Aluminum extruder APT defense method and system based on flow fingerprint identification

Abstract

The embodiment of the invention discloses an aluminum extruder APT defense method and system based on flow fingerprint identification, and belongs to the technical field of digital information transmission. Industrial data streams sent by an acquisition terminal are received, a unique identifier is generated for each industrial device, Hash is performed on the unique identifiers and network flow characteristics, first flow fingerprint data are generated, and the first flow fingerprint data are sent to a server; and sending the first traffic fingerprint data subjected to dimension reduction processing to a pattern recognition engine to generate second traffic fingerprint data, inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model, and recognizing whether ATP attack exists or not. According to the embodiment of the invention, normal operation and data security of industrial equipment including the aluminum extruder in an industrial network can be effectively protected, comprehensive monitoring of the network traffic of the aluminum extruder and accurate identification of APT attacks are realized, and the security and reliability of the industrial network are improved.

Description

Technical Field

[0001] The embodiments of the present application relate to an APT defense method and system for an aluminum extruder based on traffic fingerprint recognition, belonging to the technical field of digital information transmission. Background Art

[0002] Aluminum extruders are industrial equipment used to manufacture aluminum alloy profiles, widely used in construction, automotive, aerospace, electronics, and other fields. They heat aluminum bars or sheets at high temperatures and then use high-pressure hydraulic cylinders to extrude them into the desired shape. As critical industrial equipment, aluminum extruders typically require connection to industrial networks for real-time monitoring and control of the production process. This connection to industrial networks inevitably presents potential cybersecurity risks, such as advanced persistent threats (APTs).

[0003] APT attacks aim to steal sensitive information or disrupt critical infrastructure. An APT attack on the control system or host computer unit of an aluminum extrusion press can lead to tampering with the control system, theft of production data, and even production line downtime, causing significant economic losses and potential production safety issues. Examples of industrial equipment downtime and factory damage caused by cyberattacks include: In 2019, Norwegian aluminum producer Norsk Hydro suffered a severe ransomware attack, which caused its global computer network system to crash and several factories to suspend operations.

[0004] To protect aluminum extrusion presses, their control systems, and host computers from cyberattacks, existing technologies typically employ physical isolation methods, such as network isolation. While this effectively reduces the risk of cyberattacks during operation, physical isolation is ineffective in certain operating conditions requiring real-time control. Online, real-time cyberattack defense methods are essential. Existing technologies lack a corresponding technical solution and are no longer able to meet these requirements, urgently requiring improvement. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide an APT defense method and system for aluminum extrusion machines based on traffic fingerprint recognition, and to provide an APT prevention method and system for aluminum extrusion machines in industrial networks based on traffic fingerprint recognition, thereby solving the shortcomings of the existing technology.

[0006] The present application provides the following solutions: According to one aspect of an embodiment of the present application, a method for defending against APT attacks on aluminum extruders based on traffic fingerprint identification is provided, comprising: receiving an industrial data stream sent by an acquisition terminal, extracting a message header field from the industrial data stream, identifying corresponding industrial equipment according to the message header field, and generating a unique identifier for each industrial equipment; extracting a message payload portion from the industrial data stream, obtaining network traffic characteristics of the message payload portion, performing a hash operation on the unique identifier and the network traffic characteristics, and generating first traffic fingerprint data; performing dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, sending the first traffic fingerprint data after dimensionality reduction processing to a pattern recognition engine, and generating second traffic fingerprint data, wherein the model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data; setting a corresponding malicious traffic identification identifier based on known malicious traffic samples, obtaining probabilistic statistical characteristics of the malicious traffic through the malicious traffic identification identifier, forming a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an ATP attack exists.

[0007] According to at least one specific implementation of the embodiments of the present application, the industrial data stream sent by the receiving acquisition terminal, extracting the message header field from the industrial data stream, identifying the corresponding industrial equipment according to the message header field, and generating a unique identifier for each industrial equipment further includes: the acquisition terminal is deployed in an industrial network environment, and an aluminum extruder is provided in the industrial network environment, and the aluminum extruder is connected to a host computer; the industrial data stream from the acquisition terminal is received through the host computer, and the message header field of the industrial data stream is extracted, and the message header field includes industrial data source information and industrial data target information; the host computer obtains the network identification information of the acquisition terminal, generates an identifier for the corresponding industrial equipment according to the network identification information, associates the identifier with the operating status of the aluminum extruder, and generates a corresponding unique identifier according to the temperature value, pressure value and vibration frequency of the aluminum extruder.

[0008] According to at least one specific implementation of the embodiments of the present application, the method of extracting the message payload part from the industrial data stream, obtaining the network traffic characteristics of the message payload part, performing a hash operation on the unique identifier and the network traffic characteristics to generate first traffic fingerprint data further includes: obtaining an industrial data stream from an acquisition terminal, the industrial data stream including control instructions, status information, and sensor data of industrial equipment; parsing the industrial data stream to obtain the message payload part of the data message of the industrial data stream, and extracting the network traffic characteristics in the message payload part; converting the network traffic characteristics into structured data, performing a hash operation on the structured data and the unique identifier to generate first traffic fingerprint data, wherein the first traffic fingerprint data is a hash value of a fixed length.

[0009] According to at least one specific implementation of the embodiments of the present application, the first traffic fingerprint data is subjected to dimensionality reduction processing based on the time characteristics of the traffic fingerprint, and the first traffic fingerprint data after dimensionality reduction processing is sent to the pattern recognition engine to generate second traffic fingerprint data. The model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data, and further includes: extracting a time feature subset related to the time characteristics from the first traffic fingerprint data, and performing dimensionality reduction processing on the time feature subset; sending the first traffic fingerprint data after dimensionality reduction processing to the pattern recognition engine, and providing an abnormal traffic data label in the pattern recognition engine; the first traffic fingerprint data generates a multidimensional array in the pattern recognition engine, and each dimension of the multidimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data, and a corresponding specific traffic feature vector is generated according to the specific traffic feature value; the pattern recognition engine performs similarity analysis on the specific traffic feature vector based on a preset feature traffic template, and detects abnormal patterns in the specific traffic feature vector through a clustering algorithm or a deep learning algorithm.

[0010] According to at least one specific implementation of the embodiments of the present application, the pattern recognition engine is specifically: a support vector machine pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network pattern recognition engine, a recurrent neural network pattern recognition engine or a variant long short-term memory network pattern recognition engine.

[0011] According to at least one specific implementation of the embodiments of the present application, based on the known malicious traffic samples, a corresponding malicious traffic identification identifier is set, the probabilistic statistical characteristics of the malicious traffic are obtained through the malicious traffic identification identifier, a traffic fingerprint probability distribution model with malicious traffic characteristics is formed, and the second traffic fingerprint data is input into the traffic fingerprint probability distribution model to identify whether there is an ATP attack, further including: constructing a malicious traffic feature model based on a statistical analysis method, calculating the probability distribution of the traffic fingerprint of the malicious traffic feature, and forming a probability distribution model for characterizing the malicious traffic feature; inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model for matching, calculating the malicious traffic feature probability value of the data packet in the second traffic fingerprint data, and comparing the malicious traffic feature probability value with the probability distribution model; if the malicious traffic feature probability value is higher than a preset malicious traffic feature probability threshold, it is determined that malicious traffic exists in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

[0012] According to at least one specific implementation of the embodiments of the present application, the malicious traffic feature model constructed based on the statistical analysis method further includes: obtaining the data packet size characteristics of the second traffic fingerprint, calculating the mean, variance and standard deviation of the data packet, and forming a malicious traffic size probability density function based on the data packet size; obtaining the data packet sending interval time of the second traffic fingerprint, and calculating the malicious traffic sending interval probability density function in the malicious traffic feature model according to the data packet interval time; comparing the malicious traffic size probability density function and the malicious traffic sending interval probability density function of the malicious traffic within multiple cycles and the chi-square value corresponding to the chi-square statistic, and determining the probability density function with a chi-square value less than the chi-square statistic as the optimal fit probability density function; and identifying whether an ATP attack exists through the optimal fit probability density function.

[0013] According to at least one specific implementation of the embodiments of the present application, the malicious traffic size probability density function adopts a Gaussian distribution model, and the malicious traffic sending interval probability density function is an exponential distribution model.

[0014] According to another aspect of the embodiment of the present application, there is provided an aluminum extrusion press APT defense system based on traffic fingerprint identification, which is used to implement an aluminum extrusion press APT defense method based on traffic fingerprint identification, including: an industrial equipment unique identifier generation module, which is used to receive the industrial data stream sent by the acquisition terminal, extract the message header field from the industrial data stream, identify the corresponding industrial equipment according to the message header field, and generate a unique identifier for each industrial equipment; a first traffic fingerprint data generation module, which is used to extract the message payload part from the industrial data stream, obtain the network traffic characteristics of the message payload part, perform a hash operation on the unique identifier and the network traffic characteristics, and generate a first traffic fingerprint data generation module. The second traffic fingerprint data generating module performs dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, sends the first traffic fingerprint data after dimensionality reduction processing to the pattern recognition engine, and generates second traffic fingerprint data. The model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data; the ATP attack identification module sets a corresponding malicious traffic identification identifier based on known malicious traffic samples, obtains the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifier, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model, and identifies whether there is an ATP attack.

[0015] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; a computer program is stored in the memory, and when the computer program is executed by the processor, the processor executes the steps of the method.

[0016] Compared with the prior art, the embodiments of the present application have the following advantages: The APT defense method for aluminum extruders based on traffic fingerprint identification provided in the embodiment of the present application ensures accurate identification and management of industrial equipment such as aluminum extruders by identifying industrial equipment and generating unique identifiers. The network traffic characteristics of the payload portion of the data message in the industrial network are extracted, and a hash operation is performed on the unique identifier to generate first traffic fingerprint data. By obtaining the original network traffic characteristics in the first traffic fingerprint, a basis for subsequent analysis is provided. Then, based on known malicious traffic samples, a malicious traffic identification identifier is set, and a probabilistic statistical feature model of malicious traffic is constructed. A pattern recognition engine is used to generate second traffic fingerprint data, which is then matched with the model to identify whether an APT attack has occurred.

[0017] The embodiment of the present application is based on a probabilistic statistical feature model constructed based on known malicious traffic samples, which can effectively identify malicious traffic, especially APT attacks. The accuracy and reliability of the model are ensured through statistical methods such as the chi-square test, and real-time defense and response against APT attacks are established and corresponding defense measures are taken. The normal operation and data security of industrial equipment including aluminum extrusion presses in the industrial network are effectively protected, and comprehensive monitoring of aluminum extrusion press network traffic and accurate identification of APT attacks are achieved, thereby improving the security and reliability of the industrial network. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the specific implementation methods or the description of the prior art. Obviously, the drawings described below are some implementation methods of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is a flow chart of the APT defense method for aluminum extrusion machines based on traffic fingerprint recognition.

[0020] Figure 2 It is a flow chart of the optimization technical solution provided by steps S11 to S13.

[0021] Figure 3 It is a flow chart of the optimization technical solution provided by steps S21 to S23.

[0022] Figure 4 It is a flow chart of the optimization technical solution provided by steps S31 to S33.

[0023] Figure 5 It is a flow chart of the optimization technical solution provided by steps S41 to S43.

[0024] Figure 6 It is a flowchart of the optimization technical solution provided from step S411 to step S413.

[0025] Figure 7 This is the architecture diagram of the aluminum extrusion machine APT defense system based on traffic fingerprint recognition.

[0026] Figure 8 It is a structural diagram of an electronic device. DETAILED DESCRIPTION

[0027] The following will clearly and completely describe the technical solutions of the embodiments of the present application in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present application, not all of them. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the embodiments of the present application.

[0028] Traffic fingerprinting is the process of analyzing the characteristics of network packets to generate a digital signature that uniquely identifies a specific network activity, application, or device. A traffic fingerprint signature consists of a series of features or parameters that can be used to identify and classify network traffic. Traffic fingerprinting works because different network applications, protocols, or users generate unique network traffic patterns. For example: Packet size and order: Different applications generate different packet sizes and transmission orders.

[0029] Time interval between packets: The time interval between packets can reflect the dynamic characteristics of traffic.

[0030] Protocol characteristics: such as TCP / UDP flags, protocol type, etc.

[0031] Traffic statistics characteristics: such as packet frequency, flow duration, etc.

[0032] Traffic fingerprinting technology plays a vital role in network attack defense, particularly in identifying and preventing Advanced Persistent Threat (APT) attacks. APT attacks are complex and long-lasting, in which attackers typically maintain a stealthy presence within target networks for extended periods of time, stealing sensitive information or damaging critical infrastructure. Traffic fingerprinting can analyze network traffic characteristics to identify unusual patterns associated with APT attacks. For example, APT attackers may communicate over encrypted channels to conceal their malicious activities. Traffic fingerprinting can detect unusual characteristics in this encrypted traffic, such as packet size and time intervals.

[0033] Traffic fingerprinting can also identify malicious and abnormal traffic in industrial networks. Malicious traffic can be identified by analyzing encrypted traffic characteristics (such as packet size and time interval). Alternatively, abnormal traffic can be identified by analyzing traffic statistics and behavioral patterns. For example, using machine learning algorithms, a classifier can be trained to identify known malicious traffic patterns and classify unknown traffic.

[0034] An aluminum extruder is an industrial device used to manufacture aluminum alloy profiles. It is typically used in industrial networks for real-time monitoring and control of the production process. This embodiment of the present application applies traffic fingerprinting to industrial network monitoring, management, and network control of the aluminum extruder and its host computer. This allows for accurate identification and classification of different types of network traffic, including both normal and malicious traffic. This allows for timely detection of abnormal behavior in the network, improving network security, and enabling real-time monitoring of network traffic, prompt detection of abnormal behavior, and the issuance of alerts. This helps to quickly respond to network attacks, optimize the production efficiency of aluminum extruders, enhance the security of industrial networks, and protect important industrial equipment and basic industrial networks.

[0035] like Figure 1 The APT defense method for aluminum extrusion machines based on traffic fingerprinting includes: Step S1: Receive the industrial data stream sent by the acquisition terminal, extract the message header field from the industrial data stream, identify the corresponding industrial device according to the message header field, and generate a unique identifier for each industrial device.

[0036] Step S2: extract the message payload portion from the industrial data stream, obtain the network traffic characteristics of the message payload portion, perform a hash operation on the unique identifier and the network traffic characteristics, and generate first traffic fingerprint data.

[0037] Step S3: perform dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, and send the first traffic fingerprint data after dimensionality reduction processing to the pattern recognition engine to generate second traffic fingerprint data. The model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data.

[0038] Step S4: Based on the known malicious traffic samples, a corresponding malicious traffic identification identifier is set, and the probabilistic statistical characteristics of the malicious traffic are obtained through the malicious traffic identification identifier to form a traffic fingerprint probability distribution model with malicious traffic characteristics. The second traffic fingerprint data is input into the traffic fingerprint probability distribution model to identify whether an ATP attack exists. If an ATP attack is detected, corresponding ATP prevention measures are adopted based on the time characteristics of the traffic fingerprint.

[0039] The technical solution provided in steps S1 to S4 uses traffic fingerprinting technology to achieve comprehensive monitoring of aluminum extrusion machine network traffic and defense against APT attacks. It identifies industrial equipment and generates unique identifiers, ensuring accurate identification and management of industrial equipment such as aluminum extrusion machines. A hash operation is performed on the unique identifier to generate first traffic fingerprint data. This data is then subjected to dimensionality reduction processing to reduce the data dimension while retaining key information. The reduced first traffic fingerprint data is then input into a pattern recognition engine to generate second traffic fingerprint data. By generating traffic fingerprint data twice, traffic behavior patterns are identified to detect abnormal behavior. A malicious traffic identification identifier is set based on known malicious traffic samples, and a probabilistic statistical feature model of malicious traffic is constructed to identify the presence of an APT attack. If an APT attack is detected, corresponding defensive measures based on the time characteristics of the traffic fingerprint can be taken immediately.

[0040] The technical solution provided in steps S1 to S4 performs secondary processing on traditional traffic fingerprint data, generating first and second traffic fingerprint data at different times. The first traffic fingerprint data can be used to preliminarily screen and classify network traffic to quickly identify normal traffic and potential abnormal traffic, while the second traffic fingerprint is data after dimensionality reduction, which is more suitable for efficient analysis and processing. It can process and analyze traffic data more quickly and detect complex abnormal behaviors, such as covert communication patterns and data leakage behaviors in APT attacks. Based on the first traffic fingerprint data, the second traffic fingerprint data can support more in-depth analysis, such as time series analysis and dynamic changes in behavioral patterns, which can reveal complex behavioral patterns hidden in the data and improve the ability to identify malicious traffic. The second traffic fingerprint data can be used to match the malicious traffic feature model. By comparing the traffic fingerprint with the probability distribution model of known malicious traffic, malicious traffic can be more accurately identified.

[0041] like Figure 2 As shown, preferably, in step S1, an industrial data stream sent by an acquisition terminal is received, a message header field is extracted from the industrial data stream, a corresponding industrial device is identified according to the message header field, and a unique identifier is generated for each industrial device, further comprising: In step S11 , the data collection terminal is deployed in an industrial network environment. An aluminum extruder is provided in the industrial network environment, and the aluminum extruder is connected to a host computer.

[0042] Step S12: receiving the industrial data stream from the acquisition terminal through the host computer, and extracting the message header field of the industrial data stream, where the message header field includes industrial data source information and industrial data target information.

[0043] In step S13, the host computer obtains the network identification information of the acquisition terminal, generates an identifier for the corresponding industrial equipment based on the network identification information, associates the identifier with the operating status of the aluminum extruder, and generates a corresponding unique identifier based on the temperature value, pressure value and vibration frequency of the aluminum extruder.

[0044] The optimization technology solution provided in steps S11 through S13 utilizes collection terminals and a host computer system deployed in an industrial network environment to achieve structured collection of aluminum extrusion press operating data, extract network communication features, and associate device identifiers. This creates a unique device identification system based on multi-dimensional industrial data (temperature, pressure, and vibration frequency). In steps S11 through S13, collection terminals are deployed within the aluminum extrusion press industrial network, establishing a data link from the industrial equipment to the host computer. The host computer then parses the network layer / transport layer header fields (such as IP, port, and protocol header fields) of the industrial data stream to identify the data source and flow direction. Finally, the network identifier is combined with the equipment's operating status (temperature, pressure, vibration frequency, and other data) to generate a composite identifier that is both unique and associated with the equipment's status.

[0045] The optimized technical solution provided in steps S11 through S13 enables precise traceability of industrial equipment. By extracting message header fields, it enables end-to-end tracking of industrial data flows, clearly defining the communication path between data-generating devices and the host computer, enhancing network-layer observability, and binding the operating status of industrial equipment to the industrial network. It dynamically associates device physical parameters with network identification information, breaking through the limitations of traditional static identification that relies solely on IP / MAC addresses and incorporating real-time operating characteristics into device identities. The unique identifier integrates the device's network behavior (communication characteristics) and physical state (sensor data), providing a multi-dimensional basis for identifying potential APT attacks and significantly improving the security of industrial networks.

[0046] On the basis of steps S11 to S13, further improvements can be made to further enhance the dynamic adaptability and security reliability of industrial equipment identification: Step S14, dynamic identifier update and timeliness management: Set a validity threshold for the unique identifier and dynamically adjust it based on the rate of change of the operating status of the aluminum extruder. When the change in any sensor data exceeds the preset threshold, the identifier is regenerated. Lightweight hash chain technology is used in the process of triggering identifier regeneration to ensure that the old and new identifiers are traceable and cannot be tampered with.

[0047] Step S15: Identifier Verification Based on Zero Trust Architecture: A lightweight authentication module is deployed on the host computer to perform real-time verification of the received unique identifier. This verification includes the hash consistency of the unique identifier and the physical plausibility of the associated sensor data. If verification fails, an alarm is triggered and the suspicious device traffic is isolated. In step S15, the real-time verification of the unique identifier primarily checks whether it matches the historical chain head to ensure the hash consistency of the unique identifier. The physical plausibility of the associated sensor data refers to whether the vibration frequency is within the normal range for aluminum extrusion presses.

[0048] Step S16, Cross-Device Association Analysis and Topology Construction: Using the source / destination IP and port numbers in the message headers, a communication relationship graph is constructed between industrial devices. Unique identifiers are mapped to nodes in the graph, and roles are labeled based on device types. Based on the graph, abnormal communications are analyzed and a security audit log is generated. Device types in step S16 include aluminum extruders and PLCs, among others. Abnormal communications could be an extruder accessing devices outside the host computer in an unconventional manner.

[0049] The extended technical solution provided in steps S14 to S16 implements dynamic security protection on the original static identifier system, adds dynamic identifier update + zero-trust verification function, can more effectively resist APT attacks, and also realizes the coordination of industrial network status and network equipment. It can link the physical status of the equipment (vibration, temperature) and network behavior (communication topology) for linkage anomaly detection. It has strong scalability, is compatible with multiple industrial protocols (Modbus / TCP, PROFINET), and can be integrated into existing industrial security platforms (such as SIEM systems).

[0050] like Figure 3 As shown, preferably, in step S2, extracting the message payload portion from the industrial data stream, obtaining the network traffic characteristics of the message payload portion, performing a hash operation on the unique identifier and the network traffic characteristics, and generating first traffic fingerprint data further includes: Step S21: Acquire an industrial data stream from a collection terminal. The industrial data stream includes control instructions, status information, and sensor data of industrial equipment.

[0051] Step S22 , parsing the industrial data flow to obtain a message payload portion of a data message of the industrial data flow, and extracting network traffic features from the message payload portion.

[0052] Step S23: convert the network traffic characteristics into structured data, perform a hash operation on the structured data and the unique identifier, and generate first traffic fingerprint data, where the first traffic fingerprint data is a hash value of a fixed length.

[0053] The optimization solution provided in steps S21 to S23 extracts network traffic characteristics by parsing the message payload of the industrial data stream. This is combined with the device's unique identifier (such as IP address, MAC address, etc.) to generate a fixed-length first traffic fingerprint through a hashing operation. This process collects multiple industrial data streams, including control instructions, status information, and sensor data. The payload of the data message is then parsed to extract key network traffic characteristics. Finally, the structured traffic characteristics are combined with the device's unique identifier to generate a unique and irreversible traffic fingerprint using a hashing algorithm. The optimization solution provided in steps S21 to S23 ensures data integrity, strengthens the correlation between industrial devices and industrial network traffic, and implements lightweight security identification operations. Compared with existing technologies that only rely on header fields, this implementation also extracts message payload features, and covers the actual content of the industrial data flow (such as control instructions and sensor values) through message payload features to ensure that the fingerprint can reflect the actual device behavior and data interaction mode. Finally, the unique identifier and traffic features are combined with hash operations to generate device-level traffic fingerprints, realizing accurate binding of network traffic and physical devices. In the process of identifying APT attacks, it can accurately identify specific individual industrial devices in the industrial network.

[0054] It can be seen that the optimization technical solution provided by steps S21 to S23 builds a traffic fingerprint system that combines industrial network identity authentication and behavioral trust through the Hash algorithm fusion of "load characteristics + device identification", providing a lightweight and highly reliable technical foundation for security auditing and anomaly monitoring of industrial networks.

[0055] like Figure 4 As shown, preferably, in step S3, the first traffic fingerprint data is subjected to dimensionality reduction processing based on the traffic fingerprint time characteristic, and the first traffic fingerprint data after dimensionality reduction processing is sent to the pattern recognition engine to generate second traffic fingerprint data. The model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data, further comprising: Step S31 extracts a temporal feature subset related to time characteristics from the first traffic fingerprint data and performs dimensionality reduction on the temporal feature subset. In step S31, the feature subset may include packet arrival time intervals, flow durations, session start and end times, and so on. Predefined dimensionality reduction algorithms, such as principal component analysis (PCA), linear discriminant analysis (LDA), or autoencoders, are used to reduce data dimensionality while retaining the temporal feature subset related to time characteristics.

[0056] In step S32, the first traffic fingerprint data after dimensionality reduction is sent to a pattern recognition engine, where an abnormal traffic data label is set. The abnormal traffic data label is used to train a machine learning model by generating a large amount of labeled data for training the machine learning model. The abnormal traffic data label clearly indicates which traffic is normal and which is abnormal or malicious, thereby helping the model learn to distinguish between different types of traffic characteristics, improving the accuracy and generalization capabilities of the pattern recognition engine, and helping the model better understand the characteristics of abnormal traffic, thereby more accurately identifying new and unknown abnormal traffic in practical applications.

[0057] In step S33, the first traffic fingerprint data is used to generate a multidimensional array in the pattern recognition engine. Each dimension of the multidimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data. A corresponding specific traffic feature vector is generated based on the specific traffic feature value. Exemplarily, the specific traffic features include: packet size, packet transmission time interval, and packet traffic duration.

[0058] In step S34, the pattern recognition engine performs similarity analysis on the specific traffic feature vector based on the preset feature traffic template, and detects abnormal patterns in the specific traffic feature vector using a clustering algorithm or a deep learning algorithm. For example, the preset feature traffic module includes normal traffic samples and known abnormal traffic.

[0059] The optimization technical solution provided in steps S31 to S34 performs dynamic behavior analysis on the first traffic fingerprint data through time feature dimensionality reduction and pattern recognition engine to realize anomaly detection and classification of industrial network traffic, extracts time-related features (such as packet interval, session time, etc.) from the first traffic fingerprint data, compresses data dimensions through algorithms such as PCA / LDA, performs time feature dimensionality reduction while retaining key timing patterns, and realizes time feature dimensionality reduction at the same time. The reduced data is then input into the pattern recognition engine and converted into a multidimensional feature vector, which is matched with the preset traffic template (normal samples and abnormal samples) for similarity, identifies potential attacks (such as DDoS, port scanning), and realizes the abnormal pattern recognition function.

[0060] The optimization technology solution provided in steps S31 to S34 focuses on the dynamic behavior of traffic by extracting a subset of time features (such as packet arrival interval, session duration), avoiding the limitations of static traffic fingerprint data, and removing redundant information through dimensionality reduction processing (PCA / LDA), reducing computational complexity, and retaining key timing patterns to improve the efficiency and accuracy of subsequent analysis. Finally, the traffic fingerprint is converted into a multi-dimensional feature vector, and then anomalies are identified from multiple dimensions through clustering or deep learning algorithms, avoiding misjudgment of a single indicator, supporting rapid alarms and interception, and supporting rapid adaptation of new attack patterns through modular design (preset templates, updateable algorithms) without the need to reconstruct the entire system, reducing the computational load of the pattern recognition engine, adapting to scenarios where industrial equipment resources are limited, and upgrading the traffic fingerprint from a static identifier to a dynamic behavior portrait. While ensuring real-time performance, high-precision anomaly detection is achieved, providing industrial networks with security protection capabilities that are both efficient and intelligent.

[0061] Exemplarily, the pattern recognition engine is specifically: a support vector machine (SVM) pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network (CNN) pattern recognition engine, a recurrent neural network (RNN) pattern recognition engine or a variant long short-term memory network (LSTM) pattern recognition engine.

[0062] like Figure 5 As shown, as a preference, in step S4, based on the known malicious traffic sample, a corresponding malicious traffic identification identifier is set, the probabilistic statistical characteristics of the malicious traffic are obtained through the malicious traffic identification identifier, a traffic fingerprint probability distribution model with malicious traffic characteristics is formed, the second traffic fingerprint data is input into the traffic fingerprint probability distribution model, and whether an ATP attack exists is identified, further comprising: Step S41: construct a malicious traffic feature model based on a statistical analysis method, calculate the probability distribution of the traffic fingerprint of the malicious traffic feature, and form a probability distribution model for characterizing the malicious traffic feature.

[0063] Step S42: input the second traffic fingerprint data into the traffic fingerprint probability distribution model for matching, calculate the malicious traffic feature probability value of the data packet in the second traffic fingerprint data, and compare the malicious traffic feature probability value with the probability distribution model.

[0064] Step S43: If the malicious traffic feature probability value is higher than a preset malicious traffic feature probability threshold, it is determined that malicious traffic exists in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

[0065] The optimization technical solution provided in steps S41 to S43 detects and identifies malicious traffic in network traffic by constructing a probability distribution model of malicious traffic characteristics, and further determines whether there is an advanced persistent threat (APT) attack. By statistically analyzing the characteristics of malicious traffic, a probability distribution model is formed, and then the traffic fingerprint data to be detected is matched with the model. The probability value of the malicious traffic characteristics is calculated, and the presence of malicious traffic is determined by setting a threshold, ultimately achieving accurate identification and labeling of APT attacks.

[0066] The optimization technical solution provided by steps S41 to S43 can accurately identify malicious traffic, effectively detect APT attacks, improve detection efficiency and reliability, and adapt to dynamically changing network environments. By constructing a probability distribution model of malicious traffic characteristics, it is possible to quantitatively analyze malicious behaviors in network traffic, capture the statistical characteristics of malicious traffic, and evaluate the maliciousness of traffic by calculating probability values. Compared with traditional rule-based detection methods, it can more accurately identify malicious traffic hidden in normal traffic, especially those disguised or mutated malicious behaviors. In the process of detecting APT attacks, in view of the characteristics of APT attacks such as strong concealment, long duration, and complex attack methods, by comparing the probability value of malicious traffic characteristics with the preset threshold, it is possible to quickly determine whether an APT attack exists, quickly filter out suspicious traffic in massive network traffic, and mark it as an APT attack, providing timely warning and response basis for network security protection.

[0067] The optimization technology provided in steps S41 through S43 utilizes statistical analysis and probabilistic models to avoid the complexity of analyzing each packet individually, significantly improving detection efficiency. By setting appropriate thresholds, it balances detection sensitivity and accuracy, ensuring stability and effectiveness. The statistically-based probabilistic distribution model can dynamically reflect changes in the characteristics of malicious traffic and exhibits a degree of adaptability. Regularly updating the malicious traffic characteristic model can better address new attacks and evolving network threats.

[0068] In summary, the optimization technical solution provided by steps S41 to S43 achieves accurate identification of malicious traffic and effective detection of APT attacks by constructing a probability distribution model of malicious traffic characteristics. The technical effect is reflected in improving the accuracy, efficiency and reliability of malicious traffic detection, while being able to adapt to dynamically changing network environments.

[0069] like Figure 6 As shown, illustratively, in step S41, building a malicious traffic feature model based on a statistical analysis method further includes: Step S411, obtaining the data packet size feature of the second traffic fingerprint, calculating the mean, variance and standard deviation of the data packet, and forming a malicious traffic size probability density function based on the data packet size; Step S412: obtaining the data packet sending interval of the second traffic fingerprint, and calculating the malicious traffic sending interval probability density function in the malicious traffic feature model according to the data packet interval; Step S413 compares the chi-square values of the malicious traffic size probability density function and the malicious traffic transmission interval probability density function for multiple cycles, as well as the corresponding chi-square statistics. The probability density function with a chi-square value less than the chi-square statistic is determined as the best-fit probability density function. The malicious traffic size probability density function uses a Gaussian distribution model, and the malicious traffic transmission interval probability density function uses an exponential distribution model.

[0070] Step S414: Identify whether an ATP attack occurs by using the best fit probability density function.

[0071] The optimization technology provided in steps S411 through S413 constructs a malicious traffic feature model through statistical analysis, utilizing statistical characteristics of packet size and transmission interval to identify malicious traffic and further determine whether an APT attack exists. The specific steps of steps S411 through S413 include extracting packet size characteristics, extracting packet transmission interval characteristics, optimizing the model, and identifying APT attacks. By extracting two key characteristics, packet size and transmission interval, and modeling them using Gaussian and exponential distributions, respectively, steps S411 through S413 accurately characterize the behavioral characteristics of malicious traffic from a statistical perspective, effectively distinguishing between normal and malicious traffic, as malicious traffic typically exhibits different statistical patterns in packet size and transmission interval than normal traffic.

[0072] Then, the model is optimized and the fit is evaluated. By comparing the chi-square value and the chi-square statistic, the probability density function with the best fit is selected to ensure that the model can more accurately reflect the true characteristics of malicious traffic, improve the reliability and accuracy of the model, and reduce the possibility of false positives and false negatives. The optimized probability density function is then used to identify malicious traffic, which can quickly determine whether there is an APT attack, quickly filter out suspicious traffic in the network traffic, and mark it as an APT attack, thereby providing timely warning and response basis for network security protection.

[0073] The optimization technology provided in steps S411 through S413 can adapt to the changing characteristics of malicious traffic in different network environments. By regularly updating the malicious traffic characteristic model (for example, recalculating statistical parameters such as the mean and variance), it can better respond to new attacks and evolving network threats, effectively reducing false alarm rates. Compared with traditional rule-based detection methods, this avoids false alarms caused by the limitations of rules. The statistical analysis-based approach more comprehensively considers the characteristics of malicious traffic, thereby improving detection accuracy and reliability. Furthermore, by optimizing the model to select the probability density function with the best fit, this improves the accuracy of malicious traffic detection, reduces the false alarm rate, and can adapt to dynamically changing network environments, providing strong technical support for network security protection.

[0074] For the method steps disclosed in the above embodiments, for the purpose of simple description, the method steps are expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the order of the actions described, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0075] Any process or method description described in a flowchart or other manner can be understood as: a module, fragment or part of a code that includes one or more executable instructions for implementing a specific logical function or process step, and the scope of the preferred implementation of the embodiments of the present application includes alternative implementations, which may not be in the order shown or discussed, including executing and implementing functions in a substantially simultaneous manner or in the opposite order according to the functions involved, or executing computer instructions and implementing corresponding functions according to program structures such as loops and branches, which can naturally be understood by those skilled in the art when implementing the embodiments of the present application.

[0076] like Figure 7 As shown, the embodiment of the present application further provides an aluminum extrusion machine APT defense system based on traffic fingerprint recognition, which is used to implement the aluminum extrusion machine APT defense method based on traffic fingerprint recognition in any specific implementation of the embodiment of the present application, including: An industrial device unique identifier generation module is configured to receive an industrial data stream sent by an acquisition terminal, extract a message header field from the industrial data stream, identify a corresponding industrial device based on the message header field, and generate a unique identifier for each industrial device; A first traffic fingerprint data generating module is configured to extract a message payload portion from the industrial data stream, obtain network traffic characteristics of the message payload portion, perform a hash operation on the unique identifier and the network traffic characteristics, and generate first traffic fingerprint data; a second traffic fingerprint data generating module, which performs dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, and sends the first traffic fingerprint data after dimensionality reduction processing to a pattern recognition engine to generate second traffic fingerprint data. The pattern recognition engine is used to identify the behavior pattern of the first traffic fingerprint data; The ATP attack identification module sets a corresponding malicious traffic identification identifier based on a known malicious traffic sample, obtains the probabilistic statistical characteristics of the malicious traffic through the malicious traffic identification identifier, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model, and identifies whether an ATP attack exists.

[0077] The embodiments of the system described above are merely illustrative. For example, the various functional modules, units, or subsystems in the system may or may not be physically separate, or may or may not be physical units, that is, they may be located in the same place or distributed across multiple different systems and their subsystems or modules. Those skilled in the art may select some or all of the functional modules, units, or subsystems according to actual needs to achieve the purpose of the embodiments of the present application. For the above-mentioned situations, those of ordinary skill in the art can understand and implement them without inventive work.

[0078] It is worth noting that although only some basic functional modules are disclosed in the embodiments of the present application, it does not mean that the composition of the present system is limited to the above basic functional modules. On the contrary, what the present embodiment wants to express is that on the basis of the above basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with the existing technology to form an infinite number of embodiments or technical solutions. In other words, the present system is open rather than closed. Just because the present embodiment only discloses individual basic functional modules, it cannot be considered that the scope of protection of the claims of the embodiments of the present application is limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above devices are described in terms of functions, which are divided into various units and modules. Of course, when implementing the embodiments of the present application, the functions of each unit and module can be implemented in the same or one or more software and / or hardware.

[0079] like Figure 8 As shown, the embodiment of the present application provides an APT defense method and system for aluminum extrusion presses based on traffic fingerprint recognition, and also provides corresponding electronic devices and storage media: An electronic device includes: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of an APT defense method for an aluminum extruder based on traffic fingerprint identification.

[0080] A computer-readable storage medium stores a computer program executable by an electronic device. When the computer program runs on the electronic device, the electronic device executes the steps of an APT defense method for an aluminum extruder based on traffic fingerprint identification.

[0081] Description of reference numerals: 801 -processor, 802 -memory, 803 -communication interface, 804 -bus, 8021 -program code.

[0082] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. Figure 8 As shown, device 800 includes a processor 801, a memory 802, a communication interface 803, and a bus 804. The processor 801, memory 802, and communication interface 803 communicate via bus 804, and communication can also be achieved through other means such as wireless transmission. The memory 802 is used to store instructions, and the processor 801 is used to execute the instructions stored in the memory 802. The memory 802 stores program code 8021, and the processor 801 can call the program code 8021 stored in the memory 802 to execute the steps of the aluminum extrusion machine APT defense method based on traffic fingerprinting.

[0083] It should be understood that in the embodiment of the present application, the processor 801 may be a CPU, or may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0084] The memory 802 may include a read-only memory (ROM) and a random access memory (RAM), and provides instructions and data to the processor 801. The memory 802 may also include a non-volatile random access memory. The memory 802 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0085] In addition to the data bus, the bus 804 may also include a power bus, a control bus, a status signal bus, etc. However, for the sake of clarity, various buses are labeled as the bus 804 in the figure.

[0086] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid state drive (SSD).

[0087] It should be noted that the above embodiments illustrate rather than limit the embodiments of the present application, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbols placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The embodiments of the present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order, and these words may be interpreted as names.

[0088] In the description of the embodiments of the present application, the reference terms "one embodiment," "example," "specific example," etc., mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiments of the present application. In the description of the embodiments of the present application, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples.

[0089] In addition, the technical solutions between the various implementation methods of the embodiments of the present application can be combined with each other, but it must be based on the fact that ordinary technicians in this field can implement it. When the combination of technical solutions is mutually contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the embodiments of the present application.

[0090] All features disclosed in the embodiments of the present application, or steps in all disclosed methods or processes, except for mutually exclusive features and / or steps, can be combined in any way. Any feature disclosed in the specification of the embodiments of the present application, unless otherwise stated, can be replaced by other alternative features that are equivalent or have similar purposes. That is, unless otherwise stated, each feature is just an example in a series of equivalent or similar features. Throughout the specification, the same reference numerals indicate the same elements.

[0091] Finally, it should be noted that the above embodiments are intended only to illustrate the technical solutions of the embodiments of the present application, and are not intended to limit them. Although the embodiments of the present application have been described in detail with reference to the above embodiments, those skilled in the art should understand that they may still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents, and such modifications or replacements do not deviate from the essence of the corresponding technical solutions within the scope of the specific implementation methods of the embodiments of the present application.

Claims

1. A method for defending against APT attacks on aluminum extruders based on traffic fingerprint recognition, characterized in that: include: Receive an industrial data stream sent by a collection terminal, extract a message header field from the industrial data stream, identify a corresponding industrial device according to the message header field, and generate a unique identifier for each industrial device; Extracting a message payload portion from the industrial data stream, obtaining a network traffic feature of the message payload portion, performing a hash operation on the unique identifier and the network traffic feature to generate first traffic fingerprint data; Performing dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, sending the first traffic fingerprint data after dimensionality reduction processing to a pattern recognition engine to generate second traffic fingerprint data, wherein the pattern recognition engine is used to identify the behavior pattern of the first traffic fingerprint data; Based on known malicious traffic samples, a corresponding malicious traffic identification identifier is set, and the probabilistic statistical characteristics of the malicious traffic are obtained through the malicious traffic identification identifier to form a traffic fingerprint probability distribution model with malicious traffic characteristics. The second traffic fingerprint data is input into the traffic fingerprint probability distribution model to identify whether an ATP attack exists.

2. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 1 is characterized in that: The receiving of the industrial data stream sent by the collection terminal, extracting a message header field from the industrial data stream, identifying a corresponding industrial device according to the message header field, and generating a unique identifier for each industrial device further includes: The acquisition terminal is deployed in an industrial network environment, an aluminum extruder is provided in the industrial network environment, and the aluminum extruder is connected to a host computer; Receiving the industrial data stream from the acquisition terminal through the host computer, extracting the message header field of the industrial data stream, wherein the message header field includes industrial data source information and industrial data target information; The host computer obtains the network identification information of the acquisition terminal, generates an identifier for the corresponding industrial equipment based on the network identification information, associates the identifier with the operating status of the aluminum extruder, and generates a corresponding unique identifier based on the temperature value, pressure value and vibration frequency of the aluminum extruder.

3. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 1 is characterized in that: The step of extracting a message payload portion from the industrial data stream, obtaining a network traffic feature of the message payload portion, performing a hash operation on the unique identifier and the network traffic feature to generate first traffic fingerprint data further includes: Acquire an industrial data stream from a collection terminal, wherein the industrial data stream includes control instructions, status information, and sensor data of industrial equipment; Parsing the industrial data flow to obtain a message payload portion of a data message of the industrial data flow, and extracting network traffic features in the message payload portion; The network traffic characteristics are converted into structured data, and a hash operation is performed on the structured data and the unique identifier to generate first traffic fingerprint data, where the first traffic fingerprint data is a hash value of a fixed length.

4. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 1 is characterized in that: The method further includes performing dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, sending the first traffic fingerprint data after dimensionality reduction processing to the pattern recognition engine to generate second traffic fingerprint data, and the model recognition engine is used to identify the behavior pattern of the first traffic fingerprint data. extracting a time feature subset related to time characteristics from the first traffic fingerprint data, and performing dimensionality reduction processing on the time feature subset; Sending the first traffic fingerprint data after dimensionality reduction processing to a pattern recognition engine, wherein an abnormal traffic data label is set in the pattern recognition engine; The first traffic fingerprint data generates a multidimensional array in a pattern recognition engine, each dimension of the multidimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data, and a corresponding specific traffic feature vector is generated according to the specific traffic feature value; The pattern recognition engine performs similarity analysis on the specific traffic feature vector based on a preset feature traffic template, and detects abnormal patterns in the specific traffic feature vector through a clustering algorithm or a deep learning algorithm.

5. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 4 is characterized in that: The pattern recognition engine is specifically: a support vector machine pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network pattern recognition engine, a recurrent neural network pattern recognition engine or a variant long short-term memory network pattern recognition engine.

6. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 1 is characterized in that: The method further includes: setting a corresponding malicious traffic identification identifier based on a known malicious traffic sample, obtaining a probabilistic statistical feature of the malicious traffic through the malicious traffic identification identifier, forming a traffic fingerprint probability distribution model having the malicious traffic feature, inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model, and identifying whether an ATP attack exists. Based on statistical analysis methods, a malicious traffic feature model is constructed, and the probability distribution of traffic fingerprints of malicious traffic features is calculated to form a probability distribution model for characterizing malicious traffic features; Inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model for matching, calculating a malicious traffic feature probability value of a data packet in the second traffic fingerprint data, and comparing the malicious traffic feature probability value with the probability distribution model; If the malicious traffic feature probability value is higher than a preset malicious traffic feature probability threshold, it is determined that malicious traffic exists in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

7. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 6 is characterized in that: The method of constructing a malicious traffic feature model based on a statistical analysis method further includes: Obtaining a data packet size feature of the second traffic fingerprint, calculating a mean, variance, and standard deviation of the data packet, and forming a malicious traffic size probability density function based on the data packet size; Obtaining a data packet sending interval of the second traffic fingerprint, and calculating a malicious traffic sending interval probability density function in a malicious traffic feature model based on the data packet interval; Comparing the chi-square values of the malicious traffic size probability density function and the malicious traffic sending interval probability density function over multiple cycles and the chi-square statistic corresponding to the chi-square values, the probability density function with a chi-square value smaller than the chi-square statistic is determined as the best-fit probability density function; The presence of ATP attack is identified by using the best fit probability density function.

8. The APT defense method for aluminum extruder based on traffic fingerprint recognition according to claim 7 is characterized in that: The malicious traffic size probability density function adopts a Gaussian distribution model, and the malicious traffic sending interval probability density function adopts an exponential distribution model.

9. An APT defense system for aluminum extrusion machines based on traffic fingerprint recognition, characterized in that: The APT defense method for aluminum extrusion machines based on traffic fingerprint identification includes: An industrial device unique identifier generation module is configured to receive an industrial data stream sent by an acquisition terminal, extract a message header field from the industrial data stream, identify a corresponding industrial device based on the message header field, and generate a unique identifier for each industrial device; A first traffic fingerprint data generating module is configured to extract a message payload portion from the industrial data stream, obtain network traffic characteristics of the message payload portion, perform a hash operation on the unique identifier and the network traffic characteristics, and generate first traffic fingerprint data; a second traffic fingerprint data generating module, which performs dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, and sends the first traffic fingerprint data after dimensionality reduction processing to a pattern recognition engine to generate second traffic fingerprint data. The pattern recognition engine is used to identify the behavior pattern of the first traffic fingerprint data; The ATP attack identification module sets a corresponding malicious traffic identification identifier based on a known malicious traffic sample, obtains the probabilistic statistical characteristics of the malicious traffic through the malicious traffic identification identifier, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model, and identifies whether an ATP attack exists.

10. An electronic device, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method according to any one of claims 1 to 8.

Images