Industrial network security log collection method and system

Abstract

The invention discloses an industrial network security log collection method and system, and relates to the technical field of security log collection. The method comprises the steps of obtaining an operation instruction sequence in a current industrial network, extracting a semantic path of the current operation instruction sequence, judging whether semantic path deviation exists in the current operation instruction sequence or not, and obtaining a semantic path deviation result; calculating an instruction information entropy value of the current operation instruction sequence in the sliding time window, judging whether the current operation instruction sequence has information entropy value mutation or not, and obtaining an information entropy value mutation result; constructing a strategy effective coverage matrix of log collection, and judging whether the current operation instruction sequence falls into an empty window area of the strategy effective coverage matrix or not to obtain a strategy effective blind area result; and triggering the compensatory log acquisition behavior, and adjusting the current acquisition behavior. According to the method, the integrity, the accuracy and the intelligent response capability of industrial weblog collection are remarkably improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of security log collection, in particular to an industrial network security log collection method and system. BACKGROUND

[0002] A large number of logs are generated in an industrial network environment every day, which record various events, including user operations, system events, security events, etc. Through the collection and analysis of these logs, potential security threats and abnormal activities can be discovered in a timely manner to prevent network attacks. At the same time, log analysis can not only help identify security problems, but also find potential problems and faults in system operation through analysis of log data, so as to optimize and improve.

[0003] In related technologies, traditional log collection methods are mostly based on keyword matching, device state changes or rule triggering, which are difficult to identify whether the semantic logic behind the operation behavior deviates from the regular process, and are prone to miss abnormal operations under the appearance of legal operations. At the same time, the traditional log collection strategy is usually manually configured, lacks a structured verification mechanism, and has blind spots such as incomplete strategy coverage, time period device empty window, and configuration omission, resulting in key logs not being recorded, and there is room for improvement. SUMMARY

[0004] The purpose of the present application is to provide an industrial network security log collection method and system to solve the problems raised in the background.

[0005] In a first aspect, the present application provides an industrial network security log collection method, which adopts the following technical solution: An instruction semantic model of an industrial task is constructed, semantic path segments are extracted according to historical task execution data, and a standard semantic path is formed; An operation instruction sequence in the current industrial network is obtained at a collection node, and a current operation instruction sequence is obtained; The semantic path of the current operation instruction sequence is extracted, and whether the current operation instruction sequence deviates from the semantic path is judged according to the standard semantic path, and a semantic path deviation result is obtained; The current operation instruction sequence is divided into fixed-length sliding time windows, and the instruction information entropy value of the current operation instruction sequence in the sliding time window is calculated; Based on the instruction information entropy value, it is judged whether the current operation instruction sequence has a sudden change in information entropy value, and an information entropy value mutation result is obtained; A log collection strategy rule is established, and a strategy effective coverage matrix for log collection is constructed based on the effective time, range of action and operation type of the log collection strategy rule; determine whether the current operation instruction sequence falls into a blind area of the policy effective coverage matrix based on the policy effective coverage matrix, to obtain a policy effective blind area result; based on the semantic path deviation result, the information entropy value mutation result, and the policy effective blind area result, trigger a compensatory log collection behavior, and adjust the current collection behavior.

[0006] Preferably, the instruction semantic model of the industrial task is constructed, the semantic path segments are extracted according to the historical task execution data, and the standard semantic path is formed. Specifically, the steps are as follows: acquire historical task execution data recorded in the industrial control system, extract historical operation instruction sequences corresponding to the historical tasks; convert the historical operation instruction sequences into corresponding semantic path segments, and perform similarity clustering on the plurality of semantic path segments; remove noise paths, extract main paths and variant paths, construct an instruction semantic model, and form a standard semantic path.

[0007] Preferably, the semantic path of the current operation instruction sequence is extracted, and whether the current operation instruction sequence has semantic path deviation is determined according to the standard semantic path, to obtain a semantic path deviation result. Specifically, the steps are as follows: convert the current operation instruction sequence into a semantic label sequence to form a current operation semantic path; compare the current operation semantic path with the standard semantic path at a node level, and determine whether the current operation instruction sequence has semantic path deviation; if an illegal semantic node not contained in the standard semantic path appears in the current operation semantic path, or a path illegal jump behavior appears in the current operation semantic path, it is determined that the current operation instruction sequence has semantic path deviation, and a semantic path deviation result is generated.

[0008] Preferably, the current operation instruction sequence is divided into fixed-length sliding time windows, and the instruction information entropy value of the current operation instruction sequence in the sliding time window is calculated. Specifically, the steps are as follows: divide the current operation instruction sequence into a plurality of fixed-length sliding time windows according to instruction timestamps; identify and encode the operation instructions in each sliding time window according to function categories, count the occurrence frequency of the operation instructions of each function category in the sliding time window, and generate an operation instruction frequency distribution table; based on the operation instruction frequency distribution table, calculate the information entropy value of the current operation instruction sequence in each sliding time window using a Shannon entropy calculation formula, to obtain an instruction information entropy value.

[0009] Preferably, based on the instruction information entropy value, it is judged whether the information entropy value of the current operation instruction sequence appears mutation, and an information entropy value mutation result is obtained, specifically as follows: Based on the instruction information entropy value, the instruction information entropy value and the corresponding timestamp are combined to form an instruction information entropy value time sequence; An allowed variation range of the instruction information entropy value between adjacent sliding time windows is set, and an entropy value mutation threshold is generated; The instruction information entropy value difference of any two adjacent sliding time windows is calculated, and the instruction information entropy value difference is compared with the entropy value mutation threshold to judge whether the information entropy value of the current operation instruction sequence appears mutation; If the instruction information entropy value difference exceeds the entropy value mutation threshold, it is determined that the information entropy value of the current operation instruction sequence appears mutation in the sliding time window, and an information entropy value mutation result is output.

[0010] Preferably, based on the strategy effective coverage matrix, it is judged whether the current operation instruction sequence falls into the empty window area of the strategy effective coverage matrix, and a strategy effective blind area result is obtained, specifically as follows: The real-time operation time, target device identifier and target operation type in the current operation instruction sequence are extracted; Based on the strategy effective coverage matrix, whether there is an effective log collection strategy is queried from the strategy effective coverage matrix with the real-time operation time, target device identifier and target operation type as indexes; If there is no log collection strategy effective identifier in the corresponding index position in the strategy effective coverage matrix, it is judged that the current operation instruction sequence falls into the empty window area of the strategy effective coverage matrix, and a strategy effective blind area result is output.

[0011] Preferably, based on the semantic path deviation result, the information entropy value mutation result and the strategy effective blind area result, a compensatory log collection signal is triggered to adjust the current collection behavior, specifically as follows: Based on the semantic path deviation result, the edit distance between the current operation instruction sequence and the standard semantic path is extracted, the semantic deviation degree of the current operation instruction sequence is calculated, the semantic deviation degree is normalized to obtain a first trigger intensity value of the semantic path deviation; Based on the information entropy value mutation result, the instruction information entropy value difference in the adjacent sliding time window is calculated, and the instruction information entropy value difference is normalized to obtain a second trigger intensity value of the information entropy value mutation; Based on the strategy effective blind area result, the coverage degree of the current operation instruction sequence in the strategy effective coverage matrix is counted, the reverse coverage degree is calculated, and the reverse coverage degree is normalized to obtain a third trigger intensity value of the strategy effective blind area; The first trigger intensity value, the second trigger intensity value and the third trigger intensity value are integrated to trigger a compensatory log collection signal to adjust the current collection behavior.

[0012] Preferably, the step of integrating the first trigger intensity value, the second trigger intensity value and the third trigger intensity value to trigger a compensatory log collection behavior to adjust the current collection behavior is specifically: An abnormal weight value is set for each of the semantic path deviation, the information entropy value mutation and the strategy effective blind area; Based on the corresponding abnormal weight value, a compensation trigger index is calculated by integrating the first trigger intensity value, the second trigger intensity value and the third trigger intensity value; A compensation trigger threshold is set, and the compensation trigger index is compared with the set compensation trigger threshold; When the compensation trigger index exceeds the set compensation trigger threshold, a compensatory log collection behavior is triggered to dynamically adjust the current collection behavior.

[0013] In a second aspect, the present application provides an industrial network security log collection system, which adopts the following technical solution: An industrial network security log collection system comprises: A semantic model construction module constructs an instruction semantic model of an industrial task, extracts a semantic path segment according to historical task execution data, and forms a standard semantic path; An operation instruction collection module acquires an operation instruction sequence in a current industrial network at a collection node to obtain a current operation instruction sequence; A semantic deviation analysis module extracts a semantic path of the current operation instruction sequence, judges whether the current operation instruction sequence deviates from the semantic path according to the standard semantic path, and obtains a semantic path deviation result; An information entropy value calculation module divides the current operation instruction sequence into fixed-length sliding time windows, and calculates instruction information entropy values of the current operation instruction sequence in the sliding time windows; An information entropy value analysis module judges whether the current operation instruction sequence has an information entropy value mutation based on the instruction information entropy values, and obtains an information entropy value mutation result; A collection strategy construction module establishes a log collection strategy rule, and constructs a strategy effective coverage matrix of log collection based on an effective time, an effective range and an operation type of the log collection strategy rule; A strategy blind area identification module judges whether the current operation instruction sequence falls into a blind area of the strategy effective coverage matrix based on the strategy effective coverage matrix, and obtains a strategy effective blind area result; The compensation collection control module triggers a compensatory log collection behavior based on the semantic path deviation result, the information entropy value mutation result and the policy effective blind area result, and adjusts the current collection behavior.

[0014] In summary, the present application includes at least one of the following beneficial technical effects: 1. By analyzing historical task execution data, extracting the timing and logical relationship between typical instructions, forming semantic path segments, and integrating them into a standard semantic path set, a reference benchmark for subsequent behavior judgment is formed, thereby possessing semantic deviation detection capability for abnormal behavior. The collection node is at the network edge or in front of the control host, extracts instruction-level content such as control commands and data packets through a standard interface or a deep protocol parser, and organizes them into a sequence structure, which is the basis for the input of subsequent semantic judgment and entropy analysis core analysis logic, ensuring that the system has real-time perception capability for the current actual running state. By extracting the semantic path of the current instruction sequence and comparing it with the standard semantic path, abnormal operation behavior that does not conform to the historical rules in control logic can be identified, and a semantic path deviation result can be generated to provide semantic evidence for abnormal behavior detection, which is suitable for identifying control logic injection attacks, misoperations and other threats. By dividing the sequence into sliding windows and calculating the information entropy of the instruction distribution in each window, if the entropy value changes dramatically at a certain time compared to the previous window, it may mean a sudden change in behavior pattern, batch instruction injection or switching of operation mode to hide the intent, which helps to early warn of attack preparation stage or critical operation, and forms a multi-dimensional verification with the semantic deviation result, enhancing the accuracy and interpretability of detection, and improving the reliability of system anomaly detection. By structuring the collection strategy and mapping it into a three-dimensional space of time, device and operation type, a coverage matrix is formed, thereby realizing systematic management of log collection rules, which helps to find gaps, redundancies or errors in strategy configuration. If the current behavior is not captured by any strategy in the time period, device or operation type dimensions, it may cause key behaviors to be missed. Strategy blind area identification can timely find defects in configuration logic, ensuring log integrity and security traceability. When any or multiple abnormal conditions such as semantic anomaly, entropy value mutation or strategy blind area are detected, the system triggers compensatory collection, including enhancing collection frequency, expanding collection fields, extending collection time, etc. Not only does it improve the capture ability of abnormal behavior, but also makes up for the shortcomings of static configuration of collection strategy, realizing a more intelligent and fine industrial network log collection process.

[0015] 2. By setting a fixed length sliding window, the local characteristics of the instruction behavior can be obtained in the continuous time domain, so as to capture the mode changes such as short-time abnormality and burst behavior, and the risk of global average covering local mutation can be avoided, and the time-sensitive perception ability of the collection strategy is enhanced. By classifying the operation instructions according to the function categories and counting the occurrence frequency of the operation instructions in the window, a frequency distribution table of the operation instructions in the window is constructed, and necessary probability basis is provided for subsequent information entropy calculation. The higher the entropy value is, the more uniform the instruction category distribution is, and the more complex the behavior is. The lower the entropy value is, the more concentrated the operation is, and the more repetitive the instruction is. The method has obvious advantages for capturing unstructured abnormality and periodic behavior mutation, and can make up for the blind area of the traditional semantic rule or keyword matching method, and improve the intelligence of the industrial network security log collection system.

[0016] 3. The current operation behavior is converted into three-dimensional index information for strategy comparison, specifically including three dimensions of time, device and operation type, and the occurrence time point, position point and behavior point of the behavior are accurately positioned, so that a semantic complete query entrance is established for subsequent comparison with a strategy coverage matrix. By taking the extracted triplets as indexes, the system can quickly search whether the current operation behavior is covered by a defined log collection strategy. If the matching is successful, it indicates that the behavior has been effectively monitored by the collection configuration. Otherwise, the system provides a precise strategy applicability judgment mechanism, avoids the waste of resources caused by redundant configuration of the collection strategy, and avoids the waste of resources caused by redundant configuration of the collection strategy. If the corresponding strategy identifier cannot be found in the coverage matrix, it indicates that the current operation behavior is not covered by any effective collection strategy, which belongs to the empty window area of the strategy configuration, and may lead to the loss of important behavior logs, which is an important risk source of log collection integrity and security. The dynamic verification of log collection coverage is realized, and the industrial network security log collection system is endowed with the three abilities of dynamic adaptation, rule closed loop and leakage prevention. BRIEF DESCRIPTION OF DRAWINGS

[0017] Fig. 1 is a specific step schematic diagram of an embodiment of the industrial network security log collection method of the application.

[0018] Fig. 2 is a module connection schematic diagram of an embodiment of the industrial network security log collection system of the application. DETAILED DESCRIPTION

[0019] The application will be further described in detail below in combination with embodiments and Figs. 1-2 The embodiments of the application are not limited to this.

[0020] The application discloses an industrial network security log collection method, specifically comprising the following steps: Step S1, constructing an instruction semantic model of an industrial task, extracting a semantic path segment according to historical task execution data, and forming a standard semantic path; Step S2, the operation instruction sequence in the current industrial network is acquired at the collection node to obtain a current operation instruction sequence; Step S3, a semantic path of the current operation instruction sequence is extracted, and whether the current operation instruction sequence deviates from the semantic path is judged according to a standard semantic path to obtain a semantic path deviation result; Step S4, the current operation instruction sequence is divided into a fixed-length sliding time window, and an instruction information entropy value of the current operation instruction sequence in the sliding time window is calculated; Step S5, whether the current operation instruction sequence has a mutation of information entropy value is judged based on the instruction information entropy value to obtain a mutation result of information entropy value; Step S6, a log collection strategy rule is established, and a strategy effective coverage matrix of log collection is constructed based on an effective time, an action range and an operation type of the log collection strategy rule; Step S7, whether the current operation instruction sequence falls into a blind area of the strategy effective coverage matrix is judged based on the strategy effective coverage matrix to obtain a strategy effective blind area result; Step S8, a compensatory log collection behavior is triggered based on the semantic path deviation result, the mutation result of information entropy value and the strategy effective blind area result, and the current collection behavior is adjusted.

[0021] In actual application, the time sequence and logical relationship between typical instructions are extracted by analyzing historical task execution data to form semantic path fragments and integrate them into a standard semantic path set. This serves as a reference benchmark for subsequent behavior judgment, thereby possessing the ability to detect semantic deviation of abnormal behavior. The collection node is located at the network edge or the front end of the control host, extracts instruction-level content such as control commands and data packets through a standard interface or a deep protocol parser, and organizes them into a sequence structure. This sequence is the basis for the input of subsequent semantic judgment and entropy analysis, ensuring that the system has real-time perception of the current actual running state. By extracting the semantic path of the current instruction sequence and comparing it with the standard semantic path, abnormal operation behaviors that do not conform to historical rules in control logic can be identified, such as illegal jumps, sequence disorders, and insertion of unexpected instructions. The semantic path deviation result provides semantic evidence for abnormal behavior detection and is suitable for identifying control logic injection attacks and misoperations. By dividing the sequence into sliding windows and calculating the information entropy of the instruction distribution in each window, if the entropy value changes dramatically at a certain time compared to the previous window, it may indicate a sudden change in behavior pattern, batch instruction injection, or switching of operation mode, which helps to warn of attack preparation or critical operations in advance. Combined with the semantic deviation result, it forms a multi-dimensional verification, enhancing the accuracy and interpretability of detection and improving the reliability of system anomaly detection. By structuring the collection strategy and mapping it to a three-dimensional space of time, device, and operation type, a coverage matrix is formed, enabling systematic management of log collection rules and helping to identify gaps, redundancies, or errors in strategy configuration. If the current behavior is not captured by any strategy in the time period, device, or operation type dimensions, it may result in missing key behaviors. Strategy blind spot identification can quickly identify configuration logic defects, ensuring log integrity and security traceability. When any or multiple abnormal conditions such as semantic anomaly, entropy mutation, or strategy blind spot are detected, the system triggers compensatory collection, including increasing collection frequency, expanding collection fields, and extending collection duration. This not only improves the ability to capture abnormal behavior but also compensates for the shortcomings of static configuration of collection strategies, achieving a more intelligent and precise industrial network log collection process.

[0022] The steps of constructing the instruction semantic model of the industrial task, extracting semantic path fragments from historical task execution data, and forming standard semantic paths are as follows: Step S11, obtaining historical task execution data recorded in the industrial control system, extracting historical operation instruction sequences corresponding to the historical tasks; Step S12, converting the historical operation instruction sequences into corresponding semantic path fragments, and performing similarity clustering on multiple semantic path fragments; Step S13, removing noise paths, extracting main paths and variant paths, constructing an instruction semantic model, and forming standard semantic paths.

[0023] In actual application, by acquiring historical task logs, especially device control logs, PLC execution logs, operator instruction trajectories, etc., the original operation instruction sequence of each task is extracted to ensure the authenticity and integrity of subsequent model construction. By converting the underlying operation instruction sequence into semantic path fragments, the logical flow of task behavior can be abstracted. Then, through similarity clustering methods such as edit distance, path structure distance, etc., behavior paths with similar structures between different tasks are classified into one category, thereby finding typical execution patterns, which helps to eliminate the discrete influence of operation differences, strengthens the system's ability to generalize normal behavior patterns, and establishes a comparison benchmark for abnormal behavior judgment. Through noise path identification and removal, such as low-frequency paths, non-closed loop paths, etc., the main paths representing the regularity of most tasks are preserved, and a small number of reasonable variant paths are identified, such as parameter switching, step optimization, etc., forming standard semantic paths to provide a robust comparison model for subsequent semantic deviation detection of the system.

[0024] The step of extracting the semantic path of the current operation instruction sequence and determining whether the current operation instruction sequence deviates from the semantic path based on the standard semantic path to obtain a semantic path deviation result is specifically: Step S31, converting the current operation instruction sequence into a semantic label sequence to form a current operation semantic path; Step S32, comparing the current operation semantic path with the standard semantic path at the node level to determine whether the current operation instruction sequence deviates from the semantic path; Step S33, if the current operation semantic path contains illegal semantic nodes not included in the standard semantic path, or the current operation semantic path exhibits illegal jump behavior, it is determined that the current operation instruction sequence deviates from the semantic path, and a semantic path deviation result is generated.

[0025] In actual application, the current operation instruction sequence is converted into a clear structure and explicit semantic label sequence, i.e. semantic path, which can effectively describe the behavior logic of the current task and establish a semantic layer alignment relationship with the standard semantic model, providing a high-dimensional expression basis for subsequent deviation judgment. By comparing the structural differences between the current semantic path and the standard semantic path node by node, it is judged whether the path deviation phenomenon occurs. For example, the expected path is A-B-C-D, but the current path is A-B-E-D, and the insertion of this intermediate link can be regarded as a deviation behavior. The trigger condition of deviation judgment is set, and the key deviation type is defined, i.e. illegal semantic node, i.e. the current path contains operations not defined in the standard path, such as unauthorized configuration, skipping detection and directly starting; illegal path jump, i.e. jump behavior violating the process structure, such as jumping from initialization to end directly, skipping key security nodes. Identifying deviation behavior can effectively detect potential attacks, misoperations or unauthorized control behaviors, and the generated semantic path deviation result can not only identify illegal behaviors in the control logic, but also provide explainable deviation reasons and positions, which have high visibility and practicality, and provide reliable basis for whether to trigger subsequent compensation collection and log enhancement of the system, significantly improving the intelligence of log collection.

[0026] The step of dividing the current operation instruction sequence into a fixed-length sliding time window and calculating the instruction information entropy value of the current operation instruction sequence in the sliding time window is as follows: Step S41, the current operation instruction sequence is divided into a plurality of fixed-length sliding time windows according to the instruction timestamp; Step S42, the operation instructions in each sliding time window are identified and coded according to the function category, the occurrence frequency of the operation instructions of each function category in the sliding time window is counted, and an operation instruction frequency distribution table is generated; Step S43, based on the operation instruction frequency distribution table, the information entropy value of the current operation instruction sequence in each sliding time window is calculated by using the Shannon entropy calculation formula, and the instruction information entropy value is obtained.

[0027] In actual application, by setting a fixed length sliding window, the local characteristics of the instruction behavior can be obtained in the continuous time domain, so as to capture the mode changes such as short-time abnormality and burst behavior, and the risk of global average covering local mutation can be avoided, and the time-sensitive perception ability of the collection strategy is enhanced. By identifying and coding the operation instructions according to the function categories such as read state, write parameter, start command and alarm reset, and counting the occurrence frequency of the instructions in the window, a frequency distribution table of the instructions in the window is constructed, which provides a necessary probability basis for subsequent information entropy calculation. The higher the entropy value is, the more uniform the instruction type distribution is, and the more complex the behavior is; the lower the entropy value is, the more concentrated the operation is, and the more repetitive the instruction is. It has obvious advantages for capturing unstructured abnormalities and periodic behavior mutations, and makes up for the blind area of traditional semantic rules or keyword matching methods, and improves the intelligence of the industrial network security log collection system.

[0028] Based on the instruction information entropy value, whether the current operation instruction sequence has information entropy value mutation is judged, and an information entropy value mutation result is obtained. Specifically, the steps are as follows: In step S51, based on the instruction information entropy value, the instruction information entropy value and the corresponding time stamp are combined to form an instruction information entropy value time sequence; In step S52, the allowed change range of the instruction information entropy value between adjacent sliding time windows is set, and an entropy value mutation threshold is generated; In step S53, the instruction information entropy value difference between any two adjacent sliding time windows is calculated, the instruction information entropy value difference is compared with the entropy value mutation threshold, and whether the current operation instruction sequence has information entropy value mutation is judged; In step S54, if the instruction information entropy value difference exceeds the entropy value mutation threshold, it is determined that the current operation instruction sequence has information entropy value mutation in the sliding time window, and an information entropy value mutation result is output.

[0029] In actual application, the instruction information entropy value calculated for each sliding time window is associated with its time stamp to form an information entropy value time sequence with time dimension, which records the continuous change of the operation behavior complexity in different time periods, and is helpful to identify whether the system behavior is stable, periodic or has sudden abnormal operation. In the industrial control system, the instruction behavior has a certain degree of normal fluctuation, so it is necessary to set a reasonable change tolerance interval, that is, an entropy value change threshold, which can filter the small entropy difference caused by normal operation and significantly amplify the abnormal signal caused by sudden change. By calculating the entropy value difference between adjacent windows, the micro change trend of the system behavior stability and mutation can be captured. When the instruction structure is significantly changed by a certain operation behavior, the entropy value difference will exceed the change threshold, triggering the mutation judgment. An abnormality identification mechanism with high real-time performance is provided for the safety system, which significantly enhances the perception ability of the system to the blind spots and behavior abnormalities of the log collection.

[0030] judging whether the current operation instruction sequence falls into the empty window area of the policy effective coverage matrix based on the policy effective coverage matrix, to obtain a policy effective blind area result, specifically: In step S71, the real-time operation time, target device identifier and target operation type in the current operation instruction sequence are extracted. In step S72, based on the policy effective coverage matrix, the real-time operation time, target device identifier and target operation type are used as indexes to query whether there is an effective log collection policy in the policy effective coverage matrix. In step S73, if there is no log collection policy effective identifier in the corresponding index position in the policy effective coverage matrix, it is judged that the current operation instruction sequence falls into the empty window area of the policy effective coverage matrix, and a policy effective blind area result is output.

[0031] In actual application, the current operation behavior is converted into three-dimensional index information for policy comparison, specifically including three dimensions of time, device and operation type. By accurately positioning the time point, position point and behavior point of the behavior, a semantically complete query entrance is established for subsequent comparison with the policy coverage matrix. By taking the extracted triple as an index, the system can quickly search whether the current operation behavior is covered by a defined log collection policy. If the matching is successful, it indicates that the behavior has been effectively supervised by the collection configuration; otherwise, it will enter the next step of judgment, providing a precise policy applicability judgment mechanism for the system, avoiding the waste of resources caused by redundant configuration or virtual collection policy. If the corresponding policy identifier cannot be found in the coverage matrix, it indicates that the current operation behavior is not covered by any effective collection policy, which belongs to the empty window area of the policy configuration and may lead to the loss of important behavior logs, which is an important risk source of log collection integrity and security. The dynamic verification of log collection coverage is realized, and the industrial network security log collection system is endowed with the three capabilities of dynamic adaptation, rule closed loop and leakage prevention guarantee.

[0032] Based on the semantic path deviation result, the information entropy value mutation result and the policy effective blind area result, a step of triggering a compensatory log collection signal to adjust the current collection behavior, specifically: In step S81, based on the semantic path deviation result, the edit distance between the current operation instruction sequence and the standard semantic path is extracted, the semantic deviation degree of the current operation instruction sequence is calculated, and the semantic deviation degree is normalized to obtain a first trigger intensity value of the semantic path deviation. In step S82, based on the information entropy value mutation result, the instruction information entropy value difference in the adjacent sliding time window is calculated, and the instruction information entropy value difference is normalized to obtain a second trigger intensity value of the information entropy value mutation. Step S83, based on the policy effective blind area result, the coverage degree of the current operation instruction sequence in the policy effective coverage matrix is counted, the reverse coverage degree is calculated, the reverse coverage degree is normalized to obtain a third trigger intensity value of the policy effective blind area; Step S84, the first trigger intensity value, the second trigger intensity value and the third trigger intensity value are integrated to trigger a compensatory log collection signal to adjust the current collection behavior.

[0033] In actual application, the edit distance is taken as a quantitative index to measure the structural difference degree between the current operation behavior and the standard semantic path. The greater the deviation, the more likely the behavior is abnormal. By normalizing this difference, a standardized trigger intensity value is obtained, which enhances the semantic sensitivity of the collection system, can distinguish between minor errors and high-risk abnormalities, and helps to optimize the log collection resource allocation strategy. The entropy value change is used as a signal of behavior complexity fluctuation. The greater the entropy difference, the more dramatic the system behavior changes in a short period of time. By normalizing the entropy difference under different operation environments, a uniform scale intensity value is obtained, which reflects the dynamic sensitivity of the system. The severity of the current behavior falling into the collection strategy blind area is quantified. Low coverage degree indicates that the behavior lacks policy support and the collection is at high risk. By calculating the reverse coverage rate, i.e. the uncoated proportion, and normalizing it, the trigger intensity value of the current behavior in the policy configuration is obtained, which reflects the policy configuration vulnerability pressure of the system and can be used to dynamically identify the policy coverage failure area to trigger enhanced collection and avoid key log loss. By integrating the semantic deviation intensity, information entropy mutation intensity and policy blind area intensity in three dimensions, a comprehensive risk perception mechanism is formed to automatically trigger compensatory log collection behavior, so that the log collection mechanism is no longer triggered by passive rules, but has dynamic, adaptive and on-demand intelligent capabilities.

[0034] The step of integrating the first trigger intensity value, the second trigger intensity value and the third trigger intensity value to trigger a compensatory log collection behavior to adjust the current collection behavior is specifically: Step S841, setting corresponding abnormal weight values for semantic path deviation, information entropy value mutation and policy effective blind area; Step S842, based on the corresponding abnormal weight values, the first trigger intensity value, the second trigger intensity value and the third trigger intensity value are weighted and integrated to obtain a compensation trigger index; Step S843, setting a compensation trigger threshold, comparing the compensation trigger index with the set compensation trigger threshold; Step S844, when the compensation trigger index exceeds the set compensation trigger threshold, triggering a compensatory log collection behavior to dynamically adjust the current collection behavior.

[0035] In actual application, different types of anomalies have different importance and influence range in actual industrial scenarios, for example, semantic deviation may represent a high-risk control logic anomaly, and a strategy blind area may mean a data missing risk. By setting an independent anomaly weight value for each type of anomaly, the importance of the system to different types of anomalies can be reflected, providing strategy support for subsequent weighted fusion calculation, so that more flexible and scene-adaptive compensation collection control logic is realized. By weighting and combining the trigger intensity values of the three types of anomalies, a unified compensation trigger index is generated, which represents the overall anomaly intensity of the current system. This index can integrate the semantic deviation degree, instruction complexity mutation and acquisition strategy blind spot risk to form a more comprehensive and unified compensation acquisition risk measurement index. By setting a compensation trigger threshold, only when the comprehensive anomaly degree caused by the current operation sequence, i.e. the compensation trigger index, exceeds the threshold, the system will adjust the acquisition strategy. The compensatory acquisition behavior may include increasing the log collection granularity, extending the log retention time, temporarily activating the bypass acquisition module, and starting the real-time upload mechanism, etc. to ensure that the system can respond in time when key risks occur, improve the coverage and traceability of logs, and thus improve the overall security resilience and response ability of the system without interrupting the business process.

[0036] An industrial network security log collection system, by applying an industrial network security log collection method as described above, comprising: a semantic model construction module, which constructs an instruction semantic model of an industrial task, extracts semantic path segments from historical task execution data, and forms a standard semantic path; an operation instruction collection module, which acquires an operation instruction sequence in the current industrial network at a collection node to obtain a current operation instruction sequence; a semantic deviation analysis module, which extracts a semantic path of the current operation instruction sequence, judges whether the current operation instruction sequence has a semantic path deviation according to the standard semantic path, and obtains a semantic path deviation result; an information entropy value calculation module, which divides the current operation instruction sequence into fixed-length sliding time windows, and calculates instruction information entropy values of the current operation instruction sequence in the sliding time windows; an information entropy value analysis module, which judges whether the current operation instruction sequence has an information entropy value mutation based on the instruction information entropy values, and obtains an information entropy value mutation result; a collection strategy construction module, which establishes log collection strategy rules, and constructs a strategy effective coverage matrix of log collection based on the effective time, range of action and operation type of the log collection strategy rules; a strategy blind area identification module, which judges whether the current operation instruction sequence falls into a window area of the strategy effective coverage matrix based on the strategy effective coverage matrix, and obtains a strategy effective blind area result; The compensation collection control module triggers a compensatory log collection behavior based on the semantic path deviation result, the information entropy value mutation result and the policy effective blind area result, and adjusts the current collection behavior.

[0037] In actual application, the semantic model construction module extracts semantic path segments from historical task execution data to construct a standardized instruction semantic model, providing a benchmark for subsequent abnormal semantic behavior judgment. The operation instruction collection module acquires operation instruction sequences in the industrial network in real time at the collection node, serving as the core data source for system analysis and judgment. The semantic deviation analysis module analyzes whether the current instruction semantic path deviates from the standard path, identifying potential illegal control logic or abnormal operation behavior. The information entropy value calculation module divides the operation instruction sequence into time windows and calculates the information entropy, quantifying the complexity variation characteristics of the operation behavior. The information entropy value analysis module then detects the mutation of the instruction entropy value, identifying sudden changes in operation behavior, batch operations or potential abnormal events. The collection policy construction module constructs a policy effective coverage matrix according to the time, equipment and operation dimensions of the log collection policy, defining the collection rule boundary. The policy blind area identification module then identifies whether the current operation falls into the area not covered by the policy, discovering safety blind areas or log missing points in the collection policy configuration. The compensation collection control module finally fuses multiple abnormal signals to dynamically trigger a compensatory log collection behavior, achieving adaptive enhancement and closed-loop adjustment of log collection.

[0038] The above are preferred embodiments of the present application, and do not limit the protection scope of the present application. Therefore, equivalent changes made on the basis of the structure, shape and principle of the present application should be covered within the protection scope of the present application.

Claims

1. A method for collecting industrial network security logs, characterized in that: The following steps are involved: Build an instruction semantic model for industrial tasks, extract semantic path fragments based on historical task execution data, and form a standard semantic path; Acquire the operation instruction sequence in the current industrial network at the acquisition node to obtain the current operation instruction sequence; Extract the semantic path of the current operation instruction sequence, determine whether the current operation instruction sequence has a semantic path deviation based on the standard semantic path, and obtain a semantic path deviation result; Divide the current operation instruction sequence into a sliding time window of fixed length, and calculate the instruction information entropy value of the current operation instruction sequence within the sliding time window; Based on the instruction information entropy value, determining whether the current operation instruction sequence has an information entropy value mutation, and obtaining an information entropy value mutation result; Establish log collection policy rules, and build a log collection policy coverage matrix based on the effective time, scope, and operation type of the log collection policy rules; Based on the policy effectiveness coverage matrix, determine whether the current operation instruction sequence falls into the empty window area of ​​the policy effectiveness coverage matrix, and obtain the policy effectiveness blind area result; Based on the semantic path deviation results, information entropy value mutation results, and policy blind spot results, compensatory log collection behavior is triggered to adjust the current collection behavior.

2. The industrial network security log collection method according to claim 1, characterized in that: The steps of constructing the instruction semantic model of industrial tasks, extracting semantic path segments based on historical task execution data, and forming a standard semantic path are specifically as follows: Obtain historical task execution data recorded in the industrial control system and extract the historical operation instruction sequence corresponding to the historical tasks; Converting the historical operation instruction sequence into corresponding semantic path segments, and performing similarity clustering on multiple semantic path segments; Remove noise paths, extract main paths and variant paths, build instruction semantic models, and form standard semantic paths.

3. The industrial network security log collection method according to claim 1, characterized in that: The step of extracting the semantic path of the current operation instruction sequence, determining whether the current operation instruction sequence has a semantic path deviation based on the standard semantic path, and obtaining a semantic path deviation result is specifically as follows: Convert the current operation instruction sequence into a semantic label sequence to form the current operation semantic path; Comparing the current operation semantic path with the standard semantic path at the node level to determine whether the current operation instruction sequence deviates from the semantic path; If the current operation semantic path contains an illegal semantic node that is not included in the standard semantic path, or if the current operation semantic path contains an illegal path jump behavior, then it is determined that the current operation instruction sequence has a semantic path deviation, and a semantic path deviation result is generated.

4. The industrial network security log collection method according to claim 1, characterized in that: The step of dividing the current operation instruction sequence into a sliding time window of fixed length and calculating the instruction information entropy value of the current operation instruction sequence within the sliding time window is specifically as follows: Divide the current operation instruction sequence into multiple sliding time windows of fixed length according to the instruction timestamp; Identify and encode the operation instructions in each sliding time window according to their functional categories, count the occurrence frequencies of the operation instructions of each functional category in the sliding time window, and generate an operation instruction frequency distribution table; Based on the operation instruction frequency distribution table, the Shannon entropy calculation formula is used to calculate the information entropy value of the current operation instruction sequence in each sliding time window to obtain the instruction information entropy value.

5. The industrial network security log collection method according to claim 1, characterized in that: The step of determining whether a sudden change in the information entropy value occurs in the current operation instruction sequence based on the instruction information entropy value and obtaining the result of the sudden change in the information entropy value is specifically as follows: Based on the instruction information entropy value, the instruction information entropy value and the corresponding timestamp are combined into an instruction information entropy value time series; Set the allowable change range of the instruction information entropy value between adjacent sliding time windows to generate the entropy value mutation threshold; Calculate the difference in instruction information entropy between any two adjacent sliding time windows, compare the difference in instruction information entropy with the entropy mutation threshold, and determine whether an information entropy mutation occurs in the current operation instruction sequence; If the instruction information entropy value difference exceeds the entropy value mutation threshold, it is determined that the current operation instruction sequence has an information entropy value mutation in the sliding time window, and the information entropy value mutation result is output.

6. The industrial network security log collection method according to claim 5, characterized in that: The step of determining whether the current operation instruction sequence falls into the empty window area of ​​the policy effectiveness coverage matrix based on the policy effectiveness coverage matrix to obtain the policy effectiveness blind area result is specifically as follows: Extracting the real-time operation time, target device identification, and target operation type from the current operation instruction sequence; Based on the policy effectiveness coverage matrix, using the real-time operation time, target device identifier, and target operation type as indexes, querying from the policy effectiveness coverage matrix whether there is a valid log collection policy; If there is no log collection policy effectiveness mark at the corresponding index position in the policy effectiveness coverage matrix, it is determined that the current operation instruction sequence falls into the empty window area of ​​the policy effectiveness coverage matrix, and the policy effectiveness blind area result is output.

7. The method for collecting industrial network security logs according to claim 1, wherein: The steps of triggering a compensatory log collection signal and adjusting the current collection behavior based on the semantic path deviation result, the information entropy value mutation result, and the policy effectiveness blind spot result are specifically as follows: Based on the semantic path deviation result, extracting the edit distance between the current operation instruction sequence and the standard semantic path, calculating the semantic deviation degree of the current operation instruction sequence, normalizing the semantic deviation degree, and obtaining a first trigger intensity value of the semantic path deviation; Based on the information entropy value mutation result, calculating the instruction information entropy value difference in adjacent sliding time windows, normalizing the instruction information entropy value difference, and obtaining a second trigger intensity value of the information entropy value mutation; Based on the strategy effectiveness blind zone result, the coverage degree of the current operation instruction sequence in the strategy effectiveness coverage matrix is ​​counted, its reverse coverage degree is calculated, and the reverse coverage degree is normalized to obtain the third trigger strength value of the strategy effectiveness blind zone; The first trigger intensity value, the second trigger intensity value, and the third trigger intensity value are combined to trigger a compensatory log collection signal to adjust the current collection behavior.

8. The industrial network security log collection method according to claim 7, characterized in that: The step of triggering a compensatory log collection behavior by integrating the first trigger intensity value, the second trigger intensity value, and the third trigger intensity value and adjusting the current collection behavior is specifically as follows: They are the abnormal weight values ​​corresponding to semantic path deviation, information entropy value mutation and strategy effectiveness blind zone setting; Based on the corresponding abnormal weight value, a compensation trigger index is obtained by weighted comprehensive calculation according to the first trigger intensity value, the second trigger intensity value and the third trigger intensity value; Setting a compensation trigger threshold, and comparing the compensation trigger index with the set compensation trigger threshold; When the compensation trigger index exceeds the set compensation trigger threshold, a compensatory log collection behavior is triggered, and the current collection behavior is dynamically adjusted.

9. An industrial network security log collection system, characterized in that: Applying an industrial network security log collection method according to any one of claims 1 to 8, comprising: The semantic model construction module builds the instruction semantic model of the industrial task, extracts the semantic path fragments based on the historical task execution data, and forms a standard semantic path; The operation instruction acquisition module obtains the operation instruction sequence in the current industrial network at the acquisition node and obtains the current operation instruction sequence; The semantic deviation analysis module extracts the semantic path of the current operation instruction sequence, determines whether the current operation instruction sequence has a semantic path deviation based on the standard semantic path, and obtains the semantic path deviation result; The information entropy value calculation module divides the current operation instruction sequence into a sliding time window of fixed length and calculates the instruction information entropy value of the current operation instruction sequence within the sliding time window; An information entropy value analysis module determines whether an information entropy value mutation occurs in the current operation instruction sequence based on the instruction information entropy value, and obtains an information entropy value mutation result; The collection strategy construction module establishes log collection strategy rules and builds a log collection strategy coverage matrix based on the effective time, scope and operation type of the log collection strategy rules; A strategy blind spot identification module determines whether the current operation instruction sequence falls into the empty window area of ​​the strategy effective coverage matrix based on the strategy effective coverage matrix, and obtains the strategy effective blind spot result; The compensation collection control module triggers compensatory log collection behavior based on the semantic path deviation results, information entropy value mutation results, and policy blind spot results, and adjusts the current collection behavior.

Images