An industrial host control method and system based on artificial intelligence

Abstract

The application provides an industrial host control method and system based on artificial intelligence. The method comprises the following steps: setting a white list process; when a process accesses the industrial host, the industrial host monitors whether the process accessing the industrial host is abnormal through application layer data before and during process running; then, real-time syscall flow data is collected through an eBPF behavior collector of a kernel layer of the industrial host, the syscall flow data is analyzed through an AI decision engine, and whether the syscall flow data is abnormal is determined; process behavior entropy values are obtained, the behavior entropy values are smoothed through a moving average method, and the triggering of a fuse instruction of monitoring and control based on the application layer and the kernel layer is realized. Through the method and the corresponding system, the detection capability of abnormal processes can be improved.

Description

TECHNICAL FIELD

[0001] The application provides an industrial host control method and system based on artificial intelligence, and relates to the technical field of software security protection. BACKGROUND

[0002] Traditional security mechanisms often rely on pre-defined rules and signatures, making it difficult to deal with new and unknown attacks. Although the white list mechanism can effectively prevent the running of unauthorized programs, once the programs in the white list are invaded or tampered with, the traditional method is helpless, and there is a lack of effective monitoring of the runtime behavior of authorized programs. Most existing solutions only focus on static security, ignoring the dynamic changes of runtime behavior, resulting in the continuous existence of security vulnerabilities. SUMMARY

[0003] The application provides an industrial host control method based on artificial intelligence to solve the above-mentioned problems:

[0004] The application provides an industrial host control method based on artificial intelligence, which comprises:

[0005] Setting a white list process, when the process accesses the industrial host, the industrial host monitors the process through a static trustworthiness model, a dynamic trustworthiness model and a running environment evaluation model;

[0006] Collecting real-time syscall flow data through an eBPF behavior collector, and analyzing the syscall flow data through an AI decision engine;

[0007] Obtaining process behavior entropy values, smoothing the behavior entropy values using a moving average method, and controlling the triggering of a fuse instruction based on model monitoring and AI decision engine analysis.

[0008] Further, setting a white list process, when the process accesses the industrial host, the industrial host monitors the process through a static trustworthiness model, a dynamic trustworthiness model and a running environment evaluation model, comprising:

[0009] All processes running on the industrial host are combed, and white list processes are screened out, the white list process information is stored through a database, and the white list process information includes: process name, process ID, executable file path, file hash value, digital signature, start-up parameter, running time range, required system permission, user identity;

[0010] When a process accesses the industrial host, the industrial host first obtains static trustworthiness of the process accessing the industrial host through a static trustworthiness model by comparing SHA3-512 hash values of a first preset number of files in the process with golden hash values in a database and comparing metadata of a second preset number of files with standard metadata in the database.

[0011] On the basis of considering that trust naturally decays over time, the dynamic trustworthiness of the runtime behavior security of the process is obtained through a dynamic trustworthiness model by combining a comparison result of the system call sequence within a preset time with a normal system call sequence set generated by historical behaviors.

[0012] The ratio of the current value of each hardware level and network level monitoring index to the baseline value is weighted and summed, and then mapped through an activation function, to obtain a quantitative evaluation value of the security of the environment in which the process runs through a running environment evaluation model, the hardware level and network level monitoring indexes include: CPU instruction cycle abnormality rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution and system log information.

[0013] Further, specifically, the static trustworthiness model is:

[0014]

[0015] Wherein, T static represents static trustworthiness, n represents the number of files participating in static trustworthiness hash verification, SHA3-51h(f i ) represents the SHA3-512 hash value of the i-th file, I(·) represents an indicator function, if the condition in the bracket is true, the function value is 1, otherwise 0, DB g (f i ) represents the standard hash value of the i-th file, DB m (f j ) represents the standard metadata of the j-th file, m represents the number of files participating in static trustworthiness metadata verification, MData(f j ) represents the metadata of the j-th file, the metadata includes file size, file creation time, file modification time, file access time, file owner, file access permission, software version number, compilation time, signature state, signature certificate information, dependency file basic attributes, permission information, version information, digital signature information and association information, DB m (f j ) represents the standard metadata of the j-th file, which is stored in the database for comparison,

[0016] The dynamic trustworthiness model is:

[0017]

[0018] wherein, T dynamic (t) represents the dynamic credibility at time t, λ(t) represents a trust decay coefficient, t represents time, L represents the number of system call sequences, b k represents the kth system call sequence, B normal represents a set of normal system call sequences generated by historical behaviors;

[0019] The environment assessment model is

[0020]

[0021] wherein, T c (t) represents the environment safety assessment value, σ(·) represents an activation function, w j represents the weight of the jth monitoring index, represents the current value of the jth monitoring index, represents the baseline value of the jth monitoring index.

[0022] Further, real-time syscall flow data is collected by an eBPF behavior collector, and the syscall flow data is analyzed by an AI decision engine, including:

[0023] A customized eBPF probe is deployed in the kernel layer of the industrial control host to capture full syscall events, and key field data in the full syscall events is obtained, the key field data including: process PID, syscall number, timestamp, and specific parameters passed during syscall execution;

[0024] The key field data is cleaned and formatted, including: invalid call filtering, i.e., filtering syscall=0 and PID anomaly, parameter desensitization, i.e., hashing sensitive parameters such as file paths and network addresses, and time sequence alignment, i.e., using Lamport logical clock to ensure the order of cross-core events;

[0025] Features in the cleaned and formatted key field data are extracted, including basic statistical features and context association features, the basic statistical features including: call frequency, call type entropy, parameter diversity, and IO operation ratio, and the context association features including: process tree blood relationship and resource access chain;

[0026] The extracted feature data is labeled as normal and abnormal, the labeled feature data is divided into a training set, a validation set, and a test set, an initial LSTM model is constructed, and the initial LSTM model is trained based on the training set.

[0027] Further, the process behavior entropy value is acquired, the moving average method is adopted to smooth the behavior entropy value, and the triggering of the fuse instruction is controlled based on the monitoring of the application layer and the kernel layer, including:

[0028] The process behavior entropy value is acquired, and the moving average method is adopted to smooth the behavior entropy value.

[0029]

[0030] Wherein H(t) represents the behavior entropy value at t time, and the state space U includes: system call type, file access mode, i.e. read number and write number ratio, network connection topology, and process resource usage;

[0031]

[0032] When , the safety fuse is triggered.

[0033] When , the safety fuse is triggered.

[0034] The real-time detected data is input into the trained model to judge whether there is an anomaly, and if there is an anomaly, the safety fuse is triggered.

[0035] The application provides an industrial host control system based on artificial intelligence.

[0036] The application layer monitoring module is used for setting a white list process, and when the process accesses the industrial host, the industrial host monitors the process through a static credibility model, a dynamic credibility model and a running environment evaluation model.

[0037] The kernel layer monitoring module collects real-time syscall flow data through an eBPF behavior collector, and analyzes the syscall flow data through an AI decision engine.

[0038] The trigger fuse instruction module acquires the process behavior entropy value, smoothes the behavior entropy value through the moving average method, and controls the triggering of the fuse instruction based on the monitoring of the model and the analysis of the AI decision engine.

[0039] Further, the application layer monitoring module includes:

[0040] The storage white list process information module is used for combing all processes running on the industrial host, screening the white list process, and storing the white list process information in a database, wherein the white list process information includes: process name, process ID, executable file path, file hash value, digital signature, start parameter, running time range, required system permission and user identity.

[0041] The acquisition static credibility module is configured to, when a process accesses the industrial host, the industrial host first acquires static credibility of the process accessing the industrial host through a static credibility model by comparing SHA3-512 hash values of a first preset number of files in the process with golden hash values in a database and comparing metadata of a second preset number of files with standard metadata in the database.

[0042] The acquisition dynamic credibility module is configured to, on the basis of considering natural attenuation of trust over time, acquire dynamic credibility of runtime behavior security of the process through a dynamic credibility model by combining a comparison result of system call sequences in a preset time with a normal system call sequence set generated by historical behaviors.

[0043] The environment evaluation module is configured to acquire a quantitative evaluation value of security of an environment in which the process runs by running an environment evaluation model after weighted summation of ratios of current values of hardware-level and network-level monitoring indexes to baseline values and mapping through an activation function, the hardware-level and network-level monitoring indexes including: CPU instruction cycle abnormality rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution, and system log information.

[0044] Further, the kernel layer monitoring module further includes:

[0045] The storage static credibility model module is configured to, specifically, the static credibility model being:

[0046]

[0047] wherein, T static represents static credibility, n represents a number of files participating in static credibility hash verification, SHA3-51h(f i ) represents an SHA3-512 hash value of the i-th file, I(·) represents an indication function, if the condition in the bracket is true, the function value is 1, otherwise 0, DB g (f i ) represents a standard hash value of the i-th file, DB m (f j ) represents standard metadata of the j-th file, m represents a number of files participating in static credibility metadata verification, MData(f j ) represents metadata of the j-th file, the metadata including file size, file creation time, file modification time, file access time, file owner, file access permission, software version number, compilation time, signature status, signature certificate information, dependent file basic attributes, permission information, version information, digital signature information, and association information, DB m (f j) represents the standard metadata of the jth file, stored in the database for comparison,

[0048] a dynamic trustworthiness model module, the dynamic trustworthiness model being:

[0049]

[0050] wherein T dynamic (t) represents the dynamic trustworthiness at time t, λ(t) represents a trust decay coefficient, t represents time, L represents the number of system call sequences, b k represents the kth system call sequence, B normal represents a set of normal system call sequences generated by historical behaviors;

[0051] an environment assessment model module, the environment assessment model being

[0052]

[0053] wherein T c (t) represents an environment safety assessment value, σ(·) represents an activation function, w j represents the weight of the jth monitoring index, represents the current value of the jth monitoring index, represents the baseline value of the jth monitoring index.

[0054] Further, the judgment exception module comprises:

[0055] a key field data capturing module, configured to deploy a customized eBPF probe at a kernel layer of an industrial control host, capture full syscall events, and obtain key field data in the full syscall events, the key field data comprising: a process PID, a syscall number, a timestamp, and specific parameters passed during syscall execution;

[0056] a preprocessing module, configured to perform data cleaning and formatting on the key field data, the data cleaning and formatting comprising: invalid call filtering, i.e., filtering syscall=0 and PID exceptions; parameter desensitization, i.e., performing hash processing on sensitive parameters such as file paths and network addresses; and time sequence alignment, i.e., using a Lamport logical clock to ensure the orderliness of cross-core events;

[0057] an extraction feature module, configured to extract features in the cleaned and formatted key field data, the features comprising basic statistical features and context association features, the basic statistical features comprising: a call frequency, a call type entropy, a parameter diversity, and an IO operation ratio, and the context association features comprising: a process tree blood relationship and a resource access chain;

[0058] The training module is used to label the extracted feature data as normal and abnormal. The labeled feature data is divided into training set, validation set and test set. An initial LSTM model is constructed and trained based on the training set.

[0059] Furthermore, the circuit breaker triggering command module includes:

[0060] The module for obtaining process behavior entropy values ​​is used to obtain process behavior entropy values ​​and uses a moving average method to smooth the behavior entropy values.

[0061]

[0062] Where H(t) represents the behavioral entropy value at time t, and the state space U includes: system call type, file access mode (i.e., read / write ratio), network connection topology, and process resource usage.

[0063]

[0064] Determine whether the module is triggered, used when When this occurs, the safety circuit breaker is triggered;

[0065] when When this occurs, the safety circuit breaker is triggered;

[0066] The real-time detected data is input into the trained model to determine if there are any anomalies. If an anomaly is found, a circuit breaker is triggered.

[0067] The beneficial effects of this invention are: enhanced system security, multi-layered monitoring, combining application-layer and kernel-layer monitoring to comprehensively examine processes from different angles; application-layer monitoring can detect obvious abnormal behaviors, such as illegal file access and abnormal network connections; kernel-layer eBPF collection and AI analysis can delve into the underlying operations of processes, detecting some covert attack behaviors, greatly improving the ability to detect abnormal processes; behavioral entropy value-assisted judgment, process behavioral entropy value provides a quantitative indicator for assessing the complexity and uncertainty of process behavior; by monitoring and analyzing behavioral entropy value, processes with sudden changes in behavior patterns can be detected in a timely manner, even if these changes may be difficult to detect in traditional rule detection, thereby further enhancing system security; reduced false positive rate, smoothing processing using moving average method, the smoothing processing of behavioral entropy value can reduce the interference of short-term fluctuations, making the judgment results more stable and reliable. Attached Figure Description

[0068] Figure 1 This is a schematic diagram of an industrial host control method based on artificial intelligence as described in this invention. Detailed Implementation

[0069] In order to enable a more clear understanding of the above-mentioned objects, features and advantages of the present application, the present application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0070] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application. The described embodiments are only some of the embodiments of the present application, and are not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0071] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0072] One embodiment of the present application is an artificial intelligence-based industrial host control method, which comprises:

[0073] Setting a whitelist process, when a process accesses the industrial host, the industrial host monitors the process through a static trustworthiness model, a dynamic trustworthiness model and a running environment evaluation model; collecting real-time syscall flow data through an eBPF behavior collector, analyzing the syscall flow data through an AI decision engine; obtaining process behavior entropy values, smoothing the behavior entropy values using a moving average method, and controlling the triggering of a fuse instruction based on model monitoring and AI decision engine analysis. That is, when a process accesses the industrial host, the industrial host monitors the process accessing the industrial host through application layer data before and during process running to determine whether the process is abnormal. Then, real-time syscall flow data is collected through the eBPF behavior collector of the kernel layer of the industrial host, the syscall flow data is analyzed through the AI decision engine to determine whether it is abnormal, process behavior entropy values are obtained, and the behavior entropy values are smoothed using a moving average method to control the triggering of a fuse instruction based on application layer and kernel layer monitoring.

[0074] The working principle and effect of the above technical solution are: white list process setting and application layer monitoring, the administrator pre-determines the process list that can be trusted, adds these processes to the white list, and the processes in the white list are considered to be legal and safe, allowing them to normally access the industrial host; application layer data monitoring, when a process attempts to access the industrial host, the industrial host monitors the application layer data before and during the process running, the application layer data contains various behavior information of the process, such as the resources requested by the process, the files operated, the target address of network communication, etc., by analyzing these data, the industrial host can judge whether the process conforms to the normal behavior mode. If the process is not in the white list, or its behavior is obviously different from the normal behavior of the white list process, it may be judged as an abnormal process; eBPF (Extended Berkeley Packet Filter) is a program that can run in the kernel, with high efficiency and flexibility. The kernel layer of the industrial control host is deployed with an eBPF behavior collector, which can capture real-time syscall (system call) stream data of the process. Syscall is the interface for user programs to interact with the operating system kernel, and various operations of the process are ultimately implemented through syscall, therefore, syscall stream data can reflect the underlying behavior of the process; the collected syscall stream data is transmitted to the AI decision engine for analysis, the AI decision engine usually uses machine learning or deep learning algorithms to learn and identify normal and abnormal syscall patterns, through the training of a large amount of historical data, the engine can establish a normal behavior model. When receiving real-time syscall stream data, the engine will compare it with the normal model, if a significant deviation is found, it is judged that the process is abnormal; process behavior entropy value is used to measure the uncertainty and complexity of process behavior, state space contains system call type, file access mode, network connection topology, process resource usage and other dimensions, through the statistics and analysis of these dimensions, the entropy value of process behavior can be calculated, the higher the entropy value, the more complex and unpredictable the process behavior, and the greater the possibility of abnormality; in order to reduce the influence of short-term fluctuations of behavior entropy value on the judgment result, moving average method is used to smooth the behavior entropy value, moving average method will calculate the average value of behavior entropy value in a certain time window, so that the change of entropy value is more stable, which is convenient for observing and analyzing the long-term behavior trend; the monitoring results of the application layer and the kernel layer are combined with the smoothed process behavior entropy value to control the triggering of the fuse instruction, if the application layer monitoring finds that the process is abnormal, or the AI decision engine analyzes the syscall stream data and judges that the process is abnormal, or the process behavior entropy value exceeds the preset threshold, the fuse instruction is triggered, the connection between the process and the industrial host is cut off, to prevent further damage to the system. Enhance system security,

[0075] Multi-layer monitoring, combined with application layer and kernel layer monitoring, comprehensively checks the process from different angles. Application layer monitoring can detect some obvious abnormal behaviors, such as illegal file access and abnormal network connection. The eBPF collection and AI analysis of the kernel layer can detect some hidden attack behaviors, greatly improving the detection ability of abnormal processes. Behavior entropy value auxiliary judgment: Process behavior entropy value provides a quantitative index for evaluating the complexity and uncertainty of process behavior. Through monitoring and analysis of behavior entropy value, processes with sudden changes in behavior patterns can be detected in time, even if these changes may be difficult to detect in traditional rule detection, thereby further enhancing the security of the system. Reducing the misjudgment rate, moving average method smoothing processing: The smoothing processing of behavior entropy value can reduce the interference of short-term fluctuations, making the judgment result more stable and reliable. For example, the process may have a temporary increase in behavior entropy value at certain times due to normal business needs, but the moving average method can filter out these short-term fluctuations and avoid misjudgment as abnormal behavior. AI decision engine learning ability: The AI decision engine can continuously optimize the recognition ability of normal and abnormal behaviors through learning and training on a large amount of historical data. It can adapt to different system environments and business scenarios, reducing misjudgments caused by environmental changes or business demand changes. Fast response and protection: Real-time monitoring and analysis: The entire monitoring and analysis process is carried out in real time, which can timely detect abnormal behaviors of processes. Once an anomaly is detected, the system can quickly trigger a fuse instruction to cut off the connection between the abnormal process and the industrial host, preventing the spread of attacks and further damage to the system, and ensuring the stable operation of the industrial host. White list mechanism: The white list process setting provides flexibility, and administrators can dynamically adjust the process list in the white list according to actual business needs and security policies. At the same time, for new processes not in the white list, the system can also judge whether they are safe through real-time monitoring and analysis, with good scalability. AI decision engine trainability: The AI decision engine can adapt to new attack patterns and behavior characteristics by continuously updating training data. As the system runs and data accumulates, the performance of the engine can be continuously improved to better cope with increasingly complex security threats.

[0076] In an embodiment of the present application, a white list process is set, and when a process accesses the industrial host, the industrial host monitors the process through a static trustworthiness model, a dynamic trustworthiness model, and a running environment evaluation model, including:

[0077] The whitelist process of the industrial host is set, and information of the whitelist process is stored through a database; when a process accesses the industrial host, the industrial host obtains static trustworthiness of the process through SHA3-512 hash value comparison and metadata comparison in a static trustworthiness model; based on comparison results of a normal system call sequence set constructed based on system call sequences in a preset time and historical behaviors, dynamic trustworthiness of runtime behavior security of the process is obtained through a dynamic trustworthiness model; a quantitative evaluation value of environment security in which the process runs is obtained through an environment evaluation model, that is, all processes running on the industrial host are sorted, and whitelist processes are screened out, information of the whitelist processes is stored through the database, and the information of the whitelist processes includes: process name, process ID, executable file path, file hash value, digital signature, startup parameter, runtime range, required system permission, and user identity; when a process accesses the industrial host, the industrial host first compares SHA3-512 hash values of a first preset number of files in the process with golden hash values in the database and compares metadata of a second preset number of files with standard metadata in the database, that is, static trustworthiness of the process accessing the industrial host is obtained through the static trustworthiness model; based on considering natural attenuation of trust over time, dynamic trustworthiness of runtime behavior security of the process is obtained through the dynamic trustworthiness model in combination with comparison results of system call sequences in a preset time and a normal system call sequence set generated by historical behaviors; a ratio of current values of each hardware level and network level monitoring index to baseline values is weighted and summed, and then a quantitative evaluation value of environment security in which the process runs is obtained through the running environment evaluation model after being mapped through an activation function, and the each hardware level and network level monitoring index includes: CPU instruction cycle abnormality rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution, and system log information.

[0078] The working principle and effects of the above technical solution are as follows: white list process carding and storage, process carding and screening, comprehensively carding all processes running on the industrial host, screening out processes considered to be safe and reliable according to the system security policy and business requirements, and including the processes in the white list; storing detailed information of the white list processes in the database, such as process name, process ID, executable file path, file hash value, digital signature, start parameter, running time range, required system permission, user identity, etc. These information serves as an important basis for subsequent process legitimacy judgment; when a process accesses the industrial host, a first preset number of files are selected from the process, the SHA3-512 hash value of the files is calculated, and the hash value is compared with the golden hash value of the corresponding file stored in the database. If the hash values are consistent, it means that the file content has not been tampered with; if they are not consistent, it may indicate that the file has been maliciously modified; at the same time, a second preset number of files are selected, and the metadata (such as file size, creation time, modification time, etc.) of the files is compared with the standard metadata stored in the database. Abnormal changes in metadata may also indicate that the file has security risks; based on the results of hash value comparison and metadata comparison, the static trustworthiness of the process is calculated through a static trustworthiness model, which reflects the security of the process at the file level; trust naturally decays, considering that trust will naturally decay over time, even if the process was previously safe, it may become unsafe due to changes in the system environment or attacks, therefore, when evaluating the dynamic trustworthiness of the process, a trust decay mechanism is introduced; system call sequence comparison, combining the system call sequence of the process within a preset time, and comparing it with the normal system call sequence set generated by the Markov chain model constructed from historical behaviors, the Markov chain model can describe the normal system call behavior pattern of the process, if the system call sequence of the current process differs greatly from the normal sequence, it means that the running behavior of the process may be abnormal; based on the results of trust decay and system call sequence comparison, the dynamic trustworthiness of the running behavior of the process is calculated through a dynamic trustworthiness model, which reflects the behavior security of the process during running; the current values of various hardware-level and network-level monitoring indicators are collected, including CPU instruction cycle anomaly rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution, and system log information, etc. These indicators can reflect the state of the environment in which the process runs; the weighted sum of the ratio of the current value of each monitoring indicator to the baseline value is calculated, the weight of each monitoring indicator is set according to its importance to system security, then the result of the weighted sum is mapped through an activation function to convert it into a quantitative evaluation value within a certain range; through a running environment evaluation model, the quantitative evaluation value is taken as the evaluation result of the security of the environment in which the process runs, which reflects the influence of the process running environment on its security.The system security is enhanced, the process is comprehensively evaluated from three dimensions of static file layer, dynamic running behavior layer and running environment layer, the security risk of the process can be more accurately identified, for example, the static trustworthiness model can detect whether the file is tampered, the dynamic trustworthiness model can find the abnormality of the process running behavior, and the running environment evaluation model can evaluate the influence of environmental factors on the safety of the process, so that various types of attacks can be effectively prevented; by comparing the hash value, metadata, system call sequence and monitoring index in real time, the abnormal change of the process can be found in time. Once the abnormality is found, the system can take corresponding measures, such as limiting the process permission, terminating the process and the like, to prevent the occurrence and spread of security events; the trustworthiness evaluation accuracy is improved, the time factor is considered, the dynamic trustworthiness model considers the natural attenuation of trust with time, so that the trustworthiness evaluation is more in line with the actual situation. With the passage of time, the safety of the process may change, by introducing the trust decay mechanism, the trust degree of the process can be adjusted in time, and the potential security risk caused by long-term trust can be avoided; based on historical behavior modeling, a Markov chain model is used to generate a set of normal system call sequences, which is used as a reference standard for dynamic trustworthiness evaluation. The model is constructed based on the historical behavior of the process, which can accurately describe the normal behavior mode of the process, and improves the identification ability of abnormal behavior; the monitoring index is comprehensively considered, the running environment evaluation model comprehensively considers multiple hardware-level and network-level monitoring indexes, which can comprehensively reflect the state of the environment where the process runs. In a complex industrial environment, various factors may affect the safety of the process, by monitoring and evaluating these indexes, the influence of environmental changes on the safety of the process can be found in time, and corresponding measures can be taken for prevention; scalability, the technical solution has certain scalability, and monitoring indexes and evaluation models can be added or adjusted according to actual needs, to adapt to the safety needs of different industrial scenes; provide quantitative evaluation results, static, dynamic trustworthiness and environment evaluation value: through the static trustworthiness model, the dynamic trustworthiness model and the running environment evaluation model, the quantitative evaluation values of the static trustworthiness, the dynamic trustworthiness and the running environment safety of the process are obtained, which provides intuitive reference for system administrators, and helps them better understand the safety status of the process and make more accurate decisions.

[0079] In an embodiment of the present application, the static trustworthiness model obtains the static trustworthiness of the process by comparing the SHA3-512 hash value of the first preset number of files in the process with the golden hash value in the database and comparing the metadata of the second preset number of files with the standard metadata in the database. Specifically, the static trustworthiness model is:

[0080]

[0081] Wherein, T static represents the static trustworthiness, n represents the number of files participating in the static trustworthiness hash verification, SHA3-51h(fi ) represents the SHA3-512 hash value of the i-th file, I(·) represents an indication function, and the function value is 1 if the condition in the parentheses is true, otherwise 0, DB g (f i ) represents the standard hash value of the i-th file, DB m (F j ) represents the standard metadata of the j-th file, m represents the number of files participating in the static trustworthiness metadata verification, and MData(f j ) represents the metadata of the j-th file, and the metadata includes file size, file creation time, file modification time, file access time, file owner, file access permission, software version number, compilation time, signature status, signature certificate information, dependent file basic attributes, permission information, version information, digital signature information, and association information, DB m (f j ) represents the standard metadata of the j-th file, which is stored in the database for comparison,

[0082] The dynamic trustworthiness model obtains the dynamic trustworthiness by combining the comparison result of the system call sequence in a preset time and the normal system call sequence set generated by historical behaviors, and specifically, the dynamic trustworthiness model is:

[0083]

[0084] Wherein, T dynamic (t) represents the dynamic trustworthiness at time t, λ(t) represents a trust decay coefficient, t represents time, L represents the number of system call sequences, b k represents the k-th system call sequence, B normal represents the normal system call sequence set generated by historical behaviors;

[0085] The construction of the normal system call sequence is essentially modeling the historical system call sequence, and the mathematical formal definition and calculation process are as follows:

[0086] Define the state space, let the system call type set be Where each s i represents a specific system call (such as open, read, execve), and by counting the system call sequences generated by all legal white-listed applications in historical data, a state transition probability matrix P ∈ R n×n ,

[0087] Calculate the transition probability,

[0088] (1) Construct the original count matrix, and count the first-order transition frequency from the historical data:

[0089] N(si →s j = count(in historical data, system call s) = count(in historical data, system call s) i Following closely behind s j (number of times)

[0090] For each state s i Calculate the probability distribution of its transition to other states:

[0091]

[0092] Where ∈ represents the smoothing factor (usually Laplace smoothing ε = 1 × 10^{-6}), used to avoid zero probability problems. Indicates from s i The sum of all transfers from the starting point;

[0093] For a given system call sequence b = (b1, b2, ..., b3) h , ..., b K The probability that this is normal behavior is:

[0094]

[0095] To avoid numerical underflow in actual calculations, logarithmic probability form is used:

[0096]

[0097] For real-time captured syscall sequences, b current = (b1, ..., b) K The rules for determining whether it is abnormal are as follows: Then it is judged as abnormal;

[0098] Where the threshold τ threshold Calculated using historical normal data:

[0099] τ threshold =μ normal -3σ normal

[0100] μ normal σ represents the mean of the logarithmic probabilities of a historical normal sequence. normal The standard deviation represents the log probability of a historical normal sequence.

[0101] To adapt to changes in system behavior, B can be updated incrementally periodically. normal Add the sequence of syscalls that did not trigger the circuit breaker to the historical dataset and update the sliding window:

[0102] N new (s i →s j) = aN old (s i → s j ) + (1 - a)N recent (s i → s j )

[0103] wherein a e [0, 1] is a forgetting factor;

[0104] The environment assessment model is used for weighting and summing the ratio of the current value of each hardware level and network level monitoring index to the baseline value, and then mapping through an activation function to obtain a quantitative assessment value of the security of the environment where the process runs, the hardware level and network level monitoring index includes: CPU instruction cycle abnormality rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution and system log information, specifically, the environment assessment model is

[0105]

[0106] wherein T c (t) represents the environment security assessment value, σ(·) represents an activation function, w j represents the weight of the jth monitoring index, represents the current value of the jth monitoring index, represents the baseline value of the jth monitoring index.

[0107] The working principle and effects of the above technical solution are as follows: the static credibility model mainly evaluates the security of the process at the file level by checking the hash value and metadata of the file. The specific steps are as follows: hash value checking: for n files participating in static credibility hash checking, the SHA3-512 hash value of each file is calculated and compared with the standard hash value of the corresponding file stored in the database. An indicator function is used to determine whether the two are equal. If they are equal, the function value is 1, otherwise it is 0. The sum of the comparison results of all files is divided by the number of files to obtain the score of the hash value checking; for m files participating in static credibility metadata checking, the metadata of each file is obtained and compared with the standard metadata of the corresponding file stored in the database. Similarly, an indicator function is used to determine whether the two are equal. The sum of the comparison results of all files is divided by the number of files to obtain the score of the metadata checking. The static credibility calculation adds the hash value checking score and the metadata checking score to obtain the final static credibility. The value range of the static credibility is between 0 and 2. The closer the value is to 2, the higher the static security of the file. The dynamic credibility model mainly considers the natural decay of trust over time and the matching degree of the system call sequence of the process with the normal sequence to evaluate the security of the running behavior of the process. The specific steps are as follows: a trust decay coefficient is introduced, which will be dynamically adjusted in time according to the historical attack situation and the current security situation of the system. With the passage of time, trust will naturally decay, and an exponential function is used to describe this decay process; the number of system call sequences within a predetermined time is counted. For each system call sequence, it is determined whether it belongs to the set of normal system call sequences generated by the Markov chain model constructed from historical behavior. An indicator function is used to determine whether it is in the normal system call sequence set B normalIn the specific implementation, the function value is 1 if the system call sequence is normal, and 0 otherwise. The sum of the comparison results of all system call sequences is divided by the number of sequences to obtain the proportion of abnormal system call sequences; the dynamic trustworthiness is calculated by subtracting the proportion of abnormal system call sequences from 1 and multiplying the result by the coefficient after trust decay to obtain the dynamic trustworthiness at time t, and the dynamic trustworthiness ranges from 0 to 1, and the closer the value is to 1, the safer the dynamic behavior of the process is; the environment assessment model mainly assesses the safety of the environment in which the process runs by comparing the current values of the hardware-level and network-level monitoring indicators with the baseline values, and performing weighted summation and activation function mapping. The specific steps are as follows: monitoring indicator collection and comparison: collect the current values of the hardware-level and network-level monitoring indicators, and compare them with the corresponding baseline values to calculate the ratio of the two; assign a weight to each monitoring indicator, multiply the ratio of each monitoring indicator by its weight, and then add all the results to obtain the weighted summation result; input the weighted summation result into the activation function for mapping to obtain the final environment safety assessment value, and the activation function usually maps the input value to a specific interval, and the closer the value is to 1, the safer the environment in which the process runs is. Enhanced security, multi-dimensional assessment: the static trustworthiness model, the dynamic trustworthiness model, and the environment assessment model comprehensively assess the process from different angles to find potential security risks. The static trustworthiness model can detect whether a file has been tampered with, the dynamic trustworthiness model can find abnormalities in the process running behavior, and the environment assessment model can assess the impact of the running environment on the process security, thereby effectively preventing various types of attacks; timely detection of abnormalities: real-time comparison of hash values, metadata, system call sequences, and monitoring indicators can timely detect abnormal changes in processes and environments. Once an abnormality is found, the system can take appropriate measures such as limiting process permissions, terminating processes, etc., to prevent security incidents from occurring and spreading; improve trust assessment accuracy: the dynamic trustworthiness model considers the natural decay of trust over time, making trust assessment more in line with actual conditions. As time passes, the security of a process may change, and by introducing a trust decay mechanism, the trust level of a process can be adjusted in a timely manner to avoid ignoring potential security risks due to long-term trust; historical behavior modeling: the Markov chain model is used to generate a set of normal system call sequences as a reference standard for dynamic trustworthiness assessment. This model is based on the historical behavior of a process and can accurately describe the normal behavior patterns of a process, improving the ability to identify abnormal behavior; the environment assessment model considers multiple hardware-level and network-level monitoring indicators to comprehensively reflect the state of the environment in which a process runs; in complex industrial environments, various factors can affect the security of a process, and by monitoring and assessing these indicators, the impact of environmental changes on process security can be detected in a timely manner and appropriate measures can be taken to prevent it.

[0108] An embodiment of the application, then through the eBPF behavior collector of the kernel layer of the industrial control host collects real-time syscall flow data, analyzes the syscall flow data through an AI decision engine, and judges whether it is abnormal, including:

[0109] The eBPF probe captures all syscall events and obtains key field data in the all syscall events;

[0110] The key field data is cleaned and formatted, features in the cleaned and formatted key field data are extracted, the extracted feature data is divided into a training set, a validation set and a test set, an initial LSTM model is constructed, and the initial LSTM model is trained based on the training set. That is, a customized eBPF probe is deployed in the kernel layer of the industrial control host to capture all syscall events, obtain key field data in the all syscall events, and the key field data includes process PID, syscall number, timestamp and specific parameters passed when the syscall is executed.

[0111] The key field data is cleaned and formatted, and the data cleaning and formatting includes: invalid call filtering, i.e. filtering syscall=0 and PID anomaly, parameter desensitization, i.e. hashing sensitive parameters such as file path and network address, and time sequence alignment, i.e. using Lamport logical clock to ensure the order of cross-core events.

[0112] Features in the cleaned and formatted key field data are extracted, and the features include basic statistical features and context association features, the basic statistical features include call frequency, call type entropy, parameter diversity and IO operation ratio, and the context association features include process tree blood relationship and resource access chain.

[0113] The extracted feature data is labeled as normal and abnormal, the labeled feature data is divided into a training set, a validation set and a test set, an initial LSTM model is constructed, and the initial LSTM model is trained based on the training set.

[0114] The working principle and effect of the above technical solution are as follows: eBPF (Extended Berkeley Packet Filter) is a powerful technology in the Linux kernel that allows users to dynamically load and execute custom programs in the kernel without modifying the kernel code. Deploying customized eBPF probes in the kernel layer of the industrial host, these probes will be mounted at key positions related to system calls (syscalls) in the kernel; when a process in the system initiates a system call, the probe will be triggered, capturing all syscall events; then, extract key field data from these events, such as process PID to identify which process initiated the call, syscall number to determine which system function the call is specific to, timestamp to record the time of the call, and specific parameters to contain detailed information passed during the call, which is crucial for subsequent analysis of process behavior; data cleaning and formatting, invalid call filtering: syscall=0 usually represents an invalid system call, and abnormal PID (such as negative or beyond reasonable range) may be caused by data errors or abnormal situations, filtering these invalid data can reduce noise interference, so that subsequent analysis is based on more accurate and effective data; parameter desensitization, file path, network address, etc. are sensitive parameters that contain important system information. In order to protect the security and privacy of the system, these parameters are hashed, which converts sensitive information into fixed-length hash values, preserving the characteristics of the data while avoiding direct leakage of sensitive information; in a multi-core system, the event occurrence time on different cores may not be consistent due to hardware and scheduling reasons. Lamport logical clock is an algorithm used to assign logical timestamps to events in a distributed system, which can ensure the order of cross-core events, so that subsequent feature extraction and analysis can be based on the correct time sequence; feature extraction, basic statistical features: call frequency: statistics of the number of system calls per unit time, which reflects the activity intensity of the process. If the call frequency of a process suddenly increases or decreases, it may indicate that the behavior of the process has deviated from the norm; call type entropy: used to measure the diversity of system call types. The higher the entropy value, the more dispersed the call types; the lower the entropy value, the more concentrated the call types. Abnormal processes may exhibit different call type distribution from normal processes; parameter diversity: analyze the variation of system call parameters, reflecting the flexibility of the process in calling system functions.Anomalous changes in parameter diversity may suggest abnormal process behavior, such as a malicious process may use some uncommon parameters to perform specific operations; IO operation ratio: calculates the proportion of input-output (IO) related system calls in total calls, reflects the degree of IO activity of the process, abnormal IO operation ratio may be related to data leakage, malicious file reading and writing, etc. Context-related features: process tree blood relationship: by analyzing the parent-child relationship and ancestor relationship of the process, understand the creation and inheritance of the process; abnormal process tree structure may indicate the creation or disguise of malicious processes, such as an unknown process suddenly creating a large number of child processes; resource access chain: records the access order and relationship of the process to system resources (such as files, network ports, devices, etc.), can find abnormal resource access patterns, such as illegal file access, abnormal network connection, etc. Data labeling and dataset division, label the extracted feature data, divide it into normal and abnormal two categories. The basis of labeling can be security rules, expert experience or known normal and abnormal behavior patterns in history. Then divide the labeled feature data into training set, validation set and test set; the training set is used to train the initial LSTM model, so that the model learns the feature patterns of normal and abnormal behavior; the validation set is used to evaluate the performance of the model during training, adjust the hyperparameters of the model (such as learning rate, number of hidden layer neurons, etc.), to prevent the model from overfitting; the test set is used to finally evaluate the generalization ability of the model, to ensure that the model can also have good performance on unseen data; LSTM (Long Short-Term Memory Network) is a special kind of recurrent neural network (RNN) that can handle long-term dependencies in sequence data. In this scheme, the feature sequence of system calls is taken as input, and the LSTM model learns the patterns and rules in the sequence. During training, the model will continuously adjust its parameters (such as weights and biases) based on the input feature data and corresponding labels (normal or abnormal) to minimize the error between the predicted results and the true labels. Through multiple iterations of training, the model gradually learns the feature representation of normal and abnormal behavior, thereby acquiring the ability to predict anomalies on new data. Enhance the security of industrial control systems, anomaly behavior detection, through comprehensive monitoring and analysis of system call events, can timely discover abnormal process behavior, such as malicious software activity, illegal data access, etc. The LSTM model can learn the normal system call pattern, and when there is behavior that does not conform to the normal pattern, it can issue an alarm to help administrators take timely measures to prevent the system from being attacked; privacy protection, parameter desensitization processing ensures that sensitive information in the system will not be leaked, protects the privacy and security of the industrial control host, avoids potential risks caused by information leakage; improve system stability, performance optimization, by analyzing the frequency of system calls, IO operation ratio, etc.The administrator can optimize the system according to the information, reasonably allocate resources, improve the operation efficiency and stability of the system, for example, if it is found that the call frequency of a certain process is too high to cause the system performance to decline, the process can be optimized or limited; fault prediction, abnormal system call mode may be an early sign of system failure. By continuously monitoring and analyzing system call events, potential failures can be detected in advance, preventive maintenance can be performed, system downtime can be reduced, and losses caused by system failure can be reduced; provide explainability and traceability, behavior analysis, and extract basic statistical features and context-related features to provide detailed process behavior information for administrators. By analyzing these features, the activities of the process can be understood in depth, and the root cause of abnormal behavior can be found to provide strong support for security auditing and troubleshooting, for example, through the process tree blood relationship, the origin of the abnormal process can be traced; event tracing, time stamp and process tree blood relationship information enable administrators to trace the occurrence process of system call events, understand the sequence and correlation of events, and help restore the overall picture of the event to provide a basis for subsequent investigation and processing; the scheme is based on eBPF technology and has good adaptability and scalability. The eBPF probe can be customized according to different industrial control system requirements and can flexibly capture different types of system call events. At the same time, the LSTM model can continuously learn by updating the training data to adapt to new abnormal behavior patterns and attack methods to ensure the security and stability of the system.

[0115] In one embodiment of the present application, the process behavior entropy value is obtained, the behavior entropy value is smoothed by using the moving average method, and the triggering of the monitoring control fuse instruction based on the application layer and the kernel layer includes:

[0116] The process behavior entropy value is obtained, and the behavior entropy value is smoothed by using the moving average method;

[0117]

[0118] Wherein H(t) represents the behavior entropy value at time t, the state space U includes: system call type, file access mode, i.e., read frequency and write frequency ratio, network connection topology, and process resource usage;

[0119]

[0120] When , the safety fuse is triggered;

[0121] When , the safety fuse is triggered;

[0122] The real-time detected data is input into the trained model to determine whether there is an anomaly, and if there is an anomaly, the safety fuse is triggered.

[0123] The historical time is divided into multiple equal-length time windows, and the number of attacks in each window is counted respectively; different time windows are assigned different weights, and the weight of the window closer to the current time is greater, so as to reflect that the recent attack situation has greater influence on the current risk assessment; different attacks have different severity, and a severity coefficient can be assigned to each attack, which is considered in the calculation of attack frequency.

[0124]

[0125] wherein n represents the number of divided time windows, t i represents the ith time window, N i represents the number of attacks detected in the ith time window, S ij represents the severity coefficient of the jth attack in the ith time window, w i represents the weight of the ith time window, and satisfies Δt i represents the duration of the ith time window, wherein wherein A∈(0, 1) is an attenuation coefficient.

[0126] The working principle and effect of the above technical solution are: effectively identifying abnormal behavior, multi-dimensional analysis, calculating behavior entropy value by comprehensively considering system call type, file access mode, network connection topology and process resource usage, which can comprehensively describe the behavior characteristics of the process, so as to more accurately find abnormal behavior. For example, when the network connection topology of the process suddenly becomes complex (Shannon entropy increases), and the file access mode also changes abnormally, the behavior entropy value will change accordingly, which helps to discover potential security threats in time; Smooth processing and statistical judgment, moving average method is used to smooth the behavior entropy value, which reduces the influence of noise and short-term fluctuations, making the abnormal judgment based on entropy value more reliable. Combined with statistical methods (such as comparison with mean and standard deviation), it can effectively identify abnormal situations that deviate from normal behavior patterns, improving the accuracy of anomaly detection; Dynamic adaptation to system state, considering the melting condition of multiple factors: the second melting trigger condition comprehensively considers the process related threshold, behavior entropy value change rate, system load and historical attack frequency and other factors. This makes the melting mechanism able to dynamically adjust the trigger threshold according to the real-time state and historical situation of the system, for example, appropriately increasing the melting threshold when the system load is high, to avoid false triggering of melting due to normal business fluctuations; Appropriately increase the threshold when the historical attack frequency is low to reduce unnecessary melting operations; Adaptability of trained model, through the trained model to judge the real-time data, the model can learn the normal and abnormal behavior patterns under different conditions, and can adapt to the changes of system state with the continuous update and learning of data, improve the detection ability of new abnormal behavior; Timely trigger the security melting mechanism, when detecting process behavior anomaly, quickly cut off related processes or connections to prevent abnormal behavior from causing further damage to the system, ensuring the safety and stability of the industrial host or system. For example, when malicious software tries to attack through abnormal system calls or network connections, the melting can be triggered in time to prevent the spread of attacks and the expansion of damage; Through accurate anomaly detection and reasonable melting mechanism, the system downtime caused by abnormal behavior is reduced, and the reliability and availability of the system are improved. At the same time, the dynamic adaptation ability to system state also enables the system to run stably under different workloads and security environments. When calculating the historical average attack frequency, the time decay factor is considered. In the security field, recent attack events are more likely to reflect the current security risks of the system than long-term attack events. As time goes by, the security status, protection measures and attacker's means of the system may change, and the reference value of long-term attack events for current risk assessment gradually decreases. Therefore, by setting an exponential decay weight, the more recent time window is given a greater weight, and the farther time window is given a smaller weight, which can more reasonably reflect the importance of attack data in different time windows; Different attack events cause different degrees of harm to the system.For example, a data breach attack may be much more serious than a simple network scanning attack. Therefore, when calculating the attack frequency, the attack severity coefficient is introduced, which can more comprehensively measure the impact of the attack on the system. By quantifying the severity of each attack event and considering it in the calculation, it can avoid only relying on the number of attacks to assess the risk and ignore the actual harm of the attack; Different time windows may have different lengths, for example, in some cases, in order to analyze the recent attack situation more carefully, the recent time may be divided into shorter time windows, while the long-term time adopts longer time windows. Therefore, when calculating the historical average attack frequency, the length of each time window needs to be considered, and the length is weighted and summed to ensure that different length time windows contribute reasonably to the final result. More accurately reflect the current security risk, since the time decay factor is considered, the formula can focus more on recent attack events, thus more accurately reflecting the current security risk faced by the system. This helps security managers to discover changes in security posture in a timely manner and take appropriate protective measures, for example, if the number of attacks increases or the severity of attacks increases in the recent period, the historical average attack frequency calculated by the formula will increase accordingly, reminding the manager to strengthen security protection. Combined with the attack severity coefficient, the formula can consider both the number and severity of attacks, providing a more comprehensive attack frequency evaluation index, which makes security assessment not only focus on the number of attacks, but also considers the actual harm caused by the attack, which helps to more accurately assess the security status of the system. For example, although the number of attacks in a period of time is small, the severity of each attack is high, so the calculated attack frequency will also be high, indicating that the system faces a greater security risk. Considering the length difference of the time window makes the formula more flexible and adaptable. According to actual needs, the historical time can be divided into different numbers and lengths of time windows, and the formula can reasonably process these different division methods to ensure the accuracy and reliability of the calculation result. For example, when performing short-term security analysis, the time window can be divided more finely; when performing long-term trend analysis, longer time windows can be used, and the formula can effectively calculate the corresponding historical average attack frequency. The historical average attack frequency calculated by the formula can be used as an important security indicator to provide decision-making basis for security decision management.

[0127] In one embodiment of the present application, an industrial host control system based on artificial intelligence, the system comprises:

[0128] The application layer monitoring module is used for setting a white list process, and when a process accesses the industrial host, the industrial host monitors whether the process accessing the industrial host is abnormal through application layer data before and during process running.

[0129] The kernel layer monitoring module then collects real-time syscall flow data through an eBPF behavior collector of a kernel layer of the industrial host, analyzes the syscall flow data through an AI decision engine, and determines whether an exception exists.

[0130] The trigger fusing instruction module is configured to obtain process behavior entropy values, smooth the behavior entropy values by using a moving average method, and control the triggering of the fusing instruction based on the monitoring of the application layer and the kernel layer.

[0131] In an embodiment of the present application, the application layer monitoring module comprises:

[0132] The storage whitelist process information module is configured to sort all processes running on the industrial host, and filter out whitelist processes, wherein the whitelist process information is stored in a database, and the whitelist process information comprises a process name, a process ID, an executable file path, a file hash value, a digital signature, a startup parameter, a running time range, a required system permission, and a user identity.

[0133] The acquisition static trustworthiness module is configured to, when a process accesses the industrial host, first acquire a static trustworthiness of the process accessing the industrial host through a static trustworthiness model by comparing SHA3-512 hash values of a first preset number of files in the process with golden hash values in a database and comparing metadata of a second preset number of files with standard metadata in the database.

[0134] The acquisition dynamic trustworthiness module is configured to, on the basis of considering natural attenuation of trust over time, acquire a dynamic trustworthiness of runtime behavior security of a process by a dynamic trustworthiness model in combination with a comparison result of system call sequences in a preset time and a normal system call sequence set generated by historical behaviors.

[0135] The environment evaluation module is configured to perform weighted summation on a ratio of current values of each hardware level and network level monitoring index to baseline values, and then perform mapping through an activation function to acquire a quantitative evaluation value of environment security in which a process runs by running an environment evaluation model, wherein the each hardware level and network level monitoring index comprises a CPU instruction cycle abnormality rate, a memory access entropy, a DMA request frequency, a network traffic rate, a network traffic distribution, and system log information.

[0136] In an embodiment of the present application, the kernel layer monitoring module further comprises:

[0137] The storage static trustworthiness model module is configured to store a static trustworthiness model, and specifically, the static trustworthiness model is:

[0138]

[0139] T staticrepresents static credibility, n represents the number of files participating in static credibility hash verification, SHA3-51h(f i ) represents the SHA3-512 hash value of the i th file, I(·) represents an indication function, and the function value is 1 if the condition in the bracket is true, otherwise 0, DB g (f i ) represents the standard hash value of the i th file, DB m (f j ) represents the standard metadata of the j th file, m represents the number of files participating in static credibility metadata verification, MData(f j ) represents the metadata of the j th file, and the metadata includes file size, file creation time, file modification time, file access time, file owner, file access permission, software version number, compilation time, signature state, signature certificate information, dependent file basic attribute, permission information, version information, digital signature information and association information, DB m (f j ) represents the standard metadata of the j th file, which is stored in the database for comparison,

[0140] The dynamic credibility model is stored in the dynamic credibility model module, and the dynamic credibility model is:

[0141]

[0142] Wherein, T dynamic (t) represents the dynamic credibility at time t, λ(t) represents the trust decay coefficient, t represents time, L represents the number of system call sequences, b k represents the k th system call sequence, B normal represents a set of normal system call sequences generated by historical behaviors;

[0143] The environment evaluation model is stored in the environment evaluation model module, and the environment evaluation model is

[0144]

[0145] Wherein, T c (t) represents the environment safety evaluation value, σ(·) represents the activation function, w j represents the weight of the j th monitoring index, represents the current value of the j th monitoring index, represents the baseline value of the j th monitoring index.

[0146] In one embodiment of the application, the judgment exception module comprises:

[0147] A capture key field data module is configured to deploy a customized eBPF probe in a kernel layer of an industrial control host, capture full syscall events, and obtain key field data in the full syscall events, wherein the key field data includes a process PID, a syscall number, a timestamp, and specific parameters passed during syscall execution.

[0148] A preprocessing module is configured to perform data cleaning and formatting on the key field data, wherein the data cleaning and formatting includes invalid call filtering (i.e., filtering syscall=0 and PID abnormalities), parameter desensitization (i.e., performing hash processing on sensitive parameters such as file paths and network addresses), and time sequence alignment (i.e., using a Lamport logical clock to ensure the orderliness of cross-core events).

[0149] An extraction feature module is configured to extract features from the cleaned and formatted key field data, wherein the features include basic statistical features and context-related features, the basic statistical features include call frequency, call type entropy, parameter diversity, and IO operation ratio, and the context-related features include process tree blood relationship and resource access chain.

[0150] A training division module is configured to label the extracted feature data as normal and abnormal, divide the labeled feature data into a training set, a validation set, and a test set, construct an initial LSTM model, and train the initial LSTM model based on the training set.

[0151] In an embodiment of the present application, the trigger fuse instruction module includes:

[0152] A process behavior entropy value acquisition module is configured to acquire a process behavior entropy value and smooth the behavior entropy value by using a moving average method.

[0153]

[0154] wherein H(t) represents a behavior entropy value at time t, and a state space U includes a syscall type, a file access mode (i.e., a read count / write count ratio), a network connection topology, and a resource usage of a process.

[0155]

[0156] A judgment module is configured to trigger a security fuse when .

[0157] trigger a security fuse when .

[0158] input real-time detected data into a trained model to determine whether an anomaly exists, and trigger a security fuse if an anomaly exists.

[0159] It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application cover modifications and variations of this application provided they come within the scope of the appended claims and their equivalents.

Claims

1. An industrial host control method based on artificial intelligence, characterized in that, The method includes: A whitelist of processes is set up. When a process accesses the industrial host, the industrial host monitors the process using a static trust model, a dynamic trust model, and a runtime environment evaluation model. The static trust model is as follows: ； in, This represents the static trustworthiness, where n represents the number of files participating in the static trustworthiness hash verification. This represents the SHA3-512 hash value of the i-th file, and I(·) denotes an indicator function. The function value is 1 if the condition within the parentheses is true, and 0 otherwise. The standard hash value of the i-th file is represented by m, where m represents the number of files participating in the static trust metadata verification. This represents the metadata of the j-th file, which includes file size, file creation time, file modification time, file access time, file owner, file access permissions, software version number, compilation time, signature status, signature certificate information, basic attributes of dependent files, permission information, version information, digital signature information, and associated information. The standard metadata representing the j-th file is stored in the database for comparison. The dynamic credibility model is as follows: ； in, This represents the dynamic reliability at time t. This represents the trust decay coefficient, where t represents time and L represents the number of system call sequences. This represents the k-th system call sequence. This represents the set of normal system call sequences generated from historical behavior; The environmental assessment model is as follows: ； in, Indicates the environmental safety assessment value. (·) represents the activation function. This represents the weight of the j-th monitoring indicator. This represents the current value of the j-th monitoring indicator. This represents the baseline value of the j-th monitoring indicator; Real-time syscall stream data is collected through the eBPF behavior collector, and the syscall stream data is analyzed through the AI ​​decision engine. The process behavior entropy value is obtained, and a moving average method is used to smooth the entropy value. The triggering of circuit breaker instructions is controlled based on model-based monitoring and AI decision engine analysis; including: Obtain the process behavior entropy value and smooth it using the moving average method; ； in, Let represent the behavioral entropy value at time t. The state space U includes: system call type, file access mode (i.e., read / write ratio), network connection topology, and process resource usage. p(s|t) represents the probability of system call type s occurring within the time window t. ； in, The entropy represents the behavior at time t, and M represents the size of the smoothing window; when When this occurs, the safety circuit breaker is triggered, in which... This represents the historical normal entropy mean. This represents the standard deviation of historical normal entropy. Indicates the length of the time window; when When this occurs, the safety circuit breaker is triggered, in which... Represents the sensitivity coefficient to entropy changes. The time derivative of behavioral entropy. This indicates the preset dynamic threshold baseline value. This indicates the historical average attack frequency; ； in, , Indicates the weighting coefficient. The real-time detected data is input into the trained model to determine if there are any anomalies. If an anomaly is found, a circuit breaker is triggered.

2. The industrial host control method based on artificial intelligence according to claim 1, characterized in that, A whitelist of processes is set up. When a process accesses the industrial host, the industrial host monitors the process using a static trust model, a dynamic trust model, and an operating environment evaluation model, including: All processes running on the industrial host are reviewed, and a whitelist of processes is selected. The whitelist process information is stored in a database and includes: process name, process ID, executable file path, file hash value, digital signature, startup parameters, running time range, required system permissions, and user identity. When a process accesses the industrial host, the industrial host first compares the SHA3-512 hash value of a first preset number of files in the process with the golden hash value in the database, and compares the metadata of a second preset number of files with the standard metadata in the database. That is, it obtains the static trustworthiness of the process accessing the industrial host through a static trustworthiness model. Based on the consideration of the natural decay of trust over time, and combined with the comparison results of the system call sequence within a preset time period with the set of normal system call sequences generated from historical behavior, the dynamic trustworthiness of process runtime behavior security is obtained through a dynamic trustworthiness model. The weighted sum of the ratios of the current values ​​of each hardware-level and network-level monitoring indicator to the baseline values ​​is then applied through an activation function mapping. Finally, a quantitative assessment value of the security of the environment in which the process runs is obtained through a runtime environment assessment model. The hardware-level and network-level monitoring indicators include: CPU instruction cycle anomaly rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution, and system log information.

3. The industrial host control method based on artificial intelligence according to claim 1, characterized in that, Real-time syscall stream data is collected via an eBPF behavior collector, and analyzed by an AI decision engine, including: A customized eBPF probe is deployed at the kernel layer of the industrial control host to capture all syscall events and obtain key field data from all syscall events. The key field data includes: process PID, syscall number, timestamp, and specific parameters passed when the syscall is executed. The key field data is cleaned and formatted. The data cleaning and formatting includes invalid call filtering, parameter desensitization, and time sequence alignment. Invalid call filtering means filtering syscall=0 and PID anomalies. Parameter desensitization means hashing sensitive parameters such as file paths and network addresses. Time sequence alignment means using Lamport logical clock to ensure the orderliness of cross-core events. Extract features from the cleaned and formatted key field data. These features include basic statistical features and contextual features. The basic statistical features include call frequency, call type entropy, parameter diversity, and IO operation ratio. The contextual features include process tree lineage and resource access chain. The extracted feature data is labeled as normal and abnormal. The labeled feature data is then divided into training set, validation set and test set. An initial LSTM model is constructed and trained based on the training set.

4. An industrial host control system based on artificial intelligence, characterized in that, The system includes: The application-layer monitoring module is used to set up a whitelist of processes. When a process accesses the industrial host, the industrial host monitors the process using a static trust model, a dynamic trust model, and a runtime environment evaluation model. The static trust model is as follows: ； in, This represents the static trustworthiness, where n represents the number of files participating in the static trustworthiness hash verification. This represents the SHA3-512 hash value of the i-th file, and I(·) denotes an indicator function. The function value is 1 if the condition within the parentheses is true, and 0 otherwise. The standard hash value of the i-th file is represented by m, where m represents the number of files participating in the static trust metadata verification. This represents the metadata of the j-th file, which includes file size, file creation time, file modification time, file access time, file owner, file access permissions, software version number, compilation time, signature status, signature certificate information, basic attributes of dependent files, permission information, version information, digital signature information, and associated information. The standard metadata representing the j-th file is stored in the database for comparison. A module for storing dynamic credibility models, wherein the dynamic credibility model is: ； in, This represents the dynamic reliability at time t. This represents the trust decay coefficient, where t represents time and L represents the number of system call sequences. This represents the k-th system call sequence. This represents the set of normal system call sequences generated from historical behavior; Storage environment assessment model module, wherein the environment assessment model is ； in, Indicates the environmental safety assessment value. (·) represents the activation function. This represents the weight of the j-th monitoring indicator. This represents the current value of the j-th monitoring indicator. This represents the baseline value of the j-th monitoring indicator; The kernel-level monitoring module collects real-time syscall stream data through the eBPF behavior collector and analyzes the syscall stream data through an AI decision engine. A circuit breaker triggering module acquires process behavior entropy values, smooths these values ​​using a moving average method, and controls the triggering of circuit breaker commands based on model monitoring and AI decision engine analysis. The circuit breaker triggering module includes: The module for obtaining process behavior entropy values ​​is used to obtain process behavior entropy values ​​and uses a moving average method to smooth the behavior entropy values. ； in, Let represent the behavioral entropy value at time t. The state space U includes: system call type, file access mode (i.e., read / write ratio), network connection topology, and process resource usage. p(s|t) represents the probability of system call type s occurring within the time window t. ； in, The entropy represents the behavior at time t, and M represents the size of the smoothing window; Determine if the module is triggered, when When this occurs, the safety circuit breaker is triggered, in which... This represents the historical normal entropy mean. This represents the standard deviation of historical normal entropy. Indicates the length of the time window; when When this occurs, the safety circuit breaker is triggered, in which... Represents the sensitivity coefficient to entropy changes. The time derivative of behavioral entropy. This indicates the preset dynamic threshold baseline value. This indicates the historical average attack frequency; ； in, , Indicates the weighting coefficient. The real-time detected data is input into the trained model to determine if there are any anomalies. If an anomaly is found, a circuit breaker is triggered.

5. The industrial host control system based on artificial intelligence according to claim 4, characterized in that, The application layer monitoring module includes: The module for storing whitelist process information is used to sort out all processes running on the industrial host and filter out whitelist processes. The whitelist process information is stored in a database and includes: process name, process ID, executable file path, file hash value, digital signature, startup parameters, running time range, required system permissions, and user identity. The static trustworthiness module is used to obtain the static trustworthiness of the process accessing the industrial host when a process accesses the industrial host. The industrial host first compares the SHA3-512 hash value of a first preset number of files in the process with the golden hash value in the database, and compares the metadata of a second preset number of files with the standard metadata in the database. That is, the static trustworthiness of the process accessing the industrial host is obtained through the static trustworthiness model. The dynamic trustworthiness module is used to obtain the dynamic trustworthiness of process runtime behavior security by combining the comparison results of system call sequences within a preset time period with the set of normal system call sequences generated from historical behavior, based on the natural decay of trust over time. The environment assessment module is used to perform a weighted summation of the ratios of the current values ​​of each hardware-level and network-level monitoring indicator to the baseline values, and then, after being mapped by an activation function, obtain a quantitative assessment value of the security of the environment in which the process runs through the runtime environment assessment model. The hardware-level and network-level monitoring indicators include: CPU instruction cycle exception rate, memory access entropy, DMA request frequency, network traffic rate, network traffic distribution, and system log information.

6. The industrial host control system based on artificial intelligence according to claim 4, characterized in that, The kernel layer monitoring module includes: A customized eBPF probe is deployed at the kernel layer of the industrial control host to capture all syscall events and obtain key field data from all syscall events. The key field data includes: process PID, syscall number, timestamp, and specific parameters passed when the syscall is executed. The key field data is cleaned and formatted. The data cleaning and formatting includes invalid call filtering, parameter desensitization, and time sequence alignment. Invalid call filtering means filtering syscall=0 and PID anomalies. Parameter desensitization means hashing sensitive parameters such as file paths and network addresses. Time sequence alignment means using Lamport logical clock to ensure the orderliness of cross-core events. Extract features from the cleaned and formatted key field data. These features include basic statistical features and contextual features. The basic statistical features include call frequency, call type entropy, parameter diversity, and IO operation ratio. The contextual features include process tree lineage and resource access chain. The extracted feature data is labeled as normal and abnormal. The labeled feature data is then divided into training set, validation set and test set. An initial LSTM model is constructed and trained based on the training set.

Images