A data-driven programmable control system internal access fuzzy evaluation method

Abstract

The application provides a data-driven control system internal access fuzzy evaluation method. First, a fuzzy reasoning model is established to evaluate the internal access level of a PLC control system in controlling oil refining and chemical industry processes. Second, by analyzing the data generated during the operation of the control system, a fuzzy reasoning-based PLC control system internal access level evaluation method is designed. This method applies knowledge and experience to summarize the influence of access data on the evaluation of the internal access level of the PLC control system. Finally, a fuzzy rule updating strategy is designed. By introducing the false alarm rate as a condition to trigger the fuzzy rule updating, the degree of fuzzy rule activation is effectively controlled to adjust the evaluation level, so that the model can maintain its accuracy when facing specific access and improve the reliability of the PLC control system in evaluating the internal access level in controlling oil refining and chemical industry processes.

Description

Technical Field

[0001] This invention designs a data-driven fuzzy evaluation method for internal access in a Programmable Logic Controller (PLC), enabling the assessment of internal access levels in PLC control systems operating in oil refining and chemical industries. Since the internal access level of a PLC control system is a key indicator for determining whether the control system has been compromised, directly reflecting its operational status and access activity, evaluating its internal access level in these processes is crucial for understanding the PLC's internal access status. This internal access level can serve as an important basis for assessing and warning of internal access issues within the PLC control system, providing significant guidance for evaluative maintenance of PLC control systems. Background Technology

[0002] With the increasing maturity and widespread application of artificial intelligence (AI) technology, AI's automation capabilities have introduced entirely new intelligent elements into traditional control systems, fundamentally changing their operating modes and decision-making mechanisms. Control systems often contain critical infrastructure information, sensitive business data, or important operational process details. Therefore, understanding and monitoring access within a PLC control system, promptly detecting abnormal access, and assessing access levels are crucial for improving the security of PLC control systems. In this context, data-driven models, with their advantages of simple modeling and no need for explicit analysis of relationships between features, have become an efficient intelligent assessment method. However, in complex operating environments, traditional intelligent assessment models struggle to monitor and restrict PLC control system access permissions in real time, identify abnormal access requests, and are prone to intellectual property leaks and malicious tampering with production processes. Therefore, research on assessing access within control systems using data-driven fuzzy reasoning methods is of great significance and can provide crucial support for assessing PLC control system access levels.

[0003] This invention designs a data-driven fuzzy evaluation method for internal access of PLC control systems. It mainly analyzes the data generated during the operation of the PLC control system, designs a fuzzy inference-based evaluation model for the internal access level of the PLC control system, calculates the false alarm rate based on the defuzzified output level, updates the fuzzy rules, and realizes the evaluation of the internal access level of the PLC control system. Summary of the Invention

[0004] This invention provides a data-driven fuzzy evaluation method for internal access in oil refining and chemical processes using a PLC control system. The method employs fuzzy inference as the primary architecture for data-driven model prediction, establishing a fuzzy inference model to accurately evaluate the internal access level of the PLC control system in these processes. Furthermore, by summarizing and analyzing the data generated during system access, a fuzzy inference-based method for evaluating the internal access level of the PLC control system is designed. This method applies knowledge and experience to summarize the impact of access data on the evaluation of internal access levels in oil refining and chemical processes. Finally, a fuzzy rule update strategy is designed. This strategy effectively controls the activation level of fuzzy rules by introducing the false alarm rate as a condition for triggering fuzzy rule updates, thereby adjusting the evaluation level and maintaining the model's accuracy when facing specific accesses. This improves the reliability of the PLC control system's internal access level evaluation in oil refining and chemical processes.

[0005] The present invention adopts the following technical solution and implementation steps:

[0006] A data-driven fuzzy evaluation method for internal access in a programmable logic control system includes the following steps:

[0007] (1) Determine the input variables and output variables to be evaluated: For the programmable logic controller (PLC) control system, an intelligent evaluation is carried out on the internal access situation in the process of controlling oil refining and chemical industry. Seven variables are determined as the relevant variables inside the PLC control system to be evaluated: access time, access frequency, access duration, number of command executions, task execution time, application programming interface (API) call frequency and number of user requests. The actual evaluation value of the PLC control system over a period of time is used as the output variable.

[0008] (2) Design a dataset for training an internal access evaluation model in the control process of PLC control system in oil refining and chemical industry: Construct a fuzzy input matrix as: X = [x1, ..., x2] j ,…,x n ], x j =[x 1j ,…,x ij ,…,x mj ] T The access time data is a vector x1 = [x 11 ,…,x 1n The access frequency data is a vector x2 = [x 21 ,…,x 2nThe access duration data is a vector x3 = [x 31 ,…,x 3n The command execution count data is a vector x4 = [x 41 ,…,x 4n The task execution time data is a vector x5 = [x 51 ,…,x 5n The API call frequency data is a vector x6 = [x 61 ,...,x 6n The user requested data as a vector x7 = [x 71 ,...,x 7n Let i = 1, ..., m, j = 1, ..., n, where m and n are the number of relevant variables and the number of samples, respectively. T represents the matrix transpose. Define the target output vector as: Y = [y1, ..., y2]. i ,…,y m ] T y i = [0,1], where y i A value ≥0.8 indicates a "high-risk access" level, and 0.4≤y i <0.8 indicates an access level of "medium risk". i <0.4 indicates an access level of "low-risk access";

[0009] (3) Establish an internal access fuzzy evaluation model for PLC control systems in oil refining and chemical industry processes:

[0010] ① In the evaluation of access within a PLC control system, access time data, access frequency data, and access duration data are all related to access activity. Access activity typically refers to the frequency and degree of user participation in the control system within a specific time frame. A fuzzy subset x1 = {u l1 (x ij ),u l2 (x ij ),u l3 (x ij );u m1 (x ij ),u m2 (x ij ),u m3 (x ij );u h1 (x ij ),u h2 (x ij ),u h3 (x ij )}, change u l1 (x ij ),u l2 (xij ),u l3 (x ij The "low activity" membership is defined by access time, access frequency, and access duration, respectively. m1 (x ij ),u m2 (x ij ),u m3 (x ij ) represents the membership degree of "medium activity level", u h1 (x ij ),u h2 (x ij ),u h3 (x ij The "high activity" membership degree, command execution count data, and task execution time data are related to the access success rate. The access success rate refers to the ratio between the number of times a control system or specific resource is successfully accessed through access attempts and the total number of access attempts within a certain time range. A fuzzy subset x2 is defined as {u... l4 (x ij ),u l5 (x ij );u m4 (x ij ),u m5 (x ij );u h4 (x ij ),u h5 (x ij )}, change u l4 (x ij ),u l5 (x ij The "high success rate" membership degree is defined as the number of executions and the task execution time, respectively. m4 (x ij ),u m5 (x ij ) represents the membership degree of "medium success rate", u h4 (x ij ),u h5 (x ij The membership degree for "low success rate" is defined. API call frequency and the number of user requests are related to system load. System load typically refers to a measure of the workload processed by the system within a given time, reflecting the system's usage and performance pressure. A fuzzy subset x3 = {u l6 (x ij ),u l7 (x ij );u m6 (x ij ),u m7 (x ij );u h6(x ij ),u h7 (x ij )}, change u l6 (x ij ),u l7 (x ij ) are defined as the "high load" membership degree of API call frequency and user requests, respectively. m6 (x ij ),u m7 (x ij ) represents the membership degree of "medium load", u h6 (x ij ),u h7 (x ij ) represents the "low load" membership degree;

[0011] ② Determine the membership degree of the input elements in different fuzzy subsets, and define the membership functions of "low activity", "low success rate" and "low load" as u. li (x ij The formula is as follows:

[0012]

[0013] Among them, a i The left-hand parameter, b, represents "low activity," "low success rate," and "low load." i Let u represent the right-hand side parameter of "low activity", "low success rate", and "low load", and define the membership function of "medium activity", "medium success rate", and "medium load" as u. mi (x ij The formula is as follows:

[0014]

[0015] Among them, c i The left-hand parameter d represents "medium activity", "medium success rate", and "medium load". i The top-side parameters representing "medium activity," "medium success rate," and "medium load," e i Let u represent the right-hand side parameters of "Medium Activity", "Medium Success Rate", and "Medium Load", and define the membership functions of "High Activity", "High Success Rate", and "High Load" as u. hi (x ij The formula is as follows:

[0016]

[0017] Among them, f i The left-hand parameter, g, represents "high activity," "high success rate," and "high load." iThe right-hand parameter, a, represents "high activity," "high success rate," and "high load." i b i c i d i e i f i g i The value is determined by the 10th, 30th, 40th, 50th, 60th, 75th, and 90th percentiles of access time, access frequency, access duration, command execution count, task execution time, API call frequency, and number of user requests during the control process of oil refining and chemical industries.

[0018] ③ Establish fuzzy rules to associate input and output:

[0019] Rule 1:

[0020]

[0021] Rule 2:

[0022]

[0023] Rule 3:

[0024]

[0025] Rule 4:

[0026]

[0027] Rule 5:

[0028]

[0029] In the oil refining and chemical industries, It is determined by the 10th, 30th, 60th, 85th, and 95th percentiles of the overall input statistical variable;

[0030] ④ Fuzzy inference process: Determine the activation level of the fuzzy rules. For each rule, calculate the fuzziness level of the output and apply minimum operations.

[0031] Regarding rule one:

[0032] α1=min(u l1 (x ij ),u l2 (x ij ),u l3 (x ij ),u l4 (x ij),u l5 (x ij ),u l6 (x ij ),u l7 (x ij )) (9)

[0033] For Rule 2:

[0034] α2 = min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u l4 (x ij ),u l5 (x ij ),u m6 (x ij ),u m7 (x ij )) (10)

[0035] For Rule 3:

[0036] α3 = min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u m4 (x ij ),u m5 (x ij ),u l6 (x ij ),u l7 (x ij )) (11)

[0037] For Rule 4:

[0038] α4 = min(u h1 (x ij ),u h2 (x ij ),u h3 (x ij [[ID=9⑧]]),u[[ID=⑨⑨]] m4 (x ij ),u m5 (x ij ),u m6 (x ij ),u m7 (x​​​​​

[0040] α5=min(u h1 (x ij ),u h2 (x ij ),u h3 (x ij ),u h4 (x ij ),u h5 (x ij ),u l6 (x ij ),u l7 (x ij (13)

[0041] Where α1, α2, α3, α4, and α5 represent the activation levels of rules one through five, respectively, and min(.) represents taking the value of the smallest element within the parentheses. Combining all activated rules yields a unified fuzzy output, as shown in the following formula:

[0042]

[0043] Among them, y i It is an overall fuzzy output;

[0044] ⑤ Deblurring: Map the value of Y to the access level, using the following formula:

[0045]

[0046] (4) Fuzzy rule update:

[0047] ① Determine the triggering condition for fuzzy rule updates: Use the false positive rate as the triggering condition for fuzzy rule updates. A false positive refers to a situation where the actual access level is inconsistent with the assessed level. The formula for calculating the false positive rate is:

[0048]

[0049] Where FP is the number of false positives, i.e., the number of times the actual access level is inconsistent with the assessed level; TN is the number of true negatives, i.e., the number of times the actual access level is consistent with the assessed level; and the trigger condition for fuzzy rule updates is:

[0050] FPR>θ (17)

[0051] Where θ is the set false alarm rate threshold, which is 1% of the access base. When the FPR meets (17), proceed to ②-④; otherwise, end the rule adjustment.

[0052] ② Data preprocessing: The collected input time data is converted to a uniform format using the min-max normalization method, as shown in the following formula:

[0053]

[0054] in, It is standardized data, x max ij It is the maximum value in the data, x min ij It is the minimum value in the data, x ij It is the raw data;

[0055] ③ Rule adjustments:

[0056] a. Rule Threshold Adjustment: Adjusting the parameters of the fuzzy set, specifically parameters a, b, c, d, e, f, and g, can adjust the "high," "medium," and "low" access activity levels, access success rates, and access load classification ranges. The formula for adjusting the threshold parameters based on performance is as follows:

[0057] T'=T-β·FPR (19)

[0058] Where T′∈{a',b',c',d',e',f',g'} represents the corresponding adjusted threshold, T∈{a,b',c,d,e,f,g} represents the threshold to be adjusted, and β represents the adjustment factor;

[0059] b. Rule Weight Adjustment: The activation levels of existing rules are weighted to change the impact of different rules on the final output. The weight is set to w. k Let k represent the rule number, k = 1, 2, ..., 5. Then the activation level of the rule can be expressed as:

[0060] α k =α k ·w k (20)

[0061] Where, α′ k α represents the activation level of the new rule. k The activation level is calculated in formulas (9)-(13), and the total fuzzy output y is calculated according to formula (14). i ;

[0062] ④ Refine the risk level assessment: Considering all risk factors, the internal access risk of the PLC control system in the oil refining and chemical industry processes is divided into four levels: "Hazardous Access," "High-Risk Access," "Medium-Risk Access," and "Low-Risk Access." The final risk level is determined based on the value of Y. i Access with a value ≤0.3 is considered low-risk. <y i Access with a value ≤0.6 is considered medium risk; 0.6 <y i Access with a value ≤0.8 is considered high-risk.i A risk level greater than 0.8 indicates a high-risk access level, as shown in the formula:

[0063]

[0064] The new evaluation grade Y is obtained, and the process returns to Part ①.

[0065] The inventiveness of this invention is mainly reflected in:

[0066] This invention addresses the issue that when PLC control systems assess internal access levels in oil refining and chemical processes, the distribution characteristics of input data may fluctuate due to random access. Fixed-structure fuzzy inference and other data-driven models struggle to capture and adapt to these dynamic changes, resulting in assessments lacking knowledge guidance on operational changes and thus decreasing accuracy. To address this, a data-driven fuzzy assessment model for PLC control system internal access is established. This model utilizes knowledge- and experience-based fuzzy rules to accurately assess access levels within the PLC control system, effectively correcting assessment biases when internal access conditions change during oil refining and chemical processes, thereby improving the accuracy of internal access assessments in these processes. Detailed Implementation

[0067] A fuzzy evaluation method for internal access of a data-driven PLC control system in oil refining and chemical industry processes is proposed. The method identifies the input variables and output variables to be evaluated. Specifically, this invention focuses on the intelligent evaluation of internal access within a PLC control system in oil refining and chemical industry processes. Seven variables are identified as relevant internal variables of the PLC control system to be evaluated: access time, access frequency, access duration, command execution count, task execution time, application programming interface (API) call frequency, and number of user requests. The actual evaluation value of the PLC control system over a period of time is used as the output variable.

[0068] The experimental data came from user operation records and system logs within a PLC control system. After screening, 1700 sets of data remained in the experimental sample.

[0069] The present invention adopts the following technical solution and implementation steps:

[0070] A data-driven fuzzy evaluation method for internal access in a programmable logic control system includes the following steps:

[0071] (3) Design a dataset for training an internal access evaluation model for PLC control systems in oil refining and chemical industry processes: Construct a fuzzy input matrix as: X = [x1, ..., xj ,…,x n ], x j =[x 1j ,…,x ij ,…,x mj ] T The access time data is a vector x1 = [x 11 ,…,x 1n The access frequency data is a vector x2 = [x 21 ,…,x 2n The access duration data is a vector x3 = [x 31 ,…,x 3n The command execution count data is a vector x4 = [x 41 ,…,x 4n The task execution time data is a vector x5 = [x 51 ,…,x 5n The API call frequency data is a vector x6 = [x 61 ,...,x 6n The user requested data as a vector x7 = [x 71 ,...,x 7n Let i = 1, ..., m, j = 1, ..., n, where m = 7 and n = 1700 are the number of relevant variables and the number of samples, respectively. T represents the matrix transpose. Define the target output vector as: Y = [y1, ..., y2]. i ,…,y m ] T y i = [0,1], where y i A value ≥0.8 indicates a "high-risk access" level, and 0.4≤y i <0.8 indicates an access level of "medium risk". i <0.4 indicates an access level of "low-risk access";

[0072] (3) Establish an internal access fuzzy evaluation model for PLC control systems in oil refining and chemical industry processes:

[0073] ① In the evaluation of access within a PLC control system, access time data, access frequency data, and access duration data are all related to access activity. Access activity typically refers to the frequency and degree of user participation in the control system within a specific time frame. A fuzzy subset x1 = {u l1 (x ij ),u l2 (x ij ),u l3 (x ij );u m1 (x ij ),um2 (x ij ),u m3 (x ij );u h1 (x ij ),u h2 (x ij ),u h3 (x ij )}, change u l1 (x ij ),u l2 (x ij ),u l3 (x ij The "low activity" membership is defined by access time, access frequency, and access duration, respectively. m1 (x ij ),u m2 (x ij ),u m3 (x ij ) represents the membership degree of "medium activity level", u h1 (x ij ),u h2 (x ij ),u h3 (x ij The "high activity" membership degree, command execution count data, and task execution time data are related to the access success rate. The access success rate refers to the ratio between the number of times a control system or specific resource is successfully accessed through access attempts and the total number of access attempts within a certain time range. A fuzzy subset x2 is defined as {u... l4 (x ij ),u l5 (x ij );u m4 (x ij ),u m5 (x ij );u h4 (x ij ),u h5 (x ij )}, change u l4 (x ij ),u l5 (x ij The "high success rate" membership degree is defined as the number of executions and the task execution time, respectively. m4 (x ij ),u m5 (x ij ) represents the membership degree of "medium success rate", u h4 (x ij ),u h5 (x ijThe membership degree for "low success rate" is defined. API call frequency and the number of user requests are related to system load. System load typically refers to a measure of the workload processed by the system within a given time, reflecting the system's usage and performance pressure. A fuzzy subset x3 = {u l6 (x ij ),u l7 (x ij );u m6 (x ij ),u m7 (x ij );u h6 (x ij ),u h7 (x ij )}, change u l6 (x ij ),u l7 (x ij ) are defined as the "high load" membership degree of API call frequency and user requests, respectively. m6 (x ij ),u m7 (x ij ) represents the membership degree of "medium load", u h6 (x ij ),u h7 (x ij ) represents the "low load" membership degree;

[0074] ② Determine the membership degree of the input elements in different fuzzy subsets, and define the membership functions of "low activity", "low success rate" and "low load" as u. li (x ij The formula is as follows:

[0075]

[0076] Among them, a i The left-hand parameters representing "low activity," "low success rate," and "low load" are: a1=1, a2=3, a3=30, a4=3, a5=1, a6=2, a7=10, b i Let the right-hand parameters represent "low activity," "low success rate," and "low load," with b1=3, b2=6, b3=60, b4=5, b5=3, b6=5, and b7=30. Define the membership functions for "medium activity," "medium success rate," and "medium load" as u. mi (x ij The formula is as follows:

[0077]

[0078] Among them, c iThe left-hand parameters representing "Medium Activity," "Medium Success Rate," and "Medium Load" are c1=5, c2=10, c3=90, c4=8, c5=5, c6=8, c7=50, d i Top-side parameters representing "Medium Activity," "Medium Success Rate," and "Medium Load," d1=7, d2=15, d3=120, d4=12, d5=8, d6=12, d7=90, e i Let u represent the right-hand parameters for "Medium Activity", "Medium Success Rate", and "Medium Load", e1=10, e2=20, e3=150, e4=15, e5=12, e6=15, e7=120. Define the membership function for "High Activity", "High Success Rate", and "High Load" as u. hi (x ij The formula is as follows:

[0079]

[0080] Among them, f i The left-hand parameters representing "high activity," "high success rate," and "high load" are f1=12, f2=24, f3=180, f4=20, f5=15, f6=20, f7=140, g i The right-hand parameters representing "high activity", "high success rate" and "high load" are g1=15, g2=30, g3=200, g4=25, g5=20, g6=25, g7=160;

[0081] ③ Establish fuzzy rules to associate input and output:

[0082] Rule 1:

[0083]

[0084] Rule 2:

[0085]

[0086] Rule 3:

[0087]

[0088] Rule 4:

[0089]

[0090] Rule 5:

[0091]

[0092] in,

[0093] ④ Fuzzy inference process: Determine the activation level of the fuzzy rules. For each rule, calculate the fuzziness level of the output and apply minimum operations.

[0094] Regarding rule one:

[0095] α1=min(u l1 (x ij ),u l2 (x ij ),u l3 (x ij ),u l4 (x ij ),u l5 (x ij ),u l6 (x ij ),u l7 (x ij (30)

[0096] Regarding rule two:

[0097] α2=min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u l4 (x ij ),u l5 (x ij ),u m6 (x ij ),u m7 (x ij (31)

[0098] Regarding rule three:

[0099] α3=min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u m4 (x ij ),u m5 (x ij ),u l6 (x ij ),u l7 (x ij (32)

[0100] Regarding rule four:

[0101] α4=min(u h1 (x ij),u h2 (x ij ),u h3 (x ij ),u m4 (x ij ),u m5 (x ij ),u m6 (x ij ),u m7 (x ij (33)

[0102] Regarding rule five:

[0103] α5=min(u h1 (x ij ),u h2 (x ij ),u h3 (x ij ),u h4 (x ij ),u h5 (x ij ),u l6 (x ij ),u l7 (x ij (34)

[0104] Where α1, α2, α3, α4, and α5 represent the activation levels of rules one, two, and three, respectively, and min(.) represents taking the value of the smallest element within the parentheses. Combining all activated rules yields a unified fuzzy output, as shown in the following formula:

[0105]

[0106] Among them, y i It is an overall fuzzy output;

[0107] ⑤ Deblurring: Map the value of Y to the access level, using the following formula:

[0108]

[0109] (5) Fuzzy rule update:

[0110] ① Determine the triggering condition for fuzzy rule updates: Use the false positive rate as the triggering condition for fuzzy rule updates. A false positive refers to a situation where the actual access level is inconsistent with the evaluation level. The formula for calculating the false positive rate is:

[0111]

[0112] Where FP is the number of false positives, i.e., the number of times the actual access level is inconsistent with the assessed level; TN is the number of true negatives, i.e., the number of times the actual access level is consistent with the assessed level; and the trigger condition for fuzzy rule updates is:

[0113] FPR>θ (38)

[0114] Where θ = 0.1, if FPR satisfies (38), proceed with ②-④, otherwise end the rule adjustment;

[0115] ② Data preprocessing: The collected input time data is converted to a uniform format using the min-max normalization method, as shown in the following formula:

[0116]

[0117] in, It is standardized data, x max ij It is the maximum value in the data, x min ij It is the minimum value in the data, x ij It is the raw data;

[0118] ③ Rule adjustments:

[0119] a. Rule Threshold Adjustment: Adjusting the parameters of the fuzzy set, specifically parameters a, b, c, d, e, f, and g, can adjust the "high," "medium," and "low" access activity levels, access success rates, and access load classification ranges. The formula for adjusting the threshold parameters based on performance is as follows:

[0120] T'=T-β·FPR (40)

[0121] Where T′∈{a',b',c',d',e',f',g'} represents the corresponding adjusted threshold, T∈{a,b',c,d,e,f,g} represents the threshold to be adjusted, β represents the adjustment factor, and β=0.1;

[0122] b. Rule Weight Adjustment: The activation levels of existing rules are weighted to change the impact of different rules on the final output. The weight is set to w. k Let k represent the rule number, k = 1, 2, ..., 5. Then the activation level of the rule can be expressed as:

[0123] α k =α k ·w k (41)

[0124] Where, α ′k α represents the activation level of the new rule. kThe activation level is calculated in formulas (30)-(34), and the total fuzzy output y is calculated according to formula (35). i ;

[0125] ④ Refine the risk level assessment: Considering all risk factors, the internal access risk of the PLC control system in the oil refining and chemical industry processes is divided into four levels: "Hazardous Access," "High-Risk Access," "Medium-Risk Access," and "Low-Risk Access." The final risk level is determined based on the value of Y. i Access with a value ≤0.3 is considered low-risk. <y i Access with a value ≤0.6 is considered medium risk; 0.6 <y i Access with a value ≤0.8 is considered high-risk. i A risk level greater than 0.8 indicates a high-risk access level, as shown in the formula:

[0126]

[0127] The new evaluation grade Y is obtained, and the process returns to Part ①.

Claims

1. A fuzzy evaluation method for internal access in a data-driven programmable logic control system, characterized in that, Includes the following steps: (1) Determine the input variables and output variables to be evaluated: Intelligent evaluation of the internal access of the programmable logic PLC control system in the process of controlling oil refining or chemical industry is carried out. Seven variables are determined as relevant variables inside the PLC control system to be evaluated: access time, access frequency, access duration, number of command executions, task execution time, API call frequency and number of user requests. The actual evaluation value of the PLC control system over a period of time is used as the output variable. (2) Design a dataset for training an internal access evaluation model of a PLC control system in the oil refining or chemical industry: Construct a fuzzy input matrix as: X = [x1, ..., x j ,…,x n ], x j =[x 1j ,…,x ij ,…,x mj ] T The access time data is a vector x1 = [x 11 ,…,x 1n The access frequency data is a vector x2 = [x 21 ,…,x 2n The access duration data is a vector x3 = [x 31 ,…,x 3n The command execution count data is a vector x4 = [x 41 ,…,x 4n The task execution time data is a vector x5 = [x 51 ,…,x 5n The API call frequency data is a vector x6 = [x 61 ,...,x 6n The user requested data as a vector x7 = [x 71 ,...,x 7n Let i = 1, ..., m, j = 1, ..., n, where m and n are the number of relevant variables and the number of samples, respectively. T represents the matrix transpose. Define the target output vector as: Y = [y1, ..., y2]. i ,…,y m ] T y i = [0,1], where y i A value ≥0.8 indicates a "high-risk access" level, and 0.4≤y i <0.8 indicates an access level of "medium risk". i A value less than 0.4 indicates an access level of "low-risk access". (3) Establish an internal access fuzzy evaluation model for PLC control systems in oil refining or chemical industry processes: ① In the evaluation of access within a PLC control system, access time data, access frequency data, and access duration data are all related to access activity. Access activity typically refers to the frequency and degree of user participation in the control system within a specific time frame. A fuzzy subset x1 = {u l1 (x ij ),u l2 (x ij ),u l3 (x ij );u m1 (x ij ),u m2 (x ij ),u m3 (x ij );u h1 (x ij ),u h2 (x ij ),u h3 (x ij )}, change u l1 (x ij ),u l2 (x ij ),u l3 (x ij The "low activity" membership is defined by access time, access frequency, and access duration, respectively. m1 (x ij ),u m2 (x ij ),u m3 (x ij ) represents the membership degree of "medium activity level", u h1 (x ij ),u h2 (x ij ),u h3 (x ij The "high activity" membership degree, command execution count data, and task execution time data are related to the access success rate. The access success rate refers to the ratio between the number of successful access attempts to the control system or specific resource within a certain time range and the total number of access attempts. A fuzzy subset x2 is defined as {u... l4 (x ij ),u l5 (x ij );u m4 (x ij ),u m5 (x ij );u h4 (x ij ),u h5 (x ij )}, change u l4 (x ij ),u l5 (x ij The "high success rate" membership degree is defined as the number of executions and the task execution time, respectively. m4 (x ij ),u m5 (x ij ) represents the membership degree of "medium success rate", u h4 (x ij ),u h5 (x ij The membership degree for "low success rate" is defined. API call frequency and the number of user requests are related to system load. System load usually refers to a measure of the workload processed by the system within a given time, reflecting the system's usage and performance pressure. A fuzzy subset x3 = {u l6 (x ij ),u l7 (x ij );u m6 (x ij ),u m7 (x ij );u h6 (x ij ),u h7 (x ij )}, change u l6 (x ij ),u l7 (x ij ) are defined as the "high load" membership degree of API call frequency and user requests, respectively. m6 (x ij ),u m7 (x ij ) represents the membership degree of "medium load", u h6 (x ij ),u h7 (x ij ) represents the "low load" membership degree; ② Determine the membership degree of the input element in different fuzzy subsets, and define the membership functions for "low activity", "low success rate" and "low load" as u. li (x ij The formula is as follows: Among them, a i The left-hand parameter, b, represents "low activity," "low success rate," and "low load." i The right-hand side parameters represent "low activity," "low success rate," and "low load," and the membership functions for "medium activity," "medium success rate," and "medium load" are defined as u. mi (x ij The formula is as follows: Among them, c i The left-hand parameter d represents "medium activity", "medium success rate", and "medium load". i The top-side parameter representing "medium activity," "medium success rate," and "medium load," e i Let u represent the right-hand side parameters of "Medium Activity", "Medium Success Rate", and "Medium Load", and define the membership functions of "High Activity", "High Success Rate", and "High Load" as u. hi (x ij The formula is as follows: Among them, f i The left-hand parameter, g, represents "high activity," "high success rate," and "high load." i The right-hand parameter, a, represents "high activity," "high success rate," and "high load." i b i c i d i e i f i g i The value is determined by the 10th, 30th, 40th, 50th, 60th, 75th, and 90th percentiles of access time, access frequency, access duration, command execution count, task execution time, API call frequency, and number of user requests during the control process of oil refining and chemical industries. ③ Establish fuzzy rules to associate input and output: Rule 1: Rule 2: Rule 3: Rule 4: Rule 5: In the oil refining or chemical industry, It is determined by the 10th percentile, 30th percentile, 60th percentile, 85th percentile, and 95th percentile of the overall input statistical variable; ④ Fuzzy inference process: Determine the activation level of the fuzzy rules. For each rule, calculate the fuzziness level of the output and apply minimum operations. Regarding rule one: α1 = min(u l1 (x ij ),u l2 (x ij ),u l3 (x ij ),u l4 (x ij ),u l5 (x ij ),u l6 (x ij ),u l7 (x ji )) (9) Regarding rule two: α2 = min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u l4 (x ij ),u l5 (x ij ),u m6 (x ij ),u m7 (x ij )) (10) Regarding rule three: α3 = min(u m1 (x ij ),u m2 (x ij ),u m3 (x ij ),u m4 (x ij ),u m5 (x ij ),u l6 (x ij ),u l7 (x ij )) (11) Regarding rule four: α4 = min(u h1 (x ij ),u h2 (x ij ),u h3 (x ij ),u m4 (x ij ),u m5 (x ij ),u m6 (x ij ),u m7 (x ij )) (12) Regarding rule five: α5=min(u h1 (x ij ),u h2 (x ij ),u h3 (x ij ),u h4 (x ij ),u h5 (x ij ),u l6 (x ij ),u l7 (x ij )) (13) Where α1, α2, α3, α4, and α5 represent the activation levels of rules one through five, respectively, and min(.) represents taking the value of the smallest element within the parentheses. Combining all activated rules yields a unified fuzzy output, as shown in the following formula: Among them, y i It is an overall fuzzy output; ⑤ Deblurring: Map the value of Y to the access level, using the following formula: (4) Fuzzy rule update: ① Determine the triggering condition for fuzzy rule updates: Use the false positive rate as the triggering condition for fuzzy rule updates. A false positive refers to a situation where the actual access level is inconsistent with the assessed level. The formula for calculating the false positive rate is: Where FP is the number of false positives, i.e., the number of times the actual access level is inconsistent with the assessed level; TN is the number of true negatives, i.e., the number of times the actual access level is consistent with the assessed level; and the trigger condition for fuzzy rule updates is: FPR>θ (17) Where θ is the set false alarm rate threshold, which is 1% of the access base. When the FPR meets (17), proceed to ②-④; otherwise, end the rule adjustment. ② Data preprocessing: The collected input time data is converted to a uniform format using the min-max normalization method, as shown in the following formula: in, It is standardized data. It is the maximum value in the data. It is the minimum value in the data, x ij It is the raw data; ③ Rule adjustments: a. Rule Threshold Adjustment: Adjusting the parameters of the fuzzy set, specifically parameters a, b, c, d, e, f, and g, can adjust the "high," "medium," and "low" access activity, access success rate, and access load classification range. The formula for adjusting the threshold parameters based on performance is as follows: T'=T-β·FPR (19) Where T′∈{a',b',c',d',e',f',g'} represents the corresponding adjusted threshold, T∈{a,b',c,d,e,f,g} represents the threshold to be adjusted, and β represents the adjustment factor; b. Rule Weight Adjustment: The activation levels of existing rules are weighted to change the impact of different rules on the final output. The weight is set to w. k Let k represent the rule number, k = 1, 2, ..., 5. Then the activation level of the rule can be expressed as: α′ k ＝α k ·w k (20) Where, α′ k α represents the activation level of the new rule. k The activation level is calculated in formulas (9)-(13), and the total fuzzy output y is calculated according to formula (14). i ; ④ Refine the risk level assessment: Considering all risk factors, the internal access risk of the PLC control system in the oil refining or chemical industry process is divided into four levels: "Hazardous Access," "High-Risk Access," "Medium-Risk Access," and "Low-Risk Access." The final risk level is determined based on the value of Y. i Access with a value ≤0.3 is considered low-risk. <y i Access with a value ≤0.6 is considered medium risk; 0.6 <y i Access with a value ≤0.8 is considered high-risk. i A risk level greater than 0.8 indicates a high-risk access level, as shown in the formula: The new evaluation grade Y is obtained, and the process returns to Part ①.

Images