Dynamic inhibition method for industrial network viruses based on SCADA (Supervisory Control And Data Acquisition)

Abstract

The invention relates to an SCADA (supervisory control and data acquisition)-based industrial network virus dynamic inhibition method, which belongs to an industrial internet security technical method and is used for constructing a virus propagation model (SIIQR) and designing an undisturbed isolation strategy so as to predict and control virus propagation behaviors in an industrial control network. The industrial control network is an isomorphic network, equipment in the network has functions of software upgrading, patching and the like, and a time window mechanism is adopted. The host is switched among seven states including a susceptible state, an enhanced susceptible state, an infection state, an isolation time delay state, an isolation state, an immune state and an immune failure time delay state. The number of hosts at the moment t is N, N = S (t) + M (t) + I (t) + D1 (t) + Q (t) + R (t) + D2 (t), and N is a unique positive equilibrium point of the model. According to the model, enhancement of defense capability of dangerous information transmission among nodes on part of nodes is considered, so that the overall antiviral capability of the system is enhanced, and a double-time-delay mechanism and a nonlinear infection rate condition which are more in line with an industrial environment are combined.

Description

Technical Field

[0001] The present invention relates to an industrial Internet security technology method, and specifically to a dynamic suppression method for SCADA industrial network viruses. Background Art

[0002] In recent years, great changes have taken place in the field of cyberspace security, and industrial control systems have become one of the new main battlefields in cyberspace security. Supervisory Control and Data Acquisition (SCADA) systems are widely used in the monitoring of critical infrastructures such as power, chemical industry, water treatment, oil and gas, etc., to ensure the operation efficiency and safety of these systems, and these systems are all closely related to the development of the country.

[0003] Driven by the industrial Internet, the connectivity and complexity of SCADA systems are increasing day by day, making them face greater risks of cyber attacks. Malicious viruses often penetrate into the physical layer RTU nodes through network interfaces. As an important part of SCADA, RTU (Remote Terminal Unit) is frequently attacked, resulting in system failures, data leaks or complete system crashes.

[0004] Existing models ignore the enhancement effect of dangerous information transmission between nodes on the defense ability, do not fully consider the non-linear infection rate (traditional models mostly adopt linear assumptions and cannot reflect the characteristics of the infection rate changing dynamically with the spread of viruses in actual industrial networks), and do not simultaneously model the dual lag effects of isolation delay (τ1) and patch failure delay (τ2) in industrial scenarios, resulting in the deviation of stability analysis from reality.

[0005] Therefore, many scholars have also proposed non-linear infection rate models and the use of delay models to reflect the characteristics of the infection rate changing dynamically with the spread of viruses and the delay characteristics in actual industrial networks, but they also ignore the impact of information interaction between nodes on virus transmission.

[0006] Regarding the problem of RTU virus attacks on SCADA industrial networks, no effective solutions have been proposed based on dual time delays and non-linear infection rates. Summary of the Invention

[0007] The purpose of the present invention is to propose a dynamic suppression method for SCADA industrial network viruses. In a specific SCADA industrial environment, based on dual time delays and non-linear infection rates, considering the impact of information interaction between nodes on virus transmission, a SMIQR double-delay non-linear virus transmission model is proposed. The present invention is based on the assumption that the industrial control network is a homogeneous network, the devices in the network have functions such as software upgrade and patches, and a time window mechanism is adopted.

[0008] The technical solution of the present invention is as follows:

[0009] A dynamic inhibition method for industrial network viruses based on SCADA includes the following steps:

[0010] Step 1, the host switches among the following seven states: Susceptible state, Enhanced Susceptible state, Infected state, Isolation Delay state, Immune state, Failure Delay state.

[0011] The definitions of the seven states are as follows:

[0012] Susceptible state (S): This type of host is not infected but has the risk of being infected.

[0013] Enhanced state (M): This type of host is not infected and has certain immunity through node information exchange.

[0014] Infected state (I): This type of host is infected.

[0015] Delayed state 1 (D1): This type of host is infected, and the isolation requires a certain time, resulting in a time delay state.

[0016] Quarantine state (Q): This type of host is infected and quarantined.

[0017] Immune state (R): This type of host enters the immune state by recovering from being infected through antivirus software or patching.

[0018] Delayed state 2 (D2): In the system, due to virus update or patch failure, the recovery state changes back to the susceptible state again. This failure process is not instantaneous but has a certain delay, resulting in the delayed state.

[0019] Let S(t), M(t), I(t), D1(t), Q(t), R(t), and D2(t) represent the number of hosts in the susceptible state, enhanced state, infected state, delay state 1, quarantine state, immune state, and delay state 2 at time t, respectively.

[0020] During the virus propagation process, nodes will conduct information transmission, enabling some susceptible nodes to be transformed into enhanced susceptible nodes.

[0021] Step 2, establish the model as follows:

[0022]

[0023] The total number of hosts is N, and its formula is as follows

[0024] N = S(t) + M(t) + I(t) + D1(t) + Q(t) + R(t) + D2(t)

[0025] The symbols involved in the model and their definitions are shown in the following table:

[0026]

[0027] In the model, equation means that if the host is in a susceptible state, it either directly becomes an infected host or becomes a strengthened susceptible host through node information transmission. The probability that each susceptible node is infected at time t is Then at time t, there is For the infected susceptible hosts, there are susceptible hosts that turn into strengthened susceptible hosts.

[0028] Equation means that if the host is in a strengthened susceptible state, it either becomes an infected host or turns into an immune host. θ represents the magnitude of the host's own defense ability after receiving a danger message. If it can completely resist virus invasion after receiving the message, it will directly transform into an immune host; if not, it will transform into an infected host.

[0029] Equation means that if the host is in an infected state, there is a probability θ of being quarantined.

[0030] Equation means that if the host is in a quarantine delay state, it will become a quarantined state at a delay of τ1.

[0031] Equation means that if the host is in a quarantined state, there is a probability η of becoming an immune host.

[0032] Equation means that if the host is in an immune state, due to reasons such as patch failure, there is a probability α of reverting to a susceptible host state.

[0033] Equation means that if the host is in an immune failure delay state, it reverts to a susceptible state at a delay of τ2.

[0034] Furthermore, model ① has a unique positive equilibrium point where

[0035]

[0036] The beneficial effects of the present invention are:

[0037] When analyzing the double time delay, it is found that the two time delays affect each other and cannot be simply split into two single time delay systems for separate discussion. Therefore, it is necessary to specifically analyze the joint impact of the two time delays on the dynamic system and precisely control them to ensure system stability, thereby suppressing the spread of malware. Based on the time window, the isolation strategy (Q state transition) is dynamically adjusted to ensure that virus suppression does not affect the continuity of industrial production. The infection rate saturation effect is adjusted by parameter a, and nodes with high connection density are preferentially isolated to reduce the transmission rate. Description of the Drawings

[0038] Figure 1 is the state transition diagram of the present invention;

[0039] Figure 2 is a partial flowchart of the present invention;

[0040] Figure 3 is the double time-delay Hopf bifurcation diagram of the present invention;

[0041] Figure 4 is the fitting result of the real dataset of the present invention. Detailed Embodiment

[0042] The following further elaborates on the present invention in conjunction with the drawings and specific implementation schemes, but does not limit the technical solutions of the present invention.

[0043] Driven by the industrial Internet, the connectivity and complexity of the SCADA system are increasing day by day, making it face greater risks of network attacks. Malicious viruses often penetrate into the physical layer RTU nodes through network interfaces. Currently, there are relatively few virus propagation models generated for the attack on RTU in the SCADA system, and most models do not consider the non-linear characteristics of infection in the real industrial environment and the existence of double time delays. The present invention provides a dynamic suppression method for viruses based on the SCADA industrial network.

[0044] Figure 1 Reveals the dynamic characteristics of virus propagation in the SCADA industrial network, and strengthens the active defense of node state transition through the information interaction mechanism.

[0045] As Figure 1 shown, the non-linear infection rate f(β) adopted is There are two possibilities for a susceptible host to be infected by an infected host. One is to convert to an infected host, and the other is to convert to a strengthened susceptible host. The strengthened susceptible host itself has a certain immunity. This conversion does not utilize external defense strategies, but considers the enhancement of the defense ability from the transmission of dangerous information between nodes, so as to realize the self-anti-virus ability of a system, and at the same time considers the double lag effects of the isolation time delay (τ1) and the patch failure time delay (τ2) in the modeling industrial scenario.

[0046] Figure 2 It is the conversion process from a susceptible host to a strengthened susceptible host.

[0047] This model is inspired by real-world scenarios, such as rumor control in social networks, risk management in financial markets, traffic congestion reduction in urban transportation systems, and biological immune systems, enabling the hosts in the system to have enhanced immune characteristics through information transmission. Figure 2 Taking biological immunology as an example, it shows the process of S conversion to M.

[0048] Figure 3 Overall, it is the double-time-delay Hopf bifurcation diagram of the invention, which describes the unstable phenomenon presented by the system with double time delays.

[0049] Figure 3 What is shown is the fixed immune failure time delay The bifurcation diagram shows that the bifurcation diagram is very irregular, with many abnormal points, which is very different from the situation shown when discussing only the single time delay of the isolation time delay. This indicates that when there are double time delays in the system, the size of a single time delay cannot be controlled alone. For example, the size of the isolation time delay cannot be controlled alone. If the immune time delay is added, simply controlling the size of the isolation time delay may also lead to bifurcation. In this case, we need to specifically analyze the combined effects of the isolation time delay and the immune time delay on the dynamic system, and can more accurately control to ensure the stability of the system and inhibit the spread of the virus. The above experiments prove that the stability of the dynamic system needs to be maintained by controlling the values of both the immune delay and the isolation delay simultaneously.

[0050] Figure 4 It is the fitting result of the real dataset of the present invention.

[0051] Figure 4 It shows the evolution of the model under real datasets and under simulated differential equations under three different initial conditions. It can be seen that there are also type changes in the differential equations and real datasets. Each state has the same trend and a high degree of fitting, indicating the effectiveness of the model. Although there are differences between the partial results reflected in the real data and the theoretical data, the differences are small, which is due to the different simulation methods themselves. However, the final results of both methods converge to a stable state, which also shows that the model is very stable under real datasets.

[0052] The model of the present invention has a unique positive equilibrium point

[0053] where

[0054]

[0055] The proof steps are as follows:

[0056] 1) When the equation ① is stable, the number of hosts in all states will no longer increase. If the derivatives on the left side of the equal sign are all 0, it means the model is stable, and we get:

[0057]

[0058] 2) From the above equation, we can get:

[0059]

[0060] 3) Since the total quantity in equation ② is N, we continue to derive the equation of :

[0061]

[0062] 4) Obviously, equation ③ has a unique positive root and a unique positive equilibrium point

[0063]

[0064] Proof completed.

[0065] It should be noted that: As described above, it is an implementation manner provided in combination with specific content, and it cannot be determined that the specific implementation of the present invention is only limited to these descriptions. Any structure, device similar or identical to the present invention, or any technical deduction or replacement made under the premise of the concept of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A dynamic suppression method for industrial network viruses based on SCADA, characterized in that, The method includes the following steps: Step 1, the host switches among the following seven states: Susceptible state, Enhanced Susceptible state, Infected state, Isolation Delay state, Quarantine state, Immunity state, Immunity Failure Time Delay state; The definitions of the above states are as follows: Susceptible state (S): This type of host is not infected, but has the risk of being infected; Enhanced state (M): This type of host is not infected and has immunity through node information exchange; Infected state (I): This type of host is infected; Delay state 1 (D1): This type of host is infected and is in a time delay state due to the time required for isolation; Quarantine state (Q): This type of host is infected and quarantined; Immunity state (R): This type of host enters the immunity state by restoring to uninfected through antivirus software or patching; Delay state 2 (D2): In the system, due to virus update or patch failure, the recovery state changes back to the susceptible state again; this failure process is not instantaneous, but there is a delay, resulting in a delay state; Let S(t), M(t), I(t), D1(t), Q(t), R(t) and D2(t) represent the number of hosts in the susceptible state, enhanced state, infected state, time delay state 1, quarantine state, immunity state and time delay state 2 at time t respectively; Step 2, establish the model as: The total number of hosts is N, and its formula is as follows N = S(t) + M(t) + I(t) + D1(t) + Q(t) + R(t) + D2(t). The symbols involved in the model and their definitions are shown in the following table. In the model, the formula means that if the host is in a susceptible state, it either directly becomes an infected host or becomes a strengthened susceptible host through node information transmission; the probability that each susceptible node is infected at time t is Then at time t, there is For the infected susceptible hosts, there is of the susceptible hosts turn into strengthened susceptible hosts; Formula Indicates that if the host is in a highly vulnerable state, it will either become an infected host or transform into an immune host; θ represents the magnitude of the host's own defense ability after receiving a dangerous message. If it can completely resist virus intrusion after receiving the message, it will directly transform into an immune host. If there is no effect, it will transform into an infected host; Formula Indicates that if the host is in an infected state, there is a probability θ of being quarantined; Formula It means that if the host is in the isolated delay state, it will change to the isolated state at a delay of τ1. Formula Indicates that if the host is in an isolated state, there is a probability η of becoming an immune host; Formula Indicates that if the host is in an immune state, due to reasons such as patch failure, there is a probability α that it will revert to a susceptible host again; Formula It means that if the host is in the immune failure delay state, it will return to the susceptible state again when the delay is τ2.

2. The dynamic suppression method for SCADA industrial network virus according to claim 1, characterized in that, The model ① has a unique positive equilibrium point Where

Images