A scanning method and system for concealed asset identification in an electric power industrial control network

Abstract

The application provides a scanning method and system for concealed asset identification in a power industrial control network, aiming to solve the problem that existing asset mapping means is difficult to find silent, non-registered or illegal access devices. The method injects multiple protocol induction type probe packets into the target network, collects device response data and extracts feature vectors, uses unsupervised clustering and anomaly detection algorithm to identify abnormal device behavior; at the same time, combining graph neural network and hidden Markov model, the network communication chain structure and historical behavior sequence are modeled, and the potential concealed asset nodes are inferred. The application can realize active discovery and risk reasoning of concealed assets without affecting industrial control business, and is suitable for industrial control scenes such as substations and dispatching centers in the power industry, and has high security, intelligence and feasibility.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control system security, and particularly relates to a scanning method and system for hidden asset identification in a power industrial control network. BACKGROUND

[0002] In a modern power system, industrial control systems (ICS) are widely used in power generation, power transmission, power transformation and power distribution, and the like. Subordinate devices such as remote terminal units (RTU), programmable logic controllers (PLC) and intelligent electronic devices (IED) communicate and cooperate through various industrial protocols, forming a complex industrial communication network. In order to effectively manage and protect these devices, asset identification and state awareness are basic work. At present, the power industry often uses network scanning and deep packet inspection technology to inventory and classify network assets. However, due to the diversity of device protocols, sparsity of communication and long-term silence of some devices, traditional scanning methods cannot completely cover all online or latent assets, resulting in "blind spots" or "dead angles" in asset information, which poses risks to subsequent network operation and protection.

[0003] Under the above background, there is a technical need for accurately identifying hidden assets (such as devices with abnormal configuration, communication isolation, non-standard protocol or silent operation) in the power industrial control network. On the one hand, these devices may not be presented in the centralized management platform due to installation configuration, communication failure, network isolation and the like; on the other hand, their latent behavior may also become a potential security risk or attack entry. Therefore, the industry urgently needs an identification technology that balances scanning accuracy and disturbance control, which can integrate multi-source protocol behavior, communication structure features and time sequence state information to achieve non-intrusive and intelligent identification and tracing of hidden assets, and make up for the capability gap of traditional methods in low visibility scenarios. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a scanning method and system for hidden asset identification in a power industrial control network, which comprehensively utilizes multi-protocol active probing, behavior clustering analysis, graph neural network modeling and time sequence reasoning, and constructs a full-process intelligent identification system from data acquisition, response behavior modeling, structure relationship analysis to abnormal device inference. This method not only supports accurate identification of various industrial protocol assets, but also has the ability to model and discover potential hidden assets such as silent devices, communication island devices and atypical response devices, which can effectively improve the integrity of power system asset management and the forward-looking nature of security protection.

[0005] To achieve the above object, the application adopts the following technical solutions: a scanning method and system for hidden asset identification in a power industrial control network, comprising the following specific steps:

[0006] S1: constructing a set of detection messages according to the industrial control protocol of the power industry, generating a protocol message using a template-based syntax tree builder, that is, P_protocol = Template(FUNC_CODE, ADDR, LEN, CRC), generating diversified request combinations through random disturbance and interpolation of the protocol structure field; injecting detection messages of different protocols in a staggered manner within a set time interval to form a rhythmic detection flow, and the injection sequence is dynamically adjusted according to the success rate of historical responses;

[0007] Specifically, P_protocol represents a protocol message; Template represents a protocol message template function; FUNC_CODE represents a function code, indicating the operation type of this detection (such as reading a holding register, calling a command, etc.); ADDR represents an address, the address location of the target data unit in the device; LEN represents the length, the amount of data expected to be read this time; CRC represents the cyclic redundancy check, a field used for message integrity check;

[0008] S2: performing a protocol analysis operation on each response message, which decodes the field structure according to the identified protocol type and extracts key elements for subsequent modeling;

[0009] S3: constructing a feature set of all device response vectors ; represents the response feature vector of the i-th device, i=1,...,n;

[0010] S4: to identify potential hidden assets outside the clustering cluster, use the Isolation Forest algorithm Isolation Forest to build an anomaly detection model based on feature isolation;

[0011] S5: constructing a device topology graph according to the communication behavior between known devices , where node represents a device, and edge represents a communication relationship, and simultaneously extracting communication features such as connectivity, communication frequency, and protocol distribution as initial input vectors , using a graph convolution network GCN model to learn node embedding

[0012] S6: constructing a hidden Markov model HMM based on the communication behavior sequence, setting the state set as , and the observation set as the communication events of the device in different time windows, and using the forward-backward algorithm to train the transition matrix , transmit matrix and initial probability estimation, the most likely state path is calculated using the Viterbi algorithm in the inference stage;

[0013] S7: Perform fake message identification on the message structure and field content, including: whether the field length, control code, function code, and CRC (Cyclic Redundancy Check) check bit are legal, whether there are illegal field combinations or unregistered device addresses, and the detection logic is based on syntax template tree and regular expression rules for matching verification; if there are field values that are seriously inconsistent with protocol definitions, illegal device codes, or abnormal message structures, the message is identified as a fake message exception;

[0014] S8: According to the hidden asset identification result , construct an adaptive scanning strategy, record the identification success rate p(protocol i ) and the average response time T i of each protocol in different network segments, model the strategy optimization as a multi-armed bandit problem, select the protocol combination through the Upper Confidence Bound strategy, calculate the upper bound of the return UCB i of each combination, and preferentially select the protocol with high expected return and the target segment to perform the next round of scanning, where I represents the inferred hidden asset set.

[0015] In a preferred embodiment, in S1, the selection of protocol function codes is limited to read-only / query type; the field disturbance logic is as follows: for the address field, use a sliding window or random jump strategy, and the read length is within a reasonable range to inject intervals, and the sending order is controlled through a protocol priority dynamic adjustment mechanism.

[0016] In a preferred embodiment, in S2, the key elements include response delay , data length , field number , CRC check result, and error flag bit, the protocol function code is embedded in the feature vector using one-hot encoding, and if there is a device identifier string field, it is represented using character-level n-gram, n=3, encoding, and mapped to a dense vector space through an embedding layer, and finally all fields are concatenated into a unified device response vector ; represents the time delay between the system sending a probe message and receiving a device response; L i is the byte length of the response message; onehot fcodeis the one-hot encoding of the function code in the packet, used to represent the response type of the device to different protocol operations; n-gram desc represents the vector embedding of the character-level n-gram segmentation of the string field in the response, used to characterize the device manufacturer or customization features; while CRC i represents the check field of the response data, used to identify whether the data packet structure is standard or there is abnormal splicing.

[0017] In a preferred embodiment, in S3, Gaussian Mixture Model (GMM) is used for clustering learning to measure the behavior similarity between samples, and Mahalanobis distance is used as the distance function , wherein, represents the response feature vector of the jth device, is the feature covariance matrix, is the inverse matrix of the covariance matrix, and the mean, variance and weight parameters of each cluster are iteratively optimized by EM algorithm until the log-likelihood increment is lower than the set threshold, and the clusters representing typical device behaviors are output , which provides a behavior reference basis for anomaly detection

[0018] In a preferred embodiment, in S4, the normal clustering samples are used in the training stage A plurality of binary decision trees are constructed by randomly selecting a feature subset, each tree is divided by randomly selecting a division dimension and a threshold, the samples are recursively divided to form isolated paths, and in the inference stage, the average path length of the new sample in all trees is calculated , and the anomaly score function is defined as , wherein is a normalization factor, if the score is higher than the threshold , it is determined as an abnormal device, which constitutes a potential hidden asset set

[0019] In a preferred embodiment, in S5, the graph convolution network model adopts the following update formula:

[0020]

[0021] , wherein is an activation function, is the trainable weight matrix of the jth layer graph convolution, and after the propagation of two layers, the node obtains the aggregated neighbor information embedding representation; through the propagation learning of several layers, the structural representation of the device is obtained ​By judging the abnormal nodes in the topology structure through cluster center offset, isolation measure or boundary density, inference basis is provided for hidden devices with missing graph structure. represents the embedding vector of node v in the layer, represents the embedding representation of its neighbor node u in the layer, N(v) is the neighbor set of node v; d v and d u respectively represent the degrees of nodes v and u.

[0022] In a preferred embodiment, in S6, each device records whether communication occurs every 10 minutes as an observation sequence , where ∈{0,1}; the model parameters are learned using the EM (Expectation–Maximization Algorithm) algorithm, and the Viterbi algorithm is used to recursively solve the maximum probability path in the prediction stage:

[0023]

[0024] represents the maximum probability value of the optimal path in state s at time t, represents the maximum probability of the optimal path from the previous state s' at time ; represents the transition probability from state s' to the current state s, which is an item in the state transition matrix of the hidden Markov model HMM; represents the probability of generating observation o t in the current state s, i.e., the observation probability or emission probability; represents the selection of the path with the maximum probability from all possible previous states; if a device appears in the silent state continuously and the probability of transition from the communication state to the silent state is less than 0.05, it is marked as a static hidden device and included in the inference result set.

[0025] In a preferred embodiment, in S8, the revenue of each protocol combination is defined as:

[0026]

[0027] The combination UCB with the current maximum UCB value is selected in each round of scanning i

[0028]

[0029] wherein is the average income, is the number of times, t is the total round, by recording the identification efficiency of each protocol combination, the strategy is evaluated every 10 rounds, and the protocol redundancy injection mechanism is triggered as a threshold to prevent local optimization.

[0030] The application also provides a scanning system for concealed asset identification in a power industrial control network.

[0031] Compared with the prior art, the application has the following beneficial effects: the application can significantly improve the identification capability of concealed assets in the power industrial control network, not only supports active detection of multiple industrial protocols, but also realizes intelligent identification of silent devices, communication island devices and atypical response devices through unsupervised clustering, anomaly detection, graph neural network structure modeling and time series reasoning, has the advantages of wide identification range, high precision, small disturbance and strong self-adaptability, effectively makes up for the technical short board of traditional scanning methods in low visibility scenarios, and improves the integrity of asset management and the forward-looking nature of network protection in the power industry. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 The flowchart of the preferred embodiment of the application is shown. DETAILED DESCRIPTION

[0033] The application will be further described below in conjunction with the drawings and examples.

[0034] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise indicated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0035] It should be noted that the terms used herein are only for the purpose of describing the specific embodiments, and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form, and furthermore, it should be understood that when the terms "comprise" and / or "include" are used in the specification, they indicate the presence of a feature, step, operation, device, component and / or combination thereof.

[0036] As Figure 1 shown, the application provides a scanning method for concealed asset identification in a power industrial control network, comprising the following steps:

[0037] S1: The active scanning module constructs a set of probe packets according to common industrial protocols in the power industry, including Modbus-TCP, IEC 60870-5-104, DNP3, and IEC 61850. The packets are constructed with legal function codes without write operations, such as Modbus function codes 0x03 (Read Holding Registers) and 0x2B (Read Device Identification), and C_IC_NA_1 (summon command) frames in IEC104. To generate high-coverage probe packets, the system uses a template-based syntax tree builder to generate protocol packets, i.e., P_protocol = Template(FUNC_CODE, ADDR, LEN, CRC). By randomly perturbing and interpolating the protocol structure fields, a diversified request combination is generated. The system injects probe packets of different protocols in a staggered manner within a set time interval to form a rhythmic probe stream. The injection order is dynamically adjusted based on the success rate of historical responses, thereby improving the probability of activating hidden devices.

[0038] S2: The system performs protocol parsing operations on each response packet. The parser decodes the field structure based on the identified protocol type, extracts key elements such as response delay , data length , field number , CRC check result, error flag, etc., and embeds the protocol function code in the one-hot encoding manner into the feature vector, such as function code 0x03 assigned as 1 in the corresponding dimension and 0 in the remaining dimensions. If there are device identifier and other string fields, the system uses character-level n-gram (n=3) encoding to represent them and maps them to a dense vector space through an embedding layer. Finally, all fields are concatenated into a unified device response vector for subsequent modeling; where: represents the time delay between the system sending a probe packet and receiving a device response, in milliseconds, used to characterize the timeliness of the device response; L i is the byte length of the response packet, which can reflect the complexity of the device's returned data structure; onehot fcode is the one-hot encoding of the function code in the packet, used to represent the response type of the device to different protocol operations; n-gram desc represents the vector embedding of the character-level n-gram segmentation of the string fields (such as device identification and manufacturer information) in the response, used to characterize the device manufacturer or custom features; and CRC iCheck field representing response data, used to identify whether the packet structure is normal or abnormal splicing. This vector provides a multi-dimensional information base of behavior, semantics and structure as an input feature, supporting subsequent clustering and anomaly detection modeling.

[0039] S3: Construct the feature set of all device responses ; is the response feature vector of the i-th device, i = 1,..., n; is the covariance matrix of all sample response vectors, with a dimension of d x d, used to characterize the linear correlation and scale distribution between each feature dimension. is the inverse matrix of the covariance matrix, used to "normalize rotation" the difference vector to adapt to the influence of different scales or correlations between features. The full multiplication represents the weighted sum of squares of feature differences under the covariance structure, that is, the overall difference degree under the constraint of feature correlation. The final square root operation makes the distance have the same dimension as the Euclidean distance, which is convenient for intuitive measurement.

[0040] The system uses Gaussian Mixture Model (GMM) for clustering learning to measure the behavior similarity between samples, using Mahalanobis distance as the distance function , where is the response feature vector of the j-th device, is the feature covariance matrix, is the inverse matrix of the covariance matrix, which is iteratively optimized by the EM algorithm to output the mean, variance and weight parameters of each cluster clusters representing typical device behaviors , providing a behavior reference basis for anomaly detection.

[0041] S4: To identify potential hidden assets outside the clustering clusters, the system uses Isolation Forest to build an anomaly detection model based on feature isolation, using normal clustering samples in the training stage Randomly select a subset of features to build multiple binary decision trees, each tree divides the sample recursively by randomly selecting a division dimension and threshold, forming an isolation path, and in the inference stage, the average path length of the new sample in all trees is calculated , and the anomaly score function is defined as , where is the normalization factor. If the score is higher than the threshold , it is determined to be an abnormal device, which constitutes a potential hidden asset set.

[0042] S5: Construct a device topology graph according to the communication behavior between known devices , where the node represents a device, and the edge represents the communication relationship, and extracts communication features such as connectivity, communication frequency, protocol distribution, etc. as initial input vectors for each node , the system uses a graph convolution network (GCN) to learn node embeddings, and the GCN model iterative update formula is , through several layers of propagation learning, the system obtains the structural representation of the device , by clustering center offset, isolation measure or boundary density to judge the abnormal nodes in the topology structure, and provide reasoning basis for hidden devices with missing graph structure; represents the embedding vector of node v at the layer, represents the embedding representation of its neighbor node u at the layer, N(v) is the neighbor set of node v; d v and d u represent the degree (i.e. the number of neighbors) of nodes v and u, respectively; is the trainable weight matrix of the layer graph convolution; σ(·) is the activation function (such as ReLU). This formula realizes the propagation and aggregation of node features in the graph structure, and the degree-normalized weight can avoid over-amplification of node information and ensure smooth propagation of features in the local neighborhood, thereby learning a structure-aware embedding representation.

[0043] S6: The system constructs a hidden Markov model (HMM) based on the communication behavior sequence, sets the state set as , and the observation set is the communication event of the device in different time windows. In the training phase, the forward-backward algorithm is used to estimate the transition matrix , the emission matrix and the initial probability , and in the inference phase, the Viterbi algorithm is used to calculate the most likely state path. By recursively calculating , the state of each device on the time axis is predicted. If a device is continuously predicted to be in the "silent" state and the transition probability is significantly lower than the average level, the device is marked as a static hidden device and included in the reasoning result set; represents the maximum probability value of the optimal path of state s at time t (i.e. the cumulative probability of the most likely path to state s); represents the maximum probability of the optimal path from the previous state s' at time ; represents the transition probability from state s' to the current state s, which is an item in the state transition matrix of HMM; represents the probability of generating observation o t under the current state s, i.e. the observation probability or emission probability; The most probable path is selected from all possible previous states.

[0044] S7: The forged packet identification is performed on the packet structure and field content, mainly including whether the field length, control code, function code and CRC check bit are legal, whether there is illegal field combination or unregistered device address, and the detection logic is matched and checked based on the syntax template tree and regular expression rule; if there is a serious inconsistency between the field value and the protocol definition, illegal device coding or packet structure deformity, etc., the packet is identified as a forged packet exception; this module supports configuring packet black list rules and format templates to enhance the detection flexibility.

[0045] S8: The system constructs an adaptive scanning strategy according to the covert asset identification result , records the identification success rate p(protocol i ) and the average response time T i of each protocol in different network segments, models the strategy optimization as a multi-armed bandit problem, selects the protocol combination through the Upper Confidence Bound (UCB) strategy, calculates the upper bound of the return of each combination , wherein is the average return, represents the number of uses, t is the total number of rounds, and the protocol with high expected return is preferentially selected to perform the next round of scanning with the target segment, thereby improving the detection capability of the system in the covert area and realizing the continuous self-improvement of the identification efficiency of the covert asset.

[0046] The above only describes the embodiments of the present application and is not used to limit the protection scope of the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A scanning method for identifying concealed assets in power industrial control networks, characterized in that, The specific steps include the following: S1: Construct a probe message set based on the power industry's industrial control protocols, and use a template-based syntax tree builder to generate protocol messages, i.e., P_protocol = Template(FUNC_CODE, ADDR, LEN, CRC). Generate diverse request combinations by randomly perturbing and interpolating the protocol structure fields; inject probe messages of different protocols interleaved within a set time interval to form a rhythmic probe stream. The injection order is dynamically adjusted based on the success rate of historical responses; P_protocol represents the protocol message. Template(*) represents the protocol message template function; FUNC_CODE represents the function code; ADDR represents the address; LEN represents the length; CRC represents cyclic redundancy check. S2: Perform a protocol parsing operation on each response message. This parsing operation decodes the field structure according to the identified protocol type and extracts key elements for subsequent modeling. S3: Construct a feature set of response vectors for all devices ; This represents the response feature vector of the i-th device, where i = 1, ..., n; S4: To identify potential hidden assets outside clusters, an anomaly detection model based on feature isolation is constructed using the Isolation Forest algorithm; S5: Construct a device topology diagram based on known communication behaviors between devices. , where nodes Indicates the device, edge It represents the communication relationship and extracts communication features such as connectivity, communication frequency, and protocol distribution for each node as the initial input vector. The graph convolutional network (GCN) model is used to learn node embeddings. S6: Construct a Hidden Markov Model (HMM) based on communication behavior sequences, assuming the state set is... The observation set consists of communication events of the device in different time windows. During the training phase, a forward-backward algorithm is used to train the transition matrix. emission matrix and initial probability Estimation is performed, and the most probable state path is calculated using the Viterbi algorithm during the inference phase. S7: Perform forged message identification on message structure and field content, including: whether the field length, control code, function code and CRC check bit are valid, whether there are illegal field combinations or unregistered device addresses, the detection logic is based on the syntax template tree and regular expression rules for matching and verification; if there are field values ​​that are seriously inconsistent with the protocol definition, illegal device encoding or malformed message structure, the message is identified as an abnormal forged message; S8: Based on the results of hidden asset identification Construct an adaptive scanning strategy and record the recognition success rate p(protocol) of each protocol in different network segments. i ) and average response delay T i The strategy optimization is modeled as a multi-armed gambling machine problem. The Upper Confidence Bound algorithm is used to calculate the upper bound (UCB) of the payoff for each strategy selection protocol combination. i Select protocols and target segments with high expected returns to perform the next round of scanning. This represents the set of hidden assets used in reasoning.

2. The scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S1, the selection of protocol function codes is restricted to read-only / query type; the field perturbation logic is as follows: for the address field, a sliding window or random jump strategy is used, and the read length... Within a reasonable range, the injection interval is used, and the sending order is controlled by a dynamic adjustment mechanism based on protocol priority.

3. The scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S2, key elements include response latency. Data length Number of fields The CRC check result and error flag are used to embed the protocol function code into the feature vector using one-hot encoding. If a device identifier string field exists, it is represented using a character-level n-gram encoding method (n=3), and mapped to a dense vector space through an embedding layer. Finally, all fields are concatenated into a unified device response vector. ; Indicates the time delay between the system sending a probe message and receiving a device response; L i The length of the response message in bytes; onehot fcode It is a one-hot encoding of the function code in the message, used to represent the device's response type to different protocol operations; ngram desc This represents the vector embedding after character-level n-gram segmentation of the string field in the response, used to characterize the device manufacturer or custom features; while CRC i The validation field represents the response data and is used to identify whether the data packet structure is standard or if there are any abnormal splices.

4. The scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S3, a Gaussian Mixture Model (GMM) is used for clustering learning to measure the behavioral similarity between samples, using Mahalanobis distance as the distance function. ,in, This represents the response feature vector of the j-th device. The characteristic covariance matrix, Given the inverse of the covariance matrix, the mean, variance, and weight parameters of each cluster are iteratively optimized using the Expectation-Maximization (EM) algorithm until the log-likelihood increment falls below a set threshold, at which point the output is given. Clusters representing typical device behavior This provides a behavioral reference basis for anomaly detection.

5. A scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S4, normal clustering samples are used during the training phase. Multiple binary decision trees are constructed by randomly selecting a subset of features. Each tree recursively partitions the samples by randomly selecting a partitioning dimension and threshold, forming isolated paths. During the inference phase, new samples are then processed... Calculate its average path length across all trees. Define the anomaly scoring function as follows: ,in As a normalization factor, if the score is higher than the threshold If so, it is determined to be an abnormal device, constituting a potential collection of hidden assets.

6. A scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S5, the Graph Convolutional Network (GCN) model uses the following update formula: in For activation function, It is the first The trainable weight matrix of the layered graph convolution, after two layers of propagation, allows nodes to obtain an aggregated neighbor information embedding representation; through propagation learning over several layers, the structural representation of the device is obtained. By identifying abnormal nodes in the topology through cluster center offset, isolation metric, or boundary density, a reasoning basis can be provided for hidden devices with missing graph structures. Indicates that node v is at the th Layer embedding vectors, Indicates that its neighbor node u is at the th The embedding representation of the layer, where N(v) is the set of neighbors of node v; d v and d u Let v and u represent the degrees of nodes v and u, respectively.

7. A scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S6, each device records whether communication has occurred every 10 minutes, as an observation sequence. ,in ∈{0,1}; Model parameters The Expectation-Maximization (EM) algorithm is used for learning, and the Viterbi algorithm is used recursively to find the maximum probability path in the prediction phase. This represents the maximum probability value of the optimal path with state s at time t. Indicates at time When, the maximum probability of the optimal path starting from the previous state s'; It represents the transition probability from state s′ to the current state s, and is a term in the state transition matrix of a Hidden Markov Model (HMM). This indicates that an observation o is generated under the current state s. t The probability of observation or emission; This means selecting the path with the highest probability from all possible previous states; if a device continuously enters a silent state and the probability of transitioning from a communication state to a silent state is less than 0.05, it is marked as a static concealed device and included in the inference result set.

8. A scanning method for identifying concealed assets in a power industrial control network according to claim 1, characterized in that, In S8, the revenue of each protocol combination Defined as: Each scan selects the combination of UCBs with the current maximum UCB value. i ,in For average returns, t represents the number of times the protocol is used and t represents the total number of rounds. The strategy is evaluated every 10 rounds by recording the recognition efficiency of each protocol combination and triggering a protocol redundancy injection mechanism based on a threshold to prevent local optima.

9. A scanning system for identifying concealed assets in power industrial control networks, characterized in that... The scanning method for identifying hidden assets in a power industrial control network, as described in any one of claims 1-8, is executed.

Images