A Machine Learning-Based Dynamic Access Control Method and System for Industrial Control Systems

Abstract

This invention discloses a machine learning-based dynamic access control method and system for industrial control systems, belonging to the field of dynamic control technology for industrial control systems. Through the cooperation of an identity access perception module and an access path modeling module, the actual access behaviors of users and devices are structured into an access graph. This transforms access control from a static rule table into a dynamic model that adapts to time, operating conditions, and device status, thus overcoming the shortcomings of traditional static access control, which is rigid and unable to adapt to complex industrial control process changes. The behavior stability calculation module can quantify the stability characteristics of access paths within different time windows, while the access deviation measurement module can identify seemingly compliant but unreasonable access behaviors based on these characteristics, effectively reducing the false alarm and false negative rates under traditional single-point threshold methods. Access events are captured in real time through an access event monitoring unit connected directly to the data bus via a read-only interface without interrupting the normal communication process of the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of industrial control dynamic control technology, specifically to a machine learning-based industrial control dynamic access control method and system. Background Technology

[0002] This invention focuses on access behavior between PLCs, DCSs, and SCADA master stations, including operator accounts, engineer workstations and field devices, accessed process objects, and read / write and execution instruction sequences generated around industrial protocols such as Modbus, S7, and OPC UA. Based on this, the system uses an access behavior graph to structure the relationships between identity, resources, instructions, and time, and uses this graph as a carrier for machine learning discrimination and dynamic permission mapping.

[0003] Existing technologies commonly employ methods such as static access control lists, role-based access control, whitelists, and fixed-time policies. These solutions have significant shortcomings:

[0004] First, the decoupling of permissions and behaviors makes it impossible to reflect the differences in access by the same identity at different process stages, shifts, and equipment states, making it difficult to maintain the "least privilege" during operation.

[0005] Secondly, policy maintenance is highly dependent on manual labor. When faced with scenarios such as equipment replacement, process adjustment, temporary repairs, and remote maintenance, rule updates lag behind, resulting in permission drift and rule aging.

[0006] Third, traditional anomaly detection often relies on static fields or single-point event thresholds, lacking joint modeling of instruction sequences, access paths, and time patterns, making it difficult to promptly identify "compliant but unreasonable" unauthorized access and path-level anomalies.

[0007] The root cause of these problems lies in the strong temporal and condition-dependent nature of industrial control production: access patterns during process segment switching, production line cycle time fluctuations, and nighttime and maintenance periods differ significantly from normal daytime patterns; and static lists cannot accurately map this dynamic coupling of behavior and permissions in real time. Furthermore, situations such as shared accounts, temporary external access, cross-domain remote maintenance, and emergency response make seemingly legitimate access unreasonable at specific times and along specific paths. Summary of the Invention

[0008] To address the shortcomings of existing technologies, this invention provides a machine learning-based dynamic access control method and system for industrial control systems, solving the problems mentioned in the background section.

[0009] To achieve the above objectives, the present invention is implemented through the following technical solution: a machine learning-based industrial control dynamic access control system, comprising an identity access perception module, an access path modeling module, a behavior stability calculation module, an access deviation measurement module, a dynamic permission response module, and a behavior permission feedback learning module;

[0010] The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically marks them based on their historical behavior, and obtains the identity access tuple set Ius.

[0011] Within a unit time window, the access path modeling module constructs an access graph G(t) with all access records of the identity access tuple set Ius as edges and users or devices as nodes.

[0012] The behavior stability calculation module is based on the access graph G(t). Within the time window [t0, t0+T], it analyzes the changes in the frequency of access to resources and obtains the temporal stability Wsta of the user and device access paths.

[0013] The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev.

[0014] The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism.

[0015] The behavior permission feedback learning module backtracks the results of the compression mechanism with the actual security events Xsafe to obtain the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

[0016] Preferably, the identity access awareness module includes an access event listening unit and a dynamic tagging unit;

[0017] The access event listening unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures all user and device access events in real time and records the information of each event, including user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, and operation instruction type Op.

[0018] Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions;

[0019] The access event time information includes the original request time and the deviation between the acquisition terminal and the system master clock; the calibrated request time is obtained by subtracting the clock deviation from the original request time; this ensures that the time sequence of the event records is consistent with the actual working conditions and avoids misjudgment of access behavior due to acquisition delay.

[0020] The dynamic tagging unit analyzes the acquired access events by introducing an access similarity function, compares them with the historical access behavior database to obtain the access matching degree Match, and compares them with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access tag Mta;

[0021] The access matching degree Match is obtained as follows: multiple matching features, including user identifier (UID), access resource object (Rk), request timestamp (Tr), and operation instruction type (Op), are compared one by one, and a weight is assigned to each matching feature. When a feature matches the historical behavior, the indicator function is set to 1; otherwise, it is set to 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern.

[0022] The dynamic access tag Mta is obtained by matching in the following way:

[0023] When the access match degree Match ≥ Match threshold Tmac, it is marked as normal;

[0024] When the access match degree Match < the match threshold Tmac, it is marked as infrequent;

[0025] The obtained user identity identifier (UID), device number (DID), access resource object (Rk), request timestamp (Tr), operation instruction type (Op), and dynamic access tag (Mta) are fitted to obtain the identity access tuple set (Ius).

[0026] Preferably, the access path modeling module includes a node definition and indexing unit and a directed edge construction and attribute annotation unit;

[0027] Within a unit time window ΔT, the node definition and indexing unit extracts the user identifier (UID), device number (DID), and access resource object (Rk) from the identity access tuple set Ius; merges the user's and the device used into the same type of entity node: user node; and uses the access resource object Rk as a resource node, forming two types of node sets in the graph, and establishing a node index table N; and assigns a unique index ID to each node for subsequent rapid construction of directed edges.

[0028] The node index table N is obtained using the following formula:

[0029] N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]}

[0030] In the formula, ni represents the node identifier, user identity identifier UID, device number DID and access resource object Rk, and N(t, t+ΔT) represents the set of nodes within the time window [t, t+ΔT].

[0031] The directed edge construction and attribute annotation unit traverses the identity access tuple set Ius within the time window, mapping each access record to a directed edge in the graph; the starting point is the access initiating node, i.e., the user or device, and the ending point is the accessed resource node; for each directed edge, record the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta, construct the edge set E, and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)).

[0032] The edge set E is obtained using the following formula:

[0033] E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]};

[0034] In the formula, eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the set of edges within the time window [t, t+ΔT].

[0035] Preferably, the behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit;

[0036] The access frequency statistics and analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij.

[0037] The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses of the path in time slice tk to the length of the time slice;

[0038] The average access frequency pfij is obtained as follows: Within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length. For each time slice tk, the access frequency fij(tk) of the path is counted. The access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path within the entire time window.

[0039] Preferably, the time stability quantization unit scores the stability of the access frequency change of each path within the time window [t0, t0+T] using the average access frequency pfij, and obtains the time stability level Wsta.

[0040] The time stability Wsta is obtained using the following formula:

[0041] ;

[0042] In the formula, T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

[0043] The formula for obtaining the time stability level Wsta directly converts the fluctuation of access frequency into a stability score Wsta, which is convenient to use in dynamic access control; the mapping between integral and exponential reduces the impact of occasional extreme access on the overall stability judgment.

[0044] The sensitivity coefficient Ks can be used to dynamically adjust the sensitivity to fluctuations based on the importance of the industrial control system and the level of operational risk.

[0045] The calculation steps for the time stability Wsta include: within a set time window [t0, t0+T], obtaining the access frequency fij(t) of the access path at each time point, calculating the average access frequency pfij within the time window, and introducing a stability sensitivity coefficient Ks for scaling based on the absolute value of the difference between the access frequency and the average access frequency; inputting the scaled difference into an exponential decay function to obtain the instantaneous stability value at each time point, and integrating and averaging the instantaneous stability value within the time window to obtain the overall time stability WstaW of the access path within the time window;

[0046] The sensitivity coefficient Ks is obtained by fitting historical access behavior data with known stability labeling results and using least squares fitting to determine the sensitivity coefficient Ks that minimizes the error between the predicted stability and the labeling results.

[0047] Preferably, the access deviation measurement module includes an anomaly factor extraction unit and a deviation calculation and determination unit;

[0048] The abnormal factor extraction unit extracts factors that cause abnormal access behavior from the access map G(t) and historical data, and performs unified dimensional processing, including operation difference factor Uop, time anomaly factor Utime and path uniqueness factor Upath.

[0049] The operation difference factor Uop is obtained as follows: extract all operation instruction types that have appeared from user U's long-term access records to form its historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has not appeared in the user's history and belongs to non-routine behavior, and the operation difference factor Uop=1 is assigned; when the operation instruction type Op(t) at time t belongs to the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop=0 is assigned.

[0050] The time anomaly factor Utime is obtained as follows: First, time t is periodically mapped to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value; then, the difference between the current time and the user's average active time mapping value μU is calculated to obtain the deviation between the current time and the user's normal time, and the absolute value is taken to ensure that the deviation value is non-negative; then, a time sensitivity coefficient is introduced to scale the degree of influence of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime; the time sensitivity coefficient is obtained by fitting historical data.

[0051] The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access record to the maximum access frequency of all paths in the historical access record.

[0052] Preferably, the deviation calculation and judgment unit combines the obtained operation difference factor Uop, time anomaly factor Utime, and path uniqueness factor Upath with the time stability degree Wsta to calculate and obtain the access deviation Ψdev;

[0053] The access deviation Ψdev is obtained using the following formula:

[0054] ;

[0055] In the formula, a1 represents the weight of the operational difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

[0056] Based on existing historical access records and their labeled normal and abnormal tags, a regression model is used to train and minimize the error between the predicted deviation and the actual tag to obtain the optimal operation difference factor weight a1, time anomaly factor weight a2, and path uniqueness factor weight a3.

[0057] By using the time stability inverse factor, the model can automatically suppress misjudgments of long-term stable paths and enhance sensitivity to temporary path anomalies.

[0058] By combining multiple factors, the deviation determination does not rely on a single feature, thus reducing the bias caused by a single indicator.

[0059] The larger the final Ψdev value, the more significant the difference between the access path and the normal mode, and the more likely it is abnormal behavior.

[0060] Preferably, the dynamic permission response module receives the access deviation degree Ψdev and dynamically calculates the deviation threshold Tη based on the historical deviation degree distribution;

[0061] The deviation threshold Tη is obtained using the following formula:

[0062] ;

[0063] In the formula, μΨdev represents the mean of the access deviation, σΨdev represents the standard deviation of the access deviation, and v1 represents the sensitivity adjustment coefficient.

[0064] The steps for obtaining the sensitivity adjustment coefficient are as follows: First, collect and label historical data: collect historical samples of access deviation and mark normal / abnormal states; next, test multiple candidate values: calculate dynamic thresholds for multiple sets of candidate sensitivity adjustment coefficients v1, and statistically analyze the corresponding false alarm rate and false negative rate; then, optimize performance indicators: select the optimal value to minimize the combined cost of false alarms and false negatives; finally, adaptive update: periodically re-estimate the sensitivity adjustment coefficient v1 during system operation or when performance degrades to ensure long-term stability and sensitivity.

[0065] The obtained deviation threshold Tη is compared with the access deviation Ψdev to determine whether the permission compression mechanism is triggered.

[0066] The judgment method is as follows:

[0067] When the access deviation Ψdev ≤ deviation threshold Tη, it means that the permission compression mechanism is not triggered;

[0068] When the access deviation Ψdev > the deviation threshold Tη, it indicates that the permission compression mechanism is triggered, activating the temporary minimum permission set; this includes generating a temporary permission policy for the current user and device, restricting the access scope, operation type, and access frequency.

[0069] When the deviation exceeds the threshold, the user immediately enters a permission compression state, retaining only the minimum necessary operations to prevent the spread of potential risks;

[0070] Once the deviation returns to normal, permissions are gradually restored, reducing the impact on business continuity.

[0071] Preferably, the behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security event Xsafe within the time window [t0, t0+T], calculates the accuracy of the system judgment, and obtains the evaluation function REs;

[0072] When Xsafe=1, it means that the access did not trigger a security event;

[0073] When the security event Xsafe=0, it indicates that the access has triggered an exception;

[0074] The evaluation function REs is obtained through the following formula:

[0075] ;

[0076] In the formula, Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign;

[0077] The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη.

[0078] The new deviation threshold nTη is obtained using the following formula:

[0079] .

[0080] A machine learning-based dynamic access control method for industrial control systems includes the following steps:

[0081] Step 1: The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically tags them based on their historical behavior, and obtains the identity access tuple set Ius;

[0082] Step 2: Within a unit time window, the access path modeling module constructs an access graph G(t) using all access records of the identity access tuple set Ius as edges and users or devices as nodes.

[0083] Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the frequency of resource access within the time window [t0, t0+T] and obtain the temporal stability degree Wsta of the user and device access paths;

[0084] Step 4: The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev.

[0085] Step 5: The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism;

[0086] Step Six: The Behavior Permission Feedback Learning Module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

[0087] This invention provides a machine learning-based dynamic access control method and system for industrial control systems, which has the following beneficial effects:

[0088] (1) During system operation, the actual access behavior of users and devices is structured into an access graph through the cooperation of the identity access perception module and the access path modeling module. This transforms the access control from a static rule table into a dynamic model that adapts to time, operating conditions, and device status, thereby overcoming the drawbacks of traditional static access control being rigid and unable to adapt to changes in complex industrial control processes. The behavior stability calculation module can quantify the stability characteristics of access paths within different time windows, while the access deviation measurement module can identify "seemingly compliant but unreasonable" access behaviors based on these characteristics. This effectively reduces the false alarm and false negative rates under the traditional single-point threshold method and improves the accuracy and coverage of abnormal access identification.

[0089] (2) By directly connecting the access event listening unit to the data bus via a read-only interface, access events are captured in real time without interrupting the normal communication process of the industrial control system. This avoids interference with the control message flow caused by traditional data acquisition methods, ensuring the continuity and real-time performance of the system. The difference between the original request time and the deviation between the acquisition end and the system master clock is used as the calibration time to ensure that the event sequence is completely consistent with the actual working conditions. This eliminates event sorting errors caused by inconsistent device clocks or network delays, and improves the accuracy of subsequent access behavior modeling.

[0090] (3) By defining and indexing nodes, users, devices, and resource objects are abstracted into two types of nodes within a unit time window, and a node index table is established. This transforms access data from raw event logs into structured data with topological semantics, facilitating subsequent path analysis and behavior pattern recognition. This overcomes the shortcomings of traditional permission tables in failing to reflect the access relationship network. The directed edge construction and attribute labeling unit maps each access record to a directed edge and retains attributes such as request time, operation instruction type, and dynamic access markers. This ensures that the access path contains both topological information and temporal and behavioral characteristics, thus reflecting the full picture of "who accessed what, when, and in what way" in the modeling process. This is something that cannot be reflected in traditional static control strategies.

[0091] (4) By combining the operational difference factor Uop, the time anomaly factor Utime, and the path uniqueness factor Upath with the time stability degree Wsta, the bias caused by judging based on a single field or static threshold is avoided, and access that is “superficially compliant but actually unreasonable” can be better identified. Long-term stability is used as the master switch to suppress occasional fluctuations, and then three types of anomaly factors are used for further subdivision and discrimination: the probability of stable paths being misjudged decreases, and unstable access with multiple anomalies is more easily captured, thus taking into account both the false positive rate and the false negative rate. Attached Figure Description

[0092] Figure 1 This is a schematic diagram of the block flow of a machine learning-based dynamic access control system for industrial control according to the present invention.

[0093] Figure 2 This is a schematic diagram illustrating the steps of a machine learning-based dynamic access control method for industrial control systems according to the present invention.

[0094] Figure 3 This is a schematic diagram of the evaluation function acquisition process of the present invention;

[0095] Figure 4 This is a trend window diagram of the time stability of the present invention;

[0096] Figure 5 This is a bar chart showing the access deviation of the present invention. Detailed Implementation

[0097] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0098] Example 1

[0099] This invention provides a machine learning-based dynamic access control system for industrial control systems. Please refer to [link / reference]. Figures 1 to 5 It includes an identity access awareness module, an access path modeling module, a behavior stability calculation module, an access deviation measurement module, a dynamic permission response module, and a behavior permission feedback learning module;

[0100] The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically marks them based on their historical behavior, and obtains the identity access tuple set Ius.

[0101] Within a unit time window, the access path modeling module constructs an access graph G(t) with all access records of the identity access tuple set Ius as edges and users or devices as nodes.

[0102] The behavior stability calculation module is based on the access graph G(t). Within the time window [t0, t0+T], it analyzes the changes in the frequency of access to resources and obtains the temporal stability Wsta of the user and device access paths.

[0103] The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev.

[0104] The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism.

[0105] The behavior permission feedback learning module backtracks the results of the compression mechanism with the actual security events Xsafe to obtain the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

[0106] In this embodiment, the actual access behavior of users and devices is structured into an access graph through the cooperation of the identity access perception module and the access path modeling module. This transforms access control from a static rule table into a dynamic model that adapts to time, operating conditions, and device status, thus overcoming the drawbacks of traditional static access control, which is rigid and unable to adapt to complex industrial control process changes. The behavior stability calculation module can quantify the stability characteristics of access paths within different time windows, while the access deviation measurement module can identify "seemingly compliant but unreasonable" access behaviors based on these characteristics. This effectively reduces the false alarm and false negative rates of traditional single-point threshold methods and improves the accuracy and coverage of abnormal access identification.

[0107] The dynamic permission response module can instantly trigger a permission compression mechanism when the deviation exceeds a dynamic threshold, temporarily converging permissions to the minimum security requirements. This effectively prevents unauthorized operations from causing process disturbances or security risks in the industrial control system, while also avoiding a decline in production efficiency due to long-term excessive tightening of permissions. The behavioral permission feedback learning module backtests and evaluates the actual effect of the permission compression mechanism against real security events, and iteratively optimizes the threshold and deviation calculation model. This enables the system to be adaptive, maintaining the effectiveness and sensitivity of the detection strategy even under long-term changes in the production environment and attack threat patterns.

[0108] Example 2

[0109] This embodiment is an explanation based on Embodiment 1. Please refer to it. Figure 1 and Figure 3 Specifically: the identity access awareness module includes an access event listening unit and a dynamic tagging unit;

[0110] The access event listening unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures all user and device access events in real time and records the information of each event, including user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, and operation instruction type Op.

[0111] Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions;

[0112] The time information of the access event includes the original request time and the deviation between the acquisition terminal and the system master clock; the calibrated request time is obtained by subtracting the clock deviation from the original request time.

[0113] The dynamic tagging unit analyzes the acquired access events by introducing an access similarity function, compares them with the historical access behavior database to obtain the access matching degree Match, and compares them with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access tag Mta;

[0114] The access matching degree Match is obtained as follows: multiple matching features, including user identifier (UID), access resource object (Rk), request timestamp (Tr), and operation instruction type (Op), are compared one by one, and a weight is assigned to each matching feature. When a feature matches the historical behavior, the indicator function is set to 1; otherwise, it is set to 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern.

[0115] The dynamic access tag Mta is obtained by matching in the following way:

[0116] When the access match degree Match ≥ Match threshold Tmac, it is marked as normal;

[0117] When the access match degree Match < the match threshold Tmac, it is marked as infrequent;

[0118] The obtained user identity identifier (UID), device number (DID), access resource object (Rk), request timestamp (Tr), operation instruction type (Op), and dynamic access tag (Mta) are fitted to obtain the identity access tuple set (Ius).

[0119] In this embodiment, access events are captured in real time without interrupting the normal communication process of the industrial control system by directly connecting the access event monitoring unit to the data bus via a read-only interface. This avoids interference with the control message flow caused by traditional data acquisition methods, ensuring the continuity and real-time performance of the system. The difference between the original request time and the deviation between the acquisition end and the system master clock is used as the calibration time to ensure that the event sequence is completely consistent with the actual operating conditions. This eliminates event sequencing errors caused by inconsistent device clocks or network latency, improving the accuracy of subsequent access behavior modeling.

[0120] The dynamic tagging unit compares access behavior with a historical behavior database using multi-feature matching and assigns weights to each feature. This allows for a comprehensive multi-dimensional assessment of whether access behavior matches historical patterns, more accurately distinguishing between normal and uncommon behaviors compared to single-feature matching. By comparing the matching degree with a preset matching threshold, access tags are dynamically generated, enabling the immediate tagging of access behavior upon occurrence. This reduces security risks associated with delayed judgments and helps to quickly block potential unauthorized operations.

[0121] Example 3

[0122] This embodiment is an explanation based on Embodiment 2. Please refer to it. Figure 4 Specifically: the access path modeling module includes a node definition and indexing unit and a directed edge construction and attribute annotation unit;

[0123] Within a unit time window ΔT, the node definition and indexing unit extracts the user identifier (UID), device number (DID), and access resource object (Rk) from the identity access tuple set Ius; merges the user's and the device used into the same type of entity node: user node; and uses the access resource object Rk as a resource node, forming two types of node sets in the graph, and establishing a node index table N;

[0124] The node index table N is obtained using the following formula:

[0125] N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]}

[0126] In the formula, ni represents the node identifier, and N(t, t+ΔT) represents the set of nodes within the time window [t, t+ΔT].

[0127] The directed edge construction and attribute annotation unit traverses the identity access tuple set Ius within the time window, mapping each access record to a directed edge in the graph; the starting point is the access initiating node, and the ending point is the accessed resource node; for each directed edge, record the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta, construct the edge set E, and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)).

[0128] The edge set E is obtained using the following formula:

[0129] E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]};

[0130] In the formula, eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the set of edges within the time window [t, t+ΔT].

[0131] The behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit;

[0132] The access frequency statistics and analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij.

[0133] The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses of the path in time slice tk to the length of the time slice;

[0134] The average access frequency pfij is obtained as follows: Within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length. For each time slice tk, the access frequency fij(tk) of the path is counted. The access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path within the entire time window.

[0135] The time stability quantification unit scores the stability of the access frequency change of each path within the time window [t0, t0+T] using the average access frequency pfij, and obtains the time stability level Wsta.

[0136] The time stability Wsta is obtained using the following formula:

[0137] ;

[0138] In the formula, T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

[0139] In this embodiment, the node definition and indexing unit abstracts users, devices, and resource objects into two types of nodes within a unit time window and establishes a node index table. This transforms access data from raw event logs into structured data with topological semantics, facilitating subsequent path analysis and behavior pattern recognition. This overcomes the shortcomings of traditional permission tables, which cannot reflect the access relationship network. The directed edge construction and attribute labeling unit maps each access record to a directed edge and retains attributes such as request time, operation instruction type, and dynamic access markers. This ensures that the access path contains both topological information and temporal and behavioral characteristics, thus reflecting the complete picture of "who accessed what, when, and how" in the modeling process. This is something that cannot be reflected in traditional static control strategies.

[0140] The access frequency statistical analysis unit divides the time window into equal-length slices, performs fine-grained statistics on the access frequency of each path within different time slices, and calculates the average access frequency. This reveals the distribution characteristics of access behavior across different time periods, avoiding the shortcomings of global statistics where short-term high-frequency anomalies are masked. The time stability quantification unit combines the average access frequency and the exponential decay factor to calculate the degree of time stability, effectively weakening the impact of occasional fluctuations. This enables the system to distinguish between long-term stable paths and temporary or abnormal paths, thereby improving the accuracy of abnormal behavior detection and reducing false alarms.

[0141] By combining access graphs with temporal stability scores, the system can dynamically adapt to changes in access patterns at different process stages, production cycles, and equipment states without altering the hardware, overcoming the limitation of traditional static access control in its inability to update strategies in a timely manner. The constructed access graphs and stability levels serve as core input data for the subsequent access deviation measurement module, ensuring that deviation calculations are based on a complete behavioral topology and temporal pattern, fundamentally improving the accuracy and real-time performance of deviation detection and dynamic permission adjustments.

[0142] Example 4

[0143] This embodiment is an explanation based on Embodiment 3. Please refer to it. Figure 5 Specifically: the access deviation measurement module includes an anomaly factor extraction unit and a deviation calculation and judgment unit;

[0144] The anomaly factor extraction unit extracts factors that cause abnormal access behavior from the access map G(t) and historical data, including the operation difference factor Uop, the time anomaly factor Utime, and the path uniqueness factor Upath.

[0145] The operation difference factor Uop is obtained as follows: extract all operation instruction types that have appeared from user U's long-term access records to form its historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has not appeared in the user's history and belongs to non-routine behavior, and the operation difference factor Uop=1 is assigned; when the operation instruction type Op(t) at time t belongs to the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop=0 is assigned.

[0146] The time anomaly factor Utime is obtained as follows: First, time t is periodically mapped to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value; then, the difference between the current time and the user's average active time mapping value μU is calculated to obtain the deviation between the current time and the user's normal time, and the absolute value is taken to ensure that the deviation value is non-negative; then, a time sensitivity coefficient is introduced to scale the degree of influence of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime;

[0147] The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access record to the maximum access frequency of all paths in the historical access record.

[0148] The deviation calculation and judgment unit combines the acquired operation difference factor Uop, time anomaly factor Utime, and path uniqueness factor Upath with the time stability degree Wsta to calculate and obtain the access deviation Ψdev.

[0149] The access deviation Ψdev is obtained using the following formula:

[0150] ;

[0151] In the formula, a1 represents the weight of the operational difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

[0152] Specific examples:

[0153] Table 1: Example table for calculating access deviation;

[0154]

[0155] In this embodiment, by combining the difference factor Uop, the time anomaly factor Utime, and the path uniqueness factor Upath with the time stability degree Wsta, the bias caused by relying solely on a single field or static threshold is avoided, and access that appears compliant but is actually unreasonable is better identified. Long-term stability is used as a master switch to suppress occasional fluctuations, and three types of anomaly factors are used for further subdivision and discrimination: the probability of stable paths being misjudged decreases, and unstable access with multiple anomalies is more easily captured, thus achieving a two-way optimization of both false positive and false negative rates.

[0156] The time anomaly factor, introduced into the user's daily activity model, automatically distinguishes the "normal-abnormal" boundary between different operating states such as day / night shifts and maintenance / production, addressing the pain point that static access tables cannot reflect operational condition dependencies. The path uniqueness factor enhances sensitivity to historically rare access links, enabling early detection of potential lateral movement, unconventional resource access, and cross-domain privilege escalation risks, shortening the time from "anomaly occurrence" to "policy response." Based on the access graph, deviation determination naturally possesses the context of "who—access—which resource—when—with which instruction," adapting to multiple protocols and avoiding the limitations of pure field detection that ignores path-level risks. Deviation degree, as a continuous quantity, can directly map different levels of response policies (such as only alerting, restricting write operations, triggering temporary minimum privileges), achieving refined management based on risk intensity and reducing production disruptions caused by "one-size-fits-all" approaches.

[0157] Example 5

[0158] This embodiment is an explanation based on Embodiment 4. Please refer to it. Figure 3 Specifically: the dynamic permission response module receives the access deviation degree Ψdev and dynamically calculates the deviation threshold Tη based on the historical deviation degree distribution;

[0159] The deviation threshold Tη is obtained using the following formula:

[0160] ;

[0161] In the formula, μΨdev represents the mean of the access deviation, σΨdev represents the standard deviation of the access deviation, and v1 represents the sensitivity adjustment coefficient.

[0162] The obtained deviation threshold Tη is compared with the access deviation Ψdev to determine whether the permission compression mechanism is triggered.

[0163] The judgment method is as follows:

[0164] When the access deviation Ψdev ≤ deviation threshold Tη, it means that the permission compression mechanism is not triggered;

[0165] When the access deviation Ψdev > deviation threshold Tη, it indicates that the permission compression mechanism is triggered, activating the temporary minimum permission set.

[0166] Within the time window [t0, t0+T], the behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security event Xsafe, calculates the accuracy of the system's judgment, and obtains the evaluation function REs.

[0167] When Xsafe=1, it means that the access did not trigger a security event;

[0168] When the security event Xsafe=0, it indicates that the access has triggered an exception;

[0169] The evaluation function REs is obtained through the following formula:

[0170] ;

[0171] In the formula, Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign;

[0172] The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη.

[0173] The new deviation threshold nTη is obtained using the following formula:

[0174] .

[0175] In this embodiment, the deviation threshold is no longer a fixed manually set value, but is calculated in real time based on the historical distribution of access deviation. It is automatically updated by combining the mean, standard deviation, and sensitivity adjustment coefficient, enabling the system to flexibly adjust according to changes in operating status and access behavior. This solves the problem of static thresholds easily failing when operating conditions change. By comparing real-time access deviation with the dynamic threshold, temporary least privilege control is triggered only when a significant deviation occurs, reducing the interference of false triggers on normal production operations. Simultaneously, it ensures that a restricted state can be quickly entered in the event of high-risk behavior.

[0176] The behavior and permission feedback learning module compares the execution results of the permission compression mechanism with actual security events to generate a quantitative score for the accuracy of the judgment, forming a complete "detection-response-verification-correction" closed loop to ensure continuous optimization of the system's judgment capabilities. When the judgment accuracy falls below the target score, the system automatically corrects the deviation from the threshold, keeping the threshold aligned with the current threat landscape. This avoids long-term reliance on manual maintenance and improves the ability to respond to sudden threats and new attack methods. The dynamic adjustment and feedback correction of the threshold ensures a balance between security and productivity, preventing frequent operation restrictions due to excessively low thresholds and avoiding the unchecked spread of high-risk behavior due to excessively high thresholds.

[0177] Example 6

[0178] A machine learning-based dynamic access control method for industrial control systems; please refer to [reference needed]. Figure 2 Specifically, it includes the following steps:

[0179] Step 1: The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically tags them based on their historical behavior, and obtains the identity access tuple set Ius;

[0180] Step 2: Within a unit time window, the access path modeling module constructs an access graph G(t) using all access records of the identity access tuple set Ius as edges and users or devices as nodes.

[0181] Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the frequency of resource access within the time window [t0, t0+T] and obtain the temporal stability degree Wsta of the user and device access paths;

[0182] Step 4: The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev.

[0183] Step 5: The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism;

[0184] Step Six: The Behavior Permission Feedback Learning Module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

[0185] In this embodiment, by combining access mapping with stability analysis, normal and abnormal access patterns under different operating conditions, process stages, production shifts, and equipment states can be identified. This allows the access control policy to automatically adjust according to changes in behavior patterns, avoiding the drawbacks of static access control tables failing in response to environmental changes. The deviation measurement module integrates time stability with multi-dimensional anomaly factors to calculate access deviation, enabling the detection of both obvious unauthorized behavior and concealed atypical abnormal access, significantly improving the accuracy and coverage of detection.

[0186] By filtering out occasional fluctuations through stability assessments and combining this with multi-factor deviation judgment, the system effectively reduces misjudgments of normal operations while ensuring that risky behaviors are not overlooked, achieving a balance between security and production continuity. The dynamic permission response module automatically calculates deviation thresholds based on the historical distribution of access deviations and combines this with real-time data to determine whether to trigger a temporary minimum permission set, enabling risk-driven permission contraction and minimizing interference with normal business operations. The behavioral permission feedback learning module compares permission adjustment results with actual security events, evaluates the effectiveness of the strategy, and automatically corrects deviation thresholds, ensuring the system maintains effective detection and response as threat profiles and production rhythms change.

[0187] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A machine learning-based dynamic access control system for industrial control, characterized in that: It includes an identity access awareness module, an access path modeling module, a behavior stability calculation module, an access deviation measurement module, a dynamic permission response module, and a behavior permission feedback learning module; The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically marks them based on their historical behavior, and obtains the identity access tuple set Ius. Within a unit time window, the access path modeling module constructs an access graph G(t) with all access records of the identity access tuple set Ius as edges and users or devices as nodes. The behavior stability calculation module is based on the access graph G(t). Within the time window [t0, t0+T], it analyzes the changes in the frequency of access to resources and obtains the temporal stability Wsta of the user and device access paths. The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev. The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism. The behavior permission feedback learning module backtracks the results of the compression mechanism with the actual security events Xsafe to obtain the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

2. The industrial control dynamic access control system based on machine learning according to claim 1, characterized in that: The identity access awareness module includes an access event listening unit and a dynamic tagging unit; The access event listening unit is directly connected to the data bus through a read-only interface. Without interrupting the communication process, it captures all user and device access events in real time and records the information of each event, including user identity identifier UID, device number DID, access resource object Rk, request timestamp Tr, and operation instruction type Op. Standardize and synchronize the time information of access events to keep the event sequence consistent with the actual working conditions; The time information of the access event includes the original request time and the deviation between the acquisition terminal and the system master clock; the calibrated request time is obtained by subtracting the clock deviation from the original request time. The dynamic tagging unit analyzes the acquired access events by introducing an access similarity function, compares them with the historical access behavior database to obtain the access matching degree Match, and compares them with the matching threshold Tmac in the historical access behavior database to obtain the dynamic access tag Mta; The access matching degree Match is obtained as follows: multiple matching features, including user identifier (UID), access resource object (Rk), request timestamp (Tr), and operation instruction type (Op), are compared one by one, and a weight is assigned to each matching feature. When a feature matches the historical behavior, the indicator function is set to 1; otherwise, it is set to 0. Then, the product of the weight of each feature and the indicator function is summed and divided by the sum of all weights to obtain the access matching degree Match between the current access behavior and the historical behavior pattern. The dynamic access tag Mta is obtained by matching in the following way: When the access match degree Match ≥ Match threshold Tmac, it is marked as normal; When the access match degree Match < the match threshold Tmac, it is marked as infrequent; The obtained user identity identifier (UID), device number (DID), access resource object (Rk), request timestamp (Tr), operation instruction type (Op), and dynamic access tag (Mta) are fitted to obtain the identity access tuple set (Ius).

3. The industrial control dynamic access control system based on machine learning according to claim 2, characterized in that: The access path modeling module includes a node definition and indexing unit and a directed edge construction and attribute annotation unit; Within a unit time window ΔT, the node definition and indexing unit extracts the user identifier (UID), device number (DID), and access resource object (Rk) from the identity access tuple set Ius; merges the user's and the device used into the same type of entity node: user node; and uses the access resource object Rk as a resource node, forming two types of node sets in the graph, and establishing a node index table N; The node index table N is obtained using the following formula: N(t,t+ΔT)={ni∣ni∈{UID, DID, Rk}, Tr∈[t,t+ΔT]} In the formula, ni represents the node identifier, and N(t, t+ΔT) represents the set of nodes within the time window [t, t+ΔT]. The directed edge construction and attribute annotation unit traverses the identity access tuple set Ius within the time window, mapping each access record to a directed edge in the graph; the starting point is the access initiating node, and the ending point is the accessed resource node; for each directed edge, record the request timestamp Tr, operation instruction type Op, and dynamic access tag Mta, construct the edge set E, and obtain the access graph G(t) = (N(t, t+ΔT), E(t, t+ΔT)). The edge set E is obtained using the following formula: E(t,t+ΔT)={eij=(ni→nj, Op, Tr, Mtag)|Tr∈[t,t+ΔT]}; In the formula, eij represents the directed edge from node ni to node nj, and E(t, t+ΔT) represents the set of edges within the time window [t, t+ΔT].

4. The industrial control dynamic access control system based on machine learning according to claim 3, characterized in that: The behavior stability calculation module includes an access frequency statistical analysis unit and a time stability quantification unit; The access frequency statistics and analysis unit extracts the access paths (ni→nj) between all users and devices and resource nodes within the time window [t0, t0+T] from the access graph G(t), counts the access frequency fij of each path according to time slices, and calculates the average access frequency pfij. The access frequency fij(tk) of time slice tk is obtained by the ratio of the number of accesses of the path in time slice tk to the length of the time slice; The average access frequency pfij is obtained as follows: Within the time window [t0, t0+T], the access time period of the path is divided into k time slices of equal length. For each time slice tk, the access frequency fij(tk) of the path is counted. The access frequencies of the K time slices are summed and divided by the number of time slices K to obtain the average access frequency pfij of the path within the entire time window.

5. The industrial control dynamic access control system based on machine learning according to claim 4, characterized in that: The time stability quantification unit scores the stability of the access frequency change of each path within the time window [t0, t0+T] using the average access frequency pfij, and obtains the time stability level Wsta. The time stability Wsta is obtained using the following formula: ； In the formula, T represents the time window length, Ks represents the sensitivity coefficient, fij(t) represents the access frequency at time t, exp represents the exponential function, and d represents the integral sign.

6. The industrial control dynamic access control system based on machine learning according to claim 1, characterized in that: The access deviation measurement module includes an anomaly factor extraction unit and a deviation calculation and determination unit; The anomaly factor extraction unit extracts factors that cause abnormal access behavior from the access map G(t) and historical data, including the operation difference factor Uop, the time anomaly factor Utime, and the path uniqueness factor Upath. The operation difference factor Uop is obtained as follows: extract all operation instruction types that have appeared from user U's long-term access records to form its historical operation set; when the operation instruction type Op(t) at time t is not in the historical operation set, it means that the operation type has not appeared in the user's history and belongs to non-routine behavior, and the operation difference factor Uop=1 is assigned; when the operation instruction type Op(t) at time t belongs to the historical operation set, it means that it is consistent with the user's past behavior, and the operation difference factor Uop=0 is assigned. The time anomaly factor Utime is obtained as follows: First, time t is periodically mapped to simulate a 24-hour cycle, so that different time points can be mapped to a periodic time value; then, the difference between the current time and the user's average active time mapping value μU is calculated to obtain the deviation between the current time and the user's normal time, and the absolute value is taken to ensure that the deviation value is non-negative; then, a time sensitivity coefficient is introduced to scale the degree of influence of the deviation, and 1 is added to the final result to obtain the time anomaly factor Utime; The path uniqueness factor Upath is obtained by the difference between 1 and the ratio of the access frequency in the historical access record to the maximum access frequency of all paths in the historical access record.

7. The industrial control dynamic access control system based on machine learning according to claim 6, characterized in that: The deviation calculation and judgment unit combines the acquired operation difference factor Uop, time anomaly factor Utime, and path uniqueness factor Upath with the time stability degree Wsta to calculate and obtain the access deviation Ψdev. The access deviation Ψdev is obtained using the following formula: ； In the formula, a1 represents the weight of the operational difference factor, a2 represents the weight of the time anomaly factor, and a3 represents the weight of the path uniqueness factor.

8. The industrial control dynamic access control system based on machine learning according to claim 7, characterized in that: The dynamic permission response module receives the access deviation degree Ψdev and dynamically calculates the deviation threshold Tη based on the historical deviation degree distribution; The deviation threshold Tη is obtained using the following formula: ； In the formula, μΨdev represents the mean of the access deviation, σΨdev represents the standard deviation of the access deviation, and v1 represents the sensitivity adjustment coefficient. The obtained deviation threshold Tη is compared with the access deviation Ψdev to determine whether the permission compression mechanism is triggered. The judgment method is as follows: When the access deviation Ψdev ≤ deviation threshold Tη, it means that the permission compression mechanism is not triggered; When the access deviation Ψdev > deviation threshold Tη, it indicates that the permission compression mechanism is triggered, activating the temporary minimum permission set.

9. The industrial control dynamic access control system based on machine learning according to claim 1, characterized in that: Within the time window [t0, t0+T], the behavior permission feedback learning module compares the access deviation Ψdev output by the compression mechanism with the actual security events Xsafe in the historical records, calculates the accuracy of the system's judgment, and obtains the evaluation function REs. When Xsafe=1, it means that the access did not trigger a security event; When the security event Xsafe=0, it indicates that the access has triggered an exception; The evaluation function REs is obtained through the following formula: ； In the formula, Ψdev(t) represents the access deviation at time t, Xsafe(t) represents the actual security event at time t, and d represents the integral sign; The obtained evaluation function REs is further compared with the target score Rtar. When the evaluation function REs is less than the target score Rtar, the deviation threshold Tη is adaptively corrected to obtain a new deviation threshold nTη. The new deviation threshold nTη is obtained using the following formula: 。 10. A machine learning-based dynamic access control method for industrial control systems, applied to the machine learning-based dynamic access control system for industrial control systems as described in any one of claims 1 to 9, characterized in that: Includes the following steps: Step 1: The identity access awareness module monitors user and device access events in real time from the industrial control system, dynamically marks them based on their historical behavior, and obtains the identity access tuple set Ius; Step 2: Within a unit time window, the access path modeling module constructs an access graph G(t) using all access records of the identity access tuple set Ius as edges and users or devices as nodes. Step 3: The behavior stability calculation module uses the access graph G(t) as a basis to analyze the changes in the frequency of resource access within the time window [t0, t0+T] and obtain the temporal stability degree Wsta of the user and device access paths; Step 4: The access deviation measurement module analyzes the time stability Wsta by using the deviation index to obtain the access deviation Ψdev. Step 5: The dynamic permission response module compares the access deviation degree Ψdev with the dynamic deviation threshold Tη to determine whether to trigger the permission compression mechanism; Step Six: The Behavior Permission Feedback Learning Module backtracks the results of the compression mechanism with the actual security event Xsafe, obtains the evaluation function REs, and iteratively adjusts the deviation from the threshold Tη.

Images