Industrial internet-oriented security authentication method and system

Abstract

The invention provides a security authentication method and system for an industrial internet. The method comprises the following steps: acquiring industrial protocol instruction stream data, extracting a time window protocol field, generating a spatial-temporal feature tensor in combination with a hierarchical structure, constructing an instruction stream, and obtaining a dynamic behavior baseline; capturing protocol field dynamic dependence through long sequence correlation analysis and a multi-head attention mechanism, and generating a semantic analysis result; matching a baseline time sequence weight to output a security authentication result, and performing parallel splitting correlation analysis to generate window parameters for the sub-task queues; and triggering real-time blocking when the calculated safety deviation exceeds a threshold value, and synchronously adjusting a time sequence weight and a hierarchical rule to form a closed loop. According to the invention, real-time blocking and closed-loop defense of instruction stream threats are realized, the industrial protocol analysis precision and the security baseline adaptive capability are improved, and the dynamic reliability of a control system is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of security authentication technology, and in particular to a security authentication method and system for the industrial Internet. Background Art

[0002] In the Industrial Internet environment, the secure authentication of real-time instruction streams must meet the requirements of low latency, high reliability, and strong anti-attack capabilities. Industrial control systems (such as those in power, manufacturing, and transportation) rely on millisecond-level instruction interactions, requiring authentication mechanisms to protect against threats such as forged instructions and man-in-the-middle attacks while also being compatible with heterogeneous device protocols and avoiding the degradation of real-time performance caused by complex authentication processes. Furthermore, the network environment at industrial sites is complex and ever-changing (e.g., hybrid wired / wireless networking and limited edge node resources), requiring authentication methods to be both lightweight and dynamically adaptable.

[0003] The current mainstream targeted solution is an authentication mechanism based on lightweight dynamic tokens. This solution generates dynamic tokens using a pre-shared key or device characteristics. During command transmission, the control and controlled terminals synchronously calculate and verify the tokens in real time. For example, using hash chain technology, each command interaction uses a pre-generated hash value sequence as a dynamic credential. The verifier uses a one-way hash function to quickly verify the legitimacy of the token. This solution avoids the complex negotiation process of traditional digital certificates and supports microsecond token generation and verification, making it suitable for real-time command flow scenarios. Summary of the Invention

[0004] This application provides a security authentication method and system for the industrial Internet, which is used to solve the problems of delayed dynamic threat identification of industrial protocols and rigid security authentication mechanisms in the existing technology.

[0005] In the first aspect, this application provides a security authentication method for the Industrial Internet, including:

[0006] Collect instruction stream data from industrial internet protocols, extract protocol fields within a time window of the instruction stream data, and generate a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. Construct an industrial control instruction stream based on the spatiotemporal feature tensor and obtain a dynamic behavior baseline for the industrial control instruction stream.

[0007] Performing a correlation analysis on a long sequence of the industrial control instruction stream across the hierarchical structure, capturing dynamic dependencies between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combining the correlation analysis results with the dynamic dependencies to generate a semantic parsing result of the industrial control instruction stream;

[0008] Obtaining a timing regularity weight of the dynamic behavior baseline, and performing a matching calculation between the semantic parsing result and the timing regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow;

[0009] Parallel processing is performed on the process of correlation analysis of the long sequence, wherein the parallel processing divides the correlation analysis of the long sequence into multiple subtask queues executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues;

[0010] The deviation between the security authentication result and the dynamic behavior baseline is calculated. When the deviation exceeds a preset security threshold, a real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter, and the association rule between the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism.

[0011] Optionally, command stream data in an industrial Internet protocol is collected, and protocol fields within a time window of the command stream data are extracted. A spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operation is generated based on the hierarchical structure of the protocol fields. An industrial control command stream is constructed based on the spatiotemporal feature tensor, and a dynamic behavior baseline of the industrial control command stream is obtained, including:

[0012] Collecting continuously transmitted instruction stream data in the industrial Internet protocol, intercepting the instruction stream data according to fixed time windows, and grouping the protocol fields in each time window according to functional categories in a hierarchical structure to form a set of protocol fields with hierarchical labels;

[0013] Obtaining the subordinate relationships of different functional categories in the hierarchical structure, and vertically arranging the fields in the protocol field set according to the depth of the hierarchy according to the subordinate relationships to generate an initial spatiotemporal feature tensor;

[0014] Extracting the operation interval period of the protocol field at the same level in the initial spatiotemporal feature tensor and the repetition frequency in adjacent time windows, and superimposing and calculating the operation interval period and the repetition frequency to generate a spatiotemporal feature tensor reflecting the timing regularity of the industrial equipment operation;

[0015] horizontally splicing the timing patterns corresponding to different levels in the spatiotemporal feature tensor to generate an industrial control instruction stream describing the operation of industrial equipment, wherein the instruction stream includes the conditional relationships and time constraints for triggering operations between the levels;

[0016] The distribution range of the number of times the protocol field at each level in the industrial control instruction stream is triggered within a time window is counted, and a dynamic behavior baseline is obtained according to the distribution range.

[0017] Optionally, a correlation analysis is performed on the industrial control instruction stream across a long sequence of the hierarchical structure, and a dynamic dependency relationship between different protocol fields in the industrial control instruction stream is captured through a multi-head attention mechanism. The semantic parsing result of the industrial control instruction stream is generated by combining the result of the correlation analysis and the dynamic dependency relationship, including:

[0018] Extracting the hierarchical depths of different protocol fields in the industrial control instruction stream, splitting the industrial control instruction stream into a plurality of vertically associated hierarchical channels according to the hierarchical depths, and reorganizing the hierarchical channels to form a long sequence of data blocks spanning the hierarchical structure;

[0019] For each long sequence data block, separate parallel processing paths are set. The continuous time sequence length of the protocol field is counted within the hierarchical channels of the same processing path. The number of cross-layer triggers is counted between the hierarchical channels of different processing paths. Based on the continuous time sequence length and the number of cross-layer triggers, a local attention distribution reflecting the strength of the relationship between the protocol fields is generated.

[0020] The local attention distributions are superimposed to screen protocol field pairs with high correlation across hierarchies. The triggering sequence and hierarchical span of all protocol field pairs are integrated to form correlation analysis results.

[0021] The multi-head attention mechanism is used to capture the dynamic dependencies between different protocol fields in the industrial control instruction stream, and the fluctuation range of highly correlated protocol field pairs in the dynamic dependencies is captured. The fluctuation range is then associated with the hierarchical depth to generate trigger constraint rules that describe the response relationship between the protocol fields.

[0022] The correlation analysis result is combined with the trigger constraint rule to generate a semantic parsing result of the industrial control instruction flow.

[0023] Optionally, separate parallel processing paths are set for each long sequence data block, the continuous time sequence length of the protocol field appearing in the hierarchical channel of the same processing path is counted, and the number of cross-layer triggerings between the hierarchical channels of different processing paths is counted. Based on the continuous time sequence length and the number of cross-layer triggerings, a local attention distribution reflecting the strength of the relationship between the protocol fields is generated, including:

[0024] Split the long sequence data block into multiple parallel processing paths according to the hierarchical channels of the protocol fields, each processing path corresponds to a set of protocol fields of a single hierarchical channel, and mark a continuous time window for each processing path;

[0025] In a hierarchical channel of a single parallel processing path, counting the number of consecutive occurrences of a protocol field and the time span of adjacent protocol fields, and recording the number and time span as a continuous timing length parameter set of the same hierarchical channel;

[0026] Counting the cross-layer number and trigger interval of protocol field pairs triggered across layers between layer channels of different parallel processing paths, and recording the cross-layer number and trigger times as a cross-layer triggering number parameter set;

[0027] The continuous timing length parameter set and the cross-layer trigger number parameter set of the same-level channel are aligned according to the time window according to the trigger, and the continuous number and the cross-level number are superimposed to generate a local attention distribution that reflects the strength of the relationship between the protocol fields.

[0028] Optionally, obtaining a temporal regularity weight of the dynamic behavior baseline, and performing a matching calculation between the semantic parsing result and the temporal regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow includes:

[0029] Extracting the fluctuation range of the operation cycle and the distribution interval of the trigger times of each protocol field within the time window from the dynamic behavior baseline, and calculating the time series regularity weight of the dynamic behavior baseline based on the fluctuation range and the distribution interval;

[0030] Convert the dynamic dependency between protocol fields in the semantic parsing results into a trigger sequence table spanning the hierarchical structure, and mark the time intervals between adjacent protocol fields in the trigger sequence table as timeline matching points;

[0031] Obtaining the actual interval of the time axis matching point, and matching and comparing the actual interval with the timing regularity weight of the corresponding protocol field in the dynamic behavior baseline. When the actual interval exceeds the threshold of the fluctuation range, it is marked as a hierarchical path abnormal parameter;

[0032] The number of consecutive deviations of abnormal path parameters at each level in the time axis matching point is counted, and the security authentication result of the industrial control instruction flow is generated according to the ratio of the consecutive deviation number to the threshold value of the fluctuation range.

[0033] Optionally, the process of the long sequence correlation analysis is processed in parallel, wherein the parallel processing splits the long sequence correlation analysis into multiple subtask queues to be executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues, including:

[0034] Based on the hierarchical structure of protocol fields in industrial control instruction streams, the correlation analysis of long sequences is split into multiple subtask queues, where each subtask queue corresponds to the trigger path of protocol fields of a specific hierarchical combination, and a time window is set for each subtask queue;

[0035] In the hardware acceleration architecture, an independent processing node is allocated to each subtask queue, and synchronization signal points are inserted between the processing nodes to align the progress of the time windows of each subtask queue, so as to ensure that the analysis of the trigger paths of all subtask queues is in the same time stage;

[0036] The cross-level protocol field trigger path analysis in the subtask queue is executed in parallel by each processing node to generate the time window parameter of the industrial control instruction flow.

[0037] Optionally, a deviation between the security authentication result and the dynamic behavior baseline is calculated. When the deviation exceeds a preset security threshold, a real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter. The association rule between the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism, including:

[0038] Extracting the timing regularity weight corresponding to each protocol field from the dynamic behavior baseline, and parsing abnormal parameters in the security authentication result;

[0039] Calculate the deviation value set between the actual operation cycle of each abnormal parameter and the boundary value of the corresponding timing regularity weight;

[0040] Comparing the deviation of each time point in the deviation value set with a preset safety threshold, when the deviation of consecutive time points exceeds the threshold, intercepting the protocol field of the corresponding time period in the industrial control instruction stream based on the time window parameter, and marking the protocol field as the trigger range of the real-time blocking action;

[0041] Locate the hierarchical source of the protocol field with the deviation within the trigger range, trace back to the association rule of the dynamic behavior baseline based on the hierarchical path of the source, narrow the boundary value range of the operation cycle of the timing regularity weight at the hierarchy, and compress the distribution range of the trigger number;

[0042] The reduced operation cycle boundary value and the compressed distribution interval are reversely injected into the association rules of the dynamic behavior baseline, and the triggering sequence constraints of the hierarchical structure are updated to form a closed-loop mechanism.

[0043] Secondly, this application provides a security authentication system for the Industrial Internet, including:

[0044] An acquisition module is configured to collect instruction stream data from industrial internet protocols, extract protocol fields within a time window of the instruction stream data, and generate a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. An industrial control instruction stream is constructed based on the spatiotemporal feature tensor, and a dynamic behavior baseline of the industrial control instruction stream is obtained.

[0045] an analysis module for performing a correlation analysis on a long sequence of the industrial control instruction stream across the hierarchical structure, capturing dynamic dependencies between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combining the correlation analysis results with the dynamic dependencies to generate a semantic parsing result of the industrial control instruction stream;

[0046] a calculation module, configured to obtain a time sequence regularity weight of the dynamic behavior baseline, and perform a matching calculation between the semantic parsing result and the time sequence regularity weight of the dynamic behavior baseline, so as to output a security authentication result of the industrial control instruction flow;

[0047] a splitting module, configured to perform parallel processing on the long sequence correlation analysis process, wherein the parallel processing splits the long sequence correlation analysis into a plurality of subtask queues to be executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues;

[0048] A trigger module is used to calculate the deviation between the security authentication result and the dynamic behavior baseline. When the deviation exceeds a preset security threshold, a real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter, and the association rule of the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism.

[0049] In a third aspect, an embodiment of the present application provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a security authentication method for the industrial Internet as described in the first aspect above.

[0050] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements a security authentication method for the industrial Internet as described in the first aspect.

[0051] In the technical solution of this application, by collecting industrial Internet protocol instruction stream data and extracting protocol fields within the time window, and combining the hierarchical structure to generate spatiotemporal feature tensors, the timing laws of industrial equipment operations can be accurately characterized; the multi-head attention mechanism is used to analyze the correlation of long sequences, dynamically capture the dependencies between protocol fields, and combine dynamic behavior baselines for semantic parsing and security authentication to effectively identify abnormal instructions; the efficiency of long sequence analysis is optimized through parallel processing, and real-time blocking is achieved based on time window parameters. At the same time, the timing weights and association rules are dynamically adjusted to form an adaptive closed-loop security mechanism, thereby improving the anomaly detection capability and response speed of the industrial control system, ensuring the security and reliability of industrial Internet protocol communications, and reducing production risks caused by malicious attacks or misoperations.

[0052] By intercepting the industrial Internet protocol instruction stream data according to the time window, and grouping and vertically arranging the fields in combination with the protocol hierarchy structure, an initial spatiotemporal feature tensor is generated, which can accurately capture the hierarchical characteristics of industrial control instructions; further extracting the operation interval period and repetition frequency of the fields at the same level, and superimposing the calculation to form a spatiotemporal feature tensor reflecting the timing rules of the equipment, thereby enhancing the characterization ability of the operation mode of industrial equipment; by horizontally splicing the timing rules of different levels, an industrial control instruction stream containing trigger conditions and time constraints is constructed, and a dynamic behavior baseline is generated in combination with the distribution range of the number of triggers, thereby realizing refined modeling and anomaly detection of industrial control instructions, improving the security of the industrial Internet protocol, ensuring the compliance and stability of equipment operation, and effectively preventing system risks caused by malicious attacks or abnormal instructions.

[0053] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0055] Figure 1 A flowchart of a security authentication method for the industrial Internet provided by this application is shown;

[0056] Figure 2 A scenario diagram of a security authentication method for the Industrial Internet provided by this application is shown;

[0057] Figure 3 A scenario diagram of a security authentication method for the Industrial Internet provided by this application is shown;

[0058] Figure 4 The following is a schematic diagram showing the structure of a security authentication system for the Industrial Internet provided by this application;

[0059] Figure 5 A schematic structural diagram of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0060] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0061] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0062] Research has found that while current industrial Internet instruction stream authentication technologies achieve rapid verification through lightweight dynamic token mechanisms, their core limitations lie in the inadequate compatibility of static token generation rules with dynamic industrial protocol semantics, and weak protection of contextual relevance for long-term instruction streams. While token authentication based on pre-shared keys or hash chains can reduce computational latency, their single-dimensional credential generation mechanisms struggle to capture the dynamic interaction characteristics of multi-level fields in industrial protocols. Attackers can exploit legitimate combinations of protocol fields to forge malicious instructions that are "syntactically compliant but semantically anomalous" (e.g., tampering with device status codes to trigger unexpected operations), and traditional token authentication offers significant deficiencies in its ability to protect against such advanced threats. Furthermore, existing solutions lack cross-level correlation analysis for long instruction streams, resulting in insufficient real-time detection accuracy for intermittent anomalous instructions (e.g., periodically injecting minute offset parameters to gradually destabilize device stability). Furthermore, centralized authentication computing models are prone to system-level chain reactions due to processing delays in high-concurrency instruction scenarios.

[0063] In response to the above challenges, the present invention proposes a dynamic authentication method for industrial instruction streams based on spatiotemporal feature tensors and closed-loop weight adjustment. Its innovation lies in: through the deep integration of protocol semantic analysis and long-sequence correlation parallel computing, a "syntax-semantics-behavior" three-layer collaborative active defense system is constructed. Specifically, based on the industrial protocol hierarchical structure, spatiotemporal feature tensors are extracted to characterize the timing rules and device operation baselines of the instruction stream; further, a multi-head attention mechanism is used to parse the dynamic dependencies across protocol fields, generate semantic fingerprints of the instruction stream and match them with the behavioral baseline in real time, realizing the upgrade from "single-point token verification" to "contextual semantic authentication". At the same time, through the parallel task splitting of long-sequence correlation analysis and the synchronization of time window parameters, the end-to-end delay of complex instruction stream processing is significantly reduced; more importantly, a deviation-driven closed-loop weight adjustment mechanism is introduced. When the authentication result deviates from the security threshold, the protocol hierarchy association rules and timing weights are dynamically reconstructed to block the attack chain while realizing the adaptive evolution of the defense strategy. This approach transcends the static protection boundaries of traditional dynamic tokens: First, spatiotemporal feature tensors and semantic parsing techniques accurately identify hidden attack intent within protocol field combinations, defending against semantic-level threats that traditional solutions cannot detect. Second, a parallel computing framework and time window optimization strategy support full-scale correlation analysis of high-throughput instruction streams while ensuring millisecond-level responsiveness, balancing low latency with high reliability. Furthermore, a closed-loop weight adjustment mechanism strengthens the system's resilience to attacks through real-time feedback, forming an integrated "detection-blocking-self-healing" protection closed loop. This provides a solution that combines strong anti-attack and dynamic adaptability for real-time instruction stream security in the Industrial Internet environment.

[0064] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0065] Figure 1 A flowchart of a security authentication method for the industrial Internet is provided for the embodiment of the present application. Figure 1 As shown, the method includes:

[0066] 101. Collect instruction stream data in the industrial Internet protocol, wherein the instruction stream data includes the sending interval, register operation timing, and response delay parameters of the industrial equipment control instructions, and extract the protocol fields within the time window of the instruction stream data. Combined with the hierarchical structure of the protocol fields, a spatiotemporal feature tensor is generated that reflects the timing regularity of the industrial equipment operation. An industrial control instruction stream is constructed based on the spatiotemporal feature tensor, and a dynamic behavior baseline of the industrial control instruction stream is obtained.

[0067] Optionally, step 101 may specifically include the following steps:

[0068] 1011. Collect the instruction stream data that is continuously transmitted in the industrial Internet protocol, intercept the instruction stream data according to a fixed time window, and group the protocol fields in each time window according to the functional categories in the hierarchical structure to form a protocol field set with a hierarchical label.

[0069] 1012. Obtain the subordinate relationships of different functional categories in the hierarchical structure, and arrange the fields in the protocol field set vertically according to the depth of the hierarchy based on the subordinate relationships to generate an initial spatiotemporal feature tensor.

[0070] 1013. Extract the operation interval period of the protocol field at the same level in the initial spatiotemporal feature tensor and the repetition frequency in the adjacent time window, and superimpose the operation interval period and the repetition frequency to generate a spatiotemporal feature tensor that reflects the timing regularity of the industrial equipment operation.

[0071] 1014. Horizontally splice the timing patterns corresponding to different levels in the spatiotemporal feature tensor to generate an industrial control instruction stream describing the operation of industrial equipment. The instruction stream includes the conditional relationship and time constraints for triggering operations between each level.

[0072] 1015. Count the distribution range of the number of times the protocol field at each level in the industrial control instruction stream is triggered within a time window, and obtain a dynamic behavior baseline based on the distribution range.

[0073] In the above scheme, the Industrial Internet Protocol is a standardized communication specification for data exchange between industrial devices. Instruction stream data is a sequence of continuously transmitted control commands in the Industrial Internet Protocol. A time window is a time segment unit that intercepts instruction stream data at a fixed duration. Protocol fields are discrete data units with specific functions in the Industrial Internet Protocol. A hierarchical structure is a multi-level nested relationship in which protocol fields are divided by functional category. Functional category is a group identifier that classifies protocol fields according to industrial control functions. A hierarchically labeled protocol field set is a set of protocol field data grouped and labeled by functional category. Subordinate relationships are hierarchical affiliations between different functional categories. Vertical arrangement is the spatial arrangement of protocol fields organized in order of hierarchical depth. The initial spatiotemporal feature tensor is a spatiotemporal matrix of protocol fields arranged according to hierarchical subordinate relationships. The operation interval period is the time interval between the triggering of protocol fields at the same level. The repetition frequency is the number of recurrences of the same protocol field within adjacent time windows. Superposition computing is a method that combines the operation interval period and the repetition frequency. Time series regularity is the periodic characteristic exhibited by industrial equipment operations in the time dimension. Horizontal splicing is the spatial combination of timing patterns at different levels. Conditional relationships are the logical dependencies between triggers at different levels in the industrial control instruction flow. Time constraints are the timing constraints for triggering operations in the industrial control instruction flow. Trigger counts are the number of times a protocol field is executed within a time window. Distribution ranges are the numerical fluctuation range of the number of protocol field triggers. Dynamic behavior baselines are the standard reference ranges for the number of protocol field triggers at each level in the industrial control instruction flow.

[0074] In an embodiment of the present application, first, through step 1011, the system collects continuous instruction stream data (such as PLC control instructions and sensor response messages) from the industrial Internet protocol in real time, and intercepts data fragments according to a fixed time length (such as a window every 5 seconds). The protocol fields (such as register addresses, operation codes, and timestamps) within each time window are grouped according to functional categories (such as read and write operations, status queries, and alarm instructions) according to the hierarchical structure defined by the protocol (such as physical layer, control layer, and application layer), and a corresponding hierarchical label (such as "control layer-motor start and stop") is attached to each field to form a protocol field set with a classification label.

[0075] Subsequently, in step 1012, the dependencies between different functional categories in the protocol hierarchy are analyzed (e.g., application layer instructions are dependent on control layer signals), and the fields in the protocol field set are arranged vertically by hierarchy depth (e.g., the top layer is device status instructions, the bottom layer is register read and write operations), and the initial spatiotemporal feature tensor is generated through matrix processing. For example, the fields at the same level are arranged in chronological order as the rows of the matrix, with the hierarchy depth as the columns, to construct a three-dimensional data structure (time × hierarchy × field attributes).

[0076] Next, in step 1013, the operation interval period (e.g., the time difference between two register writes) and the repetition frequency (e.g., the number of triggers per second) of the same level field are extracted from the initial spatiotemporal feature tensor. These are then combined using a time series superposition algorithm (e.g., a Fourier transform within a sliding window) to generate a spatiotemporal feature tensor that reflects the timing regularity of device operation. For example, the periodic start and stop characteristics of motor control instructions are quantized as spectral peaks and combined with the random fluctuations of register operations.

[0077] Then, in step 1014, the timing patterns corresponding to different layers (e.g., periodicity at the control layer, burstiness at the application layer) are horizontally spliced ​​(e.g., matrix row expansion) and integrated into an industrial control instruction stream. The instruction stream clearly defines the trigger conditions at each layer (e.g., triggering an alarm layer instruction when sensor data exceeds a threshold) and time constraints (e.g., a control layer instruction must respond within 200ms of an application layer instruction), forming a complete operational logic chain.

[0078] Finally, in step 1015, the distribution range of the number of times the protocol fields at each level of the industrial control command stream are triggered within the time window is calculated (for example, control layer commands can be triggered 50-80 times per hour). Probability density estimation (such as kernel density analysis) is used to determine the fluctuation range of normal operation, thereby generating a dynamic behavior baseline that represents the normal behavior of the device. This baseline is used to identify abnormal commands or timing violations (such as response delays exceeding the baseline threshold) in subsequent real-time monitoring.

[0079] In practical applications, within the control network of stamping equipment in an automobile manufacturer, the system collects Modbus-TCP command stream data transmitted between the PLC and the robotic arm (step 1011). Protocol fields are intercepted and grouped according to time windows: pressure control parameters are classified as execution-layer functions, and coordinate adjustment commands are classified as driver-layer functions. Based on hierarchical subordination (step 1012), the execution-layer protocol fields are vertically arranged in the upper layer of the spatiotemporal feature tensor, while the driver-layer fields are placed in the lower layer, forming the initial spatiotemporal feature tensor. Analysis reveals that the operation interval period of the execution-layer pressure parameters is fixed, while the repetition frequency of the driver-layer coordinate commands varies dynamically with the switching of stamping dies (step 1013). This superposition generates a spatiotemporal feature tensor reflecting the coordinated rules between stamping cycle and coordinate calibration. The execution-layer and driver-layer timing patterns are then horizontally spliced ​​(step 1014) to construct an industrial control command stream containing the conditional relationship of "pressure threshold triggering coordinate fine-tuning." The upper limit of the number of triggers per hour of the execution layer protocol field and the fluctuation range of the driver layer instructions in the historical data are counted (step 1015) to establish a dynamic behavior baseline: when the pressure parameter trigger frequency exceeds the upper limit and the coordinate instruction response delay synchronization is abnormal, it is determined that the device control logic has been subjected to an injection attack, and the security authentication fuse mechanism is immediately triggered and the instruction stream dynamic signature verification is started to block the penetration path of unauthorized control instructions.

[0080] The overall solution in step 101 above achieves spatiotemporal feature modeling and dynamic baseline construction for industrial control instruction streams. Through hierarchical grouping and vertical arrangement of protocol fields, discrete industrial Internet protocol data is converted into spatiotemporal tensors with deep structural characteristics, accurately depicting the timing patterns of device operations. Based on the superposition of operation intervals and repetition frequencies, a time constraint relationship integrating hierarchical trigger logic is generated, constructing a multi-dimensional industrial control instruction stream description system. By statistically analyzing the distribution range of trigger counts, a dynamic behavioral baseline is established, overcoming the limitations of traditional static rule bases in capturing insufficient timing features and providing an adaptive benchmark for anomaly detection in industrial control instructions.

[0081] 102. Perform a correlation analysis on the long sequence of the industrial control instruction stream across the hierarchical structure, and capture the dynamic dependency between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combine the results of the correlation analysis and the dynamic dependency to generate a semantic parsing result of the industrial control instruction stream.

[0082] Optionally, step 102 may specifically include the following steps:

[0083] 1021. Extract the hierarchical depths of different protocol fields in the industrial control instruction stream, split the industrial control instruction stream into multiple vertically associated hierarchical channels according to the hierarchical depths, and reorganize the hierarchical channels to form a long sequence data block spanning the hierarchical structure.

[0084] 1022. Set separate parallel processing paths for each long sequence data block, count the continuous timing lengths of the protocol fields within the hierarchical channels of the same processing path, and count the number of cross-layer triggers between the hierarchical channels of different processing paths, and generate a local attention distribution reflecting the strength of the relationship between the protocol fields based on the continuous timing lengths and the number of cross-layer triggers.

[0085] Among them, step 1022 may specifically include the following processes: splitting the long sequence data block into multiple parallel processing paths according to the hierarchical channel of the protocol field, each processing path corresponds to the protocol field set of a single hierarchical channel, and marking a continuous time window for each processing path; within the hierarchical channel of a single parallel processing path, counting the consecutive number of times the protocol field appears and the time span of adjacent protocol fields, and recording the number and time span as a continuous timing length parameter set of the same hierarchical channel; between the hierarchical channels of different parallel processing paths, counting the cross-level number and trigger interval of the protocol field pairs triggered across levels, and recording the cross-level number and trigger number as a cross-layer trigger number parameter set; aligning the continuous timing length parameter set and the cross-layer trigger number parameter set of the same hierarchical channel according to the trigger according to the time window, and superimposing the consecutive number and the cross-level number to generate a local attention distribution reflecting the strength of the relationship between the protocol fields.

[0086] 1023. Superimpose the local attention distributions to screen protocol field pairs with high correlation across levels, and integrate the triggering sequence and level span of all protocol field pairs to form a correlation analysis result.

[0087] 1024. The dynamic dependency between different protocol fields in the industrial control instruction stream is captured through a multi-head attention mechanism, and the fluctuation range of highly associated protocol field pairs is captured in the dynamic dependency, and the fluctuation range is associated with the hierarchical depth to generate trigger constraint rules that describe the response relationship between protocol fields.

[0088] 1025. Combine the correlation analysis result with the trigger constraint rule to generate a semantic parsing result of the industrial control instruction flow.

[0089] In the above scheme, the industrial control instruction stream is a sequence of control commands generated during the operation of industrial equipment. Hierarchical depth refers to the number of nested levels of a protocol field in the industrial Internet protocol hierarchy. Vertically associated hierarchical channels are protocol field processing paths divided by hierarchical depth. A long sequence data block is a collection of protocol fields spanning multiple hierarchical depths. A split-head parallel processing path is a computational method that uses multiple threads to simultaneously process different hierarchical channels. Local attention distribution is a probability distribution matrix reflecting the strength of relationships between protocol fields. Highly associated protocol field pairs are combinations of cross-hierarchical protocol fields with strong interactions. Triggering order refers to the order in which protocol fields are executed in the industrial control instruction stream. Hierarchical span refers to the depth difference between a protocol field pair in the hierarchical structure. Correlation analysis results are quantitative conclusions about the interactions between protocol fields. The multi-head attention mechanism is a neural network module that parallelizes the dependencies between different protocol fields. Dynamic dependencies are the interaction patterns between protocol fields that change over time. Fluctuation range refers to the range of variation in the interaction strength between protocol field pairs. Response relationships are the causal relationships between triggers and triggered protocol fields. The trigger constraint rules are the timing specifications that limit the interaction behavior of the protocol fields. The semantic parsing results are the parsing conclusions of the industrial control instruction flow operation logic.

[0090] In the embodiment of the present application, first, through step 1021, the system extracts the hierarchical depth (such as control layer, application layer) of different protocol fields from the industrial control instruction stream, and splits the instruction stream into multiple vertically associated hierarchical channels according to the depth. For example, protocol fields belonging to the same level (such as register operation instructions) are classified into the same channel, and then the channels of different levels are spliced ​​into a long sequence data block spanning the hierarchical structure according to the time axis through a data reorganization algorithm, forming a continuous sequence containing multi-level protocol fields.

[0091] Subsequently, through step 1022, separate parallel processing paths are set for each long sequence data block, and each path corresponds to a set of protocol fields of a single-level channel. Within a single processing path, the system counts the continuous timing length of the protocol fields at the same level (such as the number of times a certain instruction is triggered continuously) and the time span of adjacent fields (such as the time interval between two triggers); at the same time, the number of cross-layer triggers (such as the number of times the application layer responds after the control layer instruction is triggered) is counted between different processing paths. The time parameters of the same level and the number of cross-layer triggers are superimposed through the time window alignment algorithm to generate a local attention distribution that reflects the strength of the relationship between protocol fields (such as fields with high frequency cross-layer triggering have high attention).

[0092] Next, in step 1023, the local attention distribution of each processing path is superimposed to screen out highly correlated protocol field pairs (such as a fixed combination of control layer instructions and application layer responses). The system integrates the triggering order of these field pairs (such as writing to a register before reading the status) and the hierarchical span (such as triggering across two layers) to form a correlation analysis result that describes the dependency relationship between fields. For example, a motor start / stop command must trigger a sensor status query, and the triggering interval across layers is stable.

[0093] Then, in step 1024, a multi-head attention mechanism is used to analyze the dynamic dependencies between different protocol fields in the industrial control instruction stream. This mechanism uses parallel attention heads to capture both transient correlations between fields (e.g., bursty instruction triggers) and long-term trends (e.g., periodic operations). Combined with the correlation analysis results from step 1023, it identifies the fluctuation range of highly correlated field pairs (e.g., the maximum deviation between trigger intervals). The system correlates the fluctuation range with the hierarchical depth and generates trigger constraint rules (e.g., application-layer instructions must be responded to within a specific time after the control-layer instruction is issued).

[0094] Finally, in step 1025, the correlation analysis results (such as the dependency paths of field pairs) are combined with the trigger constraint rules (such as time and level response limits), and the semantic parsing engine converts the protocol field operation logic into understandable semantic parsing results. For example, the business rule "When the control layer sends a motor start command, the application layer can query the motor status within 200ms; otherwise, an abnormality alarm is triggered" is parsed, forming a complete semantic description of the industrial control command flow.

[0095] In practical applications, within the control network of a painting robot in a smart factory, the system performs cross-level correlation analysis on the collected industrial control command stream (the spatiotemporal feature tensor generated in step 101). The command stream is split into vertical hierarchical channels (step 1021) based on the hierarchical depth of the protocol fields: the process layer (spray color parameters), the driver layer (robotic arm trajectory commands), and the equipment layer (spray gun pressure control). These channels are then reorganized into long sequential data blocks spanning three layers. Through separate and parallel processing paths (step 1022), the time duration during which the color parameter maintains a continuous light gray hue is counted within the process layer channel. Simultaneously, the number of cross-layer triggers that trigger trajectory adjustments after each color switch is detected in the driver layer channel. In the equipment layer channel, the cross-layer trigger intervals between the spray gun pressure parameter and the process layer color depth are shortened to a fixed threshold. By superimposing the local attention distributions at each level (step 1023), highly correlated field pairs, such as "color parameter → trajectory command" and "pressure value → color parameter," are identified to form the correlation analysis results. The multi-head attention mechanism further captures the dynamic dependency of the driver layer's trajectory instruction response delay when the process layer's color parameters suddenly change (step 1024), generating a trigger constraint rule for "triggering trajectory correction after color change." Combining this correlation with the constraint rule (step 1025), the semantic analysis reveals that the driver layer failed to synchronize trajectory adjustments after a dark blue parameter change in a particular spray instruction, violating the inter-layer response relationship. The system immediately blocks the instruction and triggers a security certification review. After confirming it was an abnormal injection attack, it initiates an emergency lock on the spray gun to prevent color errors caused by erroneous spray instructions.

[0096] The overall solution in step 102 above enables in-depth analysis of the dynamic dependencies of cross-layer protocol fields. Through separate, parallel processing of long-sequence data blocks and local attention analysis, a cross-layer channel correlation strength assessment model is constructed, accurately capturing the continuous timing characteristics and cross-layer triggering patterns of protocol fields. A multi-head attention mechanism is used to identify the fluctuation range of highly correlated field pairs, and trigger constraint rules are generated based on the depth of the hierarchy. This effectively addresses the disconnect between protocol semantic parsing and dynamic response in traditional methods, providing multi-dimensional semantic understanding support for compliance verification of industrial control instructions.

[0097] 103. Obtain the temporal regularity weight of the dynamic behavior baseline, and calculate the matching degree between the semantic analysis result and the temporal regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow.

[0098] Optionally, step 103 may specifically include the following steps:

[0099] 1031. Extract the fluctuation range of the operation cycle and the distribution interval of the triggering times of each protocol field within the time window from the dynamic behavior baseline, and calculate the timing regularity weight of the dynamic behavior baseline based on the fluctuation range and the distribution interval.

[0100] 1032. Convert the dynamic dependency relationship between the protocol fields in the semantic parsing result into a trigger sequence table that spans the hierarchical structure, and mark the time intervals between adjacent protocol fields in the trigger sequence table as time axis matching points.

[0101] 1033. Obtain the actual interval of the time axis matching point, and match and compare the actual interval with the timing regularity weight of the corresponding protocol field in the dynamic behavior baseline. When the actual interval exceeds the threshold of the fluctuation range, mark it as a hierarchical path abnormal parameter.

[0102] 1034. Count the number of consecutive deviations of abnormal path parameters at each level in the time axis matching point, and generate a security authentication result of the industrial control instruction flow based on the ratio of the consecutive deviation number to the threshold of the fluctuation range.

[0103] In the above scheme, match calculation is a similarity assessment process between the semantic parsing results and the dynamic behavior baseline timing regularity weights. The security certification result is a conclusion on the security status of the industrial control instruction flow. The fluctuation range of the operation cycle is the normal variation range of the operation interval of the protocol field within the time window. The distribution range of the trigger count is the normal statistical range of the number of times the protocol field is executed within the time window. The timing regularity weight is an indicator of the importance of the protocol field timing characteristics calculated based on the fluctuation range and distribution range. Dynamic dependencies are the interaction patterns between protocol fields that change over time. The trigger sequence table is a table that records the execution order of protocol fields. The timeline matching point is the time interval mark point between adjacent protocol fields in the trigger sequence table. The actual interval is the actual time interval value of the protocol field at the timeline matching point. The fluctuation range threshold is the critical value for determining whether the protocol field time interval is abnormal. The hierarchical path anomaly parameter is an anomaly flagged when the protocol field time interval exceeds the threshold. The number of consecutive deviations is the number of times the protocol field time interval at the timeline matching point continuously exceeds the threshold. The security certification result is a conclusion on the security status of the industrial control instruction flow generated by combining the anomaly parameters and the number of deviations.

[0104] In the embodiment of the present application, first, through step 1031, the system extracts the fluctuation range of the operation cycle of each protocol field within the time window (such as the minimum and maximum intervals between two trigger instructions) and the distribution range of the number of triggers (such as the upper and lower limits of the number of triggers per hour) from the dynamic behavior baseline, and calculates the timing regularity weight of each field through a statistical model (such as Gaussian distribution fitting or sliding window statistics). This weight reflects the time distribution characteristics of the protocol field under normal operation. For example, the weight of the field with high frequency triggering is lower, and the weight of the field with periodic triggering is higher.

[0105] Then, in step 1032, the dynamic dependencies between protocol fields in the semantic parsing results (e.g., the order of triggering between layers) are converted into a trigger sequence table spanning the hierarchical structure through the parsing engine. The time intervals between adjacent protocol fields in the sequence table are marked as timeline matching points (e.g., the interval nodes between control layer instructions and application layer responses), forming a time constraint chain to be verified.

[0106] Next, in step 1033, the actual interval of the timeline matching points (such as the real-time monitored command response time) is obtained and compared with the timing regularity weight of the corresponding protocol field in the dynamic behavior baseline. For example, if the actual interval of a matching point exceeds the preset threshold of the baseline fluctuation range (such as exceeding the maximum allowable delay), the point is marked as a hierarchical path anomaly parameter, indicating that there is a timing violation or potential security risk.

[0107] Finally, in step 1034, the number of consecutive deviations of abnormal path parameters across all hierarchical levels on the time axis is counted (e.g., three consecutive matching points exceeding the threshold), and the ratio of the number of deviations to the fluctuation range threshold is calculated (e.g., the percentage of deviations to the total number of matching points). This ratio is converted into a security certification result, such as "high risk" (where the deviation ratio can exceed 30%) or "safe" (where the deviation ratio can be less than 5%), through a security assessment model (e.g., a risk level mapping table), providing a basis for abnormal alarms or operation and maintenance decisions in industrial control systems.

[0108] In practical applications, within the relay protection control network of a power dispatching system, the system extracts the operating cycle fluctuation range of voltage regulation instructions and the trigger frequency distribution range of equipment start / stop instructions based on the dynamic behavior baseline (the protocol field trigger distribution range generated in step 1015) (step 1031). The calculated timing regularity weight of the voltage regulation field is higher, while the equipment start / stop field is lower. The semantic parsing results (the trigger constraint rules output in step 1025) indicate that after a voltage parameter change, relay device start / stop instructions must be triggered within a fixed time window. This creates a trigger sequence table spanning the control and execution layers (step 1032), and the time interval between the two instructions is marked as a timeline matching point. During actual monitoring, after a voltage surge, the delay of the equipment start / stop instructions exceeded the fluctuation range threshold set in the dynamic behavior baseline (step 1033), and the system marked this hierarchical path as an abnormal parameter. Similar delay deviations occurred within three consecutive dispatch cycles (step 1034), resulting in a high-risk security authentication result for the industrial control instruction flow, triggering a level 2 alarm. The system automatically isolated the abnormal command flow, activated the backup relay control channel, and simultaneously conducted a retrospective correlation analysis, revealing that the attacker had falsified voltage parameters and interfered with the timing of start and stop commands. Based on the authentication results, the dispatch center forcibly shut down the abnormal control node and updated the dynamic behavior baseline to ensure that subsequent command flows strictly adhered to the inter-layer triggering constraints, blocking the path for malicious parameters to destabilize the power grid.

[0109] The overall solution in step 103 above enables dynamic security assessment and anomaly location in industrial control instruction flows. Through timing pattern weight matching and timeline deviation detection technology, a multi-dimensional comparison is performed between the semantic parsing results and the fluctuation range of the dynamic behavior baseline to accurately identify abnormal parameters in the hierarchical path. Based on a quantitative analysis of the number of consecutive deviations and the ratio of thresholds, a security risk level determination model is constructed, breaking through the technical bottleneck of the traditional threshold alarm mechanism's delayed response to timing-related anomalies, and achieving full-link security authentication from protocol field triggering anomalies to hierarchical path root location.

[0110] 104. Parallel processing is performed on the process of correlation analysis of the long sequence. The parallel processing splits the correlation analysis of the long sequence into multiple subtask queues executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues.

[0111] Optionally, step 104 may specifically include the following steps:

[0112] 1041. According to the hierarchical structure of the protocol fields in the industrial control instruction stream, the correlation analysis of the long sequence is split into multiple subtask queues, where each subtask queue corresponds to the trigger path of the protocol fields of a specific hierarchical combination, and a time window is set for each subtask queue.

[0113] 1042. In the hardware acceleration architecture, an independent processing node is allocated to each subtask queue, and synchronization signal points are inserted between the processing nodes to align the progress of the time window of each subtask queue, so as to ensure that the analysis of the trigger path of all subtask queues is in the same time stage.

[0114] 1043. Analyze the cross-level protocol field trigger path in the subtask queue in parallel by each processing node to generate a time window parameter of the industrial control instruction stream.

[0115] In the above scheme, parallel processing is a computational method that decomposes an analysis task into multiple, concurrently executed subtasks. A subtask queue is a collection of analysis tasks for a specific hierarchical combination of protocol fields within parallel processing. The time window parameter of the industrial control instruction stream is a quantitative indicator that describes the trigger timing characteristics of protocol fields. The hierarchical structure of protocol fields represents the multi-level nested relationship of functional categories within industrial Internet protocols. A specific hierarchical combination of protocol fields is a selected group of related cross-hierarchical protocol fields. The trigger path is the sequential execution trajectory of protocol fields within the industrial control instruction stream. The hardware acceleration architecture is a dedicated computing hardware platform that supports parallel computing. A processing node is a computing unit within the hardware acceleration architecture that executes a subtask queue. A synchronization signal point is a synchronization marker that coordinates the execution progress of each processing node. The progress of a time window represents the analysis completion status of a subtask queue within the current time window. The cross-hierarchical protocol field trigger path represents the execution order of protocol fields across different hierarchical depths. The time window parameter is a quantitative analysis result that reflects the trigger timing characteristics of protocol fields.

[0116] In an embodiment of the present application, first, through step 1041, the system splits the long sequence correlation analysis into multiple subtask queues according to the hierarchical structure relationship of the protocol fields in the industrial control instruction stream. The splitting process is based on the logical dependency between the layers (such as the control layer instruction triggering the application layer response), and the protocol field trigger paths of different hierarchical combinations (such as the read and write paths from the sensor layer to the control layer) are assigned to independent subtask queues through the task scheduling algorithm (such as the task division based on the directed acyclic graph). Each queue is assigned a fixed time window (for example, one processing unit can be every 200 milliseconds) to ensure that the trigger paths of different levels are analyzed independently in the time dimension.

[0117] Subsequently, through step 1042, a dedicated processing node is allocated to each subtask queue in a hardware acceleration architecture (such as a GPU cluster or an FPGA array). The time window progress of each queue is coordinated between nodes through synchronization signal points (such as a global clock or a distributed lock mechanism). For example, when a node completes the analysis of the current time window, it sends a synchronization signal to other nodes, triggering all nodes to enter the data processing phase of the next time window, ensuring that the trigger path analysis across queues is completed within the same time period. This synchronization mechanism avoids timeline misalignment due to differences in node processing speeds and ensures the global consistency of correlation analysis.

[0118] Finally, in step 1043, each processing node performs cross-level protocol field trigger path analysis in parallel within the subtask queue. Based on memory sharing or pipeline technology, the node extracts the trigger sequence, layer jump frequency, and time interval characteristics of the protocol fields in real time, and generates unified time window parameters (such as the average delay and peak load of cross-layer triggers within the window) through aggregation algorithms (such as sliding window statistics or timing feature fusion). The output data of all nodes is integrated by the central scheduling module to form an industrial control instruction flow timing benchmark covering the entire hierarchical structure, providing standardized parameters for anomaly detection or real-time control.

[0119] In practical applications, within a chemical production control network, the system performs parallel processing for the long-sequence correlation analysis of the reactor temperature control instruction stream (the semantic parsing results generated in step 102). Based on the hierarchical structure of the protocol fields (step 1041), the instruction stream is split into three subtask queues: the trigger path between the temperature control layer and the valve execution layer, the trigger path between the valve execution layer and the safety monitoring layer, and the closed-loop path between the safety monitoring layer and the temperature control layer. A unified time window is set for each queue. Within the FPGA hardware acceleration architecture (step 1042), processing node A is assigned to the temperature-valve queue, node B to the valve-safety monitoring queue, and node C to the safety monitoring-temperature queue. Synchronization signal points are inserted between nodes to ensure that the analysis progress of each queue is aligned to the same time stage. When node A detects an abnormal triggering frequency of valve opening instructions due to a sudden change in temperature parameters, the synchronization signal triggers nodes B and C to pause and synchronize their current window states. Node B detects that the abnormal valve opening does not trigger an alarm at the safety monitoring layer, while node C detects that the temperature feedback delay exceeds the safety closed-loop constraints. After parallel processing, the results of each subtask are integrated (step 1043) to generate a global time window parameter, indicating that the protocol field trigger interval between the temperature control layer and the security monitoring layer presents a risk of cross-layer asynchronous communication. Based on this, the system determines that the instruction stream contains a potential malicious parameter injection attack, immediately freezes the reactor control instructions, and activates the emergency pressure relief valve, preventing the chain reaction caused by the temperature runaway. Simultaneously, the system reconstructs the dynamic behavior baseline based on the time window parameter, strengthening the security authentication mechanism's ability to intercept cross-layer asynchronous attacks.

[0120] The overall solution in step 104 above achieves efficient parallel processing and resource optimization for large-scale industrial control instruction streams. By splitting tasks and allocating hardware-accelerated nodes within hierarchical trigger paths, a multi-queue parallel analysis architecture is constructed. Time window alignment technology for synchronization signal points ensures that cross-layer protocol field correlation analysis maintains timing consistency during distributed processing, addressing the waste of computing resources in traditional serial processing. Dynamic mapping of processing nodes and subtasks achieves intelligent balancing of computing loads, significantly improving the real-time performance of long-sequence analysis of complex industrial protocols.

[0121] 105. Calculate the deviation between the security authentication result and the dynamic behavior baseline. When the deviation exceeds a preset security threshold, trigger a real-time blocking action of the industrial control instruction flow based on the time window parameter, and adjust the association rule of the timing regularity weight and the hierarchical structure according to the source of the protocol field of the deviation to form a closed-loop mechanism.

[0122] Optionally, step 105 may specifically include the following steps:

[0123] 1051. Extracting the timing regularity weight corresponding to each protocol field from the dynamic behavior baseline, and analyzing abnormal parameters in the security authentication result;

[0124] 1052. Calculate a set of deviation values ​​between the actual operation period of each abnormal parameter and the boundary value of the corresponding time series regularity weight;

[0125] 1053. Compare the deviation of each time point in the deviation value set with a preset safety threshold. When the deviation of consecutive time points exceeds the threshold, intercept the protocol field of the corresponding time period in the industrial control instruction stream based on the time window parameter, and mark the protocol field as the trigger range of the real-time blocking action.

[0126] 1054. Locate the hierarchical source of the deviated protocol field within the trigger range, trace back to the association rule of the dynamic behavior baseline based on the hierarchical path of the source, narrow the boundary value range of the operation cycle of the timing regularity weight at the hierarchy, and compress the distribution range of the trigger count;

[0127] 1055. The reduced operation cycle boundary value and the compressed distribution interval are reversely injected into the association rules of the dynamic behavior baseline, and the triggering sequence constraints of the hierarchical structure are updated to form a closed-loop mechanism.

[0128] In the above solution, the security certification result is a conclusion on the security status of the industrial control instruction flow. Deviation is the degree of difference between the security certification result and the dynamic behavior baseline. The preset security threshold is the critical value for determining whether the industrial control instruction flow is abnormal. Real-time blocking is a security measure that immediately intercepts abnormal industrial control instruction flows. Association rules are trigger constraints between protocol fields in the dynamic behavior baseline. The closed-loop mechanism is an adaptive security control system implemented through feedback adjustment. Anomaly parameters are protocol field anomaly indicators marked in the security certification result. The actual operation cycle is the actual operation interval of the protocol field in the industrial control instruction flow. The boundary value is the allowable range of the operation cycle defined by the timing regularity weight. The deviation value set is the summary data of the difference between the actual value and the standard value at each time point. The time window parameter is the quantitative analysis result that describes the trigger timing characteristics of the protocol field. The trigger range is the time period of the protocol field during which the real-time blocking action is required. The hierarchical source is the original position of the abnormal protocol field in the hierarchical structure. The hierarchical path is the nested relationship chain of the protocol field in the hierarchical structure. The boundary value range of the operation cycle is the allowable fluctuation range of the protocol field operation interval. The distribution range of trigger counts represents the normal statistical range of protocol field executions. Trigger order constraints are rules that restrict the order in which protocol fields are executed. Back injection is the process of feeding back adjusted parameters into the dynamic behavior baseline. Updating the hierarchical structure is the process of revising the hierarchical relationships of protocol fields based on security analysis results.

[0129] In the embodiment of the present application, first, through step 1051, the system extracts the timing regularity weight corresponding to each protocol field from the dynamic behavior baseline (such as the allowable fluctuation range of the operation cycle and the distribution interval of the number of triggers), and at the same time parses the marked abnormal parameters from the security authentication results (such as the instruction path triggered by the timeout or the field with abnormal frequency). The extraction process is implemented through a weight mapping table, for example, binding the protocol field in the baseline with its timing rule (such as maximum delay, minimum trigger interval); the abnormal parameters are obtained by filtering the marked fields in the security log.

[0130] Then, in step 1052, for each abnormal parameter, a set of deviation values ​​is calculated between its actual operating period (e.g., actual trigger interval) and the boundary value of the corresponding timing regularity weight (e.g., the maximum interval allowed by the baseline). For example, if the actual interval of a field exceeds the maximum value of the baseline, the deviation value is the difference between the actual value and the maximum value. The deviation value set is generated using a timing comparison algorithm, recording the degree of deviation at each time point.

[0131] Next, at step 1053, the deviation at each time point in the deviation value set is compared with a preset safety threshold (e.g., a maximum allowable deviation ratio). If the deviation at consecutive time points exceeds the threshold (e.g., three consecutive deviations), the system intercepts the protocol fields of the corresponding time period in the industrial control instruction stream based on the time window parameters (e.g., intercepts the control layer instructions during the abnormal time period) and marks these fields as triggering ranges for real-time blocking actions (e.g., marking them as instruction sets that require immediate interception).

[0132] Then, in step 1054, the hierarchical source of the protocol field that caused the deviation is located within the trigger range (e.g., the abnormal field is traced back to the status query instruction of the application layer). Based on the hierarchical path of the source (e.g., the trigger link from the application layer to the control layer), the association rules of the dynamic behavior baseline are traced back (e.g., the timing constraints of the path in the baseline). A parameter compression algorithm is used to reduce the operating cycle boundary value range of the timing regularity weight at the level (e.g., the maximum allowable interval can be adjusted from 200ms to 150ms) and compress the distribution range of the trigger number (e.g., the upper limit of the number of triggers per hour can be reduced from 100 to 80), thereby tightening the safety tolerance range.

[0133] Finally, in step 1055, the reduced operation cycle boundary values ​​and the compressed distribution intervals are updated into the association rules of the dynamic behavior baseline via a reverse injection mechanism (e.g., modifying the constraints in the baseline database). The system simultaneously adjusts the trigger sequence constraints of the hierarchical structure, forming a closed-loop dynamic feedback mechanism. This ensures that subsequent instruction flow anomaly detection is performed based on the updated baseline, continuously improving the accuracy of security protection.

[0134] In actual application, in the gas turbine control network, the system detects that the safety authentication result of the combustion chamber pressure adjustment instruction stream (the high-risk alarm output in step 1034) deviates significantly from the dynamic behavior baseline (step 1051). The weight of the combustion pressure parameter timing regularity is extracted from the baseline, and it is found that the abnormal parameter is the actual operation cycle of the fuel valve opening adjustment instruction after the pressure drop, and its three consecutive trigger intervals are all shorter than the baseline boundary value (step 1052). When the deviation value exceeds the preset safety threshold, the instruction stream during the pressure drop period is intercepted based on the time window parameter (step 1053), and the fuel valve opening adjustment field is marked as the trigger range of the real-time blocking action, and the fuel valve control signal is immediately frozen. The source of the deviation field is located as the combustion control layer (step 1054), and its association rule with the fuel supply layer is traced back to compress the distribution range of the fuel valve adjustment instruction trigger times to a narrow fluctuation range, and simultaneously reduce the operation cycle boundary value to limit the risk of high-frequency triggering. The updated dynamic behavior baseline (step 1055) strengthens the triggering sequence constraints for the combustion control layer and the fuel supply layer, forming a closed-loop mechanism of "pressure anomaly → single adjustment → delayed response." In subsequent operations, if the pressure parameter fluctuates abnormally again, the fuel valve adjustment command is restricted to a single trigger due to the new baseline. Malicious repeated commands that exceed the constraints are blocked in real time, and a multi-level association rule review is triggered simultaneously, ensuring that the attacker's forged fuel supply parameters are continuously blocked from damaging combustion stability.

[0135] The overall solution in step 105 above implements a closed-loop, self-optimizing mechanism for industrial control instruction flow security protection. Based on threshold triggering for security deviations and source-level backtracking technology, a dual-response system is constructed: real-time blocking of abnormal protocol fields and dynamic adjustment of the rule base. Through reverse injection of operation cycle boundary compression and distribution interval contraction, adaptive iterative updates of dynamic behavior baselines are achieved, overcoming the protection lag caused by the static nature of traditional security policies. This complete closed loop of "anomaly detection - real-time blocking - rule optimization" significantly enhances the dynamic adaptability and continuous evolution potential of the industrial Internet protocol security protection system.

[0136] The following is a complete embodiment of steps 101 to 105:

[0137] In the control system of a refinery's catalytic cracking unit, real-time data from a reaction temperature control instruction stream (based on the Modbus-TCP protocol) is collected. After extracting protocol fields according to time windows, temperature setting parameters are assigned to the process control layer, and catalyst flow control instructions are assigned to the execution layer. These data are then reorganized into a vertically arranged initial spatiotemporal feature tensor. The operating intervals of the process-layer temperature parameters and the repetition frequency of the execution-layer flow instructions are extracted and superimposed to generate a spatiotemporal feature tensor reflecting the synergistic law of "high-temperature trigger → catalyst increment." By horizontally concatenating temporal patterns across different layers, an industrial control instruction stream containing the conditional relationship of "flow compensation triggered after temperature exceeds the limit" is constructed. The distribution range of the number of protocol field triggers at each layer is calculated to form a dynamic behavior baseline. The instruction stream is then split into vertical hierarchical channels at the process, execution, and safety monitoring layers, and reorganized into long, cross-layer sequence data blocks. In the separate parallel processing path, when temperature parameters continuously exceed the limit in the process-layer channel, the execution-layer channel detects an abnormal increase in the number of cross-layer triggers of the flow instruction, generating a local attention distribution. After superposition, the highly correlated field pairs ("temperature exceeding the limit → traffic surge") are screened, and the trigger sequence and hierarchical span are integrated to form a correlation analysis result. A multi-head attention mechanism is used to capture the dynamic dependencies of traffic response delays during temperature fluctuations. This generates a trigger constraint rule requiring traffic compensation to be triggered within 200ms after the temperature exceeds the limit, and outputs the semantic analysis results.

[0138] The timing regularity weights of flow instructions in the dynamic behavior baseline are extracted. Matching semantic analysis results reveals that the flow response interval after a temperature excursion exceeds the baseline fluctuation range threshold, marking it as a hierarchical path anomaly parameter. Two consecutive deviations trigger a medium-risk certification result. The splitting module, using the FPGA hardware acceleration architecture, splits the correlation analysis into process-execution layer and execution-safety monitoring layer subtask queues. After aligning the signal points to the time window, it simultaneously detects that the safety monitoring layer has not synchronously received the temperature alarm and generates a global time window parameter. The flow instruction deviation value exceeding the safety threshold is calculated (Claim 7). Based on the time window parameter, the instruction stream during the abnormal period is intercepted and the source of the deviation is located as the execution layer protocol field. The dynamic behavior baseline association rules are retraced to narrow the distribution range of the flow instruction trigger times, reducing the operating cycle boundary value. The updated baseline forms a closed-loop constraint for "temperature-flow-safety monitoring." When high-frequency flow instruction triggering is detected again, the system blocks the abnormal instruction in real time and activates the backup catalyst supply channel to prevent temperature runaway in the reactor. By dynamically adjusting hierarchical rules, the system continuously intercepts maliciously injected forged traffic parameters, ensuring the security of the catalytic cracking control instruction flow and forming a closed-loop protection mechanism.

[0139] like Figure 2 、 Figure 3 As shown in the figure, the architectural design and operation mechanism of the industrial Internet security authentication system are demonstrated. Figure 2With a layered structure at its core, PLC controllers at industrial sites generate data through instruction streams, protocol fields, and spatiotemporal features. Feature tensors are extracted by the data acquisition layer and then passed to the semantic analysis layer for long-sequence correlation analysis and multi-head attention processing to identify potential abnormal patterns. The security authentication core, based on a dynamic behavioral baseline library, generates security authentication results through matching calculations and offset detection, triggering normal instruction execution or abnormal interception actions in real time. A closed-loop feedback mechanism dynamically adjusts weights and association rules. The security monitoring center simultaneously tracks metrics such as authentication speed and abnormal diffusion rate to optimize parameters and upgrade protection strategies. Figure 3 Further refining the process, the security authentication processing center integrates spatiotemporal feature tensors with customized working condition instruction chains, combining dynamic sensitive relationship analysis to determine threats. The security control system then leverages alarms, device-layer protocol management, and other modules to implement real-time blocking or parameter calibration. Together, they build a comprehensive "data acquisition - feature analysis - dynamic authentication - closed-loop control" system. Parallel processing and multi-head attention mechanisms enhance anomaly detection sensitivity, while leveraging real-time feedback mechanisms to balance security authentication speed and protection accuracy, creating an adaptive security protection closed loop that balances privacy optimization with industrial real-time requirements.

[0140] Figure 4 The present invention provides a structural diagram of a security authentication system for the industrial Internet. Figure 2 As shown, the system includes:

[0141] Acquisition module 41 is used to collect instruction stream data in industrial Internet protocols, extract protocol fields within a time window of the instruction stream data, and generate a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. Based on the spatiotemporal feature tensor, an industrial control instruction stream is constructed and a dynamic behavior baseline of the industrial control instruction stream is obtained.

[0142] an analysis module 42 for performing a correlation analysis on a long sequence of the industrial control instruction stream across the hierarchical structure, capturing dynamic dependencies between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combining the correlation analysis results with the dynamic dependencies to generate a semantic parsing result of the industrial control instruction stream;

[0143] A calculation module 43 is configured to obtain a temporal regularity weight of the dynamic behavior baseline, and perform a matching calculation between the semantic parsing result and the temporal regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow;

[0144] a splitting module 44 for performing parallel processing on the long sequence correlation analysis process, wherein the parallel processing splits the long sequence correlation analysis into multiple subtask queues to be executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues;

[0145] The trigger module 45 is used to calculate the deviation between the security authentication result and the dynamic behavior baseline. When the deviation exceeds the preset security threshold, the real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter, and the association rule of the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism.

[0146] Figure 4 The security authentication system for industrial Internet can be executed Figure 1 The implementation principle and technical effects of the security authentication method for the Industrial Internet described in the illustrated embodiment will not be repeated here. The specific manner in which each module and unit performs operations in the security authentication system for the Industrial Internet in the above embodiment has been described in detail in the embodiments of the method and will not be elaborated here.

[0147] In one possible design, Figure 4 The security authentication system for the industrial Internet in the embodiment shown can be implemented as a computing device, such as Figure 5 As shown, the computing device may include a storage component 51 and a processing component 52;

[0148] The storage component 51 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 52 .

[0149] The processing component 52 is used for the above Figure 1 The embodiment provides a security authentication method for the industrial Internet.

[0150] The processing component 52 may include one or more processors to execute computer instructions to perform all or part of the steps in the above method. Of course, the processing component may also be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above method.

[0151] The storage component 51 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk, or optical disk.

[0152] Of course, a computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0153] The input / output interface provides an interface between the processing component and the peripheral interface module, which can be an output device, an input device, etc.

[0154] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0155] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0156] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A security authentication method for the industrial Internet according to the embodiment shown.

[0157] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0158] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0159] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A security authentication method for the industrial Internet, characterized in that: include: Collect instruction stream data from industrial internet protocols, extract protocol fields within a time window of the instruction stream data, and generate a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. Construct an industrial control instruction stream based on the spatiotemporal feature tensor and obtain a dynamic behavior baseline for the industrial control instruction stream. Performing a correlation analysis on a long sequence of the industrial control instruction stream across the hierarchical structure, capturing dynamic dependencies between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combining the correlation analysis results with the dynamic dependencies to generate a semantic parsing result of the industrial control instruction stream; Obtaining a timing regularity weight of the dynamic behavior baseline, and performing a matching calculation between the semantic parsing result and the timing regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow; Parallel processing is performed on the process of correlation analysis of the long sequence, wherein the parallel processing divides the correlation analysis of the long sequence into multiple subtask queues executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues; The deviation between the security authentication result and the dynamic behavior baseline is calculated. When the deviation exceeds a preset security threshold, a real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter, and the association rule between the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism.

2. The method according to claim 1, characterized in that Collecting instruction stream data from industrial Internet protocols, extracting protocol fields within a time window of the instruction stream data, and generating a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. Building an industrial control instruction stream based on the spatiotemporal feature tensor and obtaining a dynamic behavior baseline for the industrial control instruction stream include: Collecting continuously transmitted instruction stream data in the industrial Internet protocol, intercepting the instruction stream data according to fixed time windows, and grouping the protocol fields in each time window according to functional categories in a hierarchical structure to form a set of protocol fields with hierarchical labels; Obtaining the subordinate relationships of different functional categories in the hierarchical structure, and vertically arranging the fields in the protocol field set according to the depth of the hierarchy according to the subordinate relationships to generate an initial spatiotemporal feature tensor; Extracting the operation interval period of the protocol field at the same level in the initial spatiotemporal feature tensor and the repetition frequency in adjacent time windows, and superimposing and calculating the operation interval period and the repetition frequency to generate a spatiotemporal feature tensor reflecting the timing regularity of the industrial equipment operation; horizontally splicing the timing patterns corresponding to different levels in the spatiotemporal feature tensor to generate an industrial control instruction stream describing the operation of industrial equipment, wherein the instruction stream includes the conditional relationships and time constraints for triggering operations between the levels; The distribution range of the number of times the protocol field at each level in the industrial control instruction stream is triggered within a time window is counted, and a dynamic behavior baseline is obtained according to the distribution range.

3. The method according to claim 1, characterized in that A correlation analysis is performed on the long sequence of the industrial control instruction stream across the hierarchical structure, and the dynamic dependency between different protocol fields in the industrial control instruction stream is captured through a multi-head attention mechanism. The semantic parsing result of the industrial control instruction stream is generated by combining the result of the correlation analysis and the dynamic dependency, including: Extracting the hierarchical depths of different protocol fields in the industrial control instruction stream, splitting the industrial control instruction stream into a plurality of vertically associated hierarchical channels according to the hierarchical depths, and reorganizing the hierarchical channels to form a long sequence of data blocks spanning the hierarchical structure; For each long sequence data block, separate parallel processing paths are set. The continuous time sequence length of the protocol field is counted within the hierarchical channels of the same processing path. The number of cross-layer triggers is counted between the hierarchical channels of different processing paths. Based on the continuous time sequence length and the number of cross-layer triggers, a local attention distribution reflecting the strength of the relationship between the protocol fields is generated. The local attention distributions are superimposed to screen protocol field pairs with high correlation across hierarchies. The triggering sequence and hierarchical span of all protocol field pairs are integrated to form correlation analysis results. The multi-head attention mechanism is used to capture the dynamic dependencies between different protocol fields in the industrial control instruction stream, and the fluctuation range of highly correlated protocol field pairs in the dynamic dependencies is captured. The fluctuation range is then associated with the hierarchical depth to generate trigger constraint rules that describe the response relationship between the protocol fields. The correlation analysis result is combined with the trigger constraint rule to generate a semantic parsing result of the industrial control instruction flow.

4. The method according to claim 3, wherein For each long sequence data block, separate parallel processing paths are set. The continuous time sequence length of the protocol field is counted within the hierarchical channel of the same processing path. At the same time, the number of cross-layer triggers is counted between the hierarchical channels of different processing paths. Based on the continuous time sequence length and the number of cross-layer triggers, a local attention distribution reflecting the relationship strength between the protocol fields is generated, including: Split the long sequence data block into multiple parallel processing paths according to the hierarchical channels of the protocol fields, each processing path corresponds to a set of protocol fields of a single hierarchical channel, and mark a continuous time window for each processing path; In a hierarchical channel of a single parallel processing path, counting the number of consecutive occurrences of a protocol field and the time span of adjacent protocol fields, and recording the number and time span as a continuous timing length parameter set of the same hierarchical channel; Counting the cross-layer number and trigger interval of protocol field pairs triggered across layers between layer channels of different parallel processing paths, and recording the cross-layer number and trigger times as a cross-layer triggering number parameter set; The continuous timing length parameter set and the cross-layer trigger number parameter set of the same-level channel are aligned according to the time window according to the trigger, and the continuous number and the cross-level number are superimposed to generate a local attention distribution that reflects the strength of the relationship between the protocol fields.

5. The method according to claim 1, wherein Obtaining the temporal regularity weight of the dynamic behavior baseline, and performing a matching calculation between the semantic parsing result and the temporal regularity weight of the dynamic behavior baseline to output a security authentication result of the industrial control instruction flow, including: Extracting the fluctuation range of the operation cycle and the distribution interval of the trigger times of each protocol field within the time window from the dynamic behavior baseline, and calculating the time series regularity weight of the dynamic behavior baseline based on the fluctuation range and the distribution interval; Convert the dynamic dependency between protocol fields in the semantic parsing results into a trigger sequence table spanning the hierarchical structure, and mark the time intervals between adjacent protocol fields in the trigger sequence table as timeline matching points; Obtaining the actual interval of the time axis matching point, and matching and comparing the actual interval with the timing regularity weight of the corresponding protocol field in the dynamic behavior baseline. When the actual interval exceeds the threshold of the fluctuation range, it is marked as a hierarchical path abnormal parameter; The number of consecutive deviations of abnormal path parameters at each level in the time axis matching point is counted, and the security authentication result of the industrial control instruction flow is generated according to the ratio of the consecutive deviation number to the threshold value of the fluctuation range.

6. The method according to claim 1, wherein The process of the long sequence correlation analysis is processed in parallel, wherein the parallel processing splits the long sequence correlation analysis into multiple subtask queues to be executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues, including: Based on the hierarchical structure of protocol fields in industrial control instruction streams, the correlation analysis of long sequences is split into multiple subtask queues, where each subtask queue corresponds to the trigger path of protocol fields of a specific hierarchical combination, and a time window is set for each subtask queue; In the hardware acceleration architecture, an independent processing node is allocated to each subtask queue, and synchronization signal points are inserted between the processing nodes to align the progress of the time windows of each subtask queue, so as to ensure that the analysis of the trigger paths of all subtask queues is in the same time stage; The cross-level protocol field trigger path analysis in the subtask queue is executed in parallel by each processing node to generate the time window parameter of the industrial control instruction flow.

7. The method according to claim 1, wherein Calculating the deviation between the security authentication result and the dynamic behavior baseline; when the deviation exceeds a preset security threshold, triggering a real-time blocking action of the industrial control instruction flow based on the time window parameter; and adjusting the association rule between the timing regularity weight and the hierarchical structure according to the source of the protocol field of the deviation to form a closed-loop mechanism, including: Extracting the timing regularity weight corresponding to each protocol field from the dynamic behavior baseline, and parsing abnormal parameters in the security authentication result; Calculate the deviation value set between the actual operation cycle of each abnormal parameter and the boundary value of the corresponding timing regularity weight; Comparing the deviation of each time point in the deviation value set with a preset safety threshold, when the deviation of consecutive time points exceeds the threshold, intercepting the protocol field of the corresponding time period in the industrial control instruction stream based on the time window parameter, and marking the protocol field as the trigger range of the real-time blocking action; Locate the hierarchical source of the protocol field with the deviation within the trigger range, trace back to the association rule of the dynamic behavior baseline based on the hierarchical path of the source, narrow the boundary value range of the operation cycle of the timing regularity weight at the hierarchy, and compress the distribution range of the trigger number; The reduced operation cycle boundary value and the compressed distribution interval are reversely injected into the association rules of the dynamic behavior baseline, and the triggering sequence constraints of the hierarchical structure are updated to form a closed-loop mechanism.

8. A security authentication system for the industrial Internet, characterized in that: include: An acquisition module is configured to collect instruction stream data from industrial internet protocols, extract protocol fields within a time window of the instruction stream data, and generate a spatiotemporal feature tensor reflecting the timing regularity of industrial equipment operations based on the hierarchical structure of the protocol fields. An industrial control instruction stream is constructed based on the spatiotemporal feature tensor, and a dynamic behavior baseline of the industrial control instruction stream is obtained. an analysis module for performing a correlation analysis on a long sequence of the industrial control instruction stream across the hierarchical structure, capturing dynamic dependencies between different protocol fields in the industrial control instruction stream through a multi-head attention mechanism, and combining the correlation analysis results with the dynamic dependencies to generate a semantic parsing result of the industrial control instruction stream; a calculation module, configured to obtain a time sequence regularity weight of the dynamic behavior baseline, and perform a matching calculation between the semantic parsing result and the time sequence regularity weight of the dynamic behavior baseline, so as to output a security authentication result of the industrial control instruction flow; a splitting module, configured to perform parallel processing on the long sequence correlation analysis process, wherein the parallel processing splits the long sequence correlation analysis into a plurality of subtask queues to be executed in parallel, and generates time window parameters of the industrial control instruction stream by synchronously processing the subtask queues; A trigger module is used to calculate the deviation between the security authentication result and the dynamic behavior baseline. When the deviation exceeds a preset security threshold, a real-time blocking action of the industrial control instruction flow is triggered based on the time window parameter, and the association rule of the timing regularity weight and the hierarchical structure is adjusted according to the source of the protocol field of the deviation to form a closed-loop mechanism.

9. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a security authentication method for the industrial Internet as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, a security authentication method for the industrial Internet as described in any one of claims 1 to 7 is implemented.

Images