Industrial control system attack detection system suitable for low-quality data background

Abstract

The invention relates to the field of industrial control system attack detection, and particularly provides an industrial control system attack detection system and method suitable for a low-quality data background. A semantic extraction module in the attack detection model outputs semantic features based on industrial control system data of a plurality of historical time steps, and a correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value of a current time step; the alarm generation module obtains an abnormal threshold value based on the data predicted value and the actual value during training, and compares the target deviation with the abnormal threshold value during testing to determine whether an alarm is generated or not; obtaining a trained attack detection model by using a training data set constructed by historical normal data, collecting real-time data of a current time step, and obtaining target historical data; and determining whether a data attack occurs or not by using the trained attack detection model. By using the method provided by the invention, the data attack aiming at the industrial control system can be accurately found under low-quality data.

Description

Technical Field

[0001] The present invention relates to the field of industrial control system attack detection, and particularly to an industrial control system attack detection system and method applicable to the background of low-quality data. Background Art

[0002] The industrial control system (ICS) is the core component of the modern industrial Internet. It consists of a large number of components such as programmable logic controllers (PLCs), sensors, actuators, and supervisory control and data acquisition (SCADA) systems, and controls the production and manufacturing processes of industrial equipment based on the industrial production business logic. Specifically, the industrial control system will collect the specific data of different components in real time, such as the measurement data of sensors and the action status data of actuators, to analyze the current industrial production status, and make decisions based on the industrial production business logic to send the next-stage industrial control commands to industrial equipment, and so on in a cycle.

[0003] However, with the increasing prevalence of online black industries in recent years, the industrial control system, which has extremely high value and importance, has more often become the target of attacks by online black industries. There are two main attack methods against industrial control systems: 1) Tampering with the industrial data collected by the industrial control system, that is, destroying the authenticity and correctness of the data, so that the industrial control system makes incorrect industrial production logic judgments; 2) Tampering with or directly issuing incorrect industrial control commands, that is, destroying the integrity of the industrial control commands, resulting in a reduction in the efficiency of industrial production and even causing industrial accidents. Therefore, timely detection of various data attacks against industrial control systems is crucial for maintaining the normal operation of industrial control systems and even ensuring the security and stability of the industrial Internet.

[0004] To detect data attacks against industrial control systems, many existing solutions adopt a data-driven technical route. Their advantages are strong generality, detection timeliness, and easy rapid deployment in new industrial Internet systems. Their specific working process is usually as follows: 1) Collect data of different components of the industrial control system in the normal working state; 2) Through statistical methods, machine learning, and even deep learning, model the changing patterns of these normal data over time to achieve data prediction for the next stage of the industrial control system in the normal working state; 3) Calculate the deviation degree between the predicted data and the actual measured data. If the deviation is greater than the threshold, it is considered that the system data deviates from the normal state and there may be a data attack. The essence of such methods is to learn and model the normal industrial production process mode behind the industrial control system and the mutual relationship between different industrial components through data.

[0005] There is a major common problem in data-driven industrial control system data attack detection technologies. They assume that the data collected from industrial control systems is of high quality, that is, the data can accurately reflect the real state of the industrial control system in the physical world during the data collection time segment. However, in the real industrial production environment, the data collected by industrial control systems is often of low quality, that is, the data cannot accurately reflect the real state of the industrial control system and its components in the physical world. There are two common reasons for low-quality data: First, there are many components in the real industrial Internet, and their ages are different. It is difficult to ensure that each component is perfect and accurate, resulting in some components reporting low-quality physical world state data to the industrial control system. For example, some sensors or controllers may fail and cannot report, resulting in partial data loss. The clocks of some sensors or controllers are not synchronized, resulting in data from different time stages being wrongly mixed together. Some sensors or controllers are old or faulty, and there is a lot of noise in the collected data. In addition, there may be undetected data attacks in the industrial control system, resulting in the actual inclusion of abnormal data in the "normal" data collected.

[0006] Second, when launching a data attack, the attacker will tamper with the data collected by the industrial control system by attacking the key nodes responsible for data transmission and collection in the industrial control system, that is, modifying the abnormal data state caused by the data attack to seemingly "normal" to achieve the purpose of hiding the data attack. At this time, the data collected by the industrial control system cannot reflect the abnormal attack state it is suffering from, so it is also of low quality. Some viruses adopt this attack mode. While tampering with the centrifuge control command, they send the previously recorded normal working state data of the centrifuge to the data collection system, resulting in their attack not being discovered for a long time.

[0007] Generally speaking, in the context of low-quality industrial control system data, existing data-driven industrial control system data attack detection schemes can neither correctly model and learn the normal state of industrial systems nor understand the real data anomalies and attack states, thus leading to a serious decline in their detection capabilities and posing serious security risks to industrial control systems and even the entire industrial Internet. Summary of the Invention

[0008] The present invention aims to solve at least one of the technical problems in the related art to some extent.

[0009] To this end, the first object of the present invention is to propose an industrial control system attack detection method applicable to the background of low-quality data, so as to accurately detect data attacks against industrial control systems in the low-quality data generated by industrial control systems.

[0010] The second object of the present invention is to propose an industrial control system attack detection system applicable to the background of low-quality data.

[0011] The third object of the present invention is to propose an electronic device.

[0012] The fourth object of the present invention is to propose a computer-readable storage medium.

[0013] To achieve the above object, the first aspect of the present invention proposes an industrial control system attack detection method applicable to the background of low-quality data, including: Construct a training data set based on the historical normal data of the industrial control system; Construct an attack detection model, the attack detection model includes a semantic extraction module, a correlation analysis module and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and the corresponding actual values of multiple time steps to obtain an anomaly threshold during training, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm; Use the training data set to train the attack detection model to obtain a trained attack detection model; Collect the real-time data of the industrial control system at the current time step, and obtain the target historical data before the current time step; Input the target historical data and real-time data into the trained attack detection model to determine whether to issue an alarm. In the trained attack detection model, the semantic extraction module and the correlation analysis module process the target historical data to obtain the target data prediction value at the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated.

[0014] In the method of the first aspect of the present invention, the historical data includes state-type data. For state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

[0015] In the method of the first aspect of the present invention, the historical data includes numerical data. For numerical data, when the semantic extraction module extracts semantic features, it adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value.

[0016] In the method of the first aspect of the present invention, the correlation analysis module analyzes the correlation between semantic features from two dimensions of space and time.

[0017] In the method of the first aspect of the present invention, the correlation analysis module uses a dual Transformer model with an improved attention mechanism to implement the correlation analysis of space and time between semantic features.

[0018] In the method of the first aspect of the present invention, the alarm generation module uses the POT algorithm to obtain the anomaly threshold.

[0019] In the method of the first aspect of the present invention, the real-time data includes multiple types of data. The target deviation output by the alarm generation module includes the target deviation corresponding to each type of data. Determining whether a data attack has occurred based on the target deviation and the anomaly threshold includes: comparing the target deviation corresponding to each type of data with the anomaly threshold to determine the number of data categories with anomalies; determining whether a data attack has occurred at the current time step based on the number of data categories with anomalies and a set number threshold.

[0020] To achieve the above object, the second aspect of the present invention proposes an industrial control system attack detection system applicable to the background of low-quality data, including: A training set construction unit for constructing a training data set based on the historical normal data of the industrial control system; A modeling unit for constructing an attack detection model, where the attack detection model includes a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and corresponding actual values of multiple time steps during training to obtain an anomaly threshold, and to compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm. A training unit for training the attack detection model using the training dataset to obtain a trained attack detection model. An acquisition unit for collecting real-time data of the industrial control system at the current time step and obtaining target historical data before the current time step. An attack detection unit for inputting the target historical data and real-time data into the trained attack detection model to determine whether to generate an alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain a target data prediction value for the current time step. The alarm generation module in the trained attack detection model obtains a target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack has occurred, an alarm is generated.

[0021] To achieve the above object, a third aspect of the present invention proposes an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method proposed in the first aspect of the present invention.

[0022] To achieve the above object, a fourth aspect of the present invention proposes a computer-readable storage medium, in which computer execution instructions are stored, and when the computer execution instructions are executed by a processor, they are used to implement the method proposed in the first aspect of the present invention.

[0023] The industrial control system attack detection method, system, electronic device, and storage medium provided by the present invention for the background of low-quality data construct a training data set based on the historical normal data of the industrial control system; construct an attack detection model, which includes a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and corresponding actual values of multiple time steps during training to obtain an anomaly threshold, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm; use the training data set to train the attack detection model to obtain a trained attack detection model; collect the real-time data of the industrial control system at the current time step, and obtain the target historical data before the current time step; input the target historical data and real-time data into the trained attack detection model to determine whether to alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated. In this case, by integrating the semantic extraction module, the correlation analysis module, and the alarm generation module, the deviation under normal conditions is determined by analyzing the correlation of the semantic features of the industrial control system, and then it is determined whether a data attack has occurred based on the real-time data and the target historical data of the current time step. It realizes the effective detection of data attacks on industrial control system data in the background of low-quality data, and at the same time, the detection effect is better than the existing data-driven industrial control system data attack detection methods. Therefore, it can more accurately and effectively discover data attacks against industrial control systems in the low-quality data generated by industrial control systems.

[0024] Additional aspects and advantages of the present invention will be given in part in the following description, become apparent in part from the following description, or be understood through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the following description of the embodiments in conjunction with the drawings, wherein: Figure 1 is a schematic flowchart of an industrial control system attack detection method applicable to the background of low-quality data provided by an embodiment of the present invention; Figure 2 is a specific flowchart of an industrial control system attack detection method applicable to the background of low-quality data provided by an embodiment of the present invention; Figure 3It is a block diagram of an industrial control system attack detection system applicable to the background of low-quality data provided by an embodiment of the present invention. Detailed implementation manners

[0026] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the drawings, in which the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present invention and should not be construed as a limitation of the present invention.

[0027] The industrial control system attack detection method and system applicable to the background of low-quality data according to the embodiments of the present invention will be described below with reference to the drawings.

[0028] The industrial control system data involved in the present invention refers to the general term of the data of all industrial components included in the industrial control system during the operation stage, such as the measurement data of a physical parameter by a sensor, the action execution state data of an actuator, etc. According to the data format, it can be divided into two types: numerical data and state data. The data of the industrial control system in each time segment (i.e., each time step) can form a multi-dimensional vector, each dimension corresponding to a type of data, and the industrial control system data of multiple time segments can form a multi-variable time series in time sequence.

[0029] The industrial control system data attack detection involved in the present invention: An attacker's data attack on one or some components of the industrial control system will cause abnormalities in the data of the corresponding time segment. The purpose of industrial control system data attack detection is to find those time segments in which data attacks occur in the multi-variable time series composed of the industrial control system data of multiple time segments.

[0030] The low-quality data of the industrial control system targeted by the present invention refers to the data collected by the industrial control system that cannot accurately reflect the real state of the industrial control system in the physical world during the data collection time segment. There are two main categories of reasons for the low-quality data of the industrial control system: 1) Some components of the industrial control system are old and cannot accurately measure and report data; 2) The attacker actively tampers with abnormal data to hide the attack. The problem of low-quality data is very common in real industrial control systems, which will cause the detection ability of existing industrial Internet data attack detection technologies to seriously decline, unable to detect various data attacks, and seriously endanger the integrity, security and confidentiality of high-value industrial data in the industrial Internet and industrial critical infrastructure, thereby causing serious economic losses.

[0031] The embodiments of the present invention provide an industrial control system attack detection method and system applicable to the background of low-quality data to accurately detect data attacks on the industrial control system in the low-quality data generated by the industrial control system.

[0032] Figure 1 The flowchart shows a method for detecting attacks on industrial control systems applicable to low-quality data backgrounds provided by an embodiment of the present invention.

[0033] As Figure 1 shown, the method for detecting attacks on industrial control systems applicable to low-quality data backgrounds includes the following steps: Step S101: Construct a training data set based on the historical normal data of the industrial control system.

[0034] In step S101, it is easily understood that the historical normal data of the industrial control system refers to the industrial control system data obtained during the normal operation of the industrial control system (i.e., operation without data attack behavior) at historical time steps.

[0035] In step S101, the historical data includes two types of data according to the data format: state-type data (i.e., status data) and numerical-type data (i.e., numerical data). According to the data source, the industrial control system data includes multiple types of data, and each type of data is generated by different individual industrial control system components.

[0036] Step S102: Construct an attack detection model, which includes a semantic extraction module, a correlation analysis module, and an alarm generation module.

[0037] In step S102, the semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. For state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features. For numerical-type data, when extracting semantic features, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value.

[0038] Specifically, the semantic extraction module is also called the data semantic feature extraction module. This module is responsible for extracting fine-grained semantic features from different types of low-quality data collected by the industrial control system. Specifically, a dynamic data semantic feature extraction model is used. This module first divides the input industrial control system data according to a specified time sliding window. For each type of state data among them, a neural network embedding layer is used to convert it into data semantic features. For each type of numerical data among them, its specific numerical value is dynamically mapped to multiple buckets, and the feature vector of the bucket corresponding to the maximum projection value is obtained as the semantic feature of the data. Different from the existing data semantic feature extraction methods that require manual pre-setting of data semantics or data bucket value ranges, the data semantic features of this module and the weights of the data mapped to each bucket are automatically learned during the training process without manual intervention. And the data semantic feature model of this module can better maintain the accuracy of the extracted data semantic features when the data is of low quality. Therefore, this module can better perform semantic feature extraction on the heterogeneous and diverse low-quality data of the real industrial control system.

[0039] In step S102, the correlation analysis module performs correlation analysis based on semantic features to obtain the data prediction value at the current time step. The correlation analysis module analyzes the correlation between semantic features from two dimensions: space and time. The correlation analysis module uses a dual Transformer model with an improved attention mechanism to achieve the correlation analysis of the space and time between semantic features. It is easy to understand that the Transformer model is a neural network unit based on the attention mechanism. This network can receive a sequence composed of multiple features, analyze the correlation between different features, and generate an output feature sequence with the same shape as the original input. Each output feature contains the correlation between the corresponding input feature and other input features.

[0040] Specifically, the correlation analysis module is also called the data semantic spatio-temporal correlation analysis module. This module is responsible for analyzing the correlation between the data semantics of the industrial control system from two dimensions: space and time, and realizing the prediction of the normal data in the next stage of the system. This module uses a dual Transformer model improved based on the robust attention mechanism to accurately capture the spatio-temporal correlation of different types of data semantics in the same time segment, and at the same time effectively exclude the interference of low-quality data. Different from the existing industrial control system data correlation analysis methods that only analyze the correlation from a single dimension of time or space and are easily affected by low-quality data such as noise, this module can accurately model the change pattern of complex industrial control system data over time through spatio-temporal analysis, and effectively exclude the interference of low-quality data on the correlation analysis, so as to more accurately predict the correct data in the next stage. Therefore, this module can better apply to the real industrial control system scenario where low-quality complex data is widespread.

[0041] In step S102, the alarm generation module is used to statistically calculate the deviation based on the predicted values and the corresponding actual values of data at multiple time steps during training to obtain the anomaly threshold, and to compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm. The alarm generation module uses the POT (Peak over Threshold) algorithm to obtain the anomaly threshold. Understandably, the POT algorithm is an automatic threshold selection algorithm that can extract a threshold that can distinguish outliers from normal values (i.e., actual values) from sequence data. The actual value is the industrial control system data directly collected.

[0042] Specifically, the alarm generation module is also called the data attack alarm generation module. During training, this module is responsible for statistically calculating the predicted deviation values of each type of data in the normal training data under the current system, and calculating the anomaly threshold for each type of data. This module uses the POT algorithm to obtain the anomaly threshold for the deviation between the actual and predicted values of each type of data; during testing, this module analyzes the target deviation between the true values (i.e., real-time data) of each type of data actually collected by the industrial control system and the predicted values, and compares it with the anomaly threshold to determine whether to generate an alarm, so as to determine whether the industrial control system has suffered a data attack. This module can comprehensively judge whether the industrial control system has suffered a data attack based on the number of anomaly data categories and the duration. Compared with the existing technology that detects anomaly data by calculating the mean value of the deviation degree of each type of data and a single threshold, this module effectively overcomes the problem of a large number of false alarms caused by low-quality data, reduces the manual intervention cost of the security operation and maintenance personnel of the industrial control system, and improves the security operation and maintenance management efficiency of the industrial control system. Therefore, it can also be better applied to the real industrial control system with low-quality data.

[0043] Step S103: Use the training data set to train the attack detection model to obtain the trained attack detection model.

[0044] Specifically, in step S103, the semantic extraction module divides all the data of the industrial control system under all normal working times (i.e., the training data set obtained in step S101) according to a fixed-length sliding window, and extracts data semantic features from each type of data at each time step through the data semantic feature extraction model; the multivariate time series composed of the data semantic features of each type of data divided according to the sliding window is used as the input of the correlation analysis module. The correlation analysis module uses an improved dual Transformer model to learn the spatio-temporal correlation between normal data semantics, so as to learn how to predict the normal data of the next time step based on the data of multiple previous time steps. The alarm generation module is responsible for statistically calculating the predicted deviation values of each type of data in the normal training data under the current system, and calculating the anomaly detection threshold for each type of data.

[0045] Step S104: Collect the real-time data of the industrial control system at the current time step, and obtain the target historical data before the current time step.

[0046] In step S104, the number of time steps of the target historical data is the same as that of the input data of the semantic extraction module during training.

[0047] In step S104, both the real-time data and the target historical data include multiple types of data, and the types are the same.

[0048] Step S105: Input the target historical data and the real-time data into the trained attack detection model to determine whether to give an alarm.

[0049] In step S105, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the predicted value of the target data at the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the predicted value of the target data and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated.

[0050] In step S105, the target deviation output by the alarm generation module includes the target deviation corresponding to each type of data. Determining whether a data attack has occurred based on the target deviation and the anomaly threshold includes: comparing the target deviation corresponding to each type of data with the anomaly threshold to determine the number of data types with anomalies; and determining whether a data attack has occurred at the current time step based on the number of data types with anomalies and the set quantity threshold.

[0051] Specifically, in step S105, the historical time segment data of the industrial control system (i.e., the target historical data) that is the same as the sliding window length is input into the semantic extraction module in the trained attack detection model, and the data semantic features of each type of data at each time step are also extracted; then the multivariate time series composed of the data semantic features is input into the correlation analysis module to predict the data value of the industrial control system at the current time step; at the current time step, based on the true values of each type of data actually collected (i.e., the real-time data) by the industrial control system, the alarm generation module in the trained attack detection model analyzes the target deviation between the true data value and the predicted value to determine whether to generate an alarm.

[0052] Figure 2 This is a schematic diagram of the specific process of the industrial control system attack detection method provided by the embodiment of the present invention, which is applicable to the background of low-quality data.

[0053] As Figure 2 shown, the constructed attack detection model includes a data semantic feature extraction module, a data semantic spatio-temporal correlation analysis module, and a data attack alarm generation module.

[0054] The data semantic feature extraction module is responsible for converting industrial control system data (status data and numerical data) into a multivariate time series composed of data semantic features. For example, the data semantic feature <0, 1, 0……, 0, 0, 0> obtained from the status data, and the data semantic feature <0.1, 0.2……, 0.15> obtained from the numerical data. Each multivariate time series is the semantic feature at each time step; the data semantic spatio-temporal correlation analysis module uses a dual Transformer model with an improved attention mechanism for each time step semantic feature to mine and analyze the spatial and temporal correlations between data semantic features, model the change pattern of normal industrial control system data, and realize the prediction of the next-stage data. For example, the semantic feature Tn of the nth time step is predicted using the semantic features <T0, T1……, Tn-1> of the previous n time steps before the nth time step. The data attack warning generation module is responsible for analyzing the deviation degree between the actual data and the predicted data, determining the time segment of data anomaly, and finally generating a warning about the data attack. For example, the deviation degree between the predicted Tn such as <0.1, 0.2……, 0.15> and the actual Tn such as <0.1, 0.2……, 0.15> is analyzed to obtain the anomaly threshold (abbreviation: threshold).

[0055] As Figure 2 shown, the workflow of the attack detection method is mainly divided into two parts: training and detection, as shown by the white and black arrows in the figure. During the training process, the low-quality normal historical training data collected by the industrial control system passes through the data semantic feature extraction module, is converted into a multivariate time series composed of semantic features, and then input into the data semantic spatio-temporal correlation analysis module for analysis, enabling this module to have the ability to predict the next-stage data. In addition, the data attack warning generation module will also learn the anomaly thresholds of the actual values of various data and the predicted values output by the data semantic spatio-temporal correlation analysis module from the normal historical training data. During the testing process, the industrial control system sends the low-quality data of multiple historical time segments before the current time segment (i.e., the current time step) into the data semantic feature extraction module together, which is also converted into a multivariate time series composed of data semantic features, and then input into the trained data semantic spatio-temporal correlation analysis module to predict the data of the current time segment through them. The data attack warning generation module decides whether to generate a warning about the data attack based on the deviation degree between the actual values and the predicted values of various data in the current time segment and the threshold learned in the training stage.

[0056] Specifically, in the data semantic feature extraction module, the input industrial control system data is first divided according to a specified time sliding window (for example, 10 time segment lengths). Each time segment is a multi-dimensional vector composed of multiple industrial control system data. Therefore, all the data of all time segments within the sliding window form a multi-variable time series, and each variable at each time step corresponds to the specific data value of a certain industrial Internet component at that time step. To support the subsequent module's spatio-temporal correlation analysis of data semantics, it is necessary to extract semantic features from each data that can represent this type of data under the current data value, and the semantic features of all category data need to be in the same space. Therefore, this module adopts a dynamic data semantic feature extraction model, which works as follows: The raw data collected from the industrial control system can be divided into two categories: numerical type and state type. For each type of state data, first convert each specific data value into a one-hot vector. The length of the vector is equal to the number of states of this type of data, and the vector is 1 only at the position corresponding to the data value, and 0 at other positions. In addition, a matrix is stored for each state data to record the data semantic features under different state values. Denote the matrix of the i th type of state data as , where is the number of states of this type of data, and d is the dimension of the data semantic features. Through simple matrix multiplication operations, the data semantic feature i of the th type of state data (one-hot encoding) at the current value can be obtained. The matrix responsible for recording semantic features is implemented through a neural network embedding layer, and the data semantic features it stores will be automatically learned during the training process of the module without manual pre-setting.

[0057] For each type of numerical data, since it contains a very large number of specific numerical values, setting proprietary data semantic features for each specific numerical value will not only incur a very large computational overhead but also be limited by the scarcity of training data related to different data values. Another widely adopted technical route is to divide the value range of numerical data into multiple buckets, and each data value will fall into a bucket and each bucket is set with specific semantic features. However, this method not only requires manual pre - division of the value range of each bucket, but also a single slight change in the data value may lead to completely inconsistent semantic features, which does not conform to the real characteristic that the semantics are relatively close when the data values are close in industrial equipment. In particular, when industrial Internet data is of low quality and contains a large amount of noise, this way of generating data semantic features will be very vulnerable to interference and it is difficult to obtain correct data semantic features. To overcome the shortcomings of the above - mentioned traditional methods, the dynamic data semantic feature extraction model adopts the method of dynamically mapping data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value. Specifically, the dynamic data semantic feature extraction model maps the original data value of the th type of numerical data in the numerical data into multiple buckets, and the process can be expressed by the following formula: (1) (2) where and , ReLu () is the activation function, is a coefficient parameter, and is the preset number of buckets. represents the projection value of the original data value on each bucket, and further standardizes each projection value using the Softmax method: (3) where represents the th bucket, is a preset parameter controlling the degree of discreteness. represents the th bucket. Finally, the data semantic feature of the original data value can be set as the semantic feature corresponding to the bucket with the maximum projection value, and the semantic feature of each bucket is a d - dimensional feature vector. In this method, the and parameters used to dynamically divide the original data value into multiple buckets and the semantic feature corresponding to each bucket are all obtained dynamically through the model training process and do not need to be preset.

[0058] After the above data semantic feature extraction operation, each original data value is converted into a d -dimensional semantic feature vector. Let the total number of data categories in the industrial control system be , then all data semantic features of each time segment can be represented as a matrix of size dimensions, All data semantic features of all time segments within the sliding time window can be represented as a tensor of size .

[0059] The data semantic feature extraction module of the embodiment of the present invention is different from other related works that directly use the original data value as a feature, or divide the data value into artificially set buckets and only use the semantic features corresponding to a single bucket. Instead, it innovatively projects the original data value dynamically into multiple buckets and obtains the semantic features of the bucket corresponding to the maximum projection value, so as to obtain more accurate data semantic features in the context of low-quality data in the industrial control system. Moreover, the dynamic division method and semantic features of the buckets are automatically learned during the training process without manual setting, which is very suitable for extracting features from diverse heterogeneous data with a wide variety and inconsistent semantic information in real industrial control systems.

[0060] In the data semantic spatio-temporal correlation analysis module, after obtaining the semantic features of the data, the data semantic spatio-temporal correlation analysis module is responsible for analyzing the correlation between data semantics from two dimensions: space and time, so as to model the data change pattern of the industrial control system under normal conditions and realize the prediction of the next-stage data. The design of this module is based on two principles: 1) The state or action of the physical world in the industrial control system will be reflected in the semantics of multiple types of data at the same time. Therefore, there is an association between the semantics of multiple types of data at the same time, that is, spatial correlation; 2) The semantics of various types of data in the industrial control system at the same time describe the overall state of the system at that time, and the states of the historical system together determine the current system data. Therefore, there is also an association between the semantics of data at different times, that is, temporal correlation; This module uses a dual Transformer model with an improved attention mechanism to realize the analysis of the spatio-temporal correlation of data semantics, and its specific composition and working method are as follows: The first Transformer model in the dual Transformer model is responsible for extracting the correlation between different data semantic features in the same time segment, that is, spatial correlation. In principle, the Transformer model uses the Attention mechanism to analyze the correlation between input data, which can be regarded as a mathematical function responsible for mapping query data (Query) and key-value pair data (Key-Value) to output data (Output). Query data and key-value pair data are both some mapping representations of input data (Input). For the current query data, the Attention mechanism calculates its correlation with each key and uses it as the weight of the corresponding value (Value) of each key, and then takes the weighted sum of all values as the output data. The correlation between the query data and different keys will be reflected in the output data. Therefore, for the vector composed of the data semantic features of each time segment, it is denoted as , is the number of data types (i.e., the total number of data categories), d is the dimension of each data semantic feature, and the query data , the key and the value can be obtained by performing different linear mappings on : (4) where are different mapping matrices, is the dimension of each output data, and their weights will be automatically learned during the training process of the Attention mechanism to achieve the best correlation analysis ability. On this basis, the complete calculation process of the Attention function can be expressed as: (5) is the transpose of K. After being calculated by the Attention mechanism, each data semantic feature output by the first Transformer model contains the correlation with other data semantic features. However, in the context of low-quality data in the real industrial Internet environment, the above original Attention mechanism will cause the part of the data affected by noise to also perform correlation calculations with other data semantics, that is, there are incorrect correlation calculation results in the output, resulting in inaccurate description of the overall system state of the industrial Internet. To overcome this problem, the Transformer model of this module adopts a robust Attention mechanism (i.e., improved Attention mechanism). During the Attention calculation process, it sorts the correlation between each query data and all keys and only retains the top large results to update the parameters of the Attention mechanism. It is a manually set parameter. The principle of this solution is that low-quality data deviates from the normal semantics and is often semantically irrelevant to other normal data. Therefore, the calculation results of the correlation between them are usually not significant and can be filtered through sorting operations. Therefore, this strategy can enhance the robustness of the attention mechanism under low-quality data. Under this strategy, formula (5) can be improved to: (6) (7) is the Top-k value-taking operation for each row of the correlation matrix, and is a very small constant value to prevent division-by-zero errors during the operation process.

[0061] Under the same time segment, all data contains the semantic features of correlation and jointly constitutes the overall state of the industrial control system at this time. After obtaining the overall state of the industrial control system in the first time segments within the time window, this module then uses another Transformer model to perform correlation analysis on them in the time dimension, that is, the semantic features corresponding to the overall state of the industrial control system under different time segments are sequentially input into another Transformer model. Its output at the last time segment fuses the semantic features of the industrial control system in the first time segments. Therefore, the data semantic prediction for the next stage (the th) time segment can be achieved through a simple fully connected neural network. Finally, this module maps the semantic features back to the data values of various types of data through a simple fully connected neural network.

[0062] In the training stage of the system, this module uses all the data semantic features of the first time segments within each sliding window as input, calculates the loss value of the neural network model based on the average deviation between the output result and the data value of the th time segment, and is trained through the classic stochastic gradient descent algorithm. Moreover, since the data semantic feature extraction module is also connected to this module, the loss value will also be used to optimize the neural network parameters in the data semantic feature extraction module to make it better extract the semantic features of each data. In the detection stage of the system, the module uses all the data semantic features of the first time segments before the current time as input to predict the normal values of each data at the current time.

[0063] The data semantic spatio-temporal correlation analysis module in the embodiments of the present invention is different from other related works that only analyze the correlation between data semantics from a single dimension of time or space. It innovatively mines the internal correlation between the data semantics of industrial control systems from both the time and space dimensions, so as to more accurately model the change patterns of normal data in industrial control systems and achieve more accurate prediction of the data in the next stage. Moreover, this module also uses a robust attention calculation mechanism to improve the Transformer model responsible for analyzing the temporal and spatial correlations of data semantics, enabling it to exclude the interference of low-quality data on the semantics of other normal data, and more accurately depict the overall data semantics of industrial control systems, so as to accurately predict the data in the next stage of industrial control systems in the context of low-quality data.

[0064] In the data attack warning generation module, this module is responsible for analyzing the deviation degree between the predicted current time data of the data semantics in the previous time segment and the actual data value at the current time to determine whether the current data is abnormal and generate a warning about data attacks. However, low-quality industrial data is very likely to deviate from the normal data value, that is, it still has a large deviation from the predicted value even when there is no data attack. Traditional abnormal data detection methods based on the mean of the data deviation degree and a single fixed threshold will generate more false alarms in this case. To overcome this problem, this module designs an adaptive data deviation degree analysis method, and its working method is as follows: First, in the training stage, statistically analyze the deviation degree between the predicted value (generated by the data semantic analysis module) and the actual value of each type of data (i.e., the data generated by a single industrial control system component) in the historical normal data, and use the POT (Peak over Threshold) algorithm to automatically obtain the positive and abnormal thresholds of the deviation degree of each type of data. In the detection stage, if the deviation degree between the predicted value and the actual value of a certain type of data in the current time segment exceeds the corresponding threshold, then this type of data is regarded as abnormal. Then, if the number of abnormal data categories exceeds the first threshold set manually, the current time segment is recorded as abnormal, otherwise it is normal. Finally, if there are more than the second threshold set manually of consecutive time segments that are abnormal, then these time segments are regarded as a unified data attack warning, otherwise no warning is generated.

[0065] The data attack warning generation module in the embodiments of the present invention is different from other related works that only discover abnormal data through the mean of the deviation degrees of various types of data and a single threshold. It innovatively uses the POT algorithm to automatically obtain more specific thresholds for the deviation degrees of various types of data, which are also more in line with the distribution characteristics of this type of data, and realizes the fine-grained discovery of specific abnormal data. Moreover, this module comprehensively judges whether to generate a data attack warning based on the number of abnormal data categories and the duration of the abnormal data time segment, effectively reducing the false alarm problem caused by low-quality data.

[0066] To implement the above embodiments, the present invention further provides an industrial control system attack detection system applicable to the background of low-quality data.

[0067] Figure 3 It is a block diagram of an industrial control system attack detection system applicable to the background of low-quality data provided by an embodiment of the present invention.

[0068] As Figure 3 shown, the industrial control system attack detection system applicable to the background of low-quality data includes a training set construction unit 11, a modeling unit 12, a training unit 13, a collection unit 14, and an attack detection unit 15, where: The training set construction unit 11 is used to construct a training data set based on the historical normal data of the industrial control system; The modeling unit 12 is used to construct an attack detection model. The attack detection model includes a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and the corresponding actual values of multiple time steps during training to obtain an anomaly threshold, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm; The training unit 13 is used to train the attack detection model using the training data set to obtain a trained attack detection model; The collection unit 14 is used to collect the real-time data of the industrial control system at the current time step and obtain the target historical data before the current time step; The attack detection unit 15 is used to input the target historical data and real-time data into the trained attack detection model to determine whether to alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated.

[0069] Furthermore, in a possible implementation manner of the embodiment of the present invention, the historical data includes state-type data. In the modeling unit 12, for state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

[0070] Further, in a possible implementation manner of the embodiment of the present invention, the historical data includes numerical data. For the numerical data in the modeling unit 12, when the semantic extraction module extracts semantic features, it adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value.

[0071] Further, in a possible implementation manner of the embodiment of the present invention, in the modeling unit 12, the correlation analysis module analyzes the correlation between semantic features from two dimensions of space and time.

[0072] Further, in a possible implementation manner of the embodiment of the present invention, in the modeling unit 12, the correlation analysis module adopts a dual Transformer model with an improved attention mechanism to implement the correlation analysis of the space and time between semantic features.

[0073] Further, in a possible implementation manner of the embodiment of the present invention, in the modeling unit 12, the alarm generation module adopts the POT algorithm to obtain the anomaly threshold.

[0074] Further, in a possible implementation manner of the embodiment of the present invention, the real-time data includes multiple types of data. The target deviation output by the alarm generation module includes the target deviation corresponding to each type of data. In the attack detection unit 15, determining whether a data attack occurs based on the target deviation and the anomaly threshold includes: comparing the target deviation corresponding to each type of data with the anomaly threshold to determine the number of data categories with anomalies; and determining whether a data attack occurs at the current time step based on the number of data categories with anomalies and a set quantity threshold.

[0075] Further, in a possible implementation manner of the embodiment of the present invention, the semantic extraction module is also called the data semantic feature extraction module. This module is responsible for extracting fine-grained semantic features from different types of data collected by the industrial control system. There are many different sensors, actuators, etc. in the industrial control system, and they each correspond to physical world metrics with different value ranges, and different values of different data have different semantics. Therefore, this module needs to be responsible for extracting semantic features that can represent the specific meaning of the data from each piece of original and low-quality data in each time period of the industrial control system, and the semantic features of different data need to be in the same semantic space to support the subsequent module's analysis of the spatio-temporal correlation of different data semantics. To achieve this goal, this module includes a dynamic data semantic feature extraction model. For details, reference can be made to the relevant descriptions in the above method embodiments.

[0076] Further, in a possible implementation manner of the embodiment of the present invention, the correlation analysis module is also called the data semantic spatio-temporal correlation analysis module. This module is responsible for mining the inherent semantic correlation of different data collected by the industrial control system from two dimensions of space and time respectively, in order to model the data change pattern under the normal state of the industrial control system and realize the prediction of the normal data in the next stage. Based on the different data semantic features extracted by the data semantic feature extraction module, the data semantic spatio-temporal correlation analysis module adopts a dual Transformer model improved based on the robust self-attention mechanism. First, it conducts the correlation analysis in the spatial dimension, which can exclude the interference of some low-quality data, especially noise data, while fully modeling the semantic correlation of different types of data in the same time segment, so as to obtain the overall data semantics of the industrial control system in each time segment. Then, it conducts the analysis in the temporal dimension on the overall data semantics of the industrial control system in different time segments, mines the change pattern of data semantics over time, and realizes the accurate prediction of the data in the next stage of the industrial control system under the normal state.

[0077] Further, in a possible implementation manner of the embodiment of the present invention, the alarm generation module is also called the data attack alarm generation module. This module is responsible for analyzing the deviation degree between the predicted value of the data in the next stage of the industrial control system by the data semantic spatio-temporal correlation analysis module and the actually collected data value of the industrial control system, so as to discover the abnormal data time segments suspected of data attacks and generate alarms. The data attack alarm generation module designs an adaptive data deviation degree analysis method. First, it conducts statistical analysis on the historical normal data of each type of data (i.e., the data generated by a single industrial control system component) to obtain the positive and abnormal thresholds of the deviation degree of this type of data. Then, it counts the number of data categories determined to be abnormal in each time segment. If it exceeds the threshold, this time segment is considered abnormal. Subsequently, the module will analyze the persistence of the abnormal data to decide whether to generate an alarm about data attacks, so as to prevent false alarms caused by occasional data anomalies caused by low-quality data noise.

[0078] It should be noted that the foregoing explanation of the embodiment of the industrial control system attack detection method applicable to the low-quality data background also applies to the industrial control system attack detection system applicable to the low-quality data background of this embodiment, and will not be elaborated here.

[0079] In an embodiment of the present invention, a training data set is constructed based on historical normal data of an industrial control system; an attack detection model is constructed, and the attack detection model includes a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and the corresponding actual values of multiple time steps during training to obtain an anomaly threshold, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm; the attack detection model is trained using the training data set to obtain a trained attack detection model; the real-time data of the industrial control system at the current time step is collected, and the target historical data before the current time step is obtained; the target historical data and the real-time data are input into the trained attack detection model to determine whether to generate an alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated. In this case, by integrating the semantic extraction module, the correlation analysis module, and the alarm generation module, the deviation under normal conditions is determined by analyzing the correlation of the semantic features of the industrial control system, and then it is determined whether a data attack has occurred based on the real-time data and the target historical data of the current time step. Effective detection of data attacks on industrial control system data is achieved under the background of low-quality data, and the detection effect is better than that of existing data-driven industrial control system data attack detection methods. Therefore, data attacks on industrial control systems can be more accurately and effectively discovered in the low-quality data generated by industrial control systems.

[0080] In the attack detection model of the present invention, the data semantic feature extraction module can extract fine-grained semantic features from different types of data collected by the industrial control system to support the subsequent module to effectively analyze the spatio-temporal correlation of data semantics. The data semantic spatio-temporal correlation analysis module can analyze the data semantics collected by the industrial control system in the spatio-temporal dimensions respectively to fully explore the internal correlation of the normal state data of the industrial control system, model the data change pattern under the normal state of the industrial control system, and realize the prediction of the normal data in the next stage. The data attack alarm generation module can discover abnormal data based on the deviation degree between the actual measurement data in the next stage of the industrial control system and the predicted value of the normal data in the next stage by the data semantic spatio-temporal correlation analysis module, and comprehensively judge whether the industrial control system has suffered a data attack from the number and duration of abnormal data categories, and can also filter out some false attack alarms and finally generate an alarm about the data attack.

[0081] The beneficial effects of the present invention compared with the prior art are as follows: By analyzing the spatio-temporal correlation of the data semantics in the industrial control system, the present invention realizes a system that can effectively detect data attacks on the industrial control system under the background of low-quality data, that is, when the data cannot accurately reflect the real state of the industrial control system in the physical world at the data acquisition time. Meanwhile, the detection effect is better than that of the existing data-driven industrial control system data attack detection methods. There are two reasons for the low-quality data problem of the industrial control system targeted by the present invention: 1) Some components of the industrial control system are old and cannot accurately measure and report data; 2) The attacker actively tampers with abnormal data to hide the attack. Moreover, the data semantic feature extraction module in the system realized by the present invention realizes the accurate and automatic characterization of data semantics under the background of low-quality data by dynamically mapping data values into multiple buckets and obtaining the feature vector of the bucket corresponding to the maximum projection value as the semantic feature of the data value, overcoming the problems that the existing data semantic feature extraction methods rely on manual setting and that slight low-quality noise data can cause completely inconsistent semantics, and can better extract semantic features from the heterogeneous and diverse low-quality data of the real industrial control system. The data semantic spatio-temporal correlation analysis module in the system realized by the present invention accurately models the complex data change pattern of the industrial control system by analyzing the different data semantics in the same time segment from the spatial dimension and the state of the industrial control system at different times from the time dimension, and effectively excludes the interference of some low-quality data at the same time, realizing the accurate prediction of the next-stage data of the industrial control system. Compared with the prior art, this module has a better ability to model complex data change patterns and better robustness under the background of low-quality data, and can better apply to the real industrial control system scenario with generally existing low-quality complex data. The data attack alarm generation module in the system realized by the present invention identifies abnormal data by finely analyzing the deviation degree between the actual and predicted values of each type of data, and finally generates an alarm by comprehensively considering the number of abnormal data categories and the persistence of abnormal time segments, effectively overcoming the problem that the traditional abnormal data detection method will generate a large number of false alarms under the background of low-quality data, reducing the manual intervention cost of the industrial control system security operation and maintenance personnel and improving the efficiency of the industrial control system security operation and maintenance management. Therefore, it can also better apply to the real industrial control system with low-quality data. In summary, the present invention provides a solution that can effectively detect data attacks on the industrial control system under the background of low-quality data. That is, using the method of the present invention, various data attacks on the industrial control system can still be accurately discovered when only using the low-quality industrial data collected by the industrial control system.

[0082] To implement the above embodiments, the present invention further provides an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided in the foregoing embodiments. To implement the above embodiments, the present invention further provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the method provided in the foregoing embodiments when executed by a processor.

[0083] To implement the above embodiments, the present invention further provides a computer program product including a computer program, which implements the method provided in the foregoing embodiments when executed by a processor.

[0084] The collection, storage, use, processing, transmission, provision, and disclosure of the user's personal information involved in the present invention all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0085] It should be noted that personal information from users should be collected for legal and reasonable purposes and should not be shared or sold outside of these legal uses. In addition, such collection / sharing should be carried out after obtaining the informed consent of the user, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization including authorizing relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others with access to the personal information data comply with their privacy policies and procedures.

[0086] The present invention anticipates providing embodiments that allow users to selectively block the use or access of personal information data. That is, the present disclosure anticipates providing hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, the risk can be minimized by restricting data collection and deleting the data. In addition, when applicable, personal identifiers are removed from such personal information to protect the privacy of the user.

[0087] In the description of the foregoing embodiments, the descriptions referring to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0088] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0089] Any process or method description represented in a flowchart or described otherwise herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logical function or process. The scope of the preferred embodiments of the present invention includes additional implementations where functions may be executed not in the order shown or discussed, including in a substantially simultaneous manner according to the involved functions or in a reverse order, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0090] The logic and / or steps represented in a flowchart or described otherwise herein, for example, may be considered as a sequenced list of executable instructions for implementing a logical function and may be specifically embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection portion having one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable medium on which the program can be printed, as the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or otherwise processing as appropriate, and then storing it in a computer memory.

[0091] It should be understood that various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following techniques known in the art or a combination thereof can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application specific integrated circuits having appropriate combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0092] Those of ordinary skill in the art can understand that all or part of the steps carried by the method of the above embodiments can be completed by a program instructing relevant hardware. The program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0093] In addition, in each embodiment of the present invention, each functional unit can be integrated in a processing module, or each unit can exist physically alone, or two or more units can be integrated in a module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the above integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0094] The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disc, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those of ordinary skill in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. An industrial control system attack detection method applicable to the background of low-quality data, characterized in that, Including: Constructing a training data set based on the historical normal data of the industrial control system; Constructing an attack detection model, the attack detection model includes a semantic extraction module, a correlation analysis module and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to statistically calculate the deviation based on the data prediction values and the corresponding actual values of multiple time steps to obtain an anomaly threshold during training, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm; Training the attack detection model using the training data set to obtain a trained attack detection model; Collecting the real-time data of the industrial control system at the current time step, and obtaining the target historical data before the current time step; Inputting the target historical data and the real-time data into the trained attack detection model to determine whether to give an alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the anomaly threshold. If a data attack occurs, an alarm is generated.

2. The industrial control system attack detection method applicable to the background of low-quality data according to claim 1, wherein The historical data includes state-type data. For state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

3. The industrial control system attack detection method applicable to the background of low-quality data according to claim 1, wherein, The historical data includes numerical data. For numerical data, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value when extracting semantic features.

4. The industrial control system attack detection method applicable to the background of low-quality data according to claim 1, wherein The correlation analysis module analyzes the correlation between semantic features from two dimensions of space and time.

5. The industrial control system attack detection method applicable to the background of low-quality data according to claim 4, characterized in that, The correlation analysis module uses a dual Transformer model with an improved attention mechanism to realize the correlation analysis of space and time between semantic features.

6. The industrial control system attack detection method applicable to the background of low-quality data according to claim 1, wherein The alarm generation module uses the POT algorithm to obtain the anomaly threshold.

7. The industrial control system attack detection method applicable to the background of low-quality data according to claim 1, wherein The real-time data includes multiple types of data. The target deviation output by the alarm generation module includes the target deviation corresponding to each type of data. Determining whether a data attack occurs based on the target deviation and the anomaly threshold includes: Comparing the target deviation corresponding to each type of data with the anomaly threshold to determine the number of data categories with anomalies; Based on the number of data categories with anomalies and a set quantity threshold to determine whether a data attack occurs at the current time step.

8. An industrial control system attack detection system applicable to the background of low-quality data, characterized in that, Including: A training set construction unit for constructing a training data set based on the historical normal data of the industrial control system; A modeling unit for constructing an attack detection model, the attack detection model including a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step. The alarm generation module is used to, during training, statistically calculate the deviation based on the data prediction values and the corresponding actual values of multiple time steps to obtain an anomaly threshold, and during testing, compare the target deviation with the anomaly threshold to determine whether to generate an alarm; A training unit for training the attack detection model using the training dataset to obtain a trained attack detection model; A collection unit for collecting real-time data of the industrial control system at the current time step and obtaining target historical data before the current time step; An attack detection unit for inputting the target historical data and the real-time data into the trained attack detection model to determine whether to generate an alarm. Among them, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain a target data prediction value for the current time step. The alarm generation module in the trained attack detection model obtains a target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the anomaly threshold. If a data attack has occurred, an alarm is generated.

9. An electronic device, characterized in that, Comprising: A processor and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, Computer-executable instructions are stored in the computer-readable storage medium, and when the computer-executable instructions are executed by the processor, they are used to implement the method according to any one of claims 1-7.

Images