform anomaly index analysis on the protocol command sequence to obtain the abnormal network index of the water treatment plant network includes:

[0106] Calculate the probability distribution of each protocol instruction in the protocol instruction sequence;

[0107] The dispersion of the protocol instructions is quantified based on the probability distribution and a preset Shannon entropy algorithm, wherein the preset Shannon entropy algorithm is as follows: in, It is the dispersion of the protocol instructions. It is the number of protocol command types. It is the identifier of the protocol instruction in the protocol instruction sequence. The first one is determined based on the probability distribution. The probability of occurrence of protocol-like instructions;

[0108] The Shannon entropy is numerically compared with the historical entropy value in the network behavior baseline. Based on the comparison result, the entropy deviation of the Shannon entropy is determined, wherein the formula for calculating the entropy deviation is as follows: in, It is the entropy deviation of the Shannon entropy. It is the Shannon entropy, It is the historical entropy value in the aforementioned network behavior baseline;

[0109] The abnormal protocols of the water treatment plant network are obtained by filtering the protocol instruction sequence based on the entropy deviation.

[0110] Aggregate the entropy deviation of all the aforementioned abnormal protocols to generate the abnormal network index of the water treatment plant network.

[0111] For example, the "read water quality data" command accounts for 90% of the Modbus protocol.

[0112] In detail, historical entropy values ​​represent the dispersion characteristics of protocol instructions in the water treatment plant network under normal operating conditions; entropy deviation reflects the degree of deviation of the current protocol instruction dispersion from the normal situation.

[0113] In detail, in network communication, protocol commands are the foundation for interaction between devices. Under normal circumstances, the occurrence of various protocol commands will exhibit certain patterns and distributions. The more types of protocol commands there are and the more evenly they appear, the larger the Shannon entropy value, meaning that the protocol commands are more dispersed; conversely, if the Shannon entropy value is small, it indicates that the distribution of protocol commands is relatively concentrated, which may indicate anomalies.

[0114] In detail, covert attacks often utilize unusual protocol command interactions to achieve their intrusion goals, without intending to be easily detected. By calculating Shannon entropy to quantify the dispersion of protocol commands, such abnormal changes can be accurately detected. Once the Shannon entropy value of a protocol command deviates from the normal range, it indicates the potential presence of a covert attack, thereby enhancing the ability to identify covert attacks and issuing early network security warnings.

[0115] In detail, the attack scenario involves covert scanning that leads to a concentration of protocol commands (e.g., 80% of which are port probe commands).

[0116] Specifically, if the entropy deviation of a protocol command exceeds a certain threshold, it indicates that the occurrence of that protocol command differs significantly from the normal state, and it is judged as an abnormal protocol. In this way, abnormal protocols that may pose security risks can be accurately identified from a large number of protocol commands.

[0117] S4. Synchronously monitor the network traffic of the water treatment plant network to obtain the device traffic data of the water treatment plant network, and generate the vulnerability threat value of the water treatment plant network based on the device traffic data.

[0118] In this embodiment of the invention, the step of synchronously monitoring the network traffic of the water treatment plant network to obtain the equipment traffic data of the water treatment plant network includes:

[0119] The equipment flow data of the water treatment plant network is collected synchronously. The equipment flow data includes the time sequence records of the inbound flow, outbound flow and flow peak of each network device in the water treatment plant network.

[0120] In this embodiment of the invention, generating the vulnerability threat value of the water treatment plant network based on the device traffic data includes:

[0121] Based on the device traffic data, redundant devices in the water treatment plant network are identified, and threat coefficient attenuation factors are configured for the redundant devices.

[0122] The flow deviation of the water treatment plant network is generated based on the device flow data and a preset flow deviation algorithm, wherein the preset flow deviation algorithm is:

[0123] in, It is the flow deviation of the water treatment plant network. It refers to the inbound traffic in the device traffic data. It is the historical average of inbound traffic. It refers to the outbound traffic in the device traffic data. This is the historical average of outbound traffic. It is the peak flow rate in the device flow data. It is the historical average of the peak traffic volume. It is the historical standard deviation of inbound traffic. It is the historical standard deviation of outbound traffic;

[0124] The vulnerability threat value of the water treatment plant network is generated based on the flow deviation and threat coefficient attenuation factor.

[0125] In this embodiment of the invention, redundant devices in the water treatment plant network are identified based on the device traffic data when the device activity is less than 20% of the average value. For example, the daily traffic of a backup server is less than 1GB.

[0126] Furthermore, after acquiring the equipment traffic data of the water treatment plant network, the equipment in the network is first analyzed. By evaluating the activity level of the equipment, such as inbound and outbound traffic data, when the equipment activity level is less than a certain percentage (e.g., 20%) of the average, the equipment is identified as redundant. Since redundant equipment may not be core operating equipment in the network, even if it experiences abnormal traffic, the actual threat it poses to the entire network is relatively small. Therefore, a threat attenuation factor is configured for these redundant devices. This factor is used to subsequently adjust the impact of these devices on the overall vulnerability threat value.

[0127] In detail, by identifying redundant devices and configuring attenuation factors, over-assessment of network security threats caused by traffic fluctuations of redundant devices is avoided. Simultaneously, the traffic deviation algorithm comprehensively considers comparisons between various traffic indicators and historical data, enabling a more accurate measurement of the degree of network traffic anomalies. The vulnerability threat value generated by combining these two factors accurately reflects the actual security threats currently faced by the water treatment plant network due to traffic issues, providing a more reliable basis for network security early warning.

[0128] Furthermore, the standardized offset of real-time traffic from historical averages, for example: when only inbound traffic surges... The deviation is When the threat coefficient decay factor is At that time, the vulnerability threat value was .

[0129] For example: real-time inbound traffic (historical average) Standard deviation ), deviation Peak flow (historical average) ), contribution value Assume the threat coefficient attenuation factor is The deviation of the outbound flow is Then the total deviation After the redundant equipment decays .

[0130] S5. The abnormal indicators and the vulnerability threat values ​​are weighted and summed to obtain the weighted comprehensive value of the water treatment plant network.

[0131] In this embodiment of the invention, it is assumed that the anomaly index has a maximum value. Maximum vulnerability threat value The abnormal indicator is The vulnerability threat value is The weight of the abnormal indicator is The weight of the vulnerability threat value is The weighted average value of the water treatment plant network is then... .

[0132] In detail, the weighted composite value provides a unified quantitative standard for the security status of water treatment plant networks. Network administrators can intuitively understand the network's security level based on this value, avoiding the hassle of complex comparisons and judgments between multiple different indicators. At the same time, this unified standard also facilitates the comparison and analysis of security status between different water treatment plant networks at different time periods, helping to identify trends in network security status.

[0133] S6. Generate an early warning level for the water treatment plant network based on the weighted composite value and a preset weighted threshold, and deploy security protection strategies for the water treatment plant network based on the early warning level.

[0134] In this embodiment of the invention, generating the early warning level of the water treatment plant network based on the weighted composite value and a preset weighted threshold includes:

[0135] The weighted composite value The result is compared with a preset weighted threshold, wherein the preset weighted threshold is... and ,and ;

[0136] when When, a Level 1 warning is triggered, when At that time, a level-two warning was triggered.

[0137] In this embodiment of the invention, the deployment of security protection strategies for the water treatment plant network based on the early warning level includes:

[0138] The security protection strategy of the water treatment plant network is adjusted according to the warning level. The security protection strategy is as follows: when a Level 1 warning is triggered, abnormal devices in the water treatment plant network are isolated and traffic scrubbing is enabled. When a Level 2 warning is triggered, access to non-critical resources in the water treatment plant network is restricted and log monitoring is enhanced.

[0139] The warning level and the security protection strategy are dynamically updated to the security control center of the water treatment plant network.

[0140] Furthermore, assuming , ,like If this occurs, a Level 2 alert will be triggered. The security protection strategy for the Level 2 alert is to restrict access to non-critical resources and increase the frequency of log monitoring. For example, restricting access to non-critical resources means prohibiting access to the backup server, and increasing the frequency of log monitoring means scanning every 5 minutes.

[0141] In detail, the security protection strategy for Level 1 alerts involves isolating abnormal devices and enabling traffic scrubbing. For example, isolating abnormal devices can involve blocking the attack source IP, while enabling traffic scrubbing can involve filtering abnormal protocol traffic. This means isolating the PLC controller with abnormal traffic and activating the cloud scrubbing center to filter malicious traffic. Isolating abnormal devices can prevent abnormal behavior from spreading further and avoid causing greater impact on other devices and the entire network; enabling traffic scrubbing can filter out malicious traffic and ensure the normal operation of the network.

[0142] In detail, when a Level 2 alert is triggered, the security threat is relatively small, but it still requires attention. Therefore, measures such as restricting access to non-critical resources and enhancing log monitoring are taken. Restricting access to non-critical resources can reduce the potential attack surface and lower security risks; enhancing log monitoring helps to detect abnormal behavior in a timely manner, providing more information for subsequent security analysis and handling.

[0143] In detail, the warning levels and corresponding security protection strategies are dynamically updated to the water treatment plant network's security control center. The security control center is the core hub of network security management; timely updates to this information ensure that network administrators have a comprehensive understanding of the network's security status and can make effective management and decisions based on the latest warnings and strategies.

[0144] In summary, by setting different weighted thresholds and classifying warning levels, tiered warnings can be issued based on the varying degrees of cybersecurity risks. This tiered approach makes warnings more targeted, avoiding the problems of overreaction or underreaction that may result from using a single warning mechanism. For example, when the network exhibits only minor anomalies, a level-two warning is triggered, allowing for relatively mild protective measures that mitigate security risks without excessively disrupting normal network operations. Conversely, when the network faces a serious threat, a level-one warning is triggered, enabling timely and robust protective measures to ensure network security and stability.

[0145] like Figure 2 The diagram shown is a functional block diagram of a water treatment plant network security early warning system provided in an embodiment of the present invention.

[0146] The water treatment plant network security early warning system 100 of this invention can be installed in an electronic device. Depending on the functions implemented, the water treatment plant network security early warning system 100 may include a data acquisition module 101, a baseline establishment module 102, an anomaly indicator analysis module 103, a vulnerability threat value generation module 104, a weighted synthesis module 105, and a strategy deployment module 106. The module described in this invention can also be called a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and which are stored in the memory of the electronic device.

[0147] In this embodiment, the functions of each module / unit are as follows:

[0148] The data acquisition module 101 is used to collect historical network data of the water treatment plant network, wherein the historical network data includes: user behavior data and program running status;

[0149] The baseline establishment module 102 is used to establish a network behavior baseline for the water treatment plant network based on the user behavior data and the program running status.

[0150] The anomaly index analysis module 103 is used to capture the protocol instruction sequence of the water treatment plant network in real time, and to perform anomaly index analysis on the protocol instruction sequence using the network behavior baseline to obtain the anomaly network index of the water treatment plant network.

[0151] The vulnerability threat value generation module 104 is used to synchronously monitor the network traffic of the water treatment plant network, obtain the device traffic data of the water treatment plant network, and generate the vulnerability threat value of the water treatment plant network based on the device traffic data.

[0152] The weighted summation module 105 is used to perform a weighted summation of the abnormal indicators and the vulnerability threat values ​​to obtain the weighted summation value of the water treatment plant network.

[0153] The strategy deployment module 106 is used to generate an early warning level for the water treatment plant network based on the weighted comprehensive value and a preset weighted threshold, and to deploy a security protection strategy for the water treatment plant network based on the early warning level.

[0154] In the several embodiments provided by this invention, it should be understood that the disclosed methods and systems can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and other division methods may be used in actual implementation.

[0155] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0156] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional modules.

[0157] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0158] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0159] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A network security early warning method for water treatment plants, characterized in that, The method includes: Collect historical network data of the water treatment plant network, wherein the historical network data includes: user behavior data and program running status; A network behavior baseline for the water treatment plant network is established based on the user behavior data and the program running status. The protocol command sequence of the water treatment plant network is captured in real time. Anomaly index analysis is performed on the protocol command sequence using the network behavior baseline to obtain anomaly network indices for the water treatment plant network, including: Calculate the probability distribution of each protocol instruction in the protocol instruction sequence; The dispersion of the protocol instructions is quantified based on the probability distribution and a preset Shannon entropy algorithm, wherein the preset Shannon entropy algorithm is as follows: in, It is the dispersion of the protocol instructions. It is the number of protocol command types. It is the identifier of the protocol instruction in the protocol instruction sequence. The first one is determined based on the probability distribution. The probability of occurrence of protocol-like instructions; The Shannon entropy is numerically compared with the historical entropy value in the network behavior baseline. Based on the comparison result, the entropy deviation of the Shannon entropy is determined, wherein the formula for calculating the entropy deviation is as follows: in, It is the entropy deviation of the Shannon entropy. It is the Shannon entropy, It is the historical entropy value in the aforementioned network behavior baseline; The abnormal protocols of the water treatment plant network are obtained by filtering the protocol instruction sequence based on the entropy deviation. Aggregate the entropy deviation of all the aforementioned abnormal protocols to generate the abnormal network index of the water treatment plant network; The network traffic of the water treatment plant network is monitored synchronously to obtain the device traffic data of the water treatment plant network, and a vulnerability threat value of the water treatment plant network is generated based on the device traffic data. The weighted sum of the abnormal indicators and the vulnerability threat values ​​is used to obtain the weighted comprehensive value of the water treatment plant network. The water treatment plant network is given an early warning level based on the weighted composite value and a preset weighted threshold. Security protection strategies are then deployed for the water treatment plant network based on the early warning level.

2. The water treatment plant network security early warning method as described in claim 1, characterized in that, The collection of historical network data from the water treatment plant network includes: Obtain user behavior data from the water treatment plant network, wherein the user behavior data includes: user operation records in the water treatment plant network, login and logout times, and access resource paths; Collect the program running status of the water treatment plant network, wherein the program running status includes: the runtime, CPU utilization, memory usage and error logs of each application in the water treatment plant network; The user behavior data and the program running status are aligned by timestamps to generate the historical network dataset of the water treatment plant network.

3. The water treatment plant network security early warning method as described in claim 1, characterized in that, The establishment of the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status includes: Based on the user behavior data, the access path characteristics of the water treatment plant network are extracted; Extract the duration distribution characteristics of the water treatment plant network based on the program's running status; The Weibull distribution parameters of the water treatment plant network are obtained by fitting the parameters of the duration distribution characteristics. By integrating the access path characteristics and the Weibull distribution parameters, a network behavior baseline for the water treatment plant network is generated.

4. The water treatment plant network security early warning method as described in claim 3, characterized in that, The step of extracting access path features of the water treatment plant network based on the user behavior data includes: A directed graph of the water treatment plant network is constructed based on the resource access paths in the user behavior data. , wherein the nodes in the directed graph Representing resources, the edges in the directed graph This indicates the jump relationship of the access path; Calculate the degree centrality of each node in the directed graph, filter nodes with a degree centrality higher than a preset degree centrality threshold as popular resources, and extract the shortest path between nodes to form the critical path. The access path characteristics of the water treatment plant network are generated based on the critical path and the popular resources.

5. The water treatment plant network security early warning method as described in claim 3, characterized in that, The extraction of the time distribution characteristics of the water treatment plant network based on the program's running status includes: Based on the runtime of each application in the water treatment plant network, a runtime histogram and a cumulative runtime distribution function of the water treatment plant network are generated, wherein the cumulative runtime distribution function is: in, It is the cumulative distribution function of duration. It is the total number of times the application has been run. It is an index variable used by the application during runtime. The limit for measuring the duration of a single run. It is an indicator function. It is the first The runtime of a single application session; The duration distribution characteristics of the water treatment plant network are generated based on the duration histogram and the duration cumulative distribution function.

6. The water treatment plant network security early warning method as described in claim 1, characterized in that, The generation of vulnerability threat values ​​for the water treatment plant network based on the device traffic data includes: Based on the device traffic data, redundant devices in the water treatment plant network are identified, and threat coefficient attenuation factors are configured for the redundant devices. The flow deviation of the water treatment plant network is generated based on the device flow data and a preset flow deviation algorithm, wherein the preset flow deviation algorithm is: in, It is the flow deviation of the water treatment plant network. It refers to the inbound traffic in the device traffic data. It is the historical average of inbound traffic. It refers to the outbound traffic in the device traffic data. This is the historical average of outbound traffic. It is the peak flow rate in the device flow data. It is the historical average of the peak traffic volume. It is the historical standard deviation of inbound traffic. It is the historical standard deviation of outbound traffic; The vulnerability threat value of the water treatment plant network is generated based on the flow deviation and threat coefficient attenuation factor.

7. The water treatment plant network security early warning method as described in claim 1, characterized in that, The step of generating the early warning level of the water treatment plant network based on the weighted composite value and a preset weighted threshold includes: The weighted composite value The result is compared with a preset weighted threshold, wherein the preset weighted threshold is... and ,and ; when When, a Level 1 warning is triggered, when At that time, a level-two warning was triggered.

8. The water treatment plant network security early warning method according to any one of claims 1 to 7, characterized in that, The deployment of security protection strategies for the water treatment plant network based on the warning level includes: The security protection strategy of the water treatment plant network is adjusted according to the warning level. The security protection strategy is as follows: when a level 1 warning is triggered, abnormal devices in the water treatment plant network are isolated and traffic scrubbing is enabled; when a level 2 warning is triggered, access to non-critical resources in the water treatment plant network is restricted and log monitoring is enhanced. The warning level and the security protection strategy are dynamically updated to the security control center of the water treatment plant network.

9. A network security early warning system for a water treatment plant, characterized in that, The system includes: The data acquisition module is used to collect historical network data of the water treatment plant network, wherein the historical network data includes: user behavior data and program running status; The baseline establishment module is used to establish the network behavior baseline of the water treatment plant network based on the user behavior data and the program running status. An anomaly analysis module is used to capture the protocol command sequence of the water treatment plant network in real time, and to perform anomaly analysis on the protocol command sequence using the network behavior baseline to obtain an anomaly network index of the water treatment plant network, including: Calculate the probability distribution of each protocol instruction in the protocol instruction sequence; The dispersion of the protocol instructions is quantified based on the probability distribution and a preset Shannon entropy algorithm, wherein the preset Shannon entropy algorithm is as follows: in, It is the dispersion of the protocol instructions. It is the number of protocol command types. It is the identifier of the protocol instruction in the protocol instruction sequence. The first one is determined based on the probability distribution. The probability of occurrence of protocol-like instructions; The Shannon entropy is numerically compared with the historical entropy value in the network behavior baseline. Based on the comparison result, the entropy deviation of the Shannon entropy is determined, wherein the formula for calculating the entropy deviation is as follows: in, It is the entropy deviation of the Shannon entropy. It is the Shannon entropy, It is the historical entropy value in the aforementioned network behavior baseline; The abnormal protocols of the water treatment plant network are obtained by filtering the protocol instruction sequence based on the entropy deviation. Aggregate the entropy deviation of all the aforementioned abnormal protocols to generate the abnormal network index of the water treatment plant network; The vulnerability threat value generation module is used to synchronously monitor the network traffic of the water treatment plant network, obtain the device traffic data of the water treatment plant network, and generate the vulnerability threat value of the water treatment plant network based on the device traffic data. The weighted summation module is used to perform a weighted summation of the abnormal indicators and the vulnerability threat values ​​to obtain the weighted summation value of the water treatment plant network. The strategy deployment module is used to generate an early warning level for the water treatment plant network based on the weighted comprehensive value and a preset weighted threshold, and to deploy security protection strategies for the water treatment plant network based on the early warning level.

Images