Operation behavior rule analysis method in industrial control protocol based on machine learning

Abstract

The invention relates to an operation behavior rule analysis method in an industrial control protocol based on machine learning, and the method comprises the steps: carrying out the labeling processing of industrial control sample data through determining a plurality of operation behavior types, and generating behavior labeling data; performing model training and cross validation, and constructing a machine learning model; performing direct acquisition and collaborative acquisition on the plurality of industrial control operation devices to obtain industrial control related data; performing data cleaning and feature extraction on the industrial control related data to obtain industrial control feature data; and performing rule analysis on the industrial control characteristic data through a machine learning model, recording rule analysis information, and performing visual display. A machine learning model can be constructed, direct acquisition and collaborative acquisition can be performed on a plurality of industrial control operation devices, rule analysis is performed through the machine learning model, rule analysis information is obtained, and the working efficiency of the industrial control operation devices can be improved in a complex environment of multi-device collaborative work. And comprehensive data acquisition, integrated analysis and behavior rule analysis are effectively carried out on a plurality of industrial control operation devices.

Description

Technical Field

[0001] The present invention relates to the technical field of operating behavior law analysis, and in particular to a method for analyzing operating behavior laws in industrial control protocols based on machine learning. Background Art

[0002] Behavior analysis is the process of systematically collecting, organizing, modeling, and analyzing user or system behavior data in specific scenarios to uncover underlying behavioral patterns, habits, preferences, and underlying patterns. This process aims to help understand the motivations behind user behavior, predict future trends, and provide a scientific basis for product optimization, service improvement, and decision-making.

[0003] In the existing technology, there are generally certain limitations in the analysis of operational behavior patterns in industrial control protocols. Specifically, traditional analysis methods are only applicable to data collection and behavior analysis of a single industrial control operation device, and can only independently carry out data acquisition, operation instruction tracking, and behavior pattern recognition for a single device. However, in actual industrial production and operation scenarios, there are often multiple interrelated and collaborative industrial control operation devices. In this complex environment of multiple devices working together, traditional analysis that only targets a single device seems to be inadequate, and it is difficult to effectively conduct comprehensive data collection, integrated analysis, and behavioral pattern analysis for multiple industrial control operation devices. Summary of the Invention

[0004] The present invention addresses the technical problems existing in the prior art and provides a method for analyzing the operational behavior patterns in industrial control protocols based on machine learning.

[0005] The present invention solves the above technical problems with the following technical solution: a method for analyzing the operating behavior patterns in industrial control protocols based on machine learning, the method specifically comprising the following steps: Determine multiple operation behavior categories, obtain industrial control sample data, and perform labeling processing on the industrial control sample data according to the multiple operation behavior categories to generate behavior labeling data; Perform model training and cross-validation based on the behavior annotation data to build a machine learning model; Identify multiple industrial control operation devices, and perform direct and collaborative collection on the multiple industrial control operation devices to obtain industrial control related data; Performing data cleaning and feature extraction on the industrial control related data to obtain industrial control feature data; The machine learning model is used to analyze the industrial control feature data for regularities, record regularity analysis information, and perform visual display. As a further limitation of the technical solution of the embodiment of the present invention, the steps of determining multiple operation behavior categories, obtaining industrial control sample data, and labeling the industrial control sample data according to the multiple operation behavior categories to generate behavior labeling data specifically include the following steps: Identify multiple categories of operational behavior; Obtain industrial control sample data; Performing unsupervised clustering on the industrial control sample data according to the plurality of operation behavior categories to generate initial data labels; The initial data labels are manually corrected and rule-annotated to generate behavior annotation data.

[0006] As a further limitation of the technical solution of the embodiment of the present invention, the multiple operation behavior categories include: normal operation, abnormal operation and unconscious operation.

[0007] As a further limitation of the technical solution of the embodiment of the present invention, the model training and cross-validation based on the behavior annotation data to construct the machine learning model specifically includes the following steps: Select a base classification model; Dividing the behavior annotation data into a training set and a test set; Training the basic classification model using the training set; Perform cross-validation after model training using the test set; Build machine learning models.

[0008] As a further limitation of the technical solution of the embodiment of the present invention, the basic classification model is a random forest, LSTM, GRU or convolutional neural network.

[0009] As a further limitation of the technical solution of the embodiment of the present invention, the determining of multiple industrial control operation devices, directly collecting and collaboratively collecting data from the multiple industrial control operation devices, and obtaining industrial control related data specifically include the following steps: Identify multiple industrial control operation devices; Directly collecting data from the plurality of industrial control operation devices to obtain a plurality of directly collected data; Identifying the plurality of directly collected data, and dividing the plurality of industrial control operation devices into direct collection devices and abnormal collection devices; Matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices, and collaboratively collecting collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices; The industrial control related data are obtained by integrating the multiple directly collected data and the multiple collaboratively collected data.

[0010] As a further limitation of the technical solution of the embodiment of the present invention, the identifying of the plurality of directly collected data and dividing the plurality of industrial control operation devices into direct collection devices and abnormal collection devices specifically includes the following steps: Performing address recognition on the plurality of directly collected data to obtain a plurality of directly collected addresses; Based on the preset address backup data, the plurality of direct collection addresses are matched, and a plurality of abnormal collection addresses are screened; Determining a plurality of direct acquisition devices from the plurality of industrial control operation devices according to the plurality of direct acquisition addresses; According to the plurality of the abnormality collection addresses, a plurality of abnormality collection devices are determined from the plurality of the industrial control operation devices.

[0011] As a further limitation of the technical solution of the embodiment of the present invention, matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices, and collaboratively collecting collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices specifically includes the following steps: Get Internet backup information; Performing interconnection communication analysis based on the interconnection backup information, and matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices; generating and sending a collaborative collection instruction to the plurality of collaborative collection devices; The collaborative collection data of the multiple abnormal collection devices are collaboratively collected by the multiple collaborative collection devices.

[0012] As a further limitation of the technical solution of the embodiment of the present invention, the data cleaning and feature extraction of the industrial control related data to obtain the industrial control feature data specifically includes the following steps: De-noising the industrial control related data to generate industrial control denoised data; Supplementing missing data for the industrial control denoised data to generate industrial control supplementary data; Standardizing the industrial control supplementary data to generate industrial control standard data; Feature extraction is performed on the industrial control standard data to obtain industrial control feature data.

[0013] As a further limitation of the technical solution of the embodiment of the present invention, the method of performing regular analysis on the industrial control feature data by the machine learning model, recording regular analysis information, and visually displaying the information specifically includes the following steps: Using the machine learning model, mining patterns on the industrial control feature data to obtain pattern mining results; Based on the results of the rule mining, multiple high-frequency related behaviors are identified; Performing regular analysis on the plurality of high-frequency associated behaviors and recording regular analysis information; Use time series graphs, heat maps and / or behavior network graphs to visualize the regularity analysis information.

[0014] The beneficial effects of the present invention are as follows: determining multiple operational behavior categories, labeling industrial control sample data, and generating behavioral labeling data; performing model training and cross-validation to construct a machine learning model; directly and collaboratively collecting data from multiple industrial control operation devices to obtain industrial control-related data; performing data cleaning and feature extraction on the industrial control-related data to obtain industrial control feature data; and using the machine learning model to analyze the industrial control feature data for patterns, record the pattern analysis information, and perform visual display. The invention is capable of constructing a machine learning model, performing direct and collaborative collection on multiple industrial control operation devices, analyzing patterns through the machine learning model, and obtaining pattern analysis information. It is thus possible to effectively perform comprehensive data collection, integrated analysis, and behavioral pattern analysis on multiple industrial control operation devices in a complex environment where multiple devices work together. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 A flowchart of a method provided by an embodiment of the present invention; Figure 2 A flowchart of generating behavior annotation data in the method provided in an embodiment of the present invention; Figure 3 A flowchart of constructing a machine learning model in the method provided in an embodiment of the present invention; Figure 4 A flow chart of direct acquisition and collaborative acquisition in the method provided in an embodiment of the present invention; Figure 5 A flowchart of the division of industrial control operation equipment in the method provided in an embodiment of the present invention; Figure 6 A flowchart of collaboratively collecting data from multiple abnormal collection devices in the method provided by an embodiment of the present invention; Figure 7 A flowchart of data cleaning and feature extraction in the method provided in an embodiment of the present invention; Figure 8 This is a flowchart of recording regularity analysis information in the method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0017] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first" or "second" may explicitly or implicitly include one or more of the described features. In the description of this application, "plurality" means two or more, unless otherwise specifically specified.

[0018] In the description of this application, the term "for example" is used to mean "used as an example, illustration or explanation". Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art will recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in this application.

[0019] Example 1 Figure 1 A flow chart of a method provided by an embodiment of the present invention is shown.

[0020] Specifically, a method for analyzing operational behavior patterns in industrial control protocols based on machine learning includes the following steps: Step S101: determine a plurality of operation behavior categories, obtain industrial control sample data, and perform labeling processing on the industrial control sample data according to the plurality of operation behavior categories to generate behavior labeling data.

[0021] In an embodiment of the present invention, multiple operation behavior categories including normal operation, abnormal operation and unconscious operation (specifically including equipment restart, equipment upgrade, etc.) are determined, and industrial control sample data is obtained. Then, the industrial control sample data is unsupervisedly clustered according to the multiple operation behavior categories to generate initial data labels. Then, through expert labeling, the initial data labels are manually corrected and rule-labeled and recorded to generate behavior labeling data.

[0022] Specifically, Figure 2 This is a flowchart of constructing a threat monitoring model in the method provided in an embodiment of the present invention.

[0023] In a preferred embodiment of the present invention, the steps of determining multiple operation behavior categories, obtaining industrial control sample data, and labeling the industrial control sample data according to the multiple operation behavior categories to generate behavior labeling data specifically include the following steps: Step S1011: determining multiple operation behavior categories; Step S1012: Obtain industrial control sample data; Step S1013: performing unsupervised clustering on the industrial control sample data according to the plurality of operation behavior categories to generate initial data labels; Step S1014: Manually correct and record the initial data labels according to the rules to generate behavior annotation data.

[0024] Furthermore, the method for analyzing operation behavior patterns in industrial control protocols based on machine learning further includes the following steps: Step S102: Perform model training and cross-validation based on the behavior annotation data to build a machine learning model.

[0025] In an embodiment of the present invention, a basic classification model is selected from random forest, LSTM, GRU or convolutional neural network, and the behavior annotation data is divided into a training set and a test set. The basic classification model is then trained with the training set, and the trained model is cross-validated with the test set, and then hyperparameter tuning is performed to construct a machine learning model.

[0026] Specifically, Figure 3 A flowchart of constructing a machine learning model in the method provided in an embodiment of the present invention.

[0027] In a preferred embodiment of the present invention, the model training and cross-validation are performed based on the behavior annotation data to construct a machine learning model, specifically comprising the following steps: Step S1021: Select a basic classification model; Step S1022: Divide the behavior annotation data into a training set and a test set; Step S1023: training the basic classification model using the training set; Step S1024: Perform cross-validation after model training using the test set; Step S1025: Build a machine learning model.

[0028] Furthermore, the method for analyzing operation behavior patterns in industrial control protocols based on machine learning further includes the following steps: Step S103: determining a plurality of industrial control operation devices, performing direct and collaborative collection on the plurality of industrial control operation devices to obtain industrial control related data.

[0029] In an embodiment of the present invention, by determining multiple industrial control operation devices with the need to analyze the rules of operation behavior, direct collection is performed on the multiple industrial control operation devices to obtain multiple direct collection data, and then address recognition is performed on the multiple direct collection data to obtain multiple direct collection addresses. Based on preset address backup data, the multiple direct collection addresses are matched, and the unmatched addresses are marked as abnormal collection addresses to achieve screening of multiple abnormal collection addresses. Then, based on the multiple direct collection addresses, multiple direct collection devices are determined from the multiple industrial control operation devices, and based on the multiple abnormal collection addresses, multiple abnormal collection devices are determined from the multiple industrial control operation devices, and interconnection backup information is obtained. According to the interconnection backup information, interconnection communication analysis is performed on the multiple abnormal collection devices, and collaborative collection devices corresponding to the multiple abnormal collection devices are matched from the multiple direct collection devices. By generating and sending collaborative collection instructions to the multiple collaborative collection devices, the collaborative collection data of the multiple abnormal collection devices are collaboratively collected through the multiple collaborative collection devices, and the multiple direct collection data and the multiple collaborative collection data are integrated to obtain industrial control related data.

[0030] Specifically, Figure 4 This is a flow chart of direct collection and collaborative collection in the method provided in an embodiment of the present invention.

[0031] In a preferred embodiment of the present invention, the steps of determining a plurality of industrial control operation devices, directly collecting data from the plurality of industrial control operation devices and performing collaborative collection to obtain industrial control related data specifically include the following steps: Step S1031: Determine multiple industrial control operation devices.

[0032] Step S1032: directly collect data from the plurality of industrial control operation devices to obtain a plurality of directly collected data.

[0033] Step S1033: Identify the multiple directly collected data and divide the multiple industrial control operation devices into direct collection devices and abnormal collection devices.

[0034] Specifically, Figure 5 This is a flow chart of the division of industrial control operation equipment in the method provided in an embodiment of the present invention.

[0035] In a preferred embodiment of the present invention, the identifying of the plurality of directly collected data and dividing the plurality of industrial control operation devices into direct collection devices and abnormal collection devices specifically includes the following steps: Step S10331: performing address recognition on the plurality of directly collected data to obtain a plurality of direct collection addresses; Step S10332: Based on the preset address backup data, multiple direct collection addresses are matched to filter multiple abnormal collection addresses; Step S10333: Determine multiple direct data collection devices from the multiple industrial control operation devices according to the multiple direct data collection addresses; Step S10334: Determine multiple abnormality collection devices from the multiple industrial control operation devices according to the multiple abnormality collection addresses.

[0036] Furthermore, the determining of multiple industrial control operation devices, performing direct and collaborative collection on the multiple industrial control operation devices, and obtaining industrial control related data further includes the following steps: Step S1034: Match collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices, and collaboratively collect collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices.

[0037] Specifically, Figure 6 This is a flow chart of collaboratively collecting data from multiple abnormal collection devices in the method provided by an embodiment of the present invention.

[0038] In a preferred embodiment of the present invention, matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices, and collaboratively collecting collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices specifically includes the following steps: Step S10341: Obtain interconnection backup information; Step S10342: Perform interconnection communication analysis based on the interconnection backup information, and match collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices; Step S10343: Generate and send a collaborative collection instruction to the multiple collaborative collection devices; Step S10344: collaboratively collect the collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices.

[0039] Furthermore, the determining of multiple industrial control operation devices, performing direct and collaborative collection on the multiple industrial control operation devices, and obtaining industrial control related data further includes the following steps: Step S1035: Integrate the plurality of directly collected data and the plurality of collaboratively collected data to obtain industrial control related data.

[0040] Furthermore, the method for analyzing operation behavior patterns in industrial control protocols based on machine learning further includes the following steps: Step S104: performing data cleaning and feature extraction on the industrial control related data to obtain industrial control feature data.

[0041] In an embodiment of the present invention, noise is removed from industrial control related data to generate industrial control denoised data, and then missing information is supplemented in the industrial control denoised data to generate industrial control supplementary data. Thereafter, the industrial control supplementary data is standardized to generate industrial control standard data, and then feature extraction such as time series features, statistical features, and context features is performed on the industrial control standard data to obtain industrial control feature data.

[0042] Specifically, Figure 7 This is a flowchart of data cleaning and feature extraction in the method provided in an embodiment of the present invention.

[0043] In a preferred embodiment of the present invention, the data cleaning and feature extraction of the industrial control related data to obtain the industrial control feature data specifically includes the following steps: Step S1041: removing noise from the industrial control related data to generate industrial control denoised data; Step S1042: supplement the missing parts of the industrial control denoised data to generate industrial control supplementary data; Step S1043: standardize the industrial control supplementary data to generate industrial control standard data; Step S1044: extract features from the industrial control standard data to obtain industrial control feature data.

[0044] Furthermore, the method for analyzing operation behavior patterns in industrial control protocols based on machine learning further includes the following steps: Step S105: Use the machine learning model to analyze the industrial control feature data for regularities, record regularity analysis information, and perform visual display.

[0045] In an embodiment of the present invention, a machine learning model is used to conduct pattern mining on industrial control feature data to obtain pattern mining results, identify the pattern mining results, determine multiple high-frequency related behaviors, and then perform pattern analysis on the multiple high-frequency related behaviors, record the pattern analysis information, and then use time series graphs, heat maps and / or behavior network graphs to visualize the pattern analysis information. Specifically, Figure 8 This is a flowchart of recording regularity analysis information in the method provided in an embodiment of the present invention.

[0046] Among them, in the preferred embodiment provided by the present invention, the method of performing regular analysis on the industrial control feature data by the machine learning model, recording regular analysis information, and visually displaying the information specifically includes the following steps: Step S1051: Using the machine learning model, perform pattern mining on the industrial control feature data to obtain pattern mining results; Step S1052: Identify multiple high-frequency related behaviors based on the rule mining results; Step S1053: Analyze the patterns of the plurality of high-frequency related behaviors and record the pattern analysis information; Step S1054: Use a time series diagram, a heat map and / or a behavior network diagram to visualize the regularity analysis information.

[0047] Example 2 Another embodiment of the present invention provides a system for analyzing operational behavior patterns in industrial control protocols based on machine learning, including: The data annotation processing unit is used to determine multiple operation behavior categories, obtain industrial control sample data, and perform annotation processing on the industrial control sample data according to the multiple operation behavior categories to generate behavior annotation data.

[0048] In an embodiment of the present invention, the data labeling processing unit determines multiple operation behavior categories including normal operation, abnormal operation and unconscious operation (specifically including equipment restart, equipment upgrade, etc.), and obtains industrial control sample data, and then performs unsupervised clustering on the industrial control sample data according to the multiple operation behavior categories to generate initial data labels, and then uses expert labeling to manually correct and record the initial data labels to generate behavior labeling data.

[0049] The model training and verification unit is used to perform model training and cross-validation based on the behavior annotation data to build a machine learning model.

[0050] In an embodiment of the present invention, the model training and verification unit selects a basic classification model from a random forest, LSTM, GRU or convolutional neural network, and divides the behavior annotation data into a training set and a test set, and then trains the basic classification model through the training set, and then cross-validates the trained model through the test set, and then performs hyperparameter tuning to construct a machine learning model.

[0051] The data acquisition control unit is used to determine multiple industrial control operation devices, directly and collaboratively acquire data from the multiple industrial control operation devices, and obtain industrial control related data.

[0052] In an embodiment of the present invention, the data acquisition control unit determines multiple industrial control operation devices with the need to analyze the rules of operation behavior, directly acquires multiple industrial control operation devices, obtains multiple directly acquired data, then performs address recognition on the multiple directly acquired data, obtains multiple direct acquisition addresses, matches the multiple direct acquisition addresses based on preset address backup data, marks the unmatched addresses as abnormal acquisition addresses, and implements the screening of multiple abnormal acquisition addresses. Then, based on the multiple direct acquisition addresses, multiple direct acquisition devices are determined from the multiple industrial control operation devices, and based on the multiple abnormal acquisition addresses, multiple abnormal acquisition devices are determined from the multiple industrial control operation devices, and interconnection backup information is obtained. According to the interconnection backup information, interconnection communication analysis is performed on the multiple abnormal acquisition devices, and collaborative acquisition devices corresponding to the multiple abnormal acquisition devices are matched from the multiple direct acquisition devices. By generating and sending collaborative acquisition instructions to the multiple collaborative acquisition devices, the collaborative acquisition data of the multiple abnormal acquisition devices are collaboratively acquired through the multiple collaborative acquisition devices, and the multiple direct acquisition data and the multiple collaborative acquisition data are integrated to obtain industrial control related data.

[0053] The relevant data processing unit is used to perform data cleaning and feature extraction on the industrial control related data to obtain industrial control feature data.

[0054] In an embodiment of the present invention, the relevant data processing unit removes noise from the industrial control related data to generate industrial control denoised data, then supplements the missing parts of the industrial control denoised data to generate industrial control supplementary data, and then standardizes the industrial control supplementary data to generate industrial control standard data, and then extracts features such as time series features, statistical features, and context features from the industrial control standard data to obtain industrial control feature data.

[0055] A regularity analysis and display unit is used to perform regularity analysis on the industrial control feature data through the machine learning model, record regularity analysis information, and perform visual display. In an embodiment of the present invention, the pattern analysis and display unit uses a machine learning model to perform pattern mining on the industrial control feature data, obtain pattern mining results, then identify the pattern mining results, determine multiple high-frequency related behaviors, then perform pattern analysis on the multiple high-frequency related behaviors, record the pattern analysis information, and then use time series graphs, heat maps and / or behavior network graphs to visualize the pattern analysis information.

[0056] It should be noted that, in the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant description of other embodiments.

[0057] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0058] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0059] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0060] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0061] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0062] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for analyzing operational behavior patterns in industrial control protocols based on machine learning, characterized by: The method specifically comprises the following steps: Determine multiple operation behavior categories, obtain industrial control sample data, and perform labeling processing on the industrial control sample data according to the multiple operation behavior categories to generate behavior labeling data; Perform model training and cross-validation based on the behavior annotation data to build a machine learning model; Identify multiple industrial control operation devices, and perform direct and collaborative collection on the multiple industrial control operation devices to obtain industrial control related data; Performing data cleaning and feature extraction on the industrial control related data to obtain industrial control feature data; The machine learning model is used to analyze the industrial control feature data for regularities, record regularity analysis information, and perform visual display.

2. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 1 is characterized in that: The determining of multiple operation behavior categories, obtaining industrial control sample data, and labeling the industrial control sample data according to the multiple operation behavior categories to generate behavior labeling data specifically includes the following steps: Identify multiple categories of operational behavior; Obtain industrial control sample data; Performing unsupervised clustering on the industrial control sample data according to the plurality of operation behavior categories to generate initial data labels; The initial data labels are manually corrected and rule-annotated to generate behavior annotation data.

3. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 2 is characterized in that: The multiple operation behavior categories include: normal operation, abnormal operation and unconscious operation.

4. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 1 is characterized in that: The model training and cross-validation are performed based on the behavior annotation data to construct a machine learning model, specifically comprising the following steps: Select a base classification model; Dividing the behavior annotation data into a training set and a test set; Training the basic classification model using the training set; Perform cross-validation after model training using the test set; Build machine learning models.

5. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 4 is characterized in that: The basic classification model is a random forest, LSTM, GRU or convolutional neural network.

6. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 1, characterized in that: Determining a plurality of industrial control operation devices, directly collecting data and collaboratively collecting data from the plurality of industrial control operation devices, and obtaining industrial control related data specifically includes the following steps: Identify multiple industrial control operation devices; Directly collecting data from the plurality of industrial control operation devices to obtain a plurality of directly collected data; Identifying the plurality of directly collected data, and dividing the plurality of industrial control operation devices into direct collection devices and abnormal collection devices; Matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices, and collaboratively collecting collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices; The industrial control related data are obtained by integrating the multiple directly collected data and the multiple collaboratively collected data.

7. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 6 is characterized in that: The identifying of the plurality of directly collected data and dividing the plurality of industrial control operation devices into direct collection devices and abnormal collection devices specifically includes the following steps: Performing address recognition on the plurality of directly collected data to obtain a plurality of directly collected addresses; Based on the preset address backup data, the plurality of direct collection addresses are matched, and a plurality of abnormal collection addresses are screened; Determining a plurality of direct acquisition devices from the plurality of industrial control operation devices according to the plurality of direct acquisition addresses; According to the plurality of the abnormality collection addresses, a plurality of abnormality collection devices are determined from the plurality of the industrial control operation devices.

8. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 6 is characterized in that: The method of matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices and collaboratively collecting collaborative collection data of the multiple abnormal collection devices through the multiple collaborative collection devices specifically includes the following steps: Get Internet backup information; Performing interconnection communication analysis based on the interconnection backup information, and matching collaborative collection devices corresponding to multiple abnormal collection devices from multiple direct collection devices; generating and sending a collaborative collection instruction to the plurality of collaborative collection devices; The collaborative collection data of the multiple abnormal collection devices are collaboratively collected by the multiple collaborative collection devices.

9. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 1, characterized in that: The data cleaning and feature extraction of the industrial control related data to obtain the industrial control feature data specifically includes the following steps: De-noising the industrial control related data to generate industrial control denoised data; Supplementing missing data for the industrial control denoised data to generate industrial control supplementary data; Standardizing the industrial control supplementary data to generate industrial control standard data; Feature extraction is performed on the industrial control standard data to obtain industrial control feature data.

10. The method for analyzing operation behavior patterns in industrial control protocols based on machine learning according to claim 1, characterized in that: The method of analyzing the industrial control feature data using the machine learning model, recording the analysis information, and visually displaying the information specifically includes the following steps: Using the machine learning model, mining patterns on the industrial control feature data to obtain pattern mining results; Based on the results of the rule mining, multiple high-frequency related behaviors are identified; Performing regular analysis on the plurality of high-frequency associated behaviors and recording regular analysis information; Use time series graphs, heat maps and / or behavior network graphs to visualize the regularity analysis information.

Images