A method and system for APT defense in aluminum extrusion presses based on flow fingerprinting

Abstract

This application discloses an APT defense method and system for aluminum extrusion presses based on traffic fingerprinting, belonging to the technical field of digital information transmission. It receives industrial data streams sent by a data acquisition terminal, generates a unique identifier for each industrial device, performs a hash operation on the unique identifier and network traffic characteristics to generate first traffic fingerprint data, sends the dimensionality-reduced first traffic fingerprint data to a pattern recognition engine to generate second traffic fingerprint data, and inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists. This application effectively protects the normal operation and data security of industrial equipment, including aluminum extrusion presses, in industrial networks, achieving comprehensive monitoring of aluminum extrusion press network traffic and accurate identification of APT attacks, thus improving the security and reliability of industrial networks.

Description

Technical Field

[0001] This application relates to an APT defense method and system for aluminum extrusion machines based on traffic fingerprinting, belonging to the technical field of digital information transmission. Background Technology

[0002] An aluminum extrusion press is an industrial piece of equipment used to manufacture aluminum alloy profiles, widely applied in construction, automotive, aerospace, and electronics industries. The press heats aluminum bars or sheets at high temperatures and then uses high-pressure hydraulic cylinders to extrude them into the desired shape. As an important piece of industrial equipment, the aluminum extrusion press typically requires connection to an industrial network for real-time monitoring and control of the production process. This connection inevitably presents potential cybersecurity risks, such as APT attacks (Advanced Persistent Threats).

[0003] The purpose of APT attacks is to steal sensitive information or damage critical infrastructure. When the control system or host computer unit of an aluminum extrusion press is attacked by an APT, the control system can be tampered with, production data stolen, and production line shutdowns can occur, causing huge economic losses and potential production safety problems. Case studies of industrial equipment shutdowns and factory damage caused by cyberattacks include: In 2019, Norwegian aluminum producer Norsk Hydro suffered a severe ransomware attack, causing its global computer network systems to crash and several factories to shut down.

[0004] Current technologies typically employ physical isolation methods, such as network isolation, to protect aluminum extrusion presses, their control systems, and host computers from cyberattacks. While these methods effectively reduce the risk of cyberattacks during operation, they are ineffective in situations requiring real-time control. In such cases, online, real-time cyberattack defense methods are necessary. Existing technologies lack corresponding solutions and fail to meet current requirements, necessitating improvement. Summary of the Invention

[0005] The purpose of this application is to provide an APT defense method and system for aluminum extrusion machines based on traffic fingerprinting. Based on traffic fingerprinting, it provides an APT defense method and system for aluminum extrusion machines in industrial networks, and solves the shortcomings of the existing technology.

[0006] The embodiments of this application provide the following solutions:

[0007] According to one aspect of the embodiments of this application, an APT defense method for aluminum extrusion machines based on traffic fingerprinting is provided, comprising: receiving an industrial data stream sent by a data acquisition terminal; extracting a header field from the industrial data stream; identifying the corresponding industrial equipment based on the header field; and generating a unique identifier for each industrial equipment; extracting a payload portion from the industrial data stream; obtaining network traffic characteristics of the payload portion; performing a hash operation on the unique identifier and the network traffic characteristics to generate first traffic fingerprint data; performing dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint; sending the dimensionality-reduced first traffic fingerprint data to a pattern recognition engine to generate second traffic fingerprint data, wherein the pattern recognition engine is used to identify the behavioral patterns of the first traffic fingerprint data; setting a corresponding malicious traffic identification identifier based on known malicious traffic samples; obtaining the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifier to form a traffic fingerprint probability distribution model with malicious traffic characteristics; and inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists.

[0008] According to at least one specific embodiment of the present application, the step of receiving an industrial data stream sent by a data acquisition terminal, extracting message header fields from the industrial data stream, identifying corresponding industrial equipment based on the message header fields, and generating a unique identifier for each industrial equipment further includes: the data acquisition terminal being deployed in an industrial network environment, an aluminum extrusion machine being installed in the industrial network environment, and the aluminum extrusion machine being connected to a host computer; the host computer receiving the industrial data stream from the data acquisition terminal, extracting message header fields from the industrial data stream, the message header fields including industrial data source information and industrial data target information; the host computer obtaining the network identification information of the data acquisition terminal, generating an identifier for the corresponding industrial equipment based on the network identification information, associating the identifier with the operating status of the aluminum extrusion machine, and generating a corresponding unique identifier based on the temperature value, pressure value, and vibration frequency of the aluminum extrusion machine.

[0009] According to at least one specific embodiment of the present application, the step of extracting the packet payload portion from the industrial data stream, obtaining the network traffic characteristics of the packet payload portion, and performing a hash operation on the unique identifier and the network traffic characteristics to generate first traffic fingerprint data further includes: acquiring an industrial data stream from a data acquisition terminal, the industrial data stream including control instructions, status information, and sensor data of industrial equipment; parsing the industrial data stream to obtain the packet payload portion of the data packets of the industrial data stream, and extracting the network traffic characteristics from the packet payload portion; converting the network traffic characteristics into structured data, and performing a hash operation on the structured data and the unique identifier to generate first traffic fingerprint data, wherein the first traffic fingerprint data is a fixed-length hash value.

[0010] According to at least one specific embodiment of the present application, the step of performing dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of traffic fingerprints, and sending the dimensionality-reduced first traffic fingerprint data to a pattern recognition engine to generate second traffic fingerprint data, wherein the pattern recognition engine is used to identify the behavioral patterns of the first traffic fingerprint data, further includes: extracting a subset of time features related to time characteristics from the first traffic fingerprint data, and performing dimensionality reduction processing on the subset of time features; sending the dimensionality-reduced first traffic fingerprint data to the pattern recognition engine, wherein an abnormal traffic data label is set in the pattern recognition engine; generating a multi-dimensional array in the pattern recognition engine from the first traffic fingerprint data, wherein each dimension of the multi-dimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data, and generating a corresponding specific traffic feature vector based on the specific traffic feature value; the pattern recognition engine performing similarity analysis on the specific traffic feature vector based on a preset feature traffic template, and detecting abnormal patterns in the specific traffic feature vector through clustering algorithms or deep learning algorithms.

[0011] According to at least one specific embodiment of the present application, the pattern recognition engine is specifically: a support vector machine pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network pattern recognition engine, a recurrent neural network pattern recognition engine, or a variant long short-term memory network pattern recognition engine.

[0012] According to at least one specific embodiment of the present application, the step of setting a corresponding malicious traffic identification identifier based on a known malicious traffic sample, obtaining the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifier, forming a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists, further includes: constructing a malicious traffic feature model based on statistical analysis methods, calculating the probability distribution of the traffic fingerprint of malicious traffic characteristics, forming a probability distribution model for characterizing malicious traffic characteristics; inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model for matching, calculating the probability value of malicious traffic characteristics of data packets in the second traffic fingerprint data, comparing the probability value of malicious traffic characteristics with the probability distribution model; if the probability value of malicious traffic characteristics is higher than a preset malicious traffic characteristic probability threshold, it is determined that there is malicious traffic in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

[0013] According to at least one specific embodiment of the present application, the construction of the malicious traffic feature model based on statistical analysis methods further includes: obtaining the data packet size characteristics of the second traffic fingerprint, calculating the mean, variance, and standard deviation of the data packets, and forming a malicious traffic size probability density function based on the data packet size; obtaining the data packet transmission interval time of the second traffic fingerprint, and calculating the malicious traffic transmission interval probability density function in the malicious traffic feature model based on the data packet interval time; comparing the chi-square values ​​of the malicious traffic size probability density function and the malicious traffic transmission interval probability density function within multiple periods, and the chi-square statistic corresponding to the chi-square value, and determining the probability density function whose chi-square value is less than the chi-square statistic as the optimal fit probability density function; and identifying whether an APT attack exists through the optimal fit probability density function.

[0014] According to at least one specific embodiment of the present application, the probability density function of the malicious traffic size adopts a Gaussian distribution model, and the probability density function of the malicious traffic sending interval adopts an exponential distribution model.

[0015] According to another aspect of the embodiments of this application, an APT defense system for aluminum extrusion machines based on traffic fingerprinting is provided, used to implement an APT defense method for aluminum extrusion machines based on traffic fingerprinting, including: an industrial equipment unique identifier generation module, used to receive an industrial data stream sent by a data acquisition terminal, extract a packet header field from the industrial data stream, identify the corresponding industrial equipment according to the packet header field, and generate a unique identifier for each industrial equipment; a first traffic fingerprint data generation module, used to extract a packet payload portion from the industrial data stream, obtain network traffic characteristics of the packet payload portion, perform a hash operation on the unique identifier and the network traffic characteristics, and generate a first stream. The system comprises: a first traffic fingerprint data generation module; a second traffic fingerprint data generation module, which performs dimensionality reduction processing on the first traffic fingerprint data based on the temporal characteristics of the traffic fingerprint, and sends the dimensionality-reduced first traffic fingerprint data to a pattern recognition engine to generate second traffic fingerprint data, wherein the pattern recognition engine is used to identify the behavioral patterns of the first traffic fingerprint data; and an APT attack identification module, which sets corresponding malicious traffic identification identifiers based on known malicious traffic samples, obtains the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifiers, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists.

[0016] According to another aspect of the embodiments of this application, an electronic device is provided, including: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method.

[0017] The embodiments of this application have the following advantages compared with the prior art:

[0018] The APT defense method for aluminum extrusion machines based on traffic fingerprinting provided in this application ensures accurate identification and management of industrial equipment such as aluminum extrusion machines by identifying industrial equipment and generating unique identifiers. The method extracts network traffic features from the packet payload portion of data packets in the industrial network, performs a hash operation with the unique identifier to generate first traffic fingerprint data. Obtaining the original network traffic features from the first traffic fingerprint provides a foundation for subsequent analysis. Then, based on known malicious traffic samples, a malicious traffic identification identifier is set, and a probabilistic statistical feature model of malicious traffic is constructed. A pattern recognition engine is used to generate second traffic fingerprint data, which is then matched against the model to identify whether an APT attack exists.

[0019] The embodiments of this application construct a probabilistic statistical feature model based on known malicious traffic samples, which can effectively identify malicious traffic, especially APT attacks. The accuracy and reliability of the model are ensured by statistical methods such as chi-square test. Real-time defense and response against APT attacks are established and corresponding defensive measures are taken, which effectively protects the normal operation and data security of industrial equipment, including aluminum extrusion presses, in industrial networks. It realizes comprehensive monitoring of network traffic of aluminum extrusion presses and accurate identification of APT attacks, thereby improving the security and reliability of industrial networks. Attached Figure Description

[0020] To more clearly illustrate the specific implementation methods of the embodiments of this application or the technical solutions in the prior art, the drawings used in the description of the specific implementation methods or the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of an APT defense method for aluminum extrusion presses based on traffic fingerprinting.

[0022] Figure 2 This is a flowchart of the optimization technical solutions provided in steps S11 to S13.

[0023] Figure 3 This is a flowchart of the optimization technical solutions provided in steps S21 to S23.

[0024] Figure 4 This is a flowchart of the optimization technical solutions provided in steps S31 to S33.

[0025] Figure 5 This is a flowchart of the optimization technical solutions provided in steps S41 to S43.

[0026] Figure 6 This is a flowchart of the optimization technical solutions provided in steps S411 to S413.

[0027] Figure 7 This is an architecture diagram of an APT defense system for aluminum extrusion presses based on traffic fingerprinting.

[0028] Figure 8 This is a schematic diagram of the electronic device. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of the embodiments of this application.

[0030] Traffic fingerprinting refers to generating a digital signature that uniquely identifies a specific network activity, application, or device by analyzing the characteristics of network data packets. The traffic fingerprint signature consists of a series of features or parameters that can be used to identify and classify network traffic. The principle behind traffic fingerprinting is that different network applications, protocols, or users generate network traffic patterns with unique characteristics.

[0031] Data packet size and order: Different applications generate data packets of different sizes and in different transmission orders.

[0032] Inter-packet time interval: The time interval between packets can reflect the dynamic characteristics of traffic.

[0033] Protocol characteristics: such as TCP / UDP flags, protocol type, etc.

[0034] Traffic statistics characteristics: such as packet frequency, flow duration, etc.

[0035] Traffic fingerprinting technology plays a crucial role in network attack defense, particularly in identifying and defending against APT attacks. APT attacks are complex and long-lasting cyberattacks where attackers typically remain covertly within target networks for extended periods to steal sensitive information or disrupt critical infrastructure. Traffic fingerprinting identifies anomalous patterns associated with APT attacks by analyzing network traffic characteristics. For example, APT attackers might use encrypted channels to conceal their malicious activities. Traffic fingerprinting can detect unusual features in this encrypted traffic, such as packet size and time intervals.

[0036] Traffic fingerprinting can also identify malicious and abnormal traffic in industrial networks. Malicious traffic can be identified by analyzing the characteristics of encrypted traffic (such as packet size and time intervals). Alternatively, abnormal traffic can be identified by analyzing its statistical characteristics and behavioral patterns. For example, machine learning algorithms can be used to train a classifier to identify known malicious traffic patterns and classify unknown traffic.

[0037] An aluminum extrusion press is an industrial piece of equipment used to manufacture aluminum alloy profiles. It is typically used in industrial networks for real-time monitoring and control of the production process. This application applies traffic fingerprinting to industrial network monitoring, management, and network control of the aluminum extrusion press and its host computer. This enables accurate identification and classification of different types of network traffic, including normal and malicious traffic, allowing for timely detection of abnormal network behavior, improving network security, real-time monitoring of network traffic, and prompt alerts for abnormal behavior. This facilitates rapid response to network attacks, optimizes the production efficiency of the aluminum extrusion press, enhances industrial network security, and protects critical industrial equipment and basic industrial networks.

[0038] like Figure 1 The APT defense method for aluminum extrusion presses based on flow fingerprinting, as shown, includes:

[0039] Step S1: Receive the industrial data stream sent by the acquisition terminal, extract the message header fields from the industrial data stream, identify the corresponding industrial equipment based on the message header fields, and generate a unique identifier for each industrial equipment.

[0040] Step S2: Extract the message payload from the industrial data stream, obtain the network traffic characteristics of the message payload, perform a hash operation on the unique identifier and the network traffic characteristics, and generate the first traffic fingerprint data.

[0041] Step S3: Dimensionality reduction processing is performed on the first traffic fingerprint data based on the time characteristics of traffic fingerprint. The dimensionality-reduced first traffic fingerprint data is sent to the pattern recognition engine to generate second traffic fingerprint data. The pattern recognition engine is used to identify the behavior patterns of the first traffic fingerprint data.

[0042] Step S4: Based on known malicious traffic samples, set corresponding malicious traffic identification identifiers, obtain the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifiers, form a traffic fingerprint probability distribution model with malicious traffic characteristics, input the second traffic fingerprint data into the traffic fingerprint probability distribution model, identify whether there is an APT attack, and if an APT attack is detected, adopt corresponding APT defense measures based on the time characteristics of the traffic fingerprint.

[0043] The technical solutions provided in steps S1 to S4 utilize traffic fingerprinting technology to achieve comprehensive monitoring of network traffic for aluminum extrusion presses and defense against APT attacks. Industrial equipment is identified and a unique identifier is generated, ensuring accurate identification and management of industrial equipment such as aluminum extrusion presses. A hash operation is performed using the unique identifier to generate first traffic fingerprint data. This first traffic fingerprint data undergoes dimensionality reduction processing to decrease data dimensionality while retaining key information. The dimensionality-reduced first traffic fingerprint data is then input into a pattern recognition engine to generate second traffic fingerprint data. By generating traffic fingerprint data twice, behavioral patterns of the traffic are identified, detecting any abnormal behavior. Based on known malicious traffic samples, a malicious traffic identification identifier is set, constructing a probabilistic statistical feature model of malicious traffic to identify the presence of APT attacks. If an APT attack is detected, corresponding defensive measures based on the temporal characteristics of the traffic fingerprint can be taken immediately.

[0044] The technical solutions provided in steps S1 to S4 perform secondary processing on traditional traffic fingerprint data, generating first and second traffic fingerprint data at different times. The first traffic fingerprint data can be used for preliminary screening and classification of network traffic to quickly identify normal traffic and potentially abnormal traffic. The second traffic fingerprint, being dimensionality-reduced data, is more suitable for efficient analysis and processing, enabling faster processing and analysis of traffic data and detection of complex abnormal behaviors, such as covert communication patterns and data leakage behaviors in APT attacks. Building upon the first traffic fingerprint data, the second traffic fingerprint data supports deeper analysis, such as time series analysis and dynamic changes in behavioral patterns, revealing complex behavioral patterns hidden in the data and improving the ability to identify malicious traffic. The second traffic fingerprint data can be used to match with malicious traffic feature models; by comparing the traffic fingerprint with the probability distribution models of known malicious traffic, malicious traffic can be identified more accurately.

[0045] like Figure 2 As shown, preferably, in step S1, receiving the industrial data stream sent by the acquisition terminal, extracting the message header field from the industrial data stream, identifying the corresponding industrial equipment based on the message header field, and generating a unique identifier for each industrial equipment, further includes:

[0046] Step S11: The data acquisition terminal is deployed in an industrial network environment, where an aluminum extrusion machine is installed and connected to a host computer.

[0047] Step S12: Receive industrial data stream from the acquisition terminal via the host computer, and extract the message header fields of the industrial data stream. The message header fields include industrial data source information and industrial data target information.

[0048] Step S13: The host computer obtains the network identification information of the acquisition terminal, generates the corresponding industrial equipment identifier based on the network identification information, associates the identifier with the operating status of the aluminum extrusion press, and generates a corresponding unique identifier based on the temperature value, pressure value and vibration frequency of the aluminum extrusion press.

[0049] The optimized technical solutions provided in steps S11 to S13 utilize data acquisition terminals and host computer systems deployed in the industrial network environment to achieve structured data acquisition, network communication feature extraction, and equipment identification association for aluminum extrusion press operation. This constructs a unique equipment identification system based on multi-dimensional industrial data (temperature, pressure, vibration frequency). In steps S11 to S13, data acquisition terminals are deployed in the aluminum extrusion press industrial network, establishing a data link from the industrial equipment to the host computer. The host computer parses the network layer / transmission layer header fields of the industrial data stream (such as IP, port, protocol header fields, etc.) to clarify the data source and flow direction. Finally, by combining the network identifier with the equipment operating status (temperature value, pressure value, vibration frequency, etc.), a composite identifier with equipment uniqueness and status association is generated.

[0050] The optimized technical solutions provided in steps S11 to S13 achieve precise traceability of industrial equipment. By extracting header fields, end-to-end tracking of industrial data streams is achieved, clarifying the communication path between the data-generating device and the host computer, enhancing network layer observability, and binding the operating status of industrial equipment to the industrial network body. This dynamically associates device physical parameters with network identification information, breaking through the limitations of traditional static identification relying solely on IP / MAC addresses, and enabling device identity to include real-time operating condition characteristics. The unique identifier integrates device network behavior (communication characteristics) and physical status (sensor data), providing multi-dimensional judgment criteria for potential APT attacks and significantly improving the security of industrial networks.

[0051] Building upon steps S11 to S13, further improvements can be made to enhance the dynamic adaptability and security reliability of industrial equipment identification:

[0052] Step S14, Dynamic Identifier Update and Timeliness Management: Set the validity period threshold of the unique identifier and dynamically adjust it based on the change rate of the operating status of the aluminum extruder. When the change of any sensor data exceeds the preset threshold, the identifier is triggered to be regenerated. Lightweight hash chain technology is used in the process of triggering the regeneration of the identifier to ensure that the old and new identifiers are traceable and cannot be tampered with.

[0053] Step S15, Identifier Verification Based on Zero-Trust Architecture: A lightweight authentication module is deployed on the host computer to perform real-time verification of the received unique identifier. Verification includes checking the hash consistency of the unique identifier and the physical plausibility of the associated sensor data. When verification fails, an alarm is triggered and suspicious device traffic is isolated. In step S15, real-time verification of the unique identifier primarily checks whether its historical chain head matches, ensuring the hash consistency of the unique identifier. The physical plausibility of the associated sensor data refers to whether the vibration frequency is within the normal range of the aluminum extrusion machine.

[0054] Step S16, Cross-device Association Analysis and Topology Construction: Utilizing the source / destination IP and port in the message header fields, a communication relationship graph between industrial devices is constructed. Unique identifiers are mapped to graph nodes, and roles are labeled based on device type. Anomaly communication is analyzed based on the graph, and a security audit log is generated. In step S16, device types include aluminum extrusion presses, PLC devices, etc., and abnormal communication could be an extrusion press's unconventional access to external devices on the host computer.

[0055] The extended technical solutions provided in steps S14 to S16 achieve dynamic security protection on the basis of the original static identifier system. They add dynamic identifier update and zero-trust verification functions, which can more effectively resist APT attacks. They also realize the coordinated cooperation between industrial network status and network devices, and can link the physical status of devices (vibration, temperature) and network behavior (communication topology) for abnormal detection. They have strong scalability, are compatible with multiple industrial protocols (Modbus / TCP, PROFINET), and can be integrated into existing industrial security platforms (such as SIEM systems).

[0056] like Figure 3 As shown, preferably, in step S2, the message payload portion is extracted from the industrial data stream, the network traffic characteristics of the message payload portion are obtained, and a hash operation is performed on the unique identifier and the network traffic characteristics to generate first traffic fingerprint data, further including:

[0057] Step S21: Obtain industrial data stream from the acquisition terminal. The industrial data stream includes control commands, status information, and sensor data of the industrial equipment.

[0058] Step S22: Parse the industrial data stream to obtain the message payload of the industrial data stream data packet, and extract the network traffic characteristics in the message payload.

[0059] Step S23: Convert network traffic features into structured data, perform a hash operation on the structured data and a unique identifier to generate first traffic fingerprint data, which is a fixed-length hash value.

[0060] The optimized technical solutions provided in steps S21 to S23 extract network traffic characteristics by parsing the packet payload of industrial data streams and combining them with the device's unique identifier (such as IP address, MAC address, etc.) to generate a fixed-length first traffic fingerprint data through a hash operation. During the generation of the first traffic fingerprint data, diverse industrial data streams containing control commands, status information, and sensor data are collected. Then, the payload portion of the data packets is parsed to extract key network traffic characteristics. Finally, the structured traffic characteristics are fused with the device's unique identifier, and a unique and irreversible traffic fingerprint is generated through a hash algorithm. The optimized technical solutions provided in steps S21 to S23 ensure data integrity, enhance the correlation between industrial equipment and industrial network traffic, and achieve lightweight security identification operations. Compared to existing technologies that rely solely on header fields, this implementation also extracts message payload features. By covering the actual content of industrial data streams (such as control commands and sensor values) with message payload features, it ensures that the fingerprint can reflect the real device behavior and data interaction patterns. Finally, the unique identifier is combined with traffic features through a hash operation to generate a device-level traffic fingerprint, achieving precise binding between network traffic and physical devices. In the process of identifying APT attacks, it can pinpoint specific individual industrial devices in the industrial network.

[0061] It can be seen that the optimization solutions provided in steps S21 to S23 construct a traffic fingerprint system that combines industrial network identity authentication and behavioral trust by fusing the hash algorithm of "load characteristics + device identifier". This provides a lightweight and highly reliable technical foundation for the security audit and anomaly monitoring of industrial networks.

[0062] like Figure 4 As shown, preferably, in step S3, the first traffic fingerprint data is dimensionality-reduced based on the temporal characteristics of the traffic fingerprint, and the dimensionality-reduced first traffic fingerprint data is sent to the pattern recognition engine to generate second traffic fingerprint data. The pattern recognition engine is used to identify the behavioral patterns of the first traffic fingerprint data, and further includes:

[0063] Step S31 involves extracting a subset of time-related features from the first traffic fingerprint data and performing dimensionality reduction on the time feature subset. In step S31, the feature subset may include the arrival time interval of data packets, the duration of a flow, the start and end times of a session, etc. A preset dimensionality reduction algorithm may be used, such as Principal Component Analysis (PCA), Linear Discriminant Analysis (LDA), or an autoencoder, etc., thereby reducing data dimensionality while retaining the time-related feature subset.

[0064] Step S32: The dimensionality-reduced first traffic fingerprint data is sent to the pattern recognition engine, which is equipped with anomaly traffic data labels. The functions of these labels include: training the machine learning model by generating a large amount of labeled data; clearly indicating which traffic is normal and which is abnormal or malicious, thus helping the model learn to distinguish different types of traffic characteristics, improving the accuracy and generalization ability of the pattern recognition engine, and helping the model better understand the characteristics of abnormal traffic, thereby more accurately identifying new and unknown abnormal traffic in practical applications.

[0065] Step S33: The first traffic fingerprint data generates a multi-dimensional array in the pattern recognition engine. Each dimension of the multi-dimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data. A corresponding specific traffic feature vector is generated based on the specific traffic feature value. For example, the specific traffic features include: data packet size, data packet transmission time interval, and data packet traffic duration.

[0066] Step S34: The pattern recognition engine performs similarity analysis on specific traffic feature vectors based on a preset feature traffic template, and detects abnormal patterns in the specific traffic feature vectors through clustering algorithms or deep learning algorithms. For example, the preset feature traffic module includes normal traffic samples and known abnormal traffic.

[0067] The optimization solutions provided in steps S31 to S34 perform dynamic behavior analysis on the first traffic fingerprint data through time feature dimensionality reduction and pattern recognition engine, thereby realizing the anomaly detection and classification of industrial network traffic. Time-related features (such as packet interval, session time, etc.) are extracted from the first traffic fingerprint data. The data dimension is compressed through algorithms such as PCA / LDA, and key time-series patterns are preserved while performing time feature dimensionality reduction. The dimensionality-reduced data is then input into the pattern recognition engine and transformed into a multi-dimensional feature vector. Similarity matching is performed with preset traffic templates (normal samples and abnormal samples) to identify potential attacks (such as DDoS and port scanning), thus realizing the abnormal pattern recognition function.

[0068] The optimized technical solutions provided in steps S31 to S34 extract a subset of time features (such as packet arrival intervals and session durations) to focus on dynamic traffic behavior, avoiding the limitations of static traffic fingerprint data. They also remove redundant information through dimensionality reduction processing (PCA / LDA) to reduce computational complexity, while retaining key time-series patterns to improve the efficiency and accuracy of subsequent analysis. Finally, the traffic fingerprint is transformed into a multi-dimensional feature vector, and anomalies are identified from multiple dimensions using clustering or deep learning algorithms, avoiding misjudgments based on a single indicator and supporting rapid alarms and interception. Furthermore, the modular design (preset templates, updatable algorithms) supports rapid adaptation to new attack patterns without requiring system reconstruction, reducing the computational load on the pattern recognition engine and adapting to resource-constrained industrial equipment scenarios. This upgrades traffic fingerprints from static identifiers to dynamic behavioral profiles, achieving high-precision anomaly detection while ensuring real-time performance, providing industrial networks with efficient and intelligent security protection capabilities.

[0069] For example, a pattern recognition engine may be a support vector machine (SVM) pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network (CNN) pattern recognition engine, a recurrent neural network (RNN) pattern recognition engine, or a variant of a long short-term memory network (LSTM) pattern recognition engine.

[0070] like Figure 5 As shown, preferably, in step S4, based on known malicious traffic samples, a corresponding malicious traffic identification identifier is set, and the probabilistic statistical characteristics of the malicious traffic are obtained through the malicious traffic identification identifier to form a traffic fingerprint probability distribution model with malicious traffic characteristics. The second traffic fingerprint data is input into the traffic fingerprint probability distribution model to identify whether an APT attack exists. This further includes:

[0071] Step S41: Construct a malicious traffic feature model based on statistical analysis methods, calculate the probability distribution of the traffic fingerprint of malicious traffic features, and form a probability distribution model for characterizing malicious traffic features.

[0072] Step S42: Input the second traffic fingerprint data into the traffic fingerprint probability distribution model for matching, calculate the malicious traffic feature probability value of the data packet in the second traffic fingerprint data, and compare the malicious traffic feature probability value with the probability distribution model.

[0073] Step S43: If the probability value of malicious traffic features is higher than the preset probability threshold of malicious traffic features, it is determined that there is malicious traffic in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

[0074] The optimized technical solution provided in steps S41 to S43 detects and identifies malicious traffic in network traffic by constructing a probability distribution model of malicious traffic characteristics, and further determines whether there is an advanced persistent threat (APT) attack. By statistically analyzing the characteristics of malicious traffic, a probability distribution model is formed. Then, the fingerprint data of the traffic to be detected is matched with the model to calculate the probability value of the malicious traffic characteristics. By setting a threshold, it is determined whether there is malicious traffic, and finally, the accurate identification and marking of APT attacks are achieved.

[0075] The optimized technical solutions provided in steps S41 to S43 can accurately identify malicious traffic, effectively detect APT attacks, improve detection efficiency and reliability, and adapt to dynamically changing network environments. By constructing a probability distribution model of malicious traffic characteristics, it is possible to quantitatively analyze malicious behavior in network traffic, capture the statistical characteristics of malicious traffic, and assess the degree of malice of traffic by calculating probability values. Compared with traditional rule-based detection methods, it can more accurately identify malicious traffic hidden in normal traffic, especially those disguised or mutated malicious behaviors. In the process of detecting APT attacks, considering the characteristics of APT attacks such as strong concealment, long duration, and complex attack methods, by comparing the probability value of malicious traffic characteristics with preset thresholds, it is possible to quickly determine whether an APT attack exists. It can quickly filter out suspicious traffic from massive amounts of network traffic and mark it as an APT attack, providing timely early warning and response basis for network security protection.

[0076] The optimized technical solutions provided in steps S41 to S43, through statistical analysis and probabilistic models, avoid the complexity of analyzing each data packet individually, greatly improving detection efficiency. By setting reasonable thresholds, the sensitivity and accuracy of detection can be balanced, ensuring stability and effectiveness. The probability distribution model based on statistical analysis can dynamically reflect the characteristic changes of malicious traffic and has a certain degree of adaptability. By regularly updating the malicious traffic characteristic model, it is possible to better cope with new attacks and constantly evolving network threats.

[0077] In summary, the optimized technical solutions provided in steps S41 to S43 achieve accurate identification of malicious traffic and effective detection of APT attacks by constructing a probability distribution model of malicious traffic characteristics. The technical effects are reflected in improving the accuracy, efficiency and reliability of malicious traffic detection, while also being able to adapt to dynamically changing network environments.

[0078] like Figure 6 As shown, for example, in step S41, constructing a malicious traffic feature model based on statistical analysis methods further includes:

[0079] Step S411: Obtain the data packet size characteristics of the second traffic fingerprint, calculate the mean, variance and standard deviation of the data packets, and form a probability density function of malicious traffic size based on data packet size;

[0080] Step S412: Obtain the data packet sending interval of the second traffic fingerprint, and calculate the malicious traffic sending interval probability density function in the malicious traffic feature model based on the data packet interval.

[0081] Step S413: Based on the probability density functions of malicious traffic size and malicious traffic transmission interval over multiple periods, compare the chi-square values ​​of the two functions and the corresponding chi-square statistics. Determine the probability density function whose chi-square value is less than the chi-square statistics as the optimal fit probability density function. The probability density function for malicious traffic size uses a Gaussian distribution model, and the probability density function for malicious traffic transmission interval uses an exponential distribution model.

[0082] Step S414: Identify the presence of APT attacks using the optimal fit probability density function.

[0083] The optimization solutions provided in steps S411 to S413 construct a malicious traffic characteristic model using statistical analysis methods. They utilize the statistical characteristics of packet size and transmission interval to identify malicious traffic and further determine whether an APT attack exists. The specific steps in steps S411 to S413 include extracting packet size features, extracting packet transmission interval features, optimizing the model, and identifying APT attacks, etc. Steps S411 to S413 extract two key features—packet size and transmission interval—and model them using Gaussian and exponential distributions respectively. This accurately characterizes the behavioral features of malicious traffic from a statistical perspective, effectively distinguishing between normal and malicious traffic, because malicious traffic typically exhibits different statistical patterns in packet size and transmission interval compared to normal traffic.

[0084] Then, model optimization and fit evaluation are performed. By comparing the chi-square value and chi-square statistic, the probability density function with the best fit is selected to ensure that the model can more accurately reflect the real characteristics of malicious traffic, improve the reliability and accuracy of the model, and reduce the possibility of false positives and false negatives. The optimized probability density function is then used to identify malicious traffic, which can quickly determine whether there is an APT attack, quickly filter out suspicious traffic in network traffic, and mark it as an APT attack, thereby providing timely early warning and response basis for network security protection.

[0085] The optimized technical solutions provided in steps S411 to S413 can adapt to changes in malicious traffic characteristics under different network environments. By regularly updating the malicious traffic characteristic model (e.g., recalculating statistical parameters such as mean and variance), it can better cope with new attacks and constantly evolving network threats, effectively reducing the false positive rate. Compared with traditional rule-based detection methods, it avoids false positives caused by the limitations of rules. The statistical analysis-based method can more comprehensively consider the characteristics of malicious traffic, thereby improving the accuracy and reliability of detection. By optimizing the model and selecting the probability density function with the best fit, it improves the accuracy of malicious traffic detection, reduces the false positive rate, and can adapt to dynamically changing network environments, providing strong technical support for network security protection.

[0086] For the method steps disclosed in the above embodiments, the method steps are described as a series of actions for the purpose of simplicity. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of this application.

[0087] Any flowchart or other description of a process or method can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a specific logical function or process. Furthermore, the scope of preferred embodiments of this application includes additional implementations in which functions may be performed and implemented not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, or in accordance with program structures such as loops, branches, etc., to execute computer instructions and implement corresponding functions. This is something that those skilled in the art would readily understand when implementing embodiments of this application.

[0088] like Figure 7 As shown, this application embodiment also provides an APT defense system for aluminum extrusion presses based on flow fingerprint recognition, used to implement the APT defense method for aluminum extrusion presses based on flow fingerprint recognition in any specific embodiment of this application, including:

[0089] The industrial equipment unique identifier generation module is used to receive industrial data streams sent by the acquisition terminal, extract message header fields from the industrial data streams, identify the corresponding industrial equipment based on the message header fields, and generate a unique identifier for each industrial equipment.

[0090] The first traffic fingerprint data generation module is used to extract the message payload part from the industrial data stream, obtain the network traffic characteristics of the message payload part, perform a hash operation on the unique identifier and the network traffic characteristics, and generate the first traffic fingerprint data.

[0091] The second traffic fingerprint data generation module performs dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, and sends the dimensionality-reduced first traffic fingerprint data to the pattern recognition engine to generate the second traffic fingerprint data. The pattern recognition engine is used to identify the behavior patterns of the first traffic fingerprint data.

[0092] The APT attack identification module sets a corresponding malicious traffic identification identifier based on known malicious traffic samples, obtains the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifier, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists.

[0093] The implementation methods of the system described above are merely illustrative. For example, the various functional modules, units, or subsystems within the system may or may not be physically separate, or they may or may not be physical units; that is, they may be located in the same place or distributed across multiple different systems and their subsystems or modules. Those skilled in the art can select some or all of the functional modules, units, or subsystems to achieve the objectives of the embodiments of this application according to actual needs. Those skilled in the art can understand and implement the above-described situations without any creative effort.

[0094] It is worth noting that although only some basic functional modules are disclosed in this application embodiment, it does not mean that the composition of this system is limited to the above-mentioned basic functional modules. On the contrary, what this embodiment intends to express is that, based on the above-mentioned basic functional modules, those skilled in the art can arbitrarily add one or more functional modules in combination with existing technology to form an infinite number of embodiments or technical solutions. That is to say, this system is open rather than closed. The fact that this embodiment only discloses a few basic functional modules does not mean that the scope of protection of the claims of this application embodiment is limited to the disclosed basic functional modules. At the same time, for the convenience of description, the above device is described separately according to its functions as various units and modules. Of course, when implementing the embodiments of this application, the functions of each unit and module can be implemented in one or more software and / or hardware.

[0095] like Figure 8 As shown, this application embodiment, in addition to providing an APT defense method and system for aluminum extrusion machines based on traffic fingerprinting, also provides corresponding electronic devices and storage media:

[0096] An electronic device includes: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of an APT defense method for aluminum extrusion machines based on flow fingerprinting.

[0097] A computer-readable storage medium storing a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform the steps of an APT defense method for aluminum extrusion machines based on flow fingerprinting.

[0098] Explanation of reference numerals in the attached diagram: 801 - processor, 802 - memory, 803 - communication interface, 804 - bus, 8021 - program code.

[0099] Figure 8 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 8 As shown, device 800 includes a processor 801, a memory 802, a communication interface 803, and a bus 804. The processor 801, memory 802, and communication interface 803 communicate via bus 804, or via other means such as wireless transmission. The memory 802 stores instructions, and the processor 801 executes the instructions stored in the memory 802. The memory 802 stores program code 8021, and the processor 801 can call the program code 8021 stored in the memory 802 to execute the steps of the APT defense method for aluminum extrusion machines based on flow fingerprinting.

[0100] It should be understood that in the embodiments of this application, processor 801 may be a CPU, or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors may be microprocessors or any conventional processors, etc.

[0101] The memory 802 may include read-only memory (ROM) and random access memory (RAM), and provides instructions and data to the processor 801. The memory 802 may also include non-volatile random access memory. The memory 802 may be volatile memory or non-volatile memory, or may include both. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0102] In addition to the data bus, bus 804 may also include a power bus, a control bus, and a status signal bus. However, for clarity, all buses are labeled as bus 804 in the diagram.

[0103] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive (SSD).

[0104] It should be noted that the above embodiments are illustrative of the embodiments of this application and not limiting of the embodiments of this application, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Embodiments of this application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order and can be interpreted as names.

[0105] In the description of the embodiments of this application, the reference to terms such as "an embodiment," "example," "specific example," etc., means that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the embodiments of this application. In the description of the embodiments of this application, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0106] Furthermore, the technical solutions of the various implementation methods in this application can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the embodiments of this application.

[0107] All features disclosed in the embodiments of this application, or all steps in the disclosed methods or processes, may be combined in any way, except for mutually exclusive features and / or steps. Any feature disclosed in the specification of the embodiments of this application, unless specifically stated otherwise, may be replaced by other equivalent or similar alternative features. That is, unless specifically stated otherwise, each feature is merely one example of a series of equivalent or similar features. Throughout the specification, the same reference numerals indicate the same elements.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of this application, and are not intended to limit them. Although the embodiments of this application have been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein, and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the specific implementation methods of the embodiments of this application.

Claims

1. A method for APT defense in aluminum extrusion presses based on flow fingerprinting, characterized in that, include: Receive industrial data streams sent by the acquisition terminal, extract message header fields from the industrial data streams, identify the corresponding industrial equipment based on the message header fields, and generate a unique identifier for each industrial equipment; Extract the message payload portion from the industrial data stream, obtain the network traffic characteristics of the message payload portion, perform a hash operation on the unique identifier and the network traffic characteristics, and generate the first traffic fingerprint data. The first traffic fingerprint data is dimensionality reduced based on the time characteristics of the traffic fingerprint. The dimensionality-reduced first traffic fingerprint data is then sent to the pattern recognition engine to generate the second traffic fingerprint data. The pattern recognition engine is used to identify the behavior patterns of the first traffic fingerprint data. Based on known malicious traffic samples, a corresponding malicious traffic identification identifier is set, and the probabilistic statistical characteristics of malicious traffic are obtained through the malicious traffic identification identifier to form a traffic fingerprint probability distribution model with malicious traffic characteristics. The second traffic fingerprint data is input into the traffic fingerprint probability distribution model to identify whether an APT attack exists.

2. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 1, characterized in that, The receiving and acquisition terminal sends an industrial data stream, extracts message header fields from the industrial data stream, identifies the corresponding industrial equipment based on the message header fields, and generates a unique identifier for each industrial equipment, further including: The data acquisition terminal is deployed in an industrial network environment, and an aluminum extrusion machine is set up in the industrial network environment. The aluminum extrusion machine is connected to the host computer. The host computer receives industrial data streams from the acquisition terminal and extracts the header fields of the industrial data streams. The header fields include industrial data source information and industrial data target information. The host computer acquires the network identification information of the acquisition terminal, generates the corresponding identifier of the industrial equipment based on the network identification information, associates the identifier with the operating status of the aluminum extrusion press, and generates a corresponding unique identifier based on the temperature value, pressure value and vibration frequency of the aluminum extrusion press.

3. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 1, characterized in that, The step of extracting the message payload portion from the industrial data stream, obtaining the network traffic characteristics of the message payload portion, and performing a hash operation on the unique identifier and the network traffic characteristics to generate first traffic fingerprint data further includes: Acquire industrial data streams from the acquisition terminal, the industrial data streams including control commands, status information, and sensor data of industrial equipment; The industrial data stream is parsed to obtain the message payload portion of the industrial data stream data packets, and network traffic features in the message payload portion are extracted. The network traffic characteristics are converted into structured data, and the structured data is hashed with the unique identifier to generate first traffic fingerprint data, which is a fixed-length hash value.

4. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 1, characterized in that, The step of performing dimensionality reduction processing on the first traffic fingerprint data based on the temporal characteristics of the traffic fingerprint, and sending the dimensionality-reduced first traffic fingerprint data to the pattern recognition engine to generate second traffic fingerprint data, wherein the pattern recognition engine is used to identify the behavioral patterns of the first traffic fingerprint data, further includes: Extract a subset of time features related to time characteristics from the first traffic fingerprint data, and perform dimensionality reduction processing on the subset of time features; The first traffic fingerprint data after dimensionality reduction is sent to the pattern recognition engine, in which abnormal traffic data labels are set. The first traffic fingerprint data generates a multi-dimensional array in the pattern recognition engine. Each dimension of the multi-dimensional array corresponds to a specific traffic feature value of the first traffic fingerprint data. A corresponding specific traffic feature vector is generated based on the specific traffic feature value. The pattern recognition engine performs similarity analysis on the specific traffic feature vector based on a preset feature traffic template, and detects abnormal patterns in the specific traffic feature vector through clustering algorithms or deep learning algorithms.

5. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 4, characterized in that, The pattern recognition engine specifically refers to: a support vector machine pattern recognition engine, a random forest pattern recognition engine, a convolutional neural network pattern recognition engine, a recurrent neural network pattern recognition engine, or a variant long short-term memory network pattern recognition engine.

6. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 1, characterized in that, The step of setting corresponding malicious traffic identification identifiers based on known malicious traffic samples, obtaining probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifiers, forming a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputting the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists, further includes: A malicious traffic feature model is constructed based on statistical analysis methods, and the probability distribution of the traffic fingerprint of malicious traffic features is calculated to form a probability distribution model for characterizing malicious traffic features. The second traffic fingerprint data is input into the traffic fingerprint probability distribution model for matching, the malicious traffic feature probability value of the data packet in the second traffic fingerprint data is calculated, and the malicious traffic feature probability value is compared with the probability distribution model. If the probability value of malicious traffic features is higher than the preset probability threshold of malicious traffic features, it is determined that there is malicious traffic in the second traffic fingerprint data, and the second traffic fingerprint data containing malicious traffic is marked as an APT attack.

7. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 6, characterized in that, The malicious traffic feature model constructed based on statistical analysis methods further includes: Obtain the packet size characteristics of the second traffic fingerprint, calculate the mean, variance and standard deviation of the packets, and form a probability density function of malicious traffic size based on packet size; Obtain the packet sending interval time of the second traffic fingerprint, and calculate the malicious traffic sending interval probability density function in the malicious traffic feature model based on the packet sending interval time; Based on the probability density function of the malicious traffic size and the probability density function of the malicious traffic sending interval within multiple periods, compare the chi-square values ​​of the two and the chi-square statistic corresponding to the chi-square values, and determine the probability density function whose chi-square value is less than the chi-square statistic as the optimal fit probability density function. The existence of APT attacks is identified by using the optimal fit probability density function.

8. The APT defense method for aluminum extrusion presses based on flow fingerprint recognition according to claim 7, characterized in that, The probability density function for the size of the malicious traffic adopts a Gaussian distribution model, and the probability density function for the interval between malicious traffic transmissions adopts an exponential distribution model.

9. An APT defense system for aluminum extrusion presses based on flow fingerprint recognition, characterized in that, A method for implementing APT defense against aluminum extrusion presses based on flow fingerprinting includes: The industrial equipment unique identifier generation module is used to receive industrial data streams sent by the acquisition terminal, extract message header fields from the industrial data streams, identify the corresponding industrial equipment based on the message header fields, and generate a unique identifier for each industrial equipment. The first traffic fingerprint data generation module is used to extract the message payload part from the industrial data stream, obtain the network traffic characteristics of the message payload part, perform a hash operation on the unique identifier and the network traffic characteristics, and generate the first traffic fingerprint data. The second traffic fingerprint data generation module performs dimensionality reduction processing on the first traffic fingerprint data based on the time characteristics of the traffic fingerprint, and sends the dimensionality-reduced first traffic fingerprint data to the pattern recognition engine to generate the second traffic fingerprint data. The pattern recognition engine is used to identify the behavior patterns of the first traffic fingerprint data. The APT attack identification module sets a corresponding malicious traffic identification identifier based on known malicious traffic samples, obtains the probabilistic statistical characteristics of malicious traffic through the malicious traffic identification identifier, forms a traffic fingerprint probability distribution model with malicious traffic characteristics, and inputs the second traffic fingerprint data into the traffic fingerprint probability distribution model to identify whether an APT attack exists.

10. An electronic device, characterized in that, include: The system includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus; the memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of the method according to any one of claims 1 to 8.

Images