An industrial control system attack detection system suitable for low-quality data background

Abstract

The present invention relates to the field of industrial control system attack detection, and specifically proposes an industrial control system attack detection system and method suitable for low-quality data backgrounds. The method includes constructing an attack detection model, wherein a semantic extraction module in the attack detection model outputs semantic features based on industrial control system data of multiple historical time steps, a correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step, and an alarm generation module obtains an abnormality threshold based on the data prediction value and actual value during training, and compares the target deviation with the abnormality threshold to determine whether to generate an alarm during testing; a training data set constructed using historical normal data is used to obtain a trained attack detection model, real-time data for the current time step is collected, and target historical data is obtained; and the trained attack detection model is used to determine whether a data attack has occurred. The method of the present invention can accurately detect data attacks against industrial control systems in low-quality data.

Description

Technical Field

[0001] The present invention relates to the field of industrial control system attack detection, and in particular to an industrial control system attack detection system and method suitable for low-quality data backgrounds. Background Art

[0002] Industrial Control Systems (ICS) are a core component of the modern Industrial Internet. They consist of numerous components, including Programmable Logic Controllers (PLCs), sensors, actuators, and Supervisory Control and Data Acquisition (SCADA) systems. They control the production and manufacturing processes of industrial equipment based on industrial production business logic. Specifically, ICS collects real-time data from various components, such as sensor measurements and actuator status data, to analyze the current state of industrial production. Based on this business logic, ICSs make decisions and issue the next stage of industrial control commands to industrial equipment, repeating the cycle.

[0003] However, with the increasing prevalence of cybercrime in recent years, industrial control systems, which are extremely valuable and important, have become increasingly targeted. There are two main attack methods against industrial control systems: 1) tampering with the industrial data collected by the industrial control system, thereby undermining the authenticity and correctness of the data, causing the industrial control system to make incorrect industrial production logic judgments; 2) tampering with or directly issuing incorrect industrial control commands, thereby undermining the integrity of industrial control commands, resulting in reduced industrial production efficiency and even industrial accidents. Therefore, timely detection of various data attacks against industrial control systems is crucial to maintaining the normal operation of industrial control systems and, ultimately, ensuring the security and stability of the Industrial Internet.

[0004] To detect data attacks against industrial control systems, many existing solutions utilize data-driven approaches. These solutions offer the advantages of high versatility, timely detection, and ease of rapid deployment in new Industrial Internet systems. Their typical workflow involves: 1) collecting data from different components of an industrial control system under normal operating conditions; 2) using statistical methods, machine learning, and even deep learning to model the temporal changes in this normal data, thereby predicting the next stage of the industrial control system's normal operating conditions; and 3) calculating the degree of deviation between the predicted data and the actual measured data. If the deviation exceeds a threshold, the system data is considered to have deviated from normal conditions, indicating a high likelihood of a data attack. The essence of these approaches is to use data to model the normal industrial production process patterns underlying industrial control systems and the interrelationships between different industrial components.

[0005] Data-driven industrial control system data attack detection technologies share a significant common problem: they assume that the data collected from industrial control systems is high-quality, meaning that the data accurately reflects the physical state of the industrial control system at the time of data collection. However, in real industrial production environments, the data collected by industrial control systems is often of low quality, meaning that the data does not accurately reflect the physical state of the industrial control system and its components. There are two common reasons for low-quality data:

[0006] First, the real Industrial Internet consists of numerous components with varying degrees of age. It's difficult to guarantee perfect accuracy for each component, resulting in some components reporting low-quality data about the physical world to industrial control systems. For example, some sensors or controllers may fail, preventing them from reporting and causing data loss. Clocks in some sensors or controllers may be out of sync, leading to the erroneous mixing of data from different time periods. Some sensors or controllers are outdated or faulty, resulting in significant noise in the collected data. Furthermore, undetected data attacks within industrial control systems can occur, causing "normal" data to actually contain anomalous data.

[0007] Secondly, when launching a data attack, attackers may tamper with the data collected by the industrial control system by attacking key nodes responsible for data transmission and collection. This means that the abnormal data status caused by the data attack is modified to appear "normal," thereby concealing the data attack. In this case, the data collected by the industrial control system does not reflect the abnormal state of the attack and is therefore of low quality. Some viruses use this attack mode. While tampering with the centrifuge control commands, they also send previously recorded normal working status data of the centrifuge to the data collection system, allowing the attack to remain undetected for a long time.

[0008] In general, in the context of low-quality industrial control system data, existing data-driven industrial control system data attack detection solutions are not only unable to correctly model and learn the normal state of the industrial system, but also unable to understand the actual data anomalies and attack status, which in turn leads to a serious decline in their detection capabilities, posing serious security risks to industrial control systems and even the entire industrial Internet. Summary of the Invention

[0009] The present invention aims to solve one of the technical problems in the related art at least to a certain extent.

[0010] To this end, the first object of the present invention is to propose an industrial control system attack detection method suitable for low-quality data background, so as to accurately detect data attacks against the industrial control system in the low-quality data generated by the industrial control system.

[0011] The second object of the present invention is to provide an industrial control system attack detection system suitable for low-quality data background.

[0012] A third object of the present invention is to provide an electronic device.

[0013] A fourth object of the present invention is to provide a computer-readable storage medium.

[0014] To achieve the above objectives, the first aspect of the present invention provides an industrial control system attack detection method suitable for low-quality data backgrounds, comprising:

[0015] Build a training dataset based on historical normal data of industrial control systems;

[0016] Constructing an attack detection model, the attack detection model includes a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step. The alarm generation module is used to calculate the deviation between the data prediction values ​​and the corresponding actual values ​​of the multiple time steps during training to obtain an abnormality threshold, and compare the target deviation with the abnormality threshold during testing to determine whether to generate an alarm.

[0017] Using the training data set to train an attack detection model to obtain a trained attack detection model;

[0018] Collect real-time data of the industrial control system at the current time step and obtain target historical data before the current time step;

[0019] The target historical data and real-time data are input into a trained attack detection model to determine whether to issue an alarm, wherein the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step, and the alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, and generates an alarm if a data attack occurs.

[0020] In the method of the first aspect of the present invention, the historical data includes state-type data, and for the state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

[0021] In the method of the first aspect of the present invention, the historical data includes numerical data. For the numerical data, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets when extracting semantic features, and obtaining the semantic features of the bucket corresponding to the maximum projection value.

[0022] In the method of the first aspect of the present invention, the correlation analysis module analyzes the correlation between semantic features from two dimensions: space and time.

[0023] In the method of the first aspect of the present invention, the correlation analysis module adopts a dual Transformer model with an improved attention mechanism to realize spatial and temporal correlation analysis between semantic features.

[0024] In the method of the first aspect of the present invention, the alarm generation module uses a POT algorithm to obtain the abnormality threshold.

[0025] In the method of the first aspect of the present invention, the real-time data includes multiple categories of data, the target deviation output by the alarm generation module includes the target deviation corresponding to each category of data, and determining whether a data attack occurs based on the target deviation and the abnormality threshold includes: comparing the target deviation corresponding to each category of data and the abnormality threshold to determine the number of data categories in which abnormalities occur; and determining whether a data attack occurs in the current time step based on the number of data categories in which abnormalities occur and a set quantity threshold.

[0026] To achieve the above objectives, the second aspect of the present invention provides an industrial control system attack detection system suitable for low-quality data backgrounds, comprising:

[0027] A training set construction unit, used for constructing a training data set based on historical normal data of the industrial control system;

[0028] a modeling unit for constructing an attack detection model, the attack detection model comprising a semantic extraction module, a correlation analysis module, and an alarm generation module, wherein the semantic extraction module outputs semantic features based on industrial control system data at multiple historical time steps, the correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step, and the alarm generation module is configured to calculate a statistical deviation between the data prediction values ​​at multiple time steps and the corresponding actual values ​​to obtain an anomaly threshold during training, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm;

[0029] A training unit, configured to train an attack detection model using the training data set to obtain a trained attack detection model;

[0030] The acquisition unit is used to collect the real-time data of the industrial control system at the current time step and obtain the target historical data before the current time step;

[0031] An attack detection unit is used to input the target historical data and real-time data into a trained attack detection model to determine whether to issue an alarm, wherein the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step, and the alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, and generates an alarm if a data attack occurs.

[0032] To achieve the above-mentioned purpose, the third aspect of the present invention proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method proposed in the first aspect of the present invention.

[0033] To achieve the above-mentioned purpose, the fourth aspect of the present invention proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method proposed in the first aspect of the present invention.

[0034] The present invention provides an industrial control system attack detection method, system, electronic device and storage medium suitable for low-quality data backgrounds. The method constructs a training data set based on the historical normal data of the industrial control system; constructs an attack detection model, which includes a semantic extraction module, a correlation analysis module and an alarm generation module. The semantic extraction module outputs semantic features based on the industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to obtain an abnormality threshold based on the statistical deviation of the data prediction values ​​and the corresponding actual values ​​of multiple time steps during training, and compares the target deviation with the abnormality threshold to determine the target deviation during testing. Whether to generate an alarm; using a training dataset to train an attack detection model to obtain a trained attack detection model; collecting real-time data from the industrial control system at the current time step and obtaining historical target data before the current time step; inputting the target historical data and real-time data into the trained attack detection model to determine whether to issue an alarm. The semantic extraction module and correlation analysis module in the trained attack detection model process the target historical data to obtain a predicted target data value for the current time step. The alarm generation module in the trained attack detection model obtains a target deviation based on the predicted target data value and the real-time data, and determines whether a data attack has occurred based on the target deviation and an anomaly threshold. If a data attack has occurred, an alarm is generated. In this case, the semantic extraction module, correlation analysis module, and alarm generation module are integrated to determine the normal deviation by analyzing the correlation of the semantic features of the industrial control system, and then determine whether a data attack has occurred based on the real-time data at the current time step and the target historical data. This method effectively detects data attacks on industrial control systems in the context of low-quality data, and the detection effect is superior to existing data-driven industrial control system data attack detection methods. Therefore, data attacks on industrial control systems can be more accurately and effectively detected in the low-quality data generated by industrial control systems.

[0035] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0037] Figure 1 A flowchart of an industrial control system attack detection method applicable to low-quality data backgrounds provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of a specific process of an industrial control system attack detection method applicable to low-quality data backgrounds provided by an embodiment of the present invention;

[0039] Figure 3 This is a block diagram of an industrial control system attack detection system suitable for low-quality data backgrounds provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0041] The following describes an industrial control system attack detection method and system applicable to low-quality data backgrounds according to an embodiment of the present invention with reference to the accompanying drawings.

[0042] The industrial control system data referred to in this invention refers to the collective data of all industrial components within an industrial control system during their operational phase, such as sensor measurement data of specific physical parameters and actuator execution status data. Data can be categorized into two types based on format: numerical and state-based. The industrial control system data for each time segment (i.e., each time step) can be organized into a multidimensional vector, with each dimension corresponding to a type of data. Industrial control system data from multiple time segments can then be organized into a multivariate time series.

[0043] The present invention relates to industrial control system data attack detection: an attacker's data attack on one or some components of an industrial control system will cause anomalies in the corresponding time segment data. The purpose of industrial control system data attack detection is to find the time segments where data attacks occur in the multivariate time series composed of industrial control system data of multiple time segments.

[0044] The low-quality data of industrial control systems targeted by the present invention refers to the data collected by the industrial control system that cannot accurately reflect the real state of the industrial control system in the physical world during the time segment of data collection. There are two main reasons for the low-quality data of industrial control systems: 1) Some components of the industrial control system are outdated and cannot accurately measure and report data; 2) Attackers actively tamper with abnormal data to hide attacks. The problem of low-quality data is very common in real industrial control systems. It will cause the detection capability of existing industrial Internet data attack detection technology to be seriously reduced, and it will not be able to detect various data attacks, which will seriously endanger the integrity, security and confidentiality of high-value industrial data in the industrial Internet and industrial critical infrastructure, and thus lead to serious economic losses.

[0045] Embodiments of the present invention provide an industrial control system attack detection method and system applicable to low-quality data backgrounds, so as to accurately detect data attacks against the industrial control system in the low-quality data generated by the industrial control system.

[0046] Figure 1 A flowchart of an industrial control system attack detection method applicable to low-quality data backgrounds provided by an embodiment of the present invention.

[0047] like Figure 1 As shown, the industrial control system attack detection method applicable to low-quality data background includes the following steps:

[0048] Step S101: construct a training data set based on historical normal data of the industrial control system.

[0049] In step S101 , it is easy to understand that the historical normal data of the industrial control system refers to the industrial control system data collected at historical time steps when the industrial control system is operating normally (ie, operating without data attack behaviors).

[0050] In step S101, historical data includes two types of data: state data (i.e., status data) and numerical data (i.e., numerical data). Industrial control system data includes multiple types of data, each generated by different individual industrial control system components.

[0051] Step S102: construct an attack detection model, which includes a semantic extraction module, a correlation analysis module, and an alarm generation module.

[0052] In step S102, the semantic extraction module outputs semantic features based on the industrial control system data from multiple historical time steps. For state-based data, the semantic extraction module uses a neural network embedding layer to extract semantic features. For numerical data, the semantic extraction module dynamically maps the data into multiple buckets and extracts the semantic feature corresponding to the bucket with the maximum projection value.

[0053] Specifically, the semantic extraction module, also known as the data semantic feature extraction module, is responsible for extracting fine-grained semantic features from different types of low-quality data collected by industrial control systems. It utilizes a dynamic data semantic feature extraction model. This module first partitions the input industrial control system data according to a specified time sliding window. For each type of state-based data, a neural network embedding layer is used to convert it into data semantic features. For each type of numerical data, the specific values ​​are dynamically mapped into multiple buckets. The feature vector corresponding to the bucket with the maximum projection value is obtained as the semantic feature of the data. Unlike existing data semantic feature extraction methods that require manual pre-setting of data semantics or data bucket value ranges, this module's data semantic features and the weights for mapping data to each bucket are automatically learned during the training process, eliminating the need for manual intervention. Furthermore, this module's data semantic feature model is able to better maintain the accuracy of extracted data semantic features even when the data is of low quality. Therefore, this module is capable of effectively extracting semantic features from heterogeneous and diverse low-quality data from real industrial control systems.

[0054] In step S102, the correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The correlation analysis module analyzes the correlation between semantic features from two dimensions: space and time. The correlation analysis module uses a dual Transformer model with an improved attention mechanism to implement spatial and temporal correlation analysis between semantic features. It is easy to understand that the Transformer model is a neural network unit based on the attention mechanism. The network can receive a sequence composed of multiple features, analyze the correlation between different features, and generate an output feature sequence with the same shape as the original input, and each output feature contains the correlation between the corresponding input feature and other input features.

[0055] Specifically, the correlation analysis module is also called the data semantic time-space correlation analysis module. This module is responsible for analyzing the correlation between the semantics of industrial control system data from two dimensions, space and time, to achieve the prediction of normal data in the next stage of the system. This module adopts a dual Transformer model based on an improved robust attention mechanism to accurately capture the time-space correlation of semantics of different types of data in the same time segment, while effectively eliminating the interference of low-quality data. Unlike existing industrial control system data correlation analysis methods that only analyze correlation from a single dimension of time or space and are susceptible to interference from low-quality data such as noise, this module can accurately model the change pattern of complex industrial control system data over time through time-space analysis, and effectively eliminate the interference of low-quality data on correlation analysis, thereby more accurately predicting the correct data for the next stage. Therefore, this module can be better applied to real industrial control system scenarios where low-quality complex data is prevalent.

[0056] In step S102, the alarm generation module calculates the deviation between the predicted data values ​​and the corresponding actual values ​​at multiple time steps during training to determine an anomaly threshold. During testing, the module compares the target deviation with the anomaly threshold to determine whether to generate an alarm. The alarm generation module uses the POT (Peak over Threshold) algorithm to determine the anomaly threshold. As is easy to understand, the POT algorithm is an automatic threshold selection algorithm that extracts a threshold from sequence data that can distinguish between outliers and normal values ​​(i.e., actual values). The actual values ​​are directly collected industrial control system data.

[0057] Specifically, the alarm generation module, also known as the data attack alarm generation module, is responsible for counting the predicted deviation values ​​for each data type in the normal training data under the current system and calculating the anomaly threshold for each data type. This module uses the POT algorithm to obtain the anomaly threshold for the deviation between the actual and predicted values ​​for each data type. During testing, based on the actual values ​​(i.e., real-time data) collected by the industrial control system, this module analyzes the target deviation between the actual and predicted values ​​of each data type and the anomaly threshold to determine whether to generate an alarm, thereby determining whether the industrial control system has suffered a data attack. This module can comprehensively determine whether the industrial control system has suffered a data attack based on the number of anomaly data types and their duration. Compared with existing technologies that detect anomaly data by calculating the mean deviation value of each data type and using a single threshold, this module effectively overcomes the problem of low-quality data leading to a large number of false alarms, reduces the manual intervention overhead for industrial control system security operations and maintenance personnel, and improves the efficiency of industrial control system security operations and management. Therefore, it is also more applicable to real-world industrial control systems with low-quality data.

[0058] Step S103: Using the training data set to train the attack detection model to obtain a trained attack detection model.

[0059] Specifically, in step S103, the semantic extraction module divides all data from the industrial control system during normal operating hours (i.e., the training dataset obtained in step S101) into fixed-length sliding windows. Using a data semantic feature extraction model, the module extracts data semantic features from each data type at each time step. The multivariate time series composed of the data semantic features of each data type, divided according to the sliding windows, serves as input to the correlation analysis module. The correlation analysis module uses an improved dual Transformer model to learn the spatiotemporal correlations between normal data semantics, thereby learning how to predict normal data at the next time step based on data from multiple previous time steps. The alarm generation module is responsible for calculating the predicted deviation value for each data type in the normal training data under the current system and calculating the anomaly detection threshold for each data type.

[0060] Step S104 , collecting real-time data of the industrial control system at the current time step, and obtaining target historical data before the current time step.

[0061] In step S104, the time steps corresponding to the target historical data are consistent with the number of time steps of the input data of the semantic extraction module during training.

[0062] In step S104 , both the real-time data and the target historical data include multiple categories of data, and the categories are consistent.

[0063] Step S105 : Input the target historical data and real-time data into the trained attack detection model to determine whether to issue an alarm.

[0064] In step S105, the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step. The alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormal threshold. If a data attack occurs, an alarm is generated.

[0065] In step S105, the target deviation output by the alarm generation module includes the target deviation corresponding to each type of data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, including: comparing the target deviation and the abnormality threshold corresponding to each type of data to determine the number of data categories with abnormalities; based on the number of data categories with abnormalities and the set quantity threshold, determining whether a data attack occurs in the current time step.

[0066] Specifically, in step S105, the historical time segment data of the industrial control system (i.e., the target historical data) that is consistent with the length of the sliding window is input into the semantic extraction module of the trained attack detection model, and the data semantic features of each type of data at each time step are also extracted; then the multivariate time series composed of the data semantic features is input into the correlation analysis module to predict the data value of the industrial control system at the current time step; at the current time step, the industrial control system analyzes the target deviation between the actual value and the predicted value of the data based on the actual value of each type of data collected (i.e., real-time data), and the alarm generation module in the trained attack detection model decides whether to generate an alarm.

[0067] Figure 2 This is a schematic diagram of a specific flow chart of an industrial control system attack detection method applicable to low-quality data backgrounds provided by an embodiment of the present invention.

[0068] like Figure 2 As shown in the figure, the constructed attack detection model includes a data semantic feature extraction module, a data semantic time-space correlation analysis module and a data attack alarm generation module.

[0069] The data semantic feature extraction module is responsible for converting industrial control system data (status data and numerical data) into a multivariate time series composed of data semantic features. For example, the data semantic features obtained for status data are <0,1,0…,0,0,0>, and the data semantic features obtained for numerical data are <0.1,0.2…,0.15>. Each multivariate time series is the semantic feature of each time step. The data semantic time-space correlation analysis module uses a dual Transformer model with an improved attention mechanism to mine and analyze the spatial correlation and temporal correlation between the semantic features of each time step, modeling the change pattern of normal industrial control system data and realizing the prediction of the next stage of data. For example, using the semantic features of the n time steps before the nth time step<T0,T1……,Tn-1> This module predicts the semantic feature Tn at the nth time step. The data attack alert generation module analyzes the deviation between the actual and predicted data, identifies the time segments where the data anomalies occur, and ultimately generates alerts about data attacks. For example, the deviation between the predicted Tn (e.g., <0.1, 0.2…, 0.15>) and the actual Tn (e.g., <0.1, 0.2…, 0.15>) is analyzed to determine the anomaly threshold (referred to as the threshold).

[0070] like Figure 2 As shown in the figure, the attack detection method's workflow consists of two main parts: training and testing, as indicated by the white and black arrows in the figure. During the training process, low-quality, normal historical training data collected by the industrial control system is converted into a multivariate time series composed of semantic features by the data semantic feature extraction module. This data is then input into the data semantic spatiotemporal correlation analysis module for analysis, enabling the module to predict the next stage of data. Furthermore, the data attack alarm generation module learns anomaly thresholds between the actual values ​​of various data types and the predicted values ​​output by the data semantic spatiotemporal correlation analysis module from the normal historical training data. During the testing process, the industrial control system feeds multiple historical time segments prior to the current time segment (i.e., the current time step) along with low-quality data into the data semantic feature extraction module, which also converts them into multivariate time series composed of data semantic features. This data is then input into the trained data semantic spatiotemporal correlation analysis module, which uses these data to predict the data for the current time segment. The data attack alarm generation module determines whether to generate a data attack alarm based on the degree of deviation between the actual and predicted values ​​of various data types in the current time segment and the thresholds learned during the training phase.

[0071] Specifically, in the data semantic feature extraction module, the input industrial control system data is first divided according to a specified time sliding window (for example, 10 time segments in length), and each time segment is a multidimensional vector composed of multiple industrial control system data. Therefore, all the data in all time segments within the sliding window form a multivariate time series, and each variable in each time step corresponds to the specific data value of a certain industrial Internet component at that time step. In order to support the subsequent modules' analysis of the spatiotemporal correlation of data semantics, it is necessary to extract semantic features from each data that can represent this type of data under the current data value, and the semantic features of all categories of data need to be in the same space. Therefore, this module adopts a dynamic data semantic feature extraction model, which works as follows:

[0072] The raw data collected from industrial control systems can be divided into two categories: numerical and state-based. For each type of state-based data, each specific data value is first converted into a one-hot encoding (one-hot vector). The length of the vector is equal to the number of states of this type of data, and the vector is only 1 in the position corresponding to the data value, and all other positions are 0. In addition, a matrix is ​​stored for each state data to record the data semantic features under different state values. i The matrix of class state data is ,in is the number of states of this type of data, d is the dimension of the data semantic features. Through simple matrix multiplication operations, we can obtain the i Class state data (one-hot encoding) at the current value Data semantic features The matrix responsible for recording semantic features is implemented through a neural network embedding layer. The semantic features of the data stored in it will be automatically learned during the training process of the module without manual pre-setting.

[0073] For each type of numerical data, since it contains a large number of specific values, setting a dedicated data semantic feature for each specific value will not only bring a very large computational overhead, but will also be limited by the scarcity of training data related to different data values. Another widely used technical route is to divide the value range of numerical data into multiple buckets (Buckets). Each data value will fall into a bucket and each bucket is set with a dedicated semantic feature. However, this method not only requires manual pre-division of the value range of each bucket, but also a single slight change in the data value may cause the semantic features to be completely inconsistent, which is inconsistent with the actual characteristics of industrial equipment that the semantics are closer when the data values ​​are similar. In particular, when the industrial Internet data is of low quality and contains a lot of noise, this method of generating data semantic features will be very susceptible to interference, and it will be difficult to obtain the correct data semantic features. In order to overcome the shortcomings of the above-mentioned traditional methods, the dynamic data semantic feature extraction model adopts a method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value. Specifically, the dynamic data semantic feature extraction model maps the first The original data value of the numeric data The process of dividing into multiple buckets can be expressed as the following formula:

[0074] (1)

[0075] (2)

[0076] in and , ReLu () is the activation function, is a coefficient parameter, and is the preset number of buckets. Represents the original data value The projection value on each bucket is further standardized using the Softmax method:

[0077] (3)

[0078] in Represents the Buckets, It is a preset parameter that controls the degree of discreteness. Represents the Buckets, finally, the original data value Data semantic features It can be set as the semantic feature corresponding to the bucket with the largest projection value, and the semantic feature of each bucket is a d In this method, the original data value is dynamically divided into multiple buckets. and The parameters and semantic features corresponding to each bucket are obtained dynamically through the model training process and do not need to be set in advance.

[0079] After the above data semantic feature extraction operation, each original data value is converted into a d dimensional semantic feature vector. Assume that the total number of industrial control system data categories is , then all the data semantic features of each time segment can be represented as a size of A matrix of dimension, The semantic features of all data in all time segments within a sliding time window can be represented as a Tensor of .

[0080] Unlike other related approaches that directly use raw data values ​​as features, or partition data values ​​into manually defined buckets and then use only the data semantic features corresponding to a single bucket, the data semantic feature extraction module of this embodiment innovatively dynamically projects raw data values ​​into multiple buckets and obtains the semantic features corresponding to the bucket with the maximum projection value. This allows for more accurate data semantic features to be obtained even in the context of low-quality industrial control system data. Furthermore, the dynamic bucket partitioning and semantic features are automatically learned during the training process, eliminating the need for manual configuration. This makes it ideal for extracting features from diverse and heterogeneous data with inconsistent semantic information found in real industrial control systems.

[0081] In the data semantic spatiotemporal correlation analysis module, after obtaining the semantic features of the data, the data semantic spatiotemporal correlation analysis module is responsible for analyzing the correlation between the data semantics from the spatial and temporal dimensions respectively, in order to model the data change pattern of the industrial control system under normal conditions and realize the prediction of the data in the next stage. The design of this module is based on two principles: 1) The physical world state or action in the industrial control system will be reflected in the semantics of multiple types of data at the same time. Therefore, there is a correlation between the semantics of multiple types of data at the same time, that is, spatial correlation; 2) The semantics of various types of data in the industrial control system at the same time describe the overall state of the system at that time, and the state of the historical system jointly determines the data of the current system. Therefore, there is also a correlation between the semantics of data at different times, that is, temporal correlation; this module uses a dual Transformer model with an improved attention mechanism to realize the analysis of the spatiotemporal correlation of data semantics. Its specific composition and working method are as follows:

[0082] The first Transformer model in the dual Transformer model is responsible for extracting the correlation between the semantic features of different data in the same time segment, that is, spatial correlation. In principle, the Transformer model uses the attention mechanism to analyze the correlation between input data. It can be regarded as a mathematical function responsible for mapping query data (Query) and key-value data (Key-Value) to output data (Output). Query data and key-value data are both some kind of mapping representation of input data (Input). For the current query data, the attention mechanism calculates its correlation with each key (Key) and uses it as the weight of the value (Value) corresponding to each key, and then uses the weighted sum of all values ​​as the output data. The correlation between the query data and different keys will be reflected in the output data. Therefore, for the vector composed of the semantic features of the data of each time segment, it is recorded as , is the number of data types (i.e. the total number of data categories), d Is the dimension of each data semantic feature, query data ,key Sum You can use Perform different linear mappings to obtain:

[0083] (4)

[0084] in are different mapping matrices, is the dimension of each output data, and their weights are automatically learned during the training process of the attention mechanism to achieve the best correlation analysis ability. On this basis, the complete attention function The calculation process can be expressed as:

[0085] (5)

[0086] is the transpose of K. After the attention mechanism is calculated, each data semantic feature output by the first Transformer model contains the correlation with other data semantic features. However, in the context of low-quality data in the real industrial Internet environment, the above original Attention mechanism will cause the part of the data that is more affected by noise to also be correlated with other data semantics. That is, there are incorrect correlation calculation results in the output results, resulting in an inaccurate description of the overall system status of the industrial Internet. To overcome this problem, the Transformer model of this module adopts a robust attention mechanism (i.e., an improved attention mechanism). During the attention calculation process, it sorts the correlation between each query data and all keys, and only retains the top ones. The large result is used to update the parameters of the attention mechanism. is a parameter set artificially. The principle of this scheme is that low-quality data deviates from normal semantics and is often semantically irrelevant to other normal data. Therefore, the correlation calculation results between them are usually not significant and can be filtered through sorting operations. Therefore, this strategy can enhance the robustness of the attention mechanism under low-quality data. Under this strategy, formula (5) can be improved to:

[0087] (6)

[0088] (7)

[0089] It is the Top-k value operation for each row of the correlation matrix. It is a very small constant value to prevent division by zero errors during calculations.

[0090] In the same time segment, all data contain relevant semantic features, which together constitute the overall state of the industrial control system at that time. After the overall state of the industrial control system in each time segment is obtained, the module uses another Transformer model to perform a time dimension correlation analysis on them. That is, the semantic features corresponding to the overall state of the industrial control system in different time segments are input into another Transformer model in time sequence. The output of the last time segment is integrated with the previous The semantic features of the industrial control system in each time segment can be realized through a simple fully connected neural network to realize the next stage (the Finally, this module uses a simple fully connected neural network to map the semantic features back to the data values ​​of each type of data.

[0091] During the training phase of the system, the module uses the previous All the semantic features of the data of the time segment are taken as input, based on the output results and the The loss value of the neural network model is calculated by the average deviation of the data values ​​of the time segments, and the training is carried out through the classic stochastic gradient descent algorithm. Moreover, since the data semantic feature extraction module is also connected to this module, the loss value will also be used to optimize the neural network parameters in the data semantic feature extraction module to enable it to better extract the semantic features of each data. In the detection phase of the system, the module uses the previous time before the current time. The semantic features of all data in a time segment are used as input to predict the normal value of each data at the current time.

[0092] The data semantic time-space correlation analysis module of the embodiment of the present invention is different from other related works that only analyze the correlation between data semantics from a single dimension of time or space. It innovatively explores the intrinsic correlation between the data semantics of industrial control systems from both time and space dimensions, thereby more accurately modeling the change pattern of normal data in industrial control systems and achieving more accurate prediction of next-stage data. In addition, this module also uses a robust attention calculation mechanism to improve the Transformer model responsible for analyzing the time-space correlation of data semantics, so that it can eliminate the interference of low-quality data on other normal data semantics, more accurately characterize the overall data semantics of the industrial control system, and achieve accurate prediction of the next-stage data of the industrial control system in the context of low-quality data.

[0093] The data attack alarm generation module analyzes the current time data, semantically predicted by the previous time segment data, and the degree of deviation from the actual data value at the current time to determine whether the current data is abnormal and generate an alarm regarding the data attack. However, low-quality industrial data is likely to deviate from normal data values, that is, even when there is no data attack, it still deviates significantly from the predicted value. Traditional abnormal data detection methods based on the mean data deviation degree and a single fixed threshold will generate many false alarms in this situation. To overcome this problem, the module designs an adaptive data deviation degree analysis method, which works as follows:

[0094] First, during the training phase, the deviation between the predicted values ​​(generated by the data semantic analysis module) and the actual values ​​for each data type (i.e., data generated by a single industrial control system component) in historical normal data is statistically analyzed. A Peak over Threshold (POT) algorithm is used to automatically determine the positive anomaly threshold for each data type's deviation. During the detection phase, if the deviation between the predicted and actual values ​​for a particular data type in the current time segment exceeds the corresponding threshold, that data type is considered an anomaly. Subsequently, if the number of anomalous data types exceeds a predefined first threshold, the current time segment is marked as an anomaly; otherwise, it is considered normal. Finally, if multiple consecutive time segments exceeding a predefined second threshold are considered anomalies, these time segments are treated as a single data attack alert; otherwise, no alert is generated.

[0095] Unlike other related work that detects abnormal data solely through the mean of each data deviation and a single threshold, the data attack alert generation module in this embodiment of the present invention innovatively employs a POT algorithm to automatically obtain more specific thresholds for each data deviation, which are more consistent with the distribution characteristics of that data, enabling fine-grained detection of specific abnormal data. Furthermore, this module comprehensively determines whether to generate a data attack alert based on the number of abnormal data categories and the duration of the abnormal data time segment, effectively reducing the problem of false alarms caused by low-quality data.

[0096] In order to implement the above embodiment, the present invention further proposes an industrial control system attack detection system suitable for low-quality data background.

[0097] Figure 3 This is a block diagram of an industrial control system attack detection system suitable for low-quality data backgrounds provided by an embodiment of the present invention.

[0098] like Figure 3 As shown, the industrial control system attack detection system suitable for low-quality data background includes a training set construction unit 11, a modeling unit 12, a training unit 13, a collection unit 14 and an attack detection unit 15, wherein:

[0099] A training set construction unit 11 is used to construct a training data set based on historical normal data of the industrial control system;

[0100] A modeling unit 12 is configured to construct an attack detection model, the attack detection model comprising a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data at multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step. The alarm generation module is configured to calculate deviations between the data prediction values ​​at multiple time steps and the corresponding actual values ​​to obtain an anomaly threshold during training, and compare the target deviation with the anomaly threshold during testing to determine whether to generate an alarm.

[0101] A training unit 13 is used to train the attack detection model using the training data set to obtain a trained attack detection model;

[0102] The acquisition unit 14 is used to acquire the real-time data of the industrial control system at the current time step and obtain the target historical data before the current time step;

[0103] The attack detection unit 15 is used to input the target historical data and real-time data into a trained attack detection model to determine whether to issue an alarm, wherein the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step, and the alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, and generates an alarm if a data attack occurs.

[0104] Furthermore, in a possible implementation of the embodiment of the present invention, the historical data includes state-type data, and in the modeling unit 12, for the state-type data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

[0105] Furthermore, in a possible implementation of an embodiment of the present invention, historical data includes numerical data. For numerical data in the modeling unit 12, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets when extracting semantic features, and obtaining the semantic features of the bucket corresponding to the maximum projection value.

[0106] Furthermore, in a possible implementation of the embodiment of the present invention, the correlation analysis module in the modeling unit 12 analyzes the correlation between semantic features from two dimensions: space and time.

[0107] Furthermore, in a possible implementation of an embodiment of the present invention, the correlation analysis module in the modeling unit 12 adopts a dual Transformer model with an improved attention mechanism to implement spatial and temporal correlation analysis between semantic features.

[0108] Furthermore, in a possible implementation of the embodiment of the present invention, the alarm generation module in the modeling unit 12 uses a POT algorithm to obtain an abnormality threshold.

[0109] Furthermore, in a possible implementation of an embodiment of the present invention, real-time data includes multiple categories of data, and the target deviation output by the alarm generation module includes the target deviation corresponding to each category of data. In the attack detection unit 15, whether a data attack occurs is determined based on the target deviation and the abnormality threshold, including: comparing the target deviation and the abnormality threshold corresponding to each category of data to determine the number of data categories in which abnormalities occur; and determining whether a data attack occurs in the current time step based on the number of data categories in which abnormalities occur and a set quantity threshold.

[0110] Furthermore, in a possible implementation of an embodiment of the present invention, the semantic extraction module is also called a data semantic feature extraction module. This module is responsible for extracting fine-grained semantic features from different types of data collected by the industrial control system. There are many different sensors, actuators, etc. in the industrial control system, each of which corresponds to a physical world measurement with a different value range, and different values ​​of different data have different semantics. Therefore, this module needs to be responsible for extracting semantic features that can represent the specific meaning of the data from each original and low-quality data in each time period of the industrial control system, and the semantic features of different data need to be in the same semantic space to support the subsequent module's analysis of the spatiotemporal correlation of the semantics of different data. To achieve this goal, the module includes a dynamic data semantic feature extraction model. For details, please refer to the relevant description in the above method embodiment.

[0111] Furthermore, in a possible implementation of an embodiment of the present invention, the correlation analysis module is also called a data semantic time-space correlation analysis module, which is responsible for mining the intrinsic semantic correlation of different data collected by the industrial control system from the spatial and temporal dimensions, respectively, to model the data change pattern under the normal state of the industrial control system, and to predict the normal data of the next stage. Based on the different data semantic features extracted by the data semantic feature extraction module, the data semantic time-space correlation analysis module adopts a dual Transformer model improved based on the robust self-attention mechanism, and first performs a correlation analysis in the spatial dimension, which can fully model the semantic correlation of different types of data in the same time segment while excluding the interference of some low-quality data, especially noise data, to obtain the overall data semantics of the industrial control system in each time segment, and then performs a time dimension analysis on the overall data semantics of the industrial control system in different time segments, mining the change pattern of data semantics over time, and realizing accurate prediction of the next stage data of the industrial control system under normal state.

[0112] Furthermore, in one possible implementation of an embodiment of the present invention, the alarm generation module, also known as the data attack alarm generation module, is responsible for analyzing the degree of deviation between the predicted value of the industrial control system's next-stage data by the data semantic time-space correlation analysis module and the data value actually collected by the industrial control system, in order to identify abnormal data time segments suspected of data attacks and generate alarms. The data attack alarm generation module designs an adaptive data deviation degree analysis method. It first performs a statistical analysis of the historical normal data of each type of data (i.e., data generated by a single industrial control system component) to obtain a positive abnormality threshold for the degree of deviation of this type of data. It then counts the number of data categories identified as abnormal in each time segment. If the number exceeds the threshold, the time segment is considered abnormal. The module then analyzes the persistence of the abnormal data to determine whether to generate an alarm regarding the data attack, thereby preventing false alarms caused by occasional data anomalies caused by low-quality data noise.

[0113] It should be noted that the above explanation of the embodiment of the industrial control system attack detection method suitable for low-quality data background is also applicable to the industrial control system attack detection system suitable for low-quality data background of this embodiment, and will not be repeated here.

[0114] In an embodiment of the present invention, a training data set is constructed based on historical normal data of an industrial control system; an attack detection model is constructed, the attack detection model including a semantic extraction module, a correlation analysis module, and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain a data prediction value for the current time step. The alarm generation module is used to calculate the deviation between the data prediction values ​​and the corresponding actual values ​​of the multiple time steps during training to obtain an abnormality threshold, and to compare the target deviation with the abnormality threshold during testing to determine whether to generate an alarm. The attack detection model is trained using the training data set to obtain a trained attack detection model. Real-time data of the industrial control system at the current time step is collected, and target historical data before the current time step is obtained. The target historical data and real-time data are input into the trained attack detection model to determine whether to generate an alarm. The semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain a target data prediction value for the current time step. The alarm generation module in the trained attack detection model obtains a target deviation based on the target data prediction value and the real-time data, and determines whether a data attack has occurred based on the target deviation and the abnormality threshold. If a data attack has occurred, an alarm is generated. In this case, the integrated semantic extraction module, correlation analysis module, and alarm generation module analyze the correlation of the semantic features of the industrial control system to determine deviations from normality. This then determines whether a data attack has occurred based on the current time step's real-time data and the target's historical data. This method effectively detects data attacks on industrial control systems even in the presence of low-quality data, and outperforms existing data-driven methods for detecting data attacks on industrial control systems. Therefore, it can more accurately and effectively detect data attacks targeting industrial control systems even in the presence of low-quality data generated by industrial control systems.

[0115] In the attack detection model of the present invention, the data semantic feature extraction module can extract fine-grained semantic features from different types of data collected by the industrial control system to support the subsequent modules to effectively analyze the time-space correlation of the data semantics. The data semantic time-space correlation analysis module can analyze the time-space dimensions of the data semantics collected by the industrial control system respectively, so as to fully explore the inherent correlation of the normal state data of the industrial control system, model the data change pattern of the industrial control system under the normal state, and realize the prediction of the normal data in the next stage. The data attack alarm generation module can discover abnormal data based on the deviation degree of the actual measurement data of the industrial control system in the next stage and the data semantic time-space correlation analysis module's predicted value of the normal data in the next stage, and comprehensively judge whether the industrial control system has suffered a data attack based on the number of abnormal data categories and duration. It can also filter out some false alarms of attacks and ultimately generate alarms about data attacks.

[0116] Compared to existing technologies, the present invention offers the following advantages: by analyzing the spatiotemporal correlation of industrial control system data semantics, it implements a system that effectively detects industrial control system data attacks even in the presence of low-quality data, i.e., when the data does not accurately reflect the physical state of the industrial control system at the time of data acquisition. This system also outperforms existing data-driven industrial control system data attack detection methods. The low-quality data problem addressed by the present invention stems from two main causes: 1) outdated components of the industrial control system that cannot accurately measure and report data; and 2) attackers actively tamper with anomalous data to conceal attacks. Furthermore, the data semantic feature extraction module implemented in the present invention dynamically maps data values ​​into multiple buckets and extracts the feature vector corresponding to the bucket with the maximum projection value as the semantic feature of the data value. This achieves accurate and automatic data semantic representation in the presence of low-quality data. This overcomes the problems of existing data semantic feature extraction methods, which rely on manual settings and can cause complete semantic inconsistencies even with even slightly low-quality noise. This system can better extract semantic features from heterogeneous and diverse low-quality data from real industrial control systems. The data semantic spatiotemporal correlation analysis module implemented in the system of the present invention accurately models the complex data change patterns of industrial control systems by analyzing different data semantics within the same time segment from the spatial dimension and analyzing the industrial control system status at different times from the temporal dimension. This module effectively eliminates interference from some low-quality data and achieves accurate prediction of the next stage of industrial control system data. Compared with existing technologies, this module has superior complex data change pattern modeling capabilities and greater robustness in the context of low-quality data, making it more suitable for real-world industrial control system scenarios where low-quality, complex data is prevalent. The data attack alarm generation module implemented in the system of the present invention identifies abnormal data through fine-grained analysis of the degree of deviation between the actual and predicted values ​​of each data type, and ultimately generates alarms based on the number of abnormal data categories and the persistence of the abnormal time segments. This effectively overcomes the problem of traditional abnormal data detection methods generating a large number of false alarms in the context of low-quality data, reduces the manual intervention overhead of industrial control system security operation and maintenance personnel, and improves the efficiency of industrial control system security operation and maintenance management. Therefore, it is also more suitable for real-world industrial control systems with low-quality data. In summary, the present invention provides a solution for effectively detecting data attacks in industrial control systems in the context of low-quality data. That is, the method of the present invention can accurately detect various data attacks against industrial control systems when only low-quality industrial data collected by the industrial control system is used.

[0117] In order to implement the above embodiments, the present invention also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0118] In order to implement the above embodiments, the present invention further provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided in the above embodiments.

[0119] In order to implement the above embodiments, the present invention further provides a computer program product, including a computer program, which implements the methods provided in the above embodiments when executed by a processor.

[0120] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this invention are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0121] It is important to note that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold beyond these legitimate uses. Furthermore, such collection / sharing should be conducted only after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes the relevant user information before using the feature. Furthermore, any necessary steps must be taken to safeguard and secure access to such personal information and ensure that others with access to personal information comply with its privacy policy and procedures.

[0122] The present invention contemplates providing implementations that allow users to selectively block the use or access of personal information data. Specifically, the present disclosure contemplates providing hardware and / or software to prevent or block access to such personal information data. Risks can be minimized by limiting data collection and deleting data once it is no longer needed. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0123] In the descriptions of the aforementioned embodiments, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification, as well as features of different embodiments or examples, unless they are mutually inconsistent.

[0124] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0125] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0126] The logic and / or steps represented in a flowchart or otherwise described herein, for example, can be considered a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" is any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (not exhaustive) of computer-readable media include: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and a portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0127] It should be understood that various components of the present invention may be implemented using hardware, software, firmware, or a combination thereof. In the aforementioned embodiments, multiple steps or methods may be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any of the following technologies known in the art, or a combination thereof, may be used: a discrete logic circuit having logic gates for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gates, a programmable gate array (PGA), a field-programmable gate array (FPGA), etc.

[0128] Those skilled in the art will understand that all or part of the steps in the method of the above embodiment can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0129] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium.

[0130] The storage medium mentioned above may be a read-only memory, a magnetic disk, or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it should be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Persons skilled in the art may make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for detecting industrial control system attacks in low-quality data backgrounds, characterized in that: include: Build a training dataset based on historical normal data of industrial control systems; An attack detection model is constructed, which includes a semantic extraction module, a correlation analysis module and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to obtain an abnormality threshold based on the statistical deviation of the data prediction values ​​and the corresponding actual values ​​of multiple time steps during training, and compare the target deviation with the abnormality threshold during testing to determine whether to generate an alarm. The historical data includes numerical data. For numerical data, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value when extracting semantic features. The correlation analysis module adopts a dual Transformer model with an improved attention mechanism to realize spatial and temporal correlation analysis between semantic features. During the attention calculation process, the correlation between each query data and all keys is sorted, and only the top ones are retained. Large results are used to update the parameters of the attention mechanism; Using the training data set to train an attack detection model to obtain a trained attack detection model; Collect real-time data of the industrial control system at the current time step and obtain target historical data before the current time step; The target historical data and real-time data are input into a trained attack detection model to determine whether to issue an alarm, wherein the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step, and the alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, and generates an alarm if a data attack occurs.

2. The industrial control system attack detection method applicable to low-quality data background according to claim 1 is characterized in that: Historical data includes state data. For state data, the semantic extraction module uses a neural network embedding layer to extract semantic features.

3. The industrial control system attack detection method applicable to low-quality data background according to claim 1 is characterized in that: The alarm generation module uses the POT algorithm to obtain the abnormality threshold.

4. The industrial control system attack detection method applicable to low-quality data background according to claim 1 is characterized in that: The real-time data includes multiple types of data. The target deviation output by the alarm generation module includes the target deviation corresponding to each type of data. Determining whether a data attack occurs based on the target deviation and the abnormality threshold includes: Comparing the target deviation corresponding to each type of data with the anomaly threshold to determine the number of data categories with anomalies; Based on the number of abnormal data categories and the set quantity threshold, it is determined whether a data attack occurs in the current time step.

5. An industrial control system attack detection system suitable for low-quality data background, characterized in that: include: A training set construction unit, used for constructing a training data set based on historical normal data of the industrial control system; A modeling unit is used to construct an attack detection model, which includes a semantic extraction module, a correlation analysis module and an alarm generation module. The semantic extraction module outputs semantic features based on industrial control system data of multiple historical time steps. The correlation analysis module performs correlation analysis based on the semantic features to obtain the data prediction value of the current time step. The alarm generation module is used to obtain an abnormality threshold based on the statistical deviation of the data prediction values ​​and the corresponding actual values ​​of multiple time steps during training, and compare the target deviation with the abnormality threshold during testing to determine whether to generate an alarm. The historical data includes numerical data. For numerical data, the semantic extraction module adopts a processing method of dynamically mapping the data into multiple buckets and obtaining the semantic features of the bucket corresponding to the maximum projection value when extracting semantic features. The correlation analysis module adopts a dual Transformer model with an improved attention mechanism to realize spatial and temporal correlation analysis between semantic features. During the attention calculation process, the correlation of each query data with all keys is sorted, and only the top ones are retained. Large results are used to update the parameters of the attention mechanism; A training unit, configured to train an attack detection model using the training data set to obtain a trained attack detection model; The acquisition unit is used to collect the real-time data of the industrial control system at the current time step and obtain the target historical data before the current time step; An attack detection unit is used to input the target historical data and real-time data into a trained attack detection model to determine whether to issue an alarm, wherein the semantic extraction module and the correlation analysis module in the trained attack detection model process the target historical data to obtain the target data prediction value of the current time step, and the alarm generation module in the trained attack detection model obtains the target deviation based on the target data prediction value and the real-time data, and determines whether a data attack occurs based on the target deviation and the abnormality threshold, and generates an alarm if a data attack occurs.

6. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 4 when executed by a processor.

Images