Industrial control dynamic access control method and system based on machine learning

Abstract

The invention discloses an industrial control dynamic access control method and system based on machine learning, and relates to the technical field of industrial control dynamic control. Actual access behaviors of a user and equipment are structured into an access map through cooperation of an identity access sensing module and an access path modeling module; the authority control is converted from a static rule table to a dynamic model which is adaptively adjusted along with time, working conditions and equipment states, so that the defects that the traditional static access control is rigid and is difficult to adapt to the change of a complex industrial control process are overcome. The behavior stability calculation module can quantify the stability characteristics of the access path in different time windows, and the access deviation measurement module can identify the access behavior which seems to be compliant but not reasonable based on the characteristics, so that the false alarm rate and the missing report rate under the traditional single-point threshold method are effectively reduced. The access event monitoring unit captures the access event in real time on the premise of not interrupting the normal communication process of the industrial control system in a mode of directly connecting a read-only interface with a data bus.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control dynamic control, and in particular to an industrial control dynamic access control method and system based on machine learning. Background Art

[0002] This paper focuses on access behaviors between PLCs, DCSs, and SCADA master stations, including operator accounts, engineer workstations, field devices, accessed process objects, and the read, write, and execute instruction sequences generated by industrial protocols such as Modbus, S7, and OPC UA. Based on this, the system uses an access behavior graph to structure the relationship between identity, resources, instructions, and time, and uses this graph as a vehicle for machine learning identification and dynamic permission mapping.

[0003] Existing technologies generally use static access control lists, role-based access control, whitelists, and fixed time period policies. These solutions have obvious shortcomings: First, permissions are decoupled from behaviors, making it impossible to reflect the differences in access rights for the same identity at different process stages, shifts, and equipment states. This makes it difficult to maintain "minimum privilege" during operation. Second, policy maintenance is highly dependent on manual labor. In scenarios such as equipment replacement, process adjustments, temporary overhauls, and remote maintenance, rule updates lag, leading to permission drift and rule aging. Third, traditional anomaly detection mostly stays at static fields or single-point event thresholds, lacks joint modeling of instruction sequences, access paths and time patterns, and is difficult to timely identify "compliant but unreasonable" unauthorized access and path-level anomalies.

[0004] The root cause of these issues lies in the highly sequential and condition-dependent nature of industrial control production. Access patterns during process switching, fluctuations in production line cycle times, and nighttime and maintenance periods differ significantly from normal daytime access patterns. Static lists struggle to map this dynamic coupling of behavior and permissions in real time. Furthermore, account sharing, temporary outsourcing, cross-domain remote maintenance, and emergency response scenarios can render seemingly legitimate access illicit at specific times and along specific paths. Summary of the Invention

[0005] In response to the deficiencies of the prior art, the present invention provides an industrial control dynamic access control method and system based on machine learning, which solves the problems mentioned in the background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a machine learning-based industrial control dynamic access control system, including an identity access perception module, an access path modeling module, a behavior stability calculation module, an access deviation measurement module, a dynamic permission response module, and a behavior permission feedback learning module; The identity access awareness module monitors the access events of users and devices in the industrial control system in real time, and dynamically marks them based on their historical behaviors to obtain the identity access tuple set Ius; The access path modeling module constructs the access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes; The behavior stability calculation module is based on the access graph G(t), analyzes the changes in the access frequency of resources within the time window [t0, t0+T], and obtains the temporal stability of the user and device access path Wsta; The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

[0007] Preferably, the identity access awareness module includes an access event monitoring unit and a dynamic marking unit; The access event monitoring unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures the access events of all users and devices in real time and records the information of each event, including the user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr and operation instruction type Op; Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions; The time information of the access event includes the original request time and the deviation between the acquisition end and the system master clock. The calibrated request time is obtained by subtracting the clock deviation from the original request time. This ensures that the time sequence of event records is consistent with the actual working conditions and avoids misjudgment of access behavior due to acquisition delays. The dynamic marking unit analyzes the access events obtained by introducing an access similarity function, compares them with the historical access behavior database, obtains the access matching degree Match, and compares it with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access mark Mta; The access matching degree Match is obtained by comparing multiple matching features such as user identity identifier UID, access resource object Rk, request timestamp Tr, and operation instruction type Op one by one, and assigning a weight to each matching feature. When the feature is consistent with the historical behavior, the indicator function takes the value of 1, otherwise it takes the value of 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern. The dynamic access token Mta is obtained by matching in the following ways: When the access matching degree Match ≥ matching threshold Tmac, it is marked as normal; When the access matching degree Match is less than the matching threshold Tmac, it is marked as uncommon; The obtained user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, operation instruction type Op and dynamic access tag Mta are fitted to obtain the identity access tuple set Ius.

[0008] Preferably, the access path modeling module includes a node definition and indexing unit and a directed edge construction and attribute annotation unit; The node definition and indexing unit extracts the user identity identifier UID, device number DID, and access resource object Rk from the identity access tuple set Ius within the unit time window ΔT; merges the devices used by the same user into the same type of entity node: user node; access resource object Rk is used as resource node, forming two types of node sets in the graph, and establishes a node index table N; assigns a unique index ID to each node for subsequent rapid construction of directed edges; The node index table N is obtained by the following formula: N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]} Where ni represents the node identifier, user identity identifier UID, device number DID and access resource object Rk, N(t, t+ΔT) represents the node set within the time window [t, t+ΔT]; The directed edge construction and attribute annotation unit traverses the identity access tuple set Ius within the time window and maps each access record to a directed edge in the graph. The starting point is the access initiating node, that is, the user or device, and the end point is the accessed resource node. For each directed edge, the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta are recorded to construct the edge set E and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)). The edge set E is obtained by the following formula: E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]}; where eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the edge set within the time window [t, t+ΔT].

[0009] Preferably, the behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit; The access frequency statistical analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij; The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses to the path in time slice tk to the length of the time slice; The average access frequency pfij is obtained as follows: within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length, and the access frequency fij(tk) of the path is counted for each time slice tk; the access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path in the entire time window.

[0010] Preferably, the temporal stability quantification unit performs a stability score on the access frequency change of each path by averaging the access frequency pfij within the time window [t0, t0+T] to obtain the temporal stability degree Wsta; The degree of temporal stability Wsta is obtained by the following formula: ; Where T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

[0011] The formula for obtaining the temporal stability degree Wsta directly converts access frequency fluctuations into a stability score Wsta, which is convenient for direct use in dynamic permission control. The integral and exponential mapping reduces the impact of occasional extreme access on the overall stability judgment. The sensitivity coefficient Ks can be used to dynamically adjust the sensitivity to fluctuations according to the importance of the industrial control system and the level of operational risk; The temporal stability degree Wsta calculation step includes: obtaining the access frequency fij(t) of the access path at each moment within a set time window [t0, t0+T], calculating the average access frequency pfij within the time window, and introducing a stability sensitivity coefficient Ks based on the absolute value of the difference between the access frequency and the average access frequency for scaling processing; inputting the scaled difference into an exponential decay function to obtain the instantaneous stability value at each moment, and integrating and averaging the instantaneous stability value within the time window to obtain the overall temporal stability degree WstaW of the access path within the time window; The sensitivity coefficient Ks is obtained by fitting the historical access behavior data with the known stability annotation results, and determining the sensitivity coefficient Ks that minimizes the error between the predicted stability and the annotation results by using least squares fitting.

[0012] Preferably, the access deviation measurement module includes an abnormal factor extraction unit and a deviation calculation and determination unit; The abnormal factor extraction unit extracts factors that cause abnormal access behavior from the access graph G(t) and historical data, and performs unified dimensional processing, including the operation difference factor Uop, the time abnormality factor Utime, and the path uniqueness factor Upath; The operation difference factor Uop is obtained as follows: all the operation instruction types that have appeared in the long-term access records of user U are extracted to form their historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has never appeared in the user's history and is an unconventional behavior, and the operation difference factor Uop is assigned to 1; when the operation instruction type Op(t) at time t is in the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop is assigned to 0; The time anomaly factor Utime is obtained as follows: first, time t is periodically mapped to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value; then, the difference between the current time and the user's average active time mapping value μU is calculated to obtain the deviation between the current time and the user's regular time, and the absolute value is taken to ensure that the deviation value is non-negative; then, the time sensitivity coefficient is introduced to scale the impact of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime; the time sensitivity coefficient is obtained by fitting historical data.

[0013] The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access records to the maximum access frequency of all paths in the historical access records.

[0014] Preferably, the deviation calculation and determination unit combines the obtained operation difference factor Uop, time anomaly factor Utime and path uniqueness factor Upath with the time stability degree Wsta to calculate and obtain the access deviation Ψdev; The access deviation Ψdev is obtained by the following formula: ; Where a1 represents the weight of the operation difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

[0015] Based on existing historical access records and their annotated normal and abnormal labels, a regression model is trained to minimize the error between the predicted deviation and the actual label, thereby obtaining the optimal operation difference factor weight a1, time anomaly factor weight a2, and path uniqueness factor weight a3. Through the time stability inversion factor, the model can automatically suppress the misjudgment of long-term stable paths and enhance the sensitivity to temporary path anomalies; Through the combination of multiple factors, the deviation determination does not only rely on a certain dimension of characteristics, reducing the deviation caused by a single indicator; The larger the final Ψdev value is, the more significantly the access path differs from the normal pattern, and the more likely it is abnormal behavior.

[0016] Preferably, the dynamic permission response module receives the access deviation Ψdev and dynamically calculates the deviation threshold Tη based on the historical deviation distribution; The deviation threshold Tη is obtained by the following formula: ; Where μΨdev represents the mean of access deviation, σΨdev represents the standard deviation of access deviation, and v1 represents the sensitivity adjustment coefficient; Steps for obtaining the sensitivity adjustment coefficient: First, collect and annotate historical data: collect historical samples of access deviation and mark normal / abnormal status; then, test multiple candidate values: calculate dynamic thresholds for multiple groups of candidate sensitivity adjustment coefficients v1, and count the corresponding false alarm rates and missed alarm rates respectively; then optimize performance indicators: minimize the combined cost of false alarms and missed alarms by selecting the optimal value; finally, perform adaptive updates: re-estimate the sensitivity adjustment coefficient v1 regularly during system operation or when performance degrades to ensure long-term stability and sensitivity.

[0017] Compare the obtained deviation threshold Tη with the access deviation degree Ψdev to determine whether to trigger the permission compression mechanism; The judgment method is: When the access deviation Ψdev ≤ the deviation threshold Tη, it means that the permission compression mechanism is not triggered; When the access deviation Ψdev> the deviation threshold Tη, it indicates that the permission compression mechanism is triggered and the temporary minimum permission set is activated; this includes generating a temporary permission policy for the current user and device to limit the access scope, operation type and access frequency.

[0018] When the deviation exceeds the threshold, the user immediately enters a permission compression state, retaining only the minimum necessary operations to prevent the spread of potential risks; When the deviation returns to normal, permissions are gradually restored to reduce the impact on business continuity.

[0019] Preferably, the behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security event Xsafe within the time window [t0, t0+T], calculates the accuracy of the system judgment, and obtains the evaluation function REs; When the security event Xsafe=1, it means that the access did not cause a security incident; When the security event Xsafe=0, it means that the access caused an exception; The evaluation function REs is obtained by the following formula: ; Where Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign; The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη. The new deviation threshold nTη is obtained by the following formula: .

[0020] A machine learning-based industrial control dynamic access control method includes the following steps: Step 1: The identity access perception module monitors the access events of users and devices in the industrial control system in real time, dynamically tags them based on their historical behaviors, and obtains the identity access tuple set Ius; Step 2: The access path modeling module constructs an access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes. Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the access frequency of resources within the time window [t0, t0+T] and obtain the temporal stability of the user and device access paths Wsta; Step 4: The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; Step 5: The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; Step 6: The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

[0021] The present invention provides a method and system for industrial control dynamic access control based on machine learning, which has the following beneficial effects: (1) When the system is running, the actual access behavior of users and devices is structured into an access graph through the cooperation of the identity access perception module and the access path modeling module. This allows the permission control to be transformed from a static rule table to a dynamic model that is adaptively adjusted over time, working conditions, and device status. This eliminates the shortcomings of traditional static access control, which is rigid and difficult to adapt to changes in complex industrial control processes. The behavior stability calculation module can quantify the stability characteristics of the access path within different time windows, and the access deviation measurement module can identify "seemingly compliant but unreasonable" access behaviors based on these characteristics, thereby effectively reducing the false positive and false negative rates under the traditional single-point threshold method and improving the accuracy and coverage of abnormal access identification.

[0022] (2) By connecting the access event monitoring unit directly to the data bus via a read-only interface, access events are captured in real time without interrupting the normal communication process of the industrial control system. This avoids the interference of traditional data acquisition methods on the control message flow and ensures the continuity and real-time performance of the system operation. The difference between the original request time and the acquisition end-system master clock deviation is used as the calibration time to ensure that the event sequence is completely consistent with the actual working conditions, eliminating event sorting errors caused by device clock inconsistency or network delay, and improving the accuracy of subsequent access behavior modeling.

[0023] (3) Through the node definition and indexing unit, users, devices, and resource objects are abstracted into two types of nodes within a unit time window, and a node index table is established, so that access data is converted from raw event logs into structured data with topological semantics, which facilitates subsequent path analysis and behavioral pattern recognition, overcoming the deficiency of traditional permission tables that cannot reflect the access relationship network. The directed edge construction and attribute annotation unit maps each access record into a directed edge and retains attributes such as request time, operation instruction type, and dynamic access tag, so that the access path contains both topological information and temporal and behavioral characteristics, thereby reflecting the full picture of "who accessed what, when, and how" in the modeling, which cannot be reflected in traditional static control strategies.

[0024] (4) By combining the operational difference factor Uop, the time anomaly factor Utime, and the path uniqueness factor Upath with the time stability level Wsta, we can avoid the bias caused by relying solely on a single field or static threshold, and better identify accesses that are "superficially compliant but essentially unreasonable." Using long-term stability as the master switch to suppress occasional fluctuations, we then use three types of anomaly factors for detailed judgment: the probability of misjudgment of stable paths decreases, and unstable accesses with multiple anomalies are more easily captured. Overall, this achieves a two-way optimization of both false positive and false negative rates. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of a block diagram of an industrial control dynamic access control system based on machine learning in the present invention; Figure 2 This is a schematic diagram of the steps of a method for dynamic access control of industrial control based on machine learning in the present invention; Figure 3 A schematic diagram of a flow chart for obtaining the evaluation function of the present invention; Figure 4 It is a time stability degree trend window diagram of the present invention; Figure 5 It is a bar chart of the access deviation of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0027] Example 1 The present invention provides an industrial control dynamic access control system based on machine learning, please refer to Figures 1 to 5 , including identity access perception module, access path modeling module, behavior stability calculation module, access deviation measurement module, dynamic permission response module and behavior permission feedback learning module; The identity access awareness module monitors the access events of users and devices in the industrial control system in real time, and dynamically marks them based on their historical behaviors to obtain the identity access tuple set Ius; The access path modeling module constructs the access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes; The behavior stability calculation module is based on the access graph G(t), analyzes the changes in the access frequency of resources within the time window [t0, t0+T], and obtains the temporal stability of the user and device access path Wsta; The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

[0028] In this embodiment, the identity access awareness module collaborates with the access path modeling module to structure the actual access behavior of users and devices into an access graph. This transforms permission control from a static rule table to a dynamic model that adapts to time, operating conditions, and device status. This overcomes the rigidity of traditional static access control and its difficulty adapting to changes in complex industrial control processes. The behavior stability calculation module quantifies the stability characteristics of access paths within different time windows, and the access deviation measurement module identifies seemingly compliant but unreasonable access behaviors based on these characteristics. This effectively reduces the false positive and false negative rates of traditional single-point threshold methods and improves the accuracy and coverage of abnormal access identification.

[0029] The dynamic permission response module instantly triggers permission compression when deviations exceed dynamic thresholds, temporarily converging permissions to the minimum security requirements. This effectively prevents unauthorized operations from causing process disruptions or security risks in industrial control systems, while also avoiding the decline in production efficiency caused by long-term excessive tightening of permissions. The behavioral permission feedback learning module retrospectively evaluates the actual effectiveness of the permission compression mechanism against real security incidents and iteratively optimizes the threshold and deviation calculation models, making the system adaptive and able to maintain the effectiveness and sensitivity of detection strategies despite long-term changes in the production environment and attack threat patterns.

[0030] Example 2 This embodiment is explained in Example 1, please refer to Figure 1 and Figure 3 ,Specifically: the identity access perception module includes an access event ,monitoring unit and a dynamic marking unit; The access event monitoring unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures the access events of all users and devices in real time and records the information of each event, including the user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr and operation instruction type Op; Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions; The time information of the access event includes the original request time and the deviation between the acquisition end and the system master clock. The calibrated request time is obtained by subtracting the clock deviation from the original request time. The dynamic marking unit analyzes the access events obtained by introducing an access similarity function, compares them with the historical access behavior database, obtains the access matching degree Match, and compares it with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access mark Mta; The access matching degree Match is obtained by comparing multiple matching features such as user identity identifier UID, access resource object Rk, request timestamp Tr, and operation instruction type Op one by one, and assigning a weight to each matching feature. When the feature is consistent with the historical behavior, the indicator function takes the value of 1, otherwise it takes the value of 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern. The dynamic access token Mta is obtained by matching in the following ways: When the access matching degree Match ≥ matching threshold Tmac, it is marked as normal; When the access matching degree Match is less than the matching threshold Tmac, it is marked as uncommon; The obtained user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, operation instruction type Op and dynamic access tag Mta are fitted to obtain the identity access tuple set Ius.

[0031] In this embodiment, the access event monitoring unit directly connects to the data bus via a read-only interface, capturing access events in real time without interrupting the normal communication flow of the industrial control system. This avoids interference with the control message flow caused by traditional data collection methods, ensuring the continuity and real-time performance of the system. The difference between the original request time and the offset between the acquisition terminal and the system master clock is used as the calibration time, ensuring that the event sequence is completely consistent with the actual operating conditions. This eliminates event sequencing errors caused by device clock inconsistencies or network delays, and improves the accuracy of subsequent access behavior modeling.

[0032] The dynamic tagging unit compares multiple features with a historical behavior database and assigns weights to each feature. This allows for a comprehensive, multi-dimensional assessment of whether access behavior aligns with historical patterns. Compared to single-feature matching, it can more accurately distinguish between normal and unusual behavior. By comparing the matching degree with a preset matching threshold, it dynamically generates access tags, enabling the ability to instantly tag access behavior as it occurs, reducing security risks associated with delayed judgment and helping to quickly block potential unauthorized access.

[0033] Example 3 This embodiment is explained in Example 2, please refer to Figure 4 ,Specifically: the access path modeling module includes a node definition and indexing ,unit and a directed edge construction and attribute annotation unit; The node definition and indexing unit extracts the user identity identifier UID, device number DID, and access resource object Rk from the identity access tuple set Ius within the unit time window ΔT; merges the devices used by the same user into the same type of entity node: user node; access resource object Rk is used as resource node, forming two types of node sets in the graph, and establishes a node index table N; The node index table N is obtained by the following formula: N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]} Where ni represents the node identifier, N(t, t+ΔT) represents the node set in the time window [t, t+ΔT]; The directed edge construction and attribute labeling unit traverses the identity access tuple set Ius within the time window and maps each access record to a directed edge in the graph. The starting point is the access initiating node, and the end point is the accessed resource node. For each directed edge, the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta are recorded to construct the edge set E and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)). The edge set E is obtained by the following formula: E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]}; where eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the edge set within the time window [t, t+ΔT].

[0034] The behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit; The access frequency statistical analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij; The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses to the path in time slice tk to the length of the time slice; The average access frequency pfij is obtained as follows: within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length, and the access frequency fij(tk) of the path is counted for each time slice tk; the access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path in the entire time window.

[0035] The temporal stability quantification unit uses the average access frequency pfij within the time window [t0, t0+T] to score the access frequency change of each path and obtain the temporal stability degree Wsta; The degree of temporal stability Wsta is obtained by the following formula: ; Where T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

[0036] In this embodiment, a node definition and indexing unit abstracts users, devices, and resource objects into two types of nodes within a unit time window and establishes a node index table. This transforms access data from raw event logs into structured data with topological semantics, facilitating subsequent path analysis and behavioral pattern recognition. This overcomes the inability of traditional permission tables to reflect access relationship networks. A directed edge construction and attribute annotation unit maps each access record into a directed edge, preserving attributes such as request time, operation instruction type, and dynamic access tags. This ensures that access paths incorporate both topological information and temporal and behavioral characteristics. This allows for a comprehensive modeling of "who accessed what, when, and how," a capability not possible with traditional static control strategies.

[0037] The access frequency statistical analysis unit divides the time window into equal-time slices, performs fine-grained statistics on the access frequency of each path within each time slice, and calculates the average access frequency. This reveals the distribution characteristics of access behavior in different time periods, avoiding the flaw of global statistics that masks short-term high-frequency anomalies. The temporal stability quantification unit combines the average access frequency with an exponential decay factor to calculate the degree of temporal stability, effectively mitigating the impact of occasional fluctuations. This allows the system to distinguish long-term stable paths from temporary or anomalous paths, thereby improving the accuracy of anomaly detection and reducing false positives.

[0038] By combining the access graph with temporal stability scores, the system dynamically adapts to changing access patterns across different process stages, production cycles, and equipment status without changing hardware, addressing the inability of traditional static access control to update policies in a timely manner. The constructed access graph and stability level serve as core input data for the subsequent access deviation measurement module, enabling deviation calculations to be based on a complete behavioral topology and timing patterns, fundamentally improving the accuracy and real-time nature of deviation detection and dynamic permission adjustments.

[0039] Example 4 This embodiment is explained in Example 3, please refer to Figure 5 ,Specifically: the access deviation measurement module includes an anomaly factor extraction unit and a deviation ,computation and determination unit; The abnormal factor extraction unit extracts factors that cause abnormal access behavior from the access graph G(t) and historical data, including the operation difference factor Uop, the time abnormality factor Utime, and the path uniqueness factor Upath; The operation difference factor Uop is obtained as follows: all the operation instruction types that have appeared in the long-term access records of user U are extracted to form their historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has never appeared in the user's history and is an unconventional behavior, and the operation difference factor Uop is assigned to 1; when the operation instruction type Op(t) at time t is in the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop is assigned to 0; The time anomaly factor Utime is obtained by first periodically mapping time t to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value. The difference between this value and the user's average active time mapping value μU is then calculated to obtain the deviation between the current time and the user's regular time, and the absolute value is taken to ensure that the deviation is non-negative. The time sensitivity coefficient is then introduced to scale the impact of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime. The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access records to the maximum access frequency of all paths in the historical access records.

[0040] The deviation calculation and determination unit combines the obtained operation difference factor Uop, time anomaly factor Utime and path uniqueness factor Upath with the time stability degree Wsta to calculate the access deviation Ψdev; The access deviation Ψdev is obtained by the following formula: ; Where a1 represents the weight of the operation difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

[0041] Specific examples: Table 1: Sample table for calculating access deviation;

[0042] This embodiment combines the operational variance factor Uop, the temporal anomaly factor Utime, and the path uniqueness factor Upath with the temporal stability level Wsta to avoid bias caused by relying solely on a single field or static threshold, and better identify accesses that appear compliant but are ultimately illogical. Long-term stability is used as a master switch to suppress occasional fluctuations, and three types of anomaly factors are then used for detailed identification. This reduces the probability of misidentification for stable paths, making it easier to capture unstable accesses with multiple anomalies. Overall, this achieves a balanced optimization of both false positive and false negative rates.

[0043] The time anomaly factor incorporates a user's daily activity cycle model, automatically distinguishing the "normal-abnormal" boundary across different operating states, such as day / night shift and maintenance / production. This addresses the pain point that static access tables fail to reflect operational dependencies. The path uniqueness factor enhances sensitivity to historically rare access links, enabling early detection of potential lateral movement, unconventional resource access, and cross-domain privilege escaping, shortening the time from anomaly generation to policy response. Based on the access graph, deviation determination inherently incorporates the context of "who accessed what resource when and with what command," adapting to multiple protocols while avoiding the limitations of pure field detection that ignores path-level risks. Deviation, as a continuous quantity, can be directly mapped to different levels of response policies (such as alert only, write restriction, or triggering temporary least privilege), enabling granular risk management and mitigating production disruptions caused by "one-size-fits-all" approaches.

[0044] Example 5 This embodiment is explained in Example 4. Please refer to Figure 3 ,Specifically: the dynamic permission response module receives the access deviation Ψdev and dynamically calculates the deviation threshold Tη based on the ,historical deviation distribution; The deviation threshold Tη is obtained by the following formula: ; Where μΨdev represents the mean of access deviation, σΨdev represents the standard deviation of access deviation, and v1 represents the sensitivity adjustment coefficient; Compare the obtained deviation threshold Tη with the access deviation degree Ψdev to determine whether to trigger the permission compression mechanism; The judgment method is: When the access deviation Ψdev ≤ the deviation threshold Tη, it means that the permission compression mechanism is not triggered; When the access deviation Ψdev> the deviation threshold Tη, it indicates that the permission compression mechanism is triggered and the temporary minimum permission set is activated.

[0045] The behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security event Xsafe within the time window [t0, t0+T], calculates the accuracy of the system judgment, and obtains the evaluation function REs; When the security event Xsafe=1, it means that the access did not cause a security incident; When the security event Xsafe=0, it means that the access caused an exception; The evaluation function REs is obtained by the following formula: ; Where Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign; The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη. The new deviation threshold nTη is obtained by the following formula: .

[0046] In this embodiment, the deviation threshold is no longer a fixed, manually set value. Instead, it is calculated in real time based on the historical distribution of access deviations and automatically updated with the mean, standard deviation, and sensitivity adjustment coefficient. This allows the system to flexibly adjust to changes in operating status and access behavior, resolving the issue of static thresholds being susceptible to failure when operating conditions change. By comparing real-time access deviations with dynamic thresholds, temporary minimum privilege control is triggered only when significant deviations occur, minimizing the disruption to normal production operations caused by false triggers and ensuring rapid entry into a restricted state should high-risk behavior occur.

[0047] The behavioral permission feedback learning module compares the execution results of the permission compression mechanism with actual security incidents to generate a quantitative score of judgment accuracy, forming a complete "detection-response-verification-correction" closed loop to ensure the continuous optimization of the system's judgment capabilities. When judgment accuracy falls below the target score, the system automatically corrects deviations from the threshold to align the threshold with the current threat landscape, avoiding long-term reliance on manual maintenance and improving the ability to respond to sudden threats and new attack methods. Dynamic adjustment of thresholds and feedback correction ensures that the system strikes a balance between security and productivity, preventing frequent restrictions due to low thresholds and allowing high-risk behavior due to high thresholds.

[0048] Example 6 A dynamic access control method for industrial control based on machine learning, please refer to Figure 2 , specifically: including the following steps: Step 1: The identity access perception module monitors the access events of users and devices in the industrial control system in real time, dynamically tags them based on their historical behaviors, and obtains the identity access tuple set Ius; Step 2: The access path modeling module constructs an access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes. Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the access frequency of resources within the time window [t0, t0+T] and obtain the temporal stability of the user and device access paths Wsta; Step 4: The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; Step 5: The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; Step 6: The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

[0049] In this embodiment, by combining access graphs with stability analysis, it is possible to identify normal and abnormal access patterns across different operating conditions, process stages, production shifts, and equipment states. This allows permission policies to automatically adjust as behavioral patterns change, avoiding the drawback of static access control tables that become ineffective in changing environments. The deviation measurement module integrates temporal stability with multidimensional anomaly factors to calculate access deviation. This allows it to detect both obvious unauthorized behavior and covert, atypical, and abnormal access, significantly improving detection accuracy and coverage.

[0050] By filtering occasional fluctuations through stability and combining it with multi-factor deviation determination, we can effectively reduce the misjudgment of normal operations while ensuring that risky behaviors are not missed, achieving a balance between security and production continuity. The dynamic permission response module automatically calculates the deviation threshold based on the historical distribution of access deviations, and combines real-time data to determine whether to trigger a temporary minimum permission set, achieving risk-driven permission reduction and reducing interference with normal business. The behavioral permission feedback learning module compares the permission adjustment results with actual security incidents, evaluates the effectiveness of the policy, and automatically corrects the deviation threshold, so that the system can maintain the effectiveness of detection and response when the threat form and production rhythm change.

[0051] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A machine learning-based industrial control dynamic access control system, characterized by: It includes identity access perception module, access path modeling module, behavior stability calculation module, access deviation measurement module, dynamic permission response module and behavior permission feedback learning module; The identity access awareness module monitors the access events of users and devices in the industrial control system in real time, and dynamically marks them based on their historical behaviors to obtain the identity access tuple set Ius; The access path modeling module constructs the access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes; The behavior stability calculation module is based on the access graph G(t), analyzes the changes in the access frequency of resources within the time window [t0, t0+T], and obtains the temporal stability of the user and device access path Wsta; The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

2. The machine learning-based industrial control dynamic access control system according to claim 1, characterized in that: The identity access perception module includes an access event monitoring unit and a dynamic marking unit; The access event monitoring unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures the access events of all users and devices in real time and records the information of each event, including the user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr and operation instruction type Op; Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions; The time information of the access event includes the original request time and the deviation between the acquisition end and the system master clock. The calibrated request time is obtained by subtracting the clock deviation from the original request time. The dynamic marking unit analyzes the access events obtained by introducing an access similarity function, compares them with the historical access behavior database, obtains the access matching degree Match, and compares it with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access mark Mta; The access matching degree Match is obtained by comparing multiple matching features such as user identity identifier UID, access resource object Rk, request timestamp Tr, and operation instruction type Op one by one, and assigning a weight to each matching feature. When the feature is consistent with the historical behavior, the indicator function takes the value of 1, otherwise it takes the value of 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern. The dynamic access token Mta is obtained by matching in the following ways: When the access matching degree Match ≥ matching threshold Tmac, it is marked as normal; When the access matching degree Match is less than the matching threshold Tmac, it is marked as uncommon; The obtained user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, operation instruction type Op and dynamic access tag Mta are fitted to obtain the identity access tuple set Ius.

3. The machine learning-based industrial control dynamic access control system according to claim 2, characterized in that: The access path modeling module includes a node definition and indexing unit and a directed edge construction and attribute annotation unit; The node definition and indexing unit extracts the user identity identifier UID, device number DID, and access resource object Rk from the identity access tuple set Ius within the unit time window ΔT; merges the devices used by the same user into the same type of entity node: user node; access resource object Rk is used as resource node, forming two types of node sets in the graph, and establishes a node index table N; The node index table N is obtained by the following formula: N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]} Where ni represents the node identifier, N(t, t+ΔT) represents the node set in the time window [t, t+ΔT]; The directed edge construction and attribute labeling unit traverses the identity access tuple set Ius within the time window and maps each access record to a directed edge in the graph. The starting point is the access initiating node, and the end point is the accessed resource node. For each directed edge, the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta are recorded to construct the edge set E and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)). The edge set E is obtained by the following formula: E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]}; where eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the edge set within the time window [t, t+ΔT].

4. The machine learning-based industrial dynamic access control system according to claim 3, characterized in that: The behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit; The access frequency statistical analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij; The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses to the path in time slice tk to the length of the time slice; The average access frequency pfij is obtained as follows: within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length, and the access frequency fij(tk) of the path is counted for each time slice tk; the access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path in the entire time window.

5. The machine learning-based industrial control dynamic access control system according to claim 4, characterized in that: The temporal stability quantification unit uses the average access frequency pfij within the time window [t0, t0+T] to score the access frequency change of each path and obtain the temporal stability degree Wsta; The degree of temporal stability Wsta is obtained by the following formula: ； Where T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

6. The machine learning-based industrial control dynamic access control system according to claim 1, characterized in that: The access deviation measurement module includes an abnormal factor extraction unit and a deviation calculation and determination unit; The abnormal factor extraction unit extracts factors that cause abnormal access behavior from the access graph G(t) and historical data, including the operation difference factor Uop, the time abnormality factor Utime, and the path uniqueness factor Upath; The operation difference factor Uop is obtained as follows: all the operation instruction types that have appeared in the long-term access records of user U are extracted to form their historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has never appeared in the user's history and is an unconventional behavior, and the operation difference factor Uop is assigned to 1; when the operation instruction type Op(t) at time t is in the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop is assigned to 0; The time anomaly factor Utime is obtained by first periodically mapping time t to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value. The difference between this value and the user's average active time mapping value μU is then calculated to obtain the deviation between the current time and the user's regular time, and the absolute value is taken to ensure that the deviation is non-negative. The time sensitivity coefficient is then introduced to scale the impact of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime. The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access records to the maximum access frequency of all paths in the historical access records.

7. The machine learning-based industrial dynamic access control system according to claim 6, characterized in that: The deviation calculation and determination unit combines the obtained operation difference factor Uop, time anomaly factor Utime and path uniqueness factor Upath with the time stability degree Wsta to calculate the access deviation Ψdev; The access deviation Ψdev is obtained by the following formula: ； Where a1 represents the weight of the operation difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

8. The machine learning-based industrial control dynamic access control system according to claim 7, characterized in that: The dynamic permission response module receives the access deviation Ψdev and dynamically calculates the deviation threshold Tη based on the historical deviation distribution; The deviation threshold Tη is obtained by the following formula: ； Where μΨdev represents the mean of access deviation, σΨdev represents the standard deviation of access deviation, and v1 represents the sensitivity adjustment coefficient; Compare the obtained deviation threshold Tη with the access deviation degree Ψdev to determine whether to trigger the permission compression mechanism; The judgment method is: When the access deviation Ψdev ≤ the deviation threshold Tη, it means that the permission compression mechanism is not triggered; When the access deviation Ψdev> the deviation threshold Tη, it indicates that the permission compression mechanism is triggered and the temporary minimum permission set is activated.

9. The machine learning-based industrial control dynamic access control system according to claim 1, characterized in that: The behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security events Xsafe in the historical records within the time window [t0, t0+T], calculates the accuracy of the system judgment, and obtains the evaluation function REs; When the security event Xsafe=1, it means that the access did not cause a security incident; When the security event Xsafe=0, it means that the access caused an exception; The evaluation function REs is obtained by the following formula: ； Where Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign; The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη. The new deviation threshold nTη is obtained by the following formula: 。 10. A method for dynamic access control for industrial control based on machine learning, applied to a dynamic access control system for industrial control based on machine learning according to any one of claims 1 to 9, characterized in that: The following steps are involved: Step 1: The identity access perception module monitors the access events of users and devices in the industrial control system in real time, dynamically tags them based on their historical behaviors, and obtains the identity access tuple set Ius; Step 2: The access path modeling module constructs an access graph G(t) within a unit time window, using all access records of the identity access tuple set Ius as edges and users or devices as nodes. Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the access frequency of resources within the time window [t0, t0+T] and obtain the temporal stability of the user and device access paths Wsta; Step 4: The access deviation measurement module analyzes the temporal stability degree Wsta by using the deviation index measurement to obtain the access deviation degree Ψdev; Step 5: The dynamic permission response module compares the access deviation Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; Step 6: The behavior authority feedback learning module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation threshold Tη.

Images