Industrial asset fingerprint feature dynamic learning and abnormal behavior identification method and system

Abstract

The present invention discloses a method and system for dynamic learning of industrial asset fingerprint features and identification of abnormal behavior, belonging to the field of industrial control safety technology. The present invention improves the model expression capability by integrating static, dynamic and contextual features, uses the FTRL-Proximal algorithm and time decay function to adapt to the evolution of equipment behavior, combines outlier detection, behavior prediction and process verification to improve detection accuracy, generates automated disposal suggestions based on knowledge graphs and decision trees, and reduces response delays. This solution realizes adaptive dynamic learning of industrial asset fingerprints, constructs multi-dimensional behavior feature fusion analysis and anomaly detection self-optimization mechanism, and provides real-time risk disposal decision support.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control security technology, and specifically relates to a method and system for dynamic learning of industrial asset fingerprint features and abnormal behavior recognition. Background Art

[0002] In industrial control systems, device identification and behavior monitoring usually rely on the following technical means: static fingerprint library comparison: asset identification is performed through static feature libraries such as preset device MAC addresses and firmware versions, which cannot adapt to dynamic changes in device behavior; threshold alarm mechanism: setting fixed thresholds can easily cause false positives or missed positives; single-dimensional monitoring: independent analysis based on network traffic or device logs is difficult to fully reflect the device status; rule engine drive: relying on manually written rule libraries to match known attack patterns, it is difficult to identify unknown threats and has high maintenance costs.

[0003] The above methods have poor dynamic adaptability when facing complex and changing industrial environments: they are unable to automatically identify scenarios such as firmware upgrades and configuration changes (the false alarm rate is as high as 35%); the feature dimension is single: it ignores the association between the timing characteristics of device behavior and the process context (the missed alarm rate exceeds 40%); the maintenance cost is high: the fingerprint library and detection rules need to be manually updated regularly (an average of 8 man-hours per week); and there is a serious detection lag: there is a 12-48 hour window between feature changes and the effectiveness of rules. Summary of the Invention

[0004] In response to the above-mentioned deficiencies in the existing technology, this application provides a method and system for dynamic learning of industrial asset fingerprint features and abnormal behavior identification.

[0005] In the first aspect, the present application proposes a method for dynamic learning of industrial asset fingerprint features and abnormal behavior recognition, comprising the following steps:

[0006] Use edge probes to collect network communication data, protocol instruction sequences, and SCADA logs of industrial equipment in real time;

[0007] Extract static features from the industrial equipment, extract dynamic features from the network communication data and protocol instruction sequence, extract context features from the SCADA log, and fuse them to form a three-dimensional feature vector;

[0008] Based on an online learning algorithm, unsupervised incremental learning is performed on the three-dimensional feature vector, the device behavior model is dynamically updated, and the device behavior state is determined through multimodal collaborative analysis to obtain a device state determination result;

[0009] An automatic response strategy is generated based on the equipment status determination result, and the corresponding industrial equipment is dealt with in a coordinated manner in conjunction with the operation and maintenance system.

[0010] In some embodiments, extracting static features from the industrial equipment, extracting dynamic features from the network communication data and protocol instruction sequences, and extracting context features from the SCADA log to form a three-dimensional feature vector includes:

[0011] Extracting the MAC address, firmware version, and serial number of the industrial device and generating a unique identifier using the SHA-256 hash algorithm to form the static feature;

[0012] Counting the communication cycle standard deviation of the network communication data and the protocol sequence entropy of the protocol instruction sequence to form the dynamic feature;

[0013] Analyze the process trigger sequence in the SCADA log, construct a process flow chart based on the process trigger sequence in the SCADA log, and extract the topological embedding representation through a graph neural network to form the context feature;

[0014] The static features, dynamic features and context features are fused to generate a three-dimensional feature vector, and the vector is stored in a time series database according to timestamps.

[0015] In some embodiments, performing unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm to dynamically update the device behavior model includes:

[0016] Assigning a time-decay weight to the three-dimensional feature vector using the FTRL-Proximal algorithm;

[0017] Evaluate the confidence score of the three-dimensional feature vector in real time. If the score is higher than a threshold of 0.92, incorporate the corresponding three-dimensional feature vector into the model for incremental update.

[0018] If the score is lower than 0.92, the current three-dimensional feature vector is input into the reinforcement learning channel for anomaly screening.

[0019] In some embodiments, assigning a time-decay weight to the three-dimensional feature vector using the FTRL-Proximal algorithm includes:

[0020] The three-dimensional feature vector is given a weight that decays exponentially with time. The formula is:

[0021]

[0022] Where t is the difference between the feature collection time and the current time.

[0023] In some embodiments, determining the device behavior state through multimodal collaborative analysis to obtain a device state determination result includes:

[0024] Use the isolation forest algorithm to perform outlier detection on the three-dimensional feature vector for anomaly screening and output the outlier probability;

[0025] Use LSTM neural network to predict the device's next behavior and compare it with the actual behavior to calculate the residual;

[0026] Use Petri net models to verify whether equipment behavior complies with the preset process flow;

[0027] The equipment status judgment result is: if the residual > 3σ and the process verification fails, it is judged as abnormal; if 2σ < residual ≤ 3σ or any dimension is abnormal, it is judged as suspicious; otherwise it is considered normal behavior.

[0028] In some embodiments, the use of a Petri net model to verify whether the device behavior complies with a preset process flow includes:

[0029] Convert the process sequence in the SCADA log into a Petri net structure, including place nodes, transition nodes and directed arcs;

[0030] Verify whether the Petri net reachability conditions are met based on the transition sequence triggered by the actual behavior of the device;

[0031] If the trigger sequence violates the preset process logic, it will be marked as process verification failure.

[0032] In some embodiments, generating an automatic response strategy based on the device status determination result and performing coordinated disposal on the corresponding industrial equipment in conjunction with the operation and maintenance system includes:

[0033] If the device status is abnormal or suspicious, automatic handling suggestions are generated based on knowledge graph and decision tree reasoning, including device isolation, traffic restriction or alarm reporting;

[0034] Execute disposal strategies by coordinating with the operation and maintenance management system and record logs.

[0035] In the second aspect, this application proposes an industrial asset fingerprint feature dynamic learning and abnormal behavior recognition system, which includes a data acquisition module, a feature extraction and fusion module, an abnormal behavior determination module and an automatic response module;

[0036] The data acquisition module is used to collect network communication data, protocol instruction sequences and SCADA logs of industrial equipment in real time using edge probes;

[0037] The feature extraction and fusion module is used to extract static features from the industrial equipment, extract dynamic features from the network communication data and protocol instruction sequence, extract context features from the SCADA log, and fuse them to form a three-dimensional feature vector;

[0038] The abnormal behavior determination module is used to perform unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm, dynamically update the device behavior model, determine the device behavior status through multimodal collaborative analysis, and obtain a device status determination result;

[0039] The automatic response module is used to generate an automatic response strategy according to the equipment status determination result, and to carry out linkage disposal of the corresponding industrial equipment in combination with the operation and maintenance system.

[0040] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0041] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0042] Beneficial effects of the present invention:

[0043] This solution improves the model's expressiveness by integrating static, dynamic, and contextual features. It uses the FTRL-Proximal algorithm and time decay function to adapt to the evolution of equipment behavior. It combines outlier detection, behavior prediction, and process verification to improve detection accuracy. It generates automated disposal recommendations based on knowledge graphs and decision trees to reduce response latency. This solution implements adaptive dynamic learning of industrial asset fingerprints, constructs a multi-dimensional behavioral feature fusion analysis and anomaly detection self-optimization mechanism, and provides real-time risk disposal decision support. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is the overall flow chart of the present invention.

[0045] Figure 2 This is a system principle block diagram of the present invention. DETAILED DESCRIPTION

[0046] The following will describe exemplary embodiments of the present invention in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein; rather, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0047] In the first aspect, this application proposes a method for dynamic learning of industrial asset fingerprint features and abnormal behavior recognition, such as Figure 1 As shown, the following steps are included:

[0048] S100: Uses edge probes to collect network communication data, protocol instruction sequences, and SCADA logs from industrial equipment in real time;

[0049] The present invention collects the behavioral data of industrial control equipment in real time by deploying edge probes, covering network communication data, protocol instruction sequences and SCADA operation logs. The probe has a built-in protocol parsing engine that supports in-depth analysis of mainstream industrial control protocols such as Modbus / TCP, OPC UA, and DNP3. The collected data is aggregated and processed by the edge computing node, and after removing redundant information, it is transmitted to the feature calculation module for further processing. This acquisition mechanism has high throughput and low latency characteristics and can adapt to the complex network environment of the industrial site. The data acquisition process supports the access of multi-source heterogeneous devices and has dynamic adaptation capabilities, providing high-quality input for subsequent feature extraction.

[0050] S200: extracting static features from the industrial equipment, extracting dynamic features from the network communication data and protocol instruction sequence, and extracting context features from the SCADA log, and fusing them to form a three-dimensional feature vector;

[0051] In some embodiments, extracting static features from the industrial equipment, extracting dynamic features from the network communication data and protocol instruction sequences, and extracting context features from the SCADA log to form a three-dimensional feature vector includes:

[0052] Extracting the MAC address, firmware version, and serial number of the industrial device and generating a unique identifier using the SHA-256 hash algorithm to form the static feature;

[0053] Counting the communication cycle standard deviation of the network communication data and the protocol sequence entropy of the protocol instruction sequence to form the dynamic feature;

[0054] Analyze the process trigger sequence in the SCADA log, construct a process flow chart based on the process trigger sequence in the SCADA log, and extract the topological embedding representation through a graph neural network to form the context feature;

[0055] The static features, dynamic features and context features are fused to generate a three-dimensional feature vector, and the vector is stored in a time series database according to timestamps.

[0056] This step constructs a three-dimensional feature vector for the device by fusing features from three dimensions: static, dynamic, and contextual. For static features, inherent attributes such as the device's MAC address, firmware version, and serial number are extracted and hashed using the SHA-256 algorithm to enhance feature uniqueness and security. Dynamic features characterize the stability and complexity of device behavior by calculating the standard deviation of the device's communication cycle and the entropy of the protocol instruction sequence. Contextual features analyze the sequence of operations in SCADA logs and utilize graph neural networks (GNNs) to extract embedded representations of the process topology between devices, capturing the contextual dependencies of device behavior. Finally, the three types of features are fused to form a structured feature vector, which is stored in a time series database for subsequent modeling and analysis.

[0057] S300: performing unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm, dynamically updating the device behavior model, determining the device behavior state through multimodal collaborative analysis, and obtaining a device state determination result;

[0058] In some embodiments, performing unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm to dynamically update the device behavior model includes:

[0059] Assigning a time-decay weight to the three-dimensional feature vector using the FTRL-Proximal algorithm;

[0060] Evaluate the confidence score of the three-dimensional feature vector in real time. If the score is higher than a threshold of 0.92, incorporate the corresponding three-dimensional feature vector into the model for incremental update.

[0061] If the score is lower than 0.92, the current three-dimensional feature vector is input into the reinforcement learning channel for anomaly screening.

[0062] In some embodiments, assigning a time-decay weight to the three-dimensional feature vector using the FTRL-Proximal algorithm includes:

[0063] The three-dimensional feature vector is given a weight that decays exponentially with time. The formula is:

[0064]

[0065] Where t is the difference between the feature collection time and the current time.

[0066] This function ensures that historical features decay over time, preventing the model from becoming rigid. The system evaluates the confidence score of the three-dimensional feature vector in real time. If the score is above a threshold (such as 0.92), the feature is incorporated into the model for incremental updates. Otherwise, it enters the reinforcement learning channel for further anomaly screening and behavioral analysis.

[0067] S400: Generate an automatic response strategy based on the equipment status determination result, and perform coordinated disposal on the corresponding industrial equipment in conjunction with the operation and maintenance system.

[0068] In some embodiments, determining the device behavior state through multimodal collaborative analysis to obtain a device state determination result includes:

[0069] Use the isolation forest algorithm to perform outlier detection on the three-dimensional feature vector for anomaly screening and output the outlier probability;

[0070] Use LSTM neural network to predict the device's next behavior and compare it with the actual behavior to calculate the residual;

[0071] Use Petri net models to verify whether equipment behavior complies with the preset process flow;

[0072] The equipment status judgment result is: if the residual > 3σ and the process verification fails, it is judged as abnormal; if 2σ < residual ≤ 3σ or any dimension is abnormal, it is judged as suspicious; otherwise it is considered normal behavior.

[0073] In some embodiments, the use of a Petri net model to verify whether the device behavior complies with a preset process flow includes:

[0074] Convert the process sequence in the SCADA log into a Petri net structure, including place nodes, transition nodes and directed arcs;

[0075] Verify whether the Petri net reachability conditions are met based on the transition sequence triggered by the actual behavior of the device;

[0076] If the trigger sequence violates the preset process logic, it will be marked as process verification failure.

[0077] This step employs a multimodal collaborative analysis strategy to improve the accuracy and robustness of anomaly detection. First, the Isolation Forest algorithm performs primary outlier detection on feature vectors to identify behaviors that deviate from normal patterns. Second, an LSTM neural network is used to model the time series of device behavior, predicting the behavioral characteristics at the next moment. These predictions are then compared with the actual observed values ​​to calculate the predicted residuals. Simultaneously, a process constraint model constructed using Petri nets performs a logical check on device operating behaviors to determine whether they conform to the established process flow. Finally, a comprehensive judgment mechanism is used to determine the behavior status: if the residual is greater than 3σ and process verification fails, the behavior is considered abnormal; if the residual is between 2σ and 3σ or any dimension is abnormal, the behavior is marked as suspicious; otherwise, the behavior is considered normal. This multidimensional collaborative mechanism effectively reduces false negatives and improves detection accuracy.

[0078] In some embodiments, generating an automatic response strategy based on the device status determination result and performing coordinated disposal on the corresponding industrial equipment in conjunction with the operation and maintenance system includes:

[0079] If the device status is abnormal or suspicious, automatic handling suggestions are generated based on knowledge graph and decision tree reasoning, including device isolation, traffic restriction or alarm reporting;

[0080] Execute disposal strategies by coordinating with the operation and maintenance management system and record logs.

[0081] After detecting abnormal or suspicious behavior, the system automatically enters the response and disposal process. Based on the joint reasoning mechanism of knowledge graph and decision tree, the response module analyzes the correlation between current behavioral characteristics and historical abnormal patterns, and generates targeted disposal suggestions, including but not limited to equipment isolation, traffic restriction, alarm reporting, etc. The disposal strategy supports a multi-level linkage mechanism and can be integrated with the existing operation and maintenance system to achieve automated or semi-automatic response. At the same time, the platform provides a manual review interface to support policy confirmation and optimization feedback, and improve the explainability and reliability of system decisions. While ensuring security, this mechanism reduces the cost of manual intervention and improves overall response efficiency.

[0082] Furthermore, the specific implementation process of this solution is explained using the DCS control system of a chemical plant as an example:

[0083] S1: Data acquisition and preprocessing;

[0084] Edge probes collect device communication data at a 100ms granularity, extracting fields such as source / destination IP, port, and protocol instruction code;

[0085] Perform SHA-256 hashing on static information such as the firmware version and device model of the PLC device:

[0086] ;

[0087] in, Indicates the physical address of an industrial device (such as the 48-bit MAC address of a PLC). Indicates the device firmware version number (string format, such as "V2.1.5"), Indicates the device model.

[0088] Build communication cycle time series: record the periodic read and write operations between PLC and DCS with timestamps to form sequence;

[0089] S2: 3D feature vector construction;

[0090] Static features: convert the device fingerprint hash value into a 64-dimensional vector;

[0091] Dynamic characteristics: Calculate the standard deviation of the communication cycle:

[0092]

[0093] in, represents the time interval of the i-th communication cycle, n represents the number of communication cycles in the sampling window, represents the mean value of n communication cycles, Indicates the standard deviation of the communication cycle, reflecting the stability of communication time;

[0094] Calculate the entropy value of the protocol instruction sequence:

[0095]

[0096] in is the frequency of occurrence of the kth instruction code, where k represents the total number of instruction code types;

[0097] Contextual features:

[0098] Constructing a process flow chart: Converting the equipment operation sequence in the SCADA operation log into a directed graph;

[0099] Use the GraphSAGE algorithm to generate a 128-dimensional embedding vector for the device node:

[0100] Feature fusion: concatenate the three types of feature vectors to form a 256-dimensional feature vector ;

[0101] S3: Dynamic learning and model updating;

[0102] Initialize the FTRL model parameters:

[0103] Learning rate

[0104] Regularization parameter ;

[0105] Feature weight decay calculation:

[0106]

[0107] New feature confidence evaluation:

[0108] Calculate the feature stability score:

[0109] ;

[0110] in, It represents the average value of the standard deviation of the communication cycle of the historical feature vector, reflecting the average fluctuation degree of the communication cycle in the historical feature vector. It represents the standard deviation of the communication period of the new eigenvector, and is used to measure the fluctuation degree of the communication period in the new eigenvector.

[0111] like , update the model parameters:

[0112]

[0113] Represents the gradient at time step t, reflecting the sensitivity of the loss function to the model parameters and guiding the update direction of the model parameters. Represents the weight parameter at time step t. The updated weight parameter is used to measure the importance and influence of the feature vector in the model. Represents the learning rate attenuation factor at time step t, which is used to adjust the size of the learning rate. It gradually decreases with the increase of the number of iterations, making the model parameter update smoother and more stable.

[0114] S4: Anomaly detection and collaborative analysis;

[0115] Isolation Forest Anomaly Detection:

[0116] Construct 200 isolation trees and sample anomaly scores:

[0117]

[0118] Among them, h(x) is the path length of the feature vector x in the isolation tree, represents the average path length of 200 trees, represents the path length normalization factor;

[0119] LSTM Time Series Forecasting:

[0120] Build a 2-layer LSTM network to predict the next communication cycle:

[0121]

[0122] Compute the prediction residuals:

[0123]

[0124] in, represents the actual behavior feature vector of the device at time step t, Represents the device behavior feature vector predicted by the LSTM network at time step t.

[0125] Process Constraint Verification:

[0126] Construct a Petri net model to verify the compliance of equipment operation sequence;

[0127] Define the process logic rule set: ;

[0128] Comprehensive judgment:

[0129] when And when process validation fails, it is marked as abnormal;

[0130] when Or when any dimension is abnormal, it is marked as suspicious;

[0131] S5: Response and Disposition;

[0132] Knowledge graph reasoning:

[0133] Query similar historical cases and match disposal strategies

[0134] Constructing decision tree nodes , calculate the information gain:

[0135]

[0136] in, Indicates the parent node The information gain value of Indicates the parent node The information entropy of represents the information entropy of the left child node of p, represents the information entropy of the right child node of p, It represents the ratio of the number of samples in the left subset to the parent set. The ratio of the number of samples in the right subset to the number of samples in the parent set.

[0137] Generate a disposition suggestion:

[0138] Level 1 anomaly: triggers device isolation and traffic mirroring;

[0139] Level 2 suspicious: Initiate in-depth analysis + manual review;

[0140] The disposal strategy is executed by linking with the DCS system through the OPC UA interface.

[0141] Table 1 is a comparative data table of industrial equipment abnormality monitoring between this solution and the traditional solution.

[0142] Table 1

[0143]

[0144] In the second aspect, this application proposes a system for dynamic learning of industrial asset fingerprint features and abnormal behavior recognition, such as Figure 2 As shown, it includes data acquisition module, feature extraction and fusion module, abnormal behavior judgment module and automatic response module;

[0145] The data acquisition module is used to collect network communication data, protocol instruction sequences and SCADA logs of industrial equipment in real time using edge probes;

[0146] The feature extraction and fusion module is used to extract static features from the industrial equipment, extract dynamic features from the network communication data and protocol instruction sequence, extract context features from the SCADA log, and fuse them to form a three-dimensional feature vector;

[0147] The abnormal behavior determination module is used to perform unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm, dynamically update the device behavior model, determine the device behavior status through multimodal collaborative analysis, and obtain a device status determination result;

[0148] The automatic response module is used to generate an automatic response strategy according to the equipment status determination result, and to carry out linkage disposal of the corresponding industrial equipment in combination with the operation and maintenance system.

[0149] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0150] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0151] Those skilled in the art can clearly understand that, for the convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0152] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0153] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.

[0154] In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of modules or units is merely a logical function division. In actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which may be electrical, mechanical or other forms.

[0155] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0156] In addition, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0157] If the integrated module / unit is implemented as a software functional unit and sold or used as a standalone product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure can implement all or part of the process steps in the above-mentioned method embodiments by using a computer program to instruct the relevant hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program can include computer program code, which can be in source code form, object code form, executable file, or some intermediate form. Computer-readable media can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunications signals, and software distribution media. It should be noted that the content included in computer-readable media can be appropriately increased or decreased based on the requirements of legislation and patent practice in a jurisdiction. For example, in some jurisdictions, based on legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunications signals.

[0158] The above are only preferred embodiments of the present invention. It should be pointed out that various modifications and improvements made by those skilled in the art without departing from the present technical solution should also be deemed to fall within the scope of protection required by this solution.

Claims

1. Dynamic learning of industrial asset fingerprint features and abnormal behavior identification method, characterized by: The following steps are involved: Use edge probes to collect network communication data, protocol instruction sequences, and SCADA logs of industrial equipment in real time; Extract static features from the industrial equipment, extract dynamic features from the network communication data and protocol instruction sequence, extract context features from the SCADA log, and fuse them to form a three-dimensional feature vector; Based on the online learning algorithm, the three-dimensional feature vector is subjected to unsupervised incremental learning, and the device behavior model is dynamically updated. The method includes assigning a time-decaying weight to the three-dimensional feature vector using an FTRL-Proximal algorithm, including: The three-dimensional feature vector is given a weight that decays exponentially with time. The formula is: Where t is the difference between the feature acquisition time and the current time; Evaluate the confidence score of the three-dimensional feature vector in real time, and if the score is higher than a threshold, incorporate the corresponding three-dimensional feature vector into the model for incremental update; If the score is lower than the threshold, the current three-dimensional feature vector is input into the reinforcement learning channel for anomaly screening; Determine the device behavior status through multimodal collaborative analysis and obtain the device status determination results, including: Use the isolation forest algorithm to perform outlier detection on the three-dimensional feature vector for anomaly screening and output the outlier probability; Use LSTM neural network to predict the device's next behavior and compare it with the actual behavior to calculate the residual; Use Petri net models to verify whether equipment behavior complies with the preset process flow, including: Convert the process sequence in the SCADA log into a Petri net structure, including place nodes, transition nodes and directed arcs; Verify whether the Petri net reachability conditions are met based on the transition sequence triggered by the actual behavior of the device; If the trigger sequence violates the preset process logic, it will be marked as process verification failure; The equipment status determination results are: if the residual > 3σ and the process verification fails, it is determined to be abnormal; if 2σ < residual ≤ 3σ or any dimension is abnormal, it is determined to be suspicious; otherwise, it is considered normal behavior; An automatic response strategy is generated based on the equipment status determination result, and the corresponding industrial equipment is dealt with in a coordinated manner in conjunction with the operation and maintenance system.

2. The method according to claim 1, wherein: The step of extracting static features from the industrial equipment, extracting dynamic features from the network communication data and protocol instruction sequences, and extracting context features from the SCADA log to form a three-dimensional feature vector includes: Extracting the MAC address, firmware version, and serial number of the industrial device and generating a unique identifier using the SHA-256 hash algorithm to form the static feature; Counting the communication cycle standard deviation of the network communication data and the protocol sequence entropy of the protocol instruction sequence to form the dynamic feature; Analyze the process trigger sequence in the SCADA log, construct a process flow chart based on the process trigger sequence in the SCADA log, and extract the topological embedding representation through a graph neural network to form the context feature; The static features, dynamic features and context features are fused to generate a three-dimensional feature vector, and the vector is stored in a time series database according to timestamps.

3. The method according to claim 2, wherein: The automatic response strategy is generated according to the equipment status determination result, and the operation and maintenance system is combined with the corresponding industrial equipment to carry out linkage disposal, including: If the device status is abnormal or suspicious, automatic handling suggestions are generated based on knowledge graph and decision tree reasoning, including device isolation, traffic restriction or alarm reporting; Execute disposal strategies by coordinating with the operation and maintenance management system and record logs.

4. Dynamic learning of industrial asset fingerprint features and abnormal behavior recognition system, characterized by: It includes data acquisition module, feature extraction and fusion module, abnormal behavior determination module and automatic response module; The data acquisition module is used to collect network communication data, protocol instruction sequences and SCADA logs of industrial equipment in real time using edge probes; The feature extraction and fusion module is used to extract static features from the industrial equipment, extract dynamic features from the network communication data and protocol instruction sequence, extract context features from the SCADA log, and fuse them to form a three-dimensional feature vector; The abnormal behavior determination module is used to perform unsupervised incremental learning on the three-dimensional feature vector based on an online learning algorithm and dynamically update the device behavior model. The method includes assigning a time-decaying weight to the three-dimensional feature vector using an FTRL-Proximal algorithm, including: The three-dimensional feature vector is given a weight that decays exponentially with time. The formula is: Where t is the difference between the feature acquisition time and the current time; Evaluate the confidence score of the three-dimensional feature vector in real time, and if the score is higher than a threshold, incorporate the corresponding three-dimensional feature vector into the model for incremental update; If the score is lower than the threshold, the current three-dimensional feature vector is input into the reinforcement learning channel for anomaly screening; Determine the device behavior status through multimodal collaborative analysis and obtain the device status determination results, including: Use the isolation forest algorithm to perform outlier detection on the three-dimensional feature vector for anomaly screening and output the outlier probability; Use LSTM neural network to predict the device's next behavior and compare it with the actual behavior to calculate the residual; Use Petri net models to verify whether equipment behavior complies with the preset process flow, including: Convert the process sequence in the SCADA log into a Petri net structure, including place nodes, transition nodes and directed arcs; Verify whether the Petri net reachability conditions are met based on the transition sequence triggered by the actual behavior of the device; If the trigger sequence violates the preset process logic, it will be marked as process verification failure; The equipment status determination results are: if the residual > 3σ and the process verification fails, it is determined to be abnormal; if 2σ < residual ≤ 3σ or any dimension is abnormal, it is determined to be suspicious; otherwise, it is considered normal behavior; The automatic response module is used to generate an automatic response strategy according to the equipment status determination result, and to carry out linkage disposal of the corresponding industrial equipment in combination with the operation and maintenance system.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 are implemented.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images