Real-time detection method for industrial control network traffic anomaly based on P4 programmable switch

Abstract

The present invention discloses a real-time detection method for industrial control network traffic anomalies based on a P4 programmable switch. The method comprises: extracting network traffic features related to timestamps in real time on the data plane; performing preliminary high-line-speed detection of traffic to identify suspicious traffic using an industrial control network traffic anomaly detection algorithm based on threshold rules; and uploading the preliminary detection results to the control plane; the control plane obtains suspicious traffic feature data based on periodically maintained key traffic feature data and uploads it to the detection plane; the detection plane performs fine-grained detection of the suspicious traffic feature data using a machine learning-based traffic anomaly detection model to obtain a final detection result; and when the difference between the final and preliminary detection results exceeds a given value, generating a new preliminary detection threshold rule based on an optimization algorithm or deep reinforcement learning and updating it to optimize detection accuracy. The present invention can significantly reduce the delay in real-time detection of industrial control network traffic anomalies and significantly improve detection accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control network traffic anomaly detection, and in particular to a real-time detection method for industrial control network traffic anomaly based on a P4 programmable switch. Background Art

[0002] Traditional methods for detecting anomaly traffic in industrial control networks often use simple anomaly detection rules to ensure real-time detection. However, these methods lack accuracy in the face of complex network attacks. While machine learning-based industrial control network traffic anomaly detection models can achieve good detection accuracy after sufficient training, these models have high computational overhead, making it difficult to ensure real-time detection.

[0003] At the same time, the recently developed P4 programmable network technology can define the entire packet forwarding process from top to bottom, enabling complete visualization of the entire network and tracing the forwarding process of each packet, thus providing technical support for innovative industrial control network traffic anomaly detection. Furthermore, current P4 programmable network switches can achieve packet processing line speeds exceeding terabits per second, surpassing traditional server-based industrial control network traffic anomaly analysis software by several orders of magnitude in packet processing speed. Compared to traditional industrial control network traffic anomaly detection methods that require port mirroring and traffic sniffing on industrial control network switches to obtain data packets, P4 programmable network switches can function as industrial control network switches themselves in some scenarios, eliminating packet transmission delays and providing a significant inherent advantage in the real-time performance of traffic anomaly detection.

[0004] In order to address the shortcomings of the above-mentioned traditional industrial control network traffic anomaly detection method, the present invention proposes an innovative industrial control network traffic anomaly detection method by introducing a P4 programmable network switch to improve the real-time and accuracy of the industrial control network traffic anomaly detection method, so that it can achieve the same detection accuracy as the current best machine learning detection model or even higher accuracy while achieving high real-time performance of industrial control network traffic anomaly detection, providing support for the timely implementation of subsequent attack blocking and recovery. Summary of the Invention

[0005] The purpose of the present invention is to address the deficiencies of the existing technology and provide a real-time detection method for industrial control network traffic anomalies based on a P4 programmable switch.

[0006] The objective of the present invention is achieved through the following technical solutions: a method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch, implemented based on a three-layer architecture consisting of a data plane, a control plane, and a detection plane, the method specifically comprising:

[0007] The data plane of the P4 programmable switch extracts network traffic features related to timestamps in real time, and uses a threshold-based industrial control network traffic anomaly detection algorithm to perform high-speed preliminary detection of traffic. The initial detection results of abnormal traffic are obtained and uploaded to the control plane deployed on the P4 programmable switch or server.

[0008] After receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane obtains suspicious traffic feature data based on the periodic collection, aggregation, and calculation of key traffic feature data and uploads it to the detection plane located on the server;

[0009] In the detection plane, a machine learning-based industrial control network traffic anomaly detection model is used to perform fine-grained detection on suspicious traffic feature data uploaded by the control plane to obtain the final abnormal traffic detection results;

[0010] The final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The detection plane calculates the accuracy of the preliminary detection of the data plane. When the accuracy is lower than the given value, the detection plane starts the iterative optimization process of the preliminary detection threshold rule based on the optimization algorithm or deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane, and sends it to the data plane through the control plane to update the original threshold rule.

[0011] Furthermore, the network traffic characteristics include the total number of data packets and the total number of bytes transmitted by any data flow within a period of time, the time stamp interval between adjacent data packets, the sum of the time stamp intervals between adjacent data packets, and the minimum time stamp interval between adjacent data packets.

[0012] Furthermore, the industrial control network traffic anomaly detection algorithm based on threshold rules is used to perform a preliminary high-line-speed detection of traffic, specifically including:

[0013] On the data plane, a threshold rule is set to detect whether there is an anomaly in the timestamp interval between adjacent data packets, including an upper threshold limit and a lower threshold limit.

[0014] The timestamp intervals of adjacent data packets are obtained in real time, and it is determined whether the timestamp intervals of adjacent data packets are within the threshold rules. If the timestamp intervals of adjacent data packets are within the threshold rules, that is, the timestamp intervals of adjacent data packets are greater than or equal to the lower threshold limit and less than or equal to the upper threshold limit, it is considered that there is no abnormal traffic; if the timestamp intervals of adjacent data packets are not within the threshold rules, that is, the timestamp intervals of adjacent data packets are greater than the upper threshold limit or the timestamp intervals of adjacent data packets are less than the lower threshold limit, it is considered that there is abnormal traffic, and a preliminary detection result of abnormal traffic is obtained.

[0015] Furthermore, after receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane obtains suspicious traffic feature data based on the periodic collection, aggregation, and calculation of key traffic feature data and uploads it to the detection plane located on the server, specifically including:

[0016] After receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane summarizes the key traffic characteristics of the suspicious traffic, including the total number of data packets and total bytes transmitted by the data flow within the cycle time, the sum of the timestamp intervals between adjacent data packets, and the minimum timestamp interval between adjacent data packets;

[0017] The average value of the time stamp intervals of adjacent data packets is calculated using the sum of the time stamp intervals of adjacent data packets within the cycle time and the total number of transmitted data packets;

[0018] The key traffic features and the average value of the time stamp intervals of adjacent data packets are used as suspicious traffic feature data and uploaded to the detection plane located on the server.

[0019] Furthermore, the industrial control network traffic anomaly detection model based on machine learning includes an industrial control network traffic anomaly detection model based on a SARIMA-LSTM model and an industrial control network traffic anomaly detection model based on a LSTM-DT model.

[0020] Furthermore, the SARIMA-LSTM model-based industrial control network traffic anomaly detection model specifically implements abnormal traffic detection through the following method:

[0021] The SARIMA-LSTM model is used to predict the normal operating trend, and the flow rate that deviates from the predicted normal operating trend is reported as abnormal flow rate;

[0022] The industrial control network traffic anomaly detection model based on the LSTM-DT model specifically implements abnormal traffic detection through the following methods:

[0023] The traffic feature data in the current detection cycle is used as the input of the LSTM-DT model to obtain the traffic classification results to complete the online anomaly detection of network traffic.

[0024] Furthermore, the final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The detection plane calculates the accuracy of the preliminary detection of the data plane. When the accuracy is lower than a given value, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on an optimization algorithm or deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane, and sends it to the data plane through the control plane to update the original threshold rule. Specifically, the process includes:

[0025] The final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The data plane counts the true value and detection value in the past M cycles to calculate the precision, accuracy, recall rate and F1 score of the threshold rule-based industrial control network traffic anomaly detection algorithm in the data plane. The calculation of the preliminary detection accuracy of the data plane is completed based on the calculated precision, accuracy, recall rate and F1 score.

[0026] When the data plane preliminary detection accuracy is lower than a given value, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on an optimization algorithm or deep reinforcement learning to generate a new data plane preliminary detection threshold rule;

[0027] The generated new data plane preliminary detection threshold rule is sent to the data plane through the control plane to update the original threshold rule in the industrial control network traffic anomaly detection algorithm based on the threshold rule.

[0028] Furthermore, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on the Bayesian optimization algorithm to generate a new preliminary detection threshold rule for the data plane, specifically including:

[0029] The objective function of a weighted combination of precision, accuracy, recall rate and F1 score is used as the optimization objective function; the threshold rule is adjusted with the goal of improving the optimization objective function value, and the candidate threshold rule generated by each iteration of the Bayesian optimization algorithm is sent to the data plane through the control plane to update the original threshold rule; the detection plane calculates the accuracy of the initial detection of the data plane when using the candidate threshold rule, which is used as the basis for the Bayesian optimization algorithm to iteratively generate the next round of candidate threshold rules until a given number of iterative optimizations are completed to obtain the optimal threshold rule.

[0030] Furthermore, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane, specifically including:

[0031] The detection value, i.e., the accuracy index of the preliminary detection result of abnormal traffic, is used as the environmental feedback signal; a weighted combination of precision, accuracy, recall rate, and F1 score is used as the reward function; the input of deep reinforcement learning is the current data plane preliminary detection threshold rule and the corresponding precision, accuracy, recall rate, and F1 score; after each round of action adjustment performed by the deep reinforcement learning agent, the obtained candidate threshold rule is sent to the data plane through the control plane to update the original threshold rule; the detection plane calculates the accuracy of the preliminary detection of the data plane under the condition of adopting the candidate threshold rule, and recalculates the change in the precision, accuracy, recall rate, and F1 score in the reward function to calculate the new reward function value to guide the next round of agent adjustment actions on the threshold rule until a given number of iterations are completed to obtain the optimal threshold rule.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] (1) The present invention uses a threshold-based industrial control network traffic anomaly detection algorithm on the data plane of the P4 programmable switch to perform high-line-speed preliminary detection of traffic to discover suspicious traffic, so that the machine learning-based traffic anomaly detection model deployed on the detection plane server only needs to perform fine-grained detection of these suspicious traffic, thereby significantly reducing the detection load of the detection plane. In addition, the P4 programmable switch can collect more and more accurate feature data at line speed, so it can achieve high real-time performance of industrial control network anomaly detection while obtaining the same or even higher detection accuracy as the current best machine learning detection model, providing technical support for the timely implementation of subsequent attack blocking and recovery.

[0034] (2) The present invention takes the final and preliminary detection results as the true value and detection value respectively, and regularly calculates the accuracy of the preliminary detection. When the accuracy is insufficient, the accuracy of the preliminary detection is used as the optimization objective function, and an optimization algorithm or deep reinforcement learning is used to generate a new preliminary detection threshold rule, so that the preliminary detection has more generalization ability and is more accurate, further reducing the detection load of the detection plane and improving the real-time performance of the detection.

[0035] (3) The P4 programmable switch used in the present invention can, with the help of hardware support, add precise nanosecond timestamps to each data packet. Compared with the traditional method of adding microsecond timestamps to data packets through servers, the feature data that can be extracted at line speed in the P4 programmable switch will be more accurate and richer, thus enabling more accurate and rapid industrial control network traffic anomaly detection, and better meeting the real-time and accuracy requirements of industrial control networks for traffic anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1The present invention is a flowchart of a method for detecting abnormal industrial control network traffic in real time based on a P4 programmable switch. DETAILED DESCRIPTION

[0037] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numbers in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims. It should be understood that the foregoing general description and the detailed description that follows are exemplary and illustrative only and do not limit the present application.

[0038] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0039] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of..." or "when..." or "in response to determination." Moreover, the term "comprises," "comprising," or any other variant thereof is intended to cover non-exclusive inclusion, so that the process or method comprising a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process or method. In the absence of further restrictions, the elements defined by the statement "comprising a..." do not exclude the presence of other identical elements in the process, method, article, or device comprising the elements.

[0040] The present invention will be described in detail below with reference to the accompanying drawings. Unless there is any conflict, the features of the following embodiments and implementations may be combined with each other.

[0041] The present invention is based on the P4 programmable switch to build a three-layer architecture for the real-time detection of industrial control network traffic anomalies based on the P4 programmable switch and the server. The method is implemented based on the three-layer architecture, which includes a data plane, a control plane, and a detection plane. Figure 1 As shown, the data plane is located in a P4 programmable switch, the control plane is deployed in a P4 programmable switch or server, and the detection plane is located in the server. The method specifically includes: first, extracting network traffic features related to timestamps in real time on the data plane of the P4 programmable switch; then, using an industrial control network traffic anomaly detection algorithm based on threshold rules, performing preliminary line-speed detection on the traffic to identify suspicious traffic, which is uploaded as a preliminary abnormal traffic detection result to the control plane of the P4 programmable switch or server. Then, a traffic anomaly status information receiver can be set up on the control plane to receive the preliminary abnormal traffic detection result uploaded by the data plane. After receiving the preliminary abnormal traffic detection result uploaded by the data plane, the control plane, based on the periodic collection, aggregation, and calculation of key traffic features, summarizes and calculates the key traffic features extracted by the data plane to obtain suspicious traffic feature data processed by the control plane, and uploads it to the detection plane of the server for further detection. Secondly, in the detection plane, a machine learning-based industrial control network traffic anomaly detection model is used to perform fine-grained detection on the suspicious traffic feature data uploaded by the control plane to identify abnormal traffic patterns and obtain the final abnormal traffic detection result. Finally, the final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The detection plane calculates the accuracy of the preliminary detection of the data plane. When the accuracy is lower than the given value, the detection plane starts the iterative optimization process of the preliminary detection threshold rule based on the optimization algorithm (such as the Bayesian optimization algorithm) or deep reinforcement learning (such as the Deep Q Network (DQN) algorithm, the Proximal Policy Optimization (PPO) algorithm, etc.) to generate a new preliminary detection threshold rule for the data plane, and sends it to the data plane through the control plane to update the original threshold rule.

[0042] Furthermore, the network traffic characteristics include the total number of data packets transmitted by any data flow f within the cycle time and the total number of bytes , the time stamp interval between adjacent data packets I, the sum of the time stamp intervals between adjacent data packets And the minimum time stamp interval between adjacent data packets .

[0043] Furthermore, network traffic features related to timestamps are extracted in real time, specifically including the following steps:

[0044] S101, automatically accumulate the total number of data packets transmitted by any data flow f within the cycle time through the data plane counter The total number of bytes corresponding to all packets .

[0045] Specifically, the data plane on the P4 programmable switch completes the accumulation of the number of network data packets transmitted and the number of network bytes transmitted. The number of network data packets transmitted and the number of network bytes transmitted are automatically accumulated by the counter on the data plane. The counter automatically accumulates the number of data packets and the byte size corresponding to the data packets. Therefore, the total number of data packets transmitted by any data flow f within the cycle time can be obtained. The total number of bytes corresponding to all packets .

[0046] S102: Obtain the timestamp interval I between adjacent data packets based on the timestamp of each data packet stored in the register of the data plane, and store it in the register of the data plane. The calculation formula of the timestamp interval I between adjacent data packets is:

[0047]

[0048] Where, and Represents the timestamps of the previous data packet and the current data packet respectively.

[0049] Specifically, thanks to the P4 programmable switch's ability to rely on hardware to stamp each data packet with a more accurate and effective nanosecond-level timestamp, and the timestamp information of each data packet is stored in the register of the data plane deployed on the P4 programmable switch, the timestamp interval I of adjacent data packets can be calculated based on this. That is, the timestamp interval I of adjacent data packets is calculated based on the timestamp information of the previous data packet and the current data packet recorded in the register, and it is stored in the register of the data plane, which is convenient for direct call when the subsequent process determines the sum of the timestamp intervals of adjacent data packets and the minimum value of the timestamp intervals of adjacent data packets.

[0050] S103. Obtain the sum of the timestamp intervals of adjacent data packets and the minimum value of the timestamp intervals of adjacent data packets according to the timestamp intervals of adjacent data packets stored in the register of the data plane, and store them in the register of the data plane for direct calling in subsequent processes.

[0051] Specifically, the sum of adjacent data packet timestamp intervals and the minimum value of adjacent data packet timestamp intervals are both stored in registers of the programmable switch data plane. If the sum of adjacent data packet timestamp intervals and the minimum value of adjacent data packet timestamp intervals are needed in subsequent processes, they can be obtained by directly querying the registers of the data plane. When the data plane calculates the adjacent data packet timestamp intervals, the value of the current adjacent data packet timestamp interval is added to the current accumulated sum of adjacent data packet timestamp intervals, and then the value of the sum of adjacent data packet timestamp intervals stored in the register is updated; and the value of the current adjacent data packet timestamp interval is compared with the minimum value of the adjacent data packet timestamp interval stored in the register: if the minimum value of the adjacent data packet timestamp interval is less than the minimum value of the adjacent data packet timestamp interval stored in the register, the minimum value of the adjacent data packet timestamp interval stored in the register is updated to the value of the current adjacent data packet timestamp interval; if the minimum value of the adjacent data packet timestamp interval is greater than or equal to the minimum value of the adjacent data packet timestamp interval stored in the register, the minimum value of the adjacent data packet timestamp interval stored in the register remains unchanged.

[0052] Furthermore, a threshold-based industrial control network traffic anomaly detection algorithm is used to perform a preliminary high-speed detection of traffic, specifically including the following steps:

[0053] S201. Setting a threshold rule on the data plane for detecting whether there is an abnormality in the timestamp interval of adjacent data packets , including the upper threshold and the lower bound of the threshold .

[0054] S202, obtain the time stamp interval I of adjacent data packets from the register of the data plane in real time, and determine whether the time stamp interval I of adjacent data packets is within the threshold rule. If the time stamp interval I of adjacent data packets is within the threshold rule within, that is If the time interval I between adjacent data packets is not within the threshold rule, it is considered that there is no abnormal traffic; within, that is or When , it is considered that there is abnormal traffic and the preliminary detection result of abnormal traffic is obtained.

[0055] Specifically, the data plane of the P4 programmable switch extracts timestamp-related network traffic features in real time. These network traffic features can be used to detect abnormal traffic. The total number of packets and bytes transmitted by any data flow within a cycle time can be automatically accumulated using a data plane counter. Furthermore, because the P4 programmable switch can rely on hardware to stamp each packet with a more accurate and effective nanosecond-level timestamp, the data plane of the P4 programmable switch quickly analyzes the timestamp of each network packet, calculates the timestamp interval between adjacent packets, and obtains the timestamp interval between adjacent packets. This in turn determines the sum of the timestamp intervals between adjacent packets and the minimum timestamp interval between adjacent packets. A traffic anomaly detection algorithm based on threshold rules is then deployed on the data plane. Specifically, a threshold rule is set on the data plane to detect whether there are anomalies in the timestamp intervals between adjacent packets. Leveraging the high-speed and flexible packet processing capabilities of the data plane deployed on the P4 programmable switch, high-speed detection of abnormal traffic is achieved. For each data packet, the timestamp interval between it and the previous data packet is calculated, the timestamp interval of adjacent data packets is read from the register in real time, and it is judged whether the timestamp interval of adjacent data packets is within the threshold rule. When the timestamp interval of adjacent data packets does not meet the threshold rule for traffic anomaly detection, that is, or When the abnormal traffic is detected, it is considered that there is abnormal traffic and the preliminary abnormal traffic detection result is obtained. The data plane will upload the preliminary abnormal traffic detection result (i.e., abnormal traffic status information) to the control plane deployed on the programmable switch or server; when the data plane does not detect abnormal traffic, that is, When the network data packets are forwarded directly.

[0056] It should be noted that high-line-speed anomaly detection on the data plane is a preliminary detection of abnormal traffic. Although the detection speed is fast, there is a certain degree of inaccuracy. Therefore, it is necessary to use a more accurate industrial control network traffic anomaly detection model based on machine learning on the detection plane to confirm the preliminary detection results.

[0057] Furthermore, after receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane obtains suspicious traffic feature data based on the periodic collection, aggregation, and calculation of key traffic feature data and uploads it to the detection plane located on the server. The specific steps include the following:

[0058] S301. After the control plane receives the preliminary detection results of abnormal traffic uploaded by the data plane, based on the preliminary detection results of abnormal traffic, the control plane summarizes the key traffic characteristics of the suspicious traffic, including the total number of data packets and the total number of bytes transmitted by the data flow within the cycle time, the sum of the timestamp intervals of adjacent data packets, and the minimum value of the timestamp intervals of adjacent data packets.

[0059] S302: Use the sum of timestamp intervals of adjacent data packets within the cycle time And the total number of packets transmitted Calculate the average of the timestamp intervals between adjacent packets , and its calculation formula is:

[0060]

[0061] Here, the average value of the timestamp intervals between adjacent packets is calculated by dividing the sum of the timestamp intervals between adjacent packets by the total number of packet intervals. Furthermore, the processed feature data is uploaded from the control plane to the detection plane on the server for further detection and analysis.

[0062] S303: Use the key traffic characteristics obtained in step S301 and the average value of the timestamp intervals of adjacent data packets obtained in step S302 as suspicious traffic characteristic data after processing by the control plane, and upload these suspicious traffic characteristic data to the detection plane located on the server.

[0063] Furthermore, in the detection plane, a machine learning-based industrial control network traffic anomaly detection model is used to perform fine-grained detection on suspicious traffic feature data uploaded by the control plane to identify abnormal traffic patterns and obtain the final abnormal traffic detection results. The specific steps include the following:

[0064] S401. Deploy an industrial control network traffic anomaly detection model based on machine learning in a server on the detection plane.

[0065] Furthermore, the industrial control network traffic anomaly detection model based on machine learning can select any existing publicly available industrial control network traffic anomaly detection model based on machine learning, including but not limited to: an industrial control network traffic anomaly detection model based on the SARIMA-LSTM model and an industrial control network traffic anomaly detection model based on the LSTM-DT model, etc.

[0066] Furthermore, the SARIMA-LSTM-based industrial control network traffic anomaly detection model implements abnormal traffic detection through the following method: The SARIMA-LSTM model predicts normal operating trends and reports traffic that deviates from the predicted normal operating trends as abnormal traffic. The SARIMA-LSTM model combines the SARIMA (Seasonal Autoregressive Moving Average) time series forecasting model with an offline trained LSTM (Long Short-Term Memory) model. Traffic feature data within the current detection period serves as the training set input for the SARIMA model, while the prediction results of the trained LSTM model serve as a supplement to the SARIMA training set, replacing abnormal traffic feature data in the training set to optimize the SARIMA model's prediction accuracy.

[0067] Furthermore, the LSTM-DT model-based industrial control network traffic anomaly detection model implements abnormal traffic detection through the following method: using traffic feature data within the current detection cycle as input to the LSTM-DT model, obtaining traffic classification results to complete online network traffic anomaly detection. The LSTM-DT model is a supervised learning model that combines multiple LSTM models with DT (decision tree) models. It uses labeled datasets to train multiple LSTM models with different parameters. The confidence levels of the traffic classification results are generated to form training sets for further training of the DT model. The trained LSTM and DT models are then stored offline as the LSTM-DT model.

[0068] Furthermore, the training data for the machine learning-based industrial control network traffic anomaly detection model includes but is not limited to: the total number of bytes of data packets transmitted by a certain data flow within a cycle time, the minimum value of the timestamp interval between adjacent data packets, and the average value of the timestamp interval between adjacent data packets, etc.

[0069] S402. Relying on the suspicious traffic feature data uploaded by the control plane, a machine learning-based traffic anomaly detection model is used to perform fine-grained detection on the suspicious traffic feature data online to identify abnormal traffic patterns and obtain the final abnormal traffic detection results.

[0070] Specifically, the detection plane located on the server only performs fine-grained analysis on the suspicious traffic feature data uploaded by the control plane. Specifically, the industrial control network traffic anomaly detection model based on machine learning is used to perform fine-grained detection on these suspicious traffic feature data online to identify abnormal traffic patterns and obtain the final abnormal traffic detection results.

[0071] Furthermore, the final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The detection plane calculates the accuracy of the preliminary detection of the data plane. When the accuracy is lower than a given value, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on an optimization algorithm (such as the Bayesian optimization algorithm) or deep reinforcement learning (such as the DQN algorithm, the PPO algorithm, etc.) to generate a new preliminary detection threshold rule for the data plane. The new rule is then sent to the data plane through the control plane to update the original threshold rule. The specific steps include the following:

[0072] S501. The final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The data plane calculates the true value and detection value in the past M cycles to calculate the accuracy, precision, recall rate, and F1 score of the threshold rule-based industrial control network traffic anomaly detection algorithm in the data plane. The calculation of the data plane preliminary detection accuracy is completed based on the calculated accuracy, precision, recall rate, and F1 score. The calculation formulas for accuracy, precision, recall rate, and F1 score are:

[0073] ;

[0074] ;

[0075] ;

[0076] ;

[0077] Where, Indicates accuracy, Indicates accuracy, represents the recall rate, represents the F1 score; It represents the number of true positive samples, that is, the number of samples for which the initial abnormal traffic detection result obtained in the data plane is reported as abnormal and the final abnormal traffic detection result obtained in the detection plane is also reported as abnormal. This indicates the number of correctly identified abnormal samples; represents the number of false positive samples, that is, the number of samples that are reported as abnormal in the preliminary abnormal traffic detection results obtained in the data plane but are not reported as abnormal in the final abnormal traffic detection results obtained in the detection plane. This represents the number of negative samples that are incorrectly reported as abnormal; represents the number of true negative samples, that is, the number of samples that are not reported as abnormal by the preliminary abnormal traffic detection results obtained in the data plane and are not reported as abnormal by the final abnormal traffic detection results obtained in the detection plane. This represents the number of correctly identified normal samples; This represents the number of false negative samples, that is, the number of samples for which the initial abnormal traffic detection results obtained in the data plane did not report as abnormal but the final abnormal traffic detection results obtained in the detection plane reported as abnormal. This indicates the number of abnormal samples missed by the detection. The accuracy of the threshold-based industrial control network traffic anomaly detection algorithm in the data plane is then calculated based on precision, accuracy, recall, and F1 score.

[0078] S502. In order to improve the accuracy of preliminary detection of abnormal traffic on the P4 programmable switch, reduce the detection workload of the detection plane, and thereby ensure the real-time detection and meet the requirements of the industrial control network, when the preliminary detection accuracy of the data plane is lower than a given value, the detection plane starts an iterative optimization process of the preliminary detection threshold rule based on an optimization algorithm (such as the Bayesian optimization algorithm, etc.) or deep reinforcement learning (such as the DQN algorithm, the PPO algorithm, etc.) to generate a new preliminary detection threshold rule for the data plane.

[0079] Specifically, an optimization algorithm or reinforcement learning method is used on the detection plane located on the server to improve the accuracy of the industrial control network traffic anomaly detection algorithm based on the threshold rule as the optimization objective function or reward function, that is, to improve the accuracy, precision, recall rate and F1 score of the industrial control network traffic anomaly detection algorithm based on the threshold rule as the optimization objective function or reward function, optimize and adjust the threshold rule, and thus adaptively generate new data plane preliminary detection threshold rules online.

[0080] Furthermore, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on the Bayesian optimization algorithm to generate a new preliminary detection threshold rule for the data plane. Specifically, the optimization objective function is a weighted combination of precision, accuracy, recall rate, and F1 score, and its calculation formula is:

[0081]

[0082] Where, represents the optimization objective function, is the threshold rule vector to be optimized, R is a real number, d is the threshold rule dimension, 、 、 、 Represent the precision, accuracy, recall rate, and F1 score under the given threshold rule vector conditions, 、 、 、 Representing the weighting coefficients for precision, accuracy, recall, and F1 score, respectively. The threshold rules are adjusted to improve the optimization objective function. The candidate threshold rules generated by each iteration of the Bayesian optimization algorithm are distributed to the data plane via the control plane to update the original threshold rules. The detection plane calculates the accuracy of the data plane's initial detection using this candidate threshold rule, which serves as the basis for the Bayesian optimization algorithm to iteratively generate the next round of candidate threshold rules. This continues until a given number of iterative optimizations are completed (the number of iterations can be empirically calculated). Ultimately, the data plane's initial detection threshold rules are optimized, resulting in the optimal threshold rule.

[0083] Furthermore, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane. Specifically, this process includes: constructing a reward function mechanism using the accuracy indicator of the detection value (i.e., the preliminary detection result of abnormal traffic obtained by the data plane) as the environmental feedback signal; and using a weighted combination of precision, accuracy, recall rate, and F1 score as the reward function, whose mathematical expression is:

[0084]

[0085] Where, represents the reward function in deep reinforcement learning, Initially detect the current detection accuracy for the current environment state, i.e. the data plane, The threshold rule selected by the agent adjusts the action, is the subsequent state after executing the action, 、 、 、 They are the changes in precision, accuracy, recall, and F1 score after the threshold rule adjustment action is executed. 、 、 、 are the reward weight coefficients for precision, accuracy, recall, and F1 score respectively. The input of deep reinforcement learning is the current data plane preliminary detection threshold rule and the corresponding precision, accuracy, recall, and F1 score. After each round of action adjustment performed by the deep reinforcement learning agent, the obtained candidate threshold rule is sent to the data plane through the control plane to update the original threshold rule. The detection plane calculates the accuracy of the data plane preliminary detection using the candidate threshold rule, and recalculates the reward function. 、 、 、 , thereby calculating the new reward function value, which is used to guide the next round of agent adjustment of the threshold rule until a given number of iterations are completed. The number of iterations can be taken as an empirical value, and finally the optimal threshold rule is obtained.

[0086] It should be understood that the Bayesian optimization algorithm's iterations are based on the detection accuracy of the data plane corresponding to the current candidate threshold rule generated by the neural network. This eliminates the need to send each candidate threshold rule to the data plane for accuracy testing. Instead, iterative optimization is performed directly on the detection plane, resulting in the optimal threshold rule. This detection accuracy reflects the effectiveness of the threshold rule in detecting anomalies on the data plane, driving the algorithm to iterate towards improved detection performance. The reward signal in the reinforcement learning method is the detection accuracy of the data plane corresponding to the current candidate threshold rule. By feeding back detection accuracy as a reward to the agent, it incentivizes the agent to adjust its threshold action, gradually exploring the threshold rule that achieves optimal detection results. The Bayesian optimization algorithm generates candidate threshold rules at each iteration, using the detection accuracy of the data plane inferred by the neural network as the basis for iteration, driving the algorithm to iterate towards improved detection accuracy. The reward signal, by feeding back detection accuracy as a reward to the agent, incentivizes the agent to adjust its threshold action, gradually exploring the threshold rule that achieves optimal detection results.

[0087] S503: Send the generated new data plane preliminary detection threshold rule to the data plane through the control plane to update the original threshold rule in the industrial control network traffic anomaly detection algorithm based on the threshold rule.

[0088] Specifically, the generated new data plane preliminary detection threshold rule is sent to the control plane. The control plane receives the new data plane preliminary detection threshold rule sent by the detection plane located on the server, and further sends the new data plane preliminary detection threshold rule to the data plane. That is, the generated new data plane preliminary detection threshold rule can be sent to the data plane through the control plane to update the original threshold rule in the industrial control network traffic anomaly detection algorithm based on the threshold rule, thereby improving the accuracy of the preliminary detection of abnormal traffic on the P4 programmable switch, reducing the detection workload of the detection plane, and thus ensuring the real-time detection and meeting the requirements of the industrial control network. In the subsequent process, the updated industrial control network traffic anomaly detection algorithm based on the threshold rule is used to perform preliminary detection of abnormal traffic and obtain preliminary abnormal traffic detection results.

[0089] To sum up, the present invention can effectively reduce the delay of real-time detection of traffic anomalies in industrial control networks, thereby effectively ensuring that the real-time detection meets the requirements of industrial control networks, and thanks to the more accurate and diverse traffic features related to timestamps extracted in the data plane, the present invention effectively ensures the real-time detection while greatly improving its detection accuracy, and ultimately can better meet the real-time and accuracy requirements of industrial control networks for traffic anomaly detection.

[0090] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A real-time detection method for industrial control network traffic anomalies based on a P4 programmable switch, implemented based on a three-layer architecture consisting of a data plane, a control plane, and a detection plane, characterized in that: The method specifically includes: The data plane of the P4 programmable switch extracts network traffic features related to timestamps in real time, and uses a threshold-based industrial control network traffic anomaly detection algorithm to perform high-speed preliminary detection of traffic. The initial detection results of abnormal traffic are obtained and uploaded to the control plane deployed on the P4 programmable switch or server. After receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane obtains suspicious traffic feature data based on the periodic collection, aggregation, and calculation of key traffic feature data and uploads it to the detection plane located on the server; In the detection plane, a machine learning-based industrial control network traffic anomaly detection model is used to perform fine-grained detection on suspicious traffic feature data uploaded by the control plane to obtain the final abnormal traffic detection results; The final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The detection plane calculates the accuracy of the preliminary detection of the data plane. When the accuracy is lower than the given value, the detection plane starts the iterative optimization process of the preliminary detection threshold rule based on the optimization algorithm or deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane, and sends it to the data plane through the control plane to update the original threshold rule.

2. The method for detecting abnormal industrial control network traffic in real time based on a P4 programmable switch according to claim 1 is characterized in that: The network traffic characteristics include the total number of data packets and the total number of bytes transmitted by any data flow within a period of time, the time stamp interval between adjacent data packets, the sum of the time stamp intervals between adjacent data packets, and the minimum time stamp interval between adjacent data packets.

3. The method for detecting abnormal industrial control network traffic in real time based on a P4 programmable switch according to claim 1 is characterized in that: The method of performing high-speed preliminary detection of traffic using an industrial control network traffic anomaly detection algorithm based on threshold rules specifically includes: On the data plane, a threshold rule is set to detect whether there is an anomaly in the timestamp interval between adjacent data packets, including an upper threshold limit and a lower threshold limit. The timestamp intervals of adjacent data packets are obtained in real time, and it is determined whether the timestamp intervals of adjacent data packets are within the threshold rules. If the timestamp intervals of adjacent data packets are within the threshold rules, that is, the timestamp intervals of adjacent data packets are greater than or equal to the lower threshold limit and less than or equal to the upper threshold limit, it is considered that there is no abnormal traffic; if the timestamp intervals of adjacent data packets are not within the threshold rules, that is, the timestamp intervals of adjacent data packets are greater than the upper threshold limit or the timestamp intervals of adjacent data packets are less than the lower threshold limit, it is considered that there is abnormal traffic, and a preliminary detection result of abnormal traffic is obtained.

4. The method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch according to claim 1 is characterized in that: After receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane obtains suspicious traffic feature data based on the periodic collection, aggregation, and calculation of key traffic feature data and uploads it to the detection plane located on the server. Specifically, the control plane includes: After receiving the preliminary abnormal traffic detection results uploaded by the data plane, the control plane summarizes the key traffic characteristics of the suspicious traffic, including the total number of data packets and total bytes transmitted by the data flow within the cycle time, the sum of the timestamp intervals between adjacent data packets, and the minimum timestamp interval between adjacent data packets; The average value of the time stamp intervals of adjacent data packets is calculated using the sum of the time stamp intervals of adjacent data packets within the cycle time and the total number of transmitted data packets; The key traffic features and the average value of the time stamp intervals of adjacent data packets are used as suspicious traffic feature data and uploaded to the detection plane located on the server.

5. The method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch according to claim 1 is characterized in that: The industrial control network traffic anomaly detection model based on machine learning includes an industrial control network traffic anomaly detection model based on a SARIMA-LSTM model and an industrial control network traffic anomaly detection model based on an LSTM-DT model.

6. The method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch according to claim 5 is characterized in that: The SARIMA-LSTM model-based industrial control network traffic anomaly detection model specifically implements abnormal traffic detection through the following methods: The SARIMA-LSTM model is used to predict the normal operating trend, and the flow rate that deviates from the predicted normal operating trend is reported as abnormal flow rate; The industrial control network traffic anomaly detection model based on the LSTM-DT model specifically implements abnormal traffic detection through the following methods: The traffic feature data in the current detection cycle is used as the input of the LSTM-DT model to obtain the traffic classification results to complete the online anomaly detection of network traffic.

7. The method for detecting abnormal industrial control network traffic in real time based on a P4 programmable switch according to claim 1 is characterized in that: The final abnormal traffic detection result obtained in each cycle is used as the true value, the preliminary abnormal traffic detection result is used as the detection value, and the detection plane calculates the accuracy of the preliminary detection of the data plane; When the accuracy falls below a given value, the detection plane initiates an iterative optimization process for the preliminary detection threshold rule based on an optimization algorithm or deep reinforcement learning to generate a new preliminary detection threshold rule for the data plane. This rule is then sent to the data plane via the control plane to update the original threshold rule. Specifically, the following steps are performed: The final abnormal traffic detection result obtained in each cycle is used as the true value, and the preliminary abnormal traffic detection result is used as the detection value. The data plane counts the true value and detection value in the past M cycles to calculate the precision, accuracy, recall rate and F1 score of the threshold rule-based industrial control network traffic anomaly detection algorithm in the data plane. The calculation of the preliminary detection accuracy of the data plane is completed based on the calculated precision, accuracy, recall rate and F1 score. When the data plane preliminary detection accuracy is lower than a given value, the detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on an optimization algorithm or deep reinforcement learning to generate a new data plane preliminary detection threshold rule; The generated new data plane preliminary detection threshold rule is sent to the data plane through the control plane to update the original threshold rule in the industrial control network traffic anomaly detection algorithm based on the threshold rule.

8. The method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch according to claim 1 or 7, characterized in that: The detection plane initiates an iterative optimization process of the preliminary detection threshold rule based on the Bayesian optimization algorithm to generate a new preliminary detection threshold rule for the data plane. Specifically, the following steps are performed: The objective function of a weighted combination of precision, accuracy, recall rate and F1 score is used as the optimization objective function; the threshold rule is adjusted with the goal of improving the optimization objective function value, and the candidate threshold rule generated by each iteration of the Bayesian optimization algorithm is sent to the data plane through the control plane to update the original threshold rule; the detection plane calculates the accuracy of the initial detection of the data plane when using the candidate threshold rule, which is used as the basis for the Bayesian optimization algorithm to iteratively generate the next round of candidate threshold rules until a given number of iterative optimizations are completed to obtain the optimal threshold rule.

9. The method for real-time detection of industrial control network traffic anomalies based on a P4 programmable switch according to claim 1 or 7, characterized in that: The detection plane initiates an iterative optimization process of the preliminary detection threshold rules based on deep reinforcement learning to generate new preliminary detection threshold rules for the data plane. Specifically, the following steps are performed: The detection value, i.e., the accuracy index of the preliminary detection result of abnormal traffic, is used as the environmental feedback signal; a weighted combination of precision, accuracy, recall rate, and F1 score is used as the reward function; the input of deep reinforcement learning is the current data plane preliminary detection threshold rule and the corresponding precision, accuracy, recall rate, and F1 score; after each round of action adjustment performed by the deep reinforcement learning agent, the obtained candidate threshold rule is sent to the data plane through the control plane to update the original threshold rule; the detection plane calculates the accuracy of the preliminary detection of the data plane under the condition of adopting the candidate threshold rule, and recalculates the change in the precision, accuracy, recall rate, and F1 score in the reward function to calculate the new reward function value to guide the next round of agent adjustment actions on the threshold rule until a given number of iterations are completed to obtain the optimal threshold rule.

Images