An industrial network security log collection method and system

Abstract

The application discloses an industrial network security log collection method and system, and relates to the technical field of security log collection. The method comprises the following steps: acquiring an operation instruction sequence in a current industrial network, extracting a semantic path of the current operation instruction sequence, judging whether the current operation instruction sequence deviates from the semantic path, and obtaining a semantic path deviation result; calculating an instruction information entropy value of the current operation instruction sequence in a sliding time window, judging whether the current operation instruction sequence has an information entropy value mutation, and obtaining an information entropy value mutation result; constructing a strategy effect coverage matrix of log collection, judging whether the current operation instruction sequence falls into a blank window area of the strategy effect coverage matrix, and obtaining a strategy effect blind area result; and triggering a compensatory log collection behavior and adjusting a current collection behavior. The application significantly improves the completeness, accuracy and intelligent response capability of industrial network log collection.

Description

Technical Field

[0001] This application relates to the field of security log collection technology, and in particular to an industrial network security log collection method and system. Background Technology

[0002] Industrial network environments generate a large number of logs daily, recording various events including user actions, system events, and security incidents. By collecting and analyzing these logs, potential security threats and abnormal activities can be detected promptly, preventing network attacks. Furthermore, log analysis not only helps identify security issues but also uncovers potential problems and faults in system operation by analyzing log data, enabling optimization and improvement.

[0003] In related technologies, traditional log collection methods are mostly based on keyword matching, device status changes, or rule triggers. These methods struggle to identify whether the semantic logic behind operational behaviors deviates from the normal process, easily leading to missed detections of abnormal operations disguised as legitimate actions. Furthermore, traditional log collection strategies are typically configured manually, lacking structured verification mechanisms. This often results in blind spots such as incomplete strategy coverage, gaps in device availability during specific time periods, and configuration omissions, leading to the failure to record critical logs. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to provide an industrial network security log collection method and system to solve the problems mentioned in the background art.

[0005] Firstly, this application provides an industrial network security log collection method, which adopts the following technical solution:

[0006] Construct a semantic model of instructions for industrial tasks, extract semantic path fragments based on historical task execution data, and form a standard semantic path;

[0007] The current operation instruction sequence is obtained by acquiring the sequence of operation instructions in the current industrial network at the acquisition node;

[0008] Extract the semantic path of the current operation instruction sequence, and determine whether there is semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtain the semantic path deviation result;

[0009] Divide the current operation instruction sequence into a sliding time window of fixed length, and calculate the instruction information entropy value of the current operation instruction sequence within the sliding time window;

[0010] Based on the instruction information entropy value, determine whether there is a sudden change in the information entropy value in the current operation instruction sequence, and obtain the information entropy value change result;

[0011] Establish log collection strategy rules, and construct a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules;

[0012] Based on the policy coverage matrix, determine whether the current operation instruction sequence falls into the empty window area of ​​the policy coverage matrix to obtain the policy coverage blind zone result;

[0013] Based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spots, compensatory log collection behavior is triggered to adjust the current collection behavior.

[0014] Preferably, the steps of constructing an instruction semantic model for industrial tasks and extracting semantic path fragments based on historical task execution data to form a standard semantic path are as follows:

[0015] Acquire historical task execution data recorded in the industrial control system and extract the historical operation instruction sequence corresponding to the historical task.

[0016] The historical operation instruction sequence is converted into corresponding semantic path fragments, and multiple semantic path fragments are clustered based on similarity.

[0017] Noise paths are removed, main paths and variant paths are extracted, an instruction semantic model is constructed, and a standard semantic path is formed.

[0018] Preferably, the step of extracting the semantic path of the current operation instruction sequence, determining whether there is a semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtaining the semantic path deviation result is as follows:

[0019] Convert the current operation instruction sequence into a semantic tag sequence to form the current operation semantic path;

[0020] The current operation semantic path is compared with the standard semantic path at the node level to determine whether there is a semantic path deviation in the current operation instruction sequence.

[0021] If the current operation semantic path contains an illegal semantic node not included in the standard semantic path, or if the current operation semantic path exhibits an illegal path jump, then it is determined that the current operation instruction sequence has a semantic path deviation, and a semantic path deviation result is generated.

[0022] Preferably, the step of dividing the current operation instruction sequence into a sliding time window of fixed length and calculating the instruction information entropy value of the current operation instruction sequence within the sliding time window is as follows:

[0023] Divide the current sequence of operation instructions into multiple fixed-length sliding time windows based on instruction timestamps;

[0024] The operation instructions within each sliding time window are identified and coded according to their function categories. The frequency of operation instructions of each function category in the sliding time window is counted to generate an operation instruction frequency distribution table.

[0025] Based on the operation instruction frequency distribution table, the information entropy value of the current operation instruction sequence within each sliding time window is calculated using the Shannon entropy calculation formula to obtain the instruction information entropy value.

[0026] Preferably, the step of determining whether a sudden change in information entropy value occurs in the current operation instruction sequence based on the instruction information entropy value, and obtaining the result of the information entropy value change, specifically includes:

[0027] Based on the instruction information entropy value, the instruction information entropy value and the corresponding timestamp are combined to form an instruction information entropy value time series;

[0028] Define the allowable range of change in the entropy value of instruction information between adjacent sliding time windows, and generate an entropy value mutation threshold;

[0029] Calculate the difference in instruction information entropy values ​​between any two adjacent sliding time windows, compare the difference in instruction information entropy values ​​with the entropy value mutation threshold, and determine whether there is a mutation in information entropy values ​​in the current operation instruction sequence;

[0030] If the difference in the entropy value of the instruction information exceeds the entropy value mutation threshold, it is determined that the current operation instruction sequence has experienced an entropy value mutation in the sliding time window, and the entropy value mutation result is output.

[0031] Preferably, the step of determining whether the current operation instruction sequence falls within the empty window region of the policy effectiveness coverage matrix, based on the policy effectiveness coverage matrix, to obtain the policy effectiveness blind zone result, specifically includes:

[0032] Extract the real-time operation time, target device identifier, and target operation type from the current operation instruction sequence;

[0033] Based on the policy effectiveness coverage matrix, using the real-time operation time, target device identifier, and target operation type as indexes, query the policy effectiveness coverage matrix to see if there is an effective log collection policy.

[0034] If there is no log collection policy effective identifier at the corresponding index position in the policy effective coverage matrix, it is determined that the current operation instruction sequence falls into the empty window area of ​​the policy effective coverage matrix, and the policy effective blind zone result is output.

[0035] Preferably, the step of triggering a compensatory log collection signal and adjusting the current collection behavior based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results is as follows:

[0036] Based on the semantic path deviation results, the edit distance between the current operation instruction sequence and the standard semantic path is extracted, the semantic deviation degree of the current operation instruction sequence is calculated, and the semantic deviation degree is normalized to obtain the first trigger intensity value of semantic path deviation.

[0037] Based on the information entropy value mutation result, the instruction information entropy value difference within adjacent sliding time windows is calculated, and the instruction information entropy value difference is normalized to obtain the second trigger intensity value of the information entropy value mutation.

[0038] Based on the policy effective blind zone results, the coverage degree of the current operation instruction sequence in the policy effective coverage matrix is ​​statistically analyzed, its reverse coverage degree is calculated, and the reverse coverage degree is normalized to obtain the third trigger strength value of the policy effective blind zone.

[0039] By combining the first trigger strength value, the second trigger strength value, and the third trigger strength value, a compensatory log collection signal is triggered to adjust the current collection behavior.

[0040] Preferably, the step of triggering compensatory log collection behavior and adjusting the current collection behavior by combining the first trigger strength value, the second trigger strength value, and the third trigger strength value is as follows:

[0041] Set corresponding abnormal weight values ​​for semantic path deviation, information entropy value mutation, and policy effectiveness blind spot;

[0042] Based on the corresponding abnormal weight value, the compensation trigger index is calculated by weighted comprehensive calculation according to the first trigger strength value, the second trigger strength value and the third trigger strength value;

[0043] Set a compensation trigger threshold and compare the compensation trigger index with the set compensation trigger threshold;

[0044] When the compensation trigger index exceeds the set compensation trigger threshold, a compensatory log collection behavior is triggered to dynamically adjust the current collection behavior.

[0045] Secondly, the industrial network security log collection system provided in this application adopts the following technical solution:

[0046] An industrial network security log collection system includes:

[0047] The semantic model building module constructs instruction semantic models for industrial tasks and extracts semantic path fragments based on historical task execution data to form standard semantic paths.

[0048] The operation command acquisition module acquires the sequence of operation commands in the current industrial network at the acquisition node to obtain the current operation command sequence;

[0049] The semantic deviation analysis module extracts the semantic path of the current operation instruction sequence, determines whether there is semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtains the semantic path deviation result.

[0050] The information entropy calculation module divides the current operation instruction sequence into a sliding time window of fixed length and calculates the instruction information entropy value of the current operation instruction sequence within the sliding time window.

[0051] The information entropy value analysis module, based on the instruction information entropy value, determines whether there is a sudden change in information entropy value in the current operation instruction sequence, and obtains the information entropy value change result;

[0052] The log collection strategy construction module establishes log collection strategy rules and constructs a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules.

[0053] The strategy blind zone identification module determines whether the current operation instruction sequence falls into the empty window area of ​​the strategy effectiveness coverage matrix based on the strategy effectiveness coverage matrix, and obtains the strategy effectiveness blind zone result.

[0054] The compensation collection control module, based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results, triggers compensatory log collection behavior to adjust the current collection behavior.

[0055] In summary, this application includes at least one of the following beneficial technical effects:

[0056] 1. By analyzing historical task execution data, the temporal and logical relationships between typical instructions are extracted to form semantic path fragments, which are then integrated into a standard semantic path set. This serves as a reference benchmark for subsequent behavior judgment, thereby enabling the detection of semantic deviations from abnormal behavior. The data acquisition nodes are located at the network edge or in front of the control host. Through standard interfaces or deep protocol parsers, they extract instruction-level content such as control commands and data packets, organizing them into a sequence structure. This sequence is the foundational input for subsequent semantic judgment and entropy analysis, ensuring the system has real-time awareness of the current operational status. By extracting the semantic path of the current instruction sequence and comparing it with the standard semantic path, abnormal operational behaviors that do not conform to historical patterns in the control logic can be identified, generating semantic path deviation results. This provides semantic evidence for abnormal behavior detection and is suitable for identifying threats such as control logic injection attacks and misoperations. By dividing the sequence into sliding windows and calculating the information entropy of the instruction distribution within each window, a drastic change in entropy value compared to the previous window may indicate risks such as sudden behavioral changes, batch instruction injection, or attempts to mask the switching of operation modes. This helps to provide early warning of attack preparation phases or critical operations, and forms multi-dimensional verification with semantic deviation results, enhancing the accuracy and interpretability of detection and improving the reliability of system anomaly detection. By structuring the collection strategy and mapping it to a three-dimensional space of time, device, and operation type to form a coverage matrix, systematic management of log collection rules is achieved, which helps to discover gaps, redundancies, or errors in policy configuration. If the current behavior is not captured by any policy in the three dimensions of time period, device, or operation type, critical behaviors may be missed. Policy blind spot identification can promptly discover defects in configuration logic, ensuring log integrity and security traceability. When any one or more of the following anomalies are detected: semantic anomalies, entropy value mutations, or policy blind spots, the system triggers compensatory data collection, including operations such as increasing the collection frequency, expanding the collection fields, and extending the collection duration. This not only improves the ability to capture abnormal behavior but also makes up for the shortcomings of static configuration of the collection strategy, enabling a more intelligent and refined industrial network log collection process.

[0057] 2. By setting a fixed-length sliding window, local features of command behavior can be acquired in the continuous time domain, thereby capturing short-term anomalies, sudden behavioral changes, and other pattern variations. This avoids the risk of global averaging masking local mutations and enhances the timeliness of the acquisition strategy. By categorizing operation commands by function and statistically analyzing their frequency of occurrence within the window, a command frequency distribution table is constructed, providing a necessary probabilistic basis for subsequent information entropy calculation. Higher entropy values ​​indicate a more uniform distribution of command types and more complex behavior; lower entropy values ​​indicate concentrated operations and repetitive commands. This approach has significant advantages in capturing unstructured anomalies and periodic behavioral mutations, compensating for the blind spots of traditional semantic rules or keyword matching methods, and improving the intelligence of industrial network security log collection systems.

[0058] 3. The current operational behavior is transformed into three-dimensional index information for policy comparison, specifically including three dimensions: time, device, and operation type. By accurately locating the time, location, and action point of the behavior, a semantically complete query entry point is established for subsequent comparison with the policy coverage matrix. By using the extracted triples as indexes, the system can quickly retrieve whether the current operational behavior is covered by a defined log collection policy. If a match is successful, it indicates that the behavior has been effectively monitored by the collection configuration; otherwise, it will proceed to the next step of judgment, providing the system with a precise policy applicability judgment mechanism and avoiding the collection policy being ineffective or redundant configurations wasting resources. If no corresponding policy identifier is found in the coverage matrix, it indicates that the current operational behavior is not covered by any effective collection policy, belonging to a policy configuration gap area, which may lead to the loss of important behavior logs, a significant risk source for log collection integrity and security. Dynamic verification of log collection coverage is achieved, endowing the industrial network security log collection system with dynamic adaptation, rule closure, and leak prevention capabilities. Attached Figure Description

[0059] Figure 1 This is a schematic diagram illustrating the specific steps of an embodiment of an industrial network security log collection method according to the present invention.

[0060] Figure 2 This is a schematic diagram of the module connections of an embodiment of an industrial network security log collection system according to the present invention. Detailed Implementation

[0061] The following examples and... Figures 1-2 The present invention will be described in further detail, but the embodiments of the present invention are not limited thereto.

[0062] This invention discloses a method for collecting industrial network security logs, which specifically includes the following steps:

[0063] Step S1: Construct an instruction semantic model for industrial tasks, extract semantic path fragments based on historical task execution data, and form a standard semantic path;

[0064] Step S2: Obtain the current operation instruction sequence in the industrial network at the acquisition node to obtain the current operation instruction sequence;

[0065] Step S3: Extract the semantic path of the current operation instruction sequence. Based on the standard semantic path, determine whether there is a semantic path deviation in the current operation instruction sequence, and obtain the semantic path deviation result.

[0066] Step S4: Divide the current operation instruction sequence into a sliding time window of fixed length, and calculate the instruction information entropy value of the current operation instruction sequence within the sliding time window;

[0067] Step S5: Based on the instruction information entropy value, determine whether there is a sudden change in the information entropy value in the current operation instruction sequence, and obtain the information entropy value change result;

[0068] Step S6: Establish log collection strategy rules, and construct a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules.

[0069] Step S7: Based on the policy effectiveness coverage matrix, determine whether the current operation instruction sequence falls into the empty window area of ​​the policy effectiveness coverage matrix to obtain the policy effectiveness blind zone result;

[0070] Step S8: Based on the semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results, trigger compensatory log collection behavior to adjust the current collection behavior.

[0071] In practical applications, by analyzing historical task execution data, the temporal and logical relationships between typical instructions are extracted to form semantic path fragments, which are then integrated into a standard semantic path set. This serves as a reference benchmark for subsequent behavior judgment, thereby enabling the detection of semantic deviations from abnormal behavior. The data acquisition nodes are located at the network edge or the front end of the control host. Through standard interfaces or deep protocol parsers, they extract instruction-level content such as control commands and data packets, and organize them into a sequence structure. This sequence is the foundational input for subsequent semantic judgment and entropy analysis, ensuring the system has real-time awareness of its current operational status. By extracting the semantic path of the current instruction sequence and comparing it with the standard semantic path, abnormal operational behaviors that do not conform to historical patterns in the control logic can be identified. Phenomena such as illegal jumps, disordered sequences, and the insertion of unexpected instructions can all be detected, generating semantic path deviation results. This provides semantic evidence for abnormal behavior detection and is suitable for identifying threats such as control logic injection attacks and misoperations. By dividing the sequence into sliding windows and calculating the information entropy of the instruction distribution within each window, a drastic change in entropy value compared to the previous window may indicate risks such as sudden behavioral changes, batch instruction injection, or attempts to mask the switching of operation modes. This helps to provide early warning of attack preparation phases or critical operations, and forms multi-dimensional verification with semantic deviation results, enhancing the accuracy and interpretability of detection and improving the reliability of system anomaly detection. By structuring the collection strategy and mapping it to a three-dimensional space of time, device, and operation type to form a coverage matrix, systematic management of log collection rules is achieved, which helps to discover gaps, redundancies, or errors in policy configuration. If the current behavior is not captured by any policy in the three dimensions of time period, device, or operation type, critical behaviors may be missed. Policy blind spot identification can promptly discover defects in configuration logic, ensuring log integrity and security traceability. When any one or more of the following anomalies are detected: semantic anomalies, entropy value mutations, or policy blind spots, the system triggers compensatory data collection, including operations such as increasing the collection frequency, expanding the collection fields, and extending the collection duration. This not only improves the ability to capture abnormal behavior but also makes up for the shortcomings of static configuration of the collection strategy, enabling a more intelligent and refined industrial network log collection process.

[0072] The steps for constructing an instruction semantic model for industrial tasks, extracting semantic path fragments based on historical task execution data, and forming a standard semantic path are as follows:

[0073] Step S11: Obtain historical task execution data recorded in the industrial control system and extract the historical operation instruction sequence corresponding to the historical task.

[0074] Step S12: Convert the historical operation instruction sequence into corresponding semantic path segments, and perform similarity clustering on multiple semantic path segments;

[0075] Step S13: Remove noise paths, extract the main path and variant paths, construct the instruction semantic model, and form the standard semantic path.

[0076] In practical applications, by acquiring historical task logs, especially equipment control logs, PLC execution logs, and operator instruction trajectories, the original sequence of operation instructions executed for each task is extracted to ensure the authenticity and completeness of subsequent model construction. By converting the underlying sequence of operation instructions into semantic path fragments, the logical flow of task behavior can be abstracted. Subsequently, similarity clustering methods, such as edit distance and path structure distance, are used to group similar behavioral paths between different tasks into one category, thereby identifying typical execution patterns. This helps to eliminate the discrete effects caused by operational differences, strengthens the system's ability to generalize normal behavior patterns, and establishes a comparative benchmark for judging abnormal behavior. Through noise path identification and removal, such as low-frequency paths and non-closed-loop paths, the main path representing the majority of task patterns is retained, and a few acceptable reasonable variant paths, such as parameter switching and skip-step optimization, are identified to form a standard semantic path, providing a robust reference model for subsequent semantic deviation detection in the system.

[0077] The steps of extracting the semantic path of the current operation instruction sequence, determining whether there is a semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtaining the semantic path deviation result are as follows:

[0078] Step S31: Convert the current operation instruction sequence into a semantic tag sequence to form the current operation semantic path;

[0079] Step S32: Compare the current operation semantic path with the standard semantic path at the node level to determine whether there is a semantic path deviation in the current operation instruction sequence;

[0080] Step S33: If the current operation semantic path contains an illegal semantic node not included in the standard semantic path, or if the current operation semantic path exhibits an illegal path jump behavior, then it is determined that the current operation instruction sequence has a semantic path deviation, and a semantic path deviation result is generated.

[0081] In practical applications, the current sequence of operation instructions is converted into a clearly structured and semantically defined sequence of labels, i.e., a semantic path. This path effectively describes the behavioral logic of the current task and establishes a semantic layer alignment with the standard semantic model, providing a high-dimensional representation basis for subsequent deviation judgment. By comparing the structural differences between the current semantic path and the standard semantic path node by node, it is determined whether a path deviation has occurred. For example, if the expected path is ABCD, but the current path is ABED, this insertion of intermediate links can be considered a deviation behavior. Triggering conditions for deviation judgment are set, and key deviation types are clarified: illegal semantic nodes, i.e., the current path contains operations not defined in the standard path, such as unauthorized configuration or skipping detection and starting directly; and illegal path jumps, i.e., jump behaviors that violate the process structure, such as jumping directly from initialization to end, or skipping key security nodes. Identifying deviation behaviors can effectively detect potential attacks, misoperations, or unauthorized control behaviors. The generated semantic path deviation results can not only identify illegal behaviors in the control logic, but also provide interpretable reasons and locations for deviations, with high visibility and practicality. This provides a reliable basis for whether the system should trigger compensation collection and log enhancement in the future, significantly improving the intelligence of log collection.

[0082] The steps for dividing the current operation instruction sequence into a fixed-length sliding time window and calculating the instruction information entropy value of the current operation instruction sequence within the sliding time window are as follows:

[0083] Step S41: Divide the current operation instruction sequence into multiple fixed-length sliding time windows according to the instruction timestamp;

[0084] Step S42: Identify and encode the operation instructions within each sliding time window according to their function categories, count the frequency of operation instructions of each function category in the sliding time window, and generate an operation instruction frequency distribution table.

[0085] Step S43: Based on the operation instruction frequency distribution table, the information entropy value of the current operation instruction sequence within each sliding time window is calculated using the Shannon entropy calculation formula to obtain the instruction information entropy value.

[0086] In practical applications, by setting a sliding window of fixed length, local features of command behavior can be acquired in the continuous time domain, thereby capturing short-term anomalies, sudden behavioral changes, and other pattern variations. This avoids the risk of global averaging masking local mutations and enhances the timeliness of the acquisition strategy. By identifying and encoding operation commands according to functional categories, such as read status, write parameters, start commands, alarm resets, etc., and statistically analyzing their frequency of occurrence within the window, a command frequency distribution table within the window is constructed. This provides the necessary probabilistic basis for subsequent information entropy calculation. A higher entropy value indicates a more uniform distribution of command types and more complex behavior; a lower entropy value indicates concentrated operations and repetitive commands. This approach has significant advantages in capturing unstructured anomalies and periodic behavioral mutations, compensating for the blind spots of traditional semantic rules or keyword matching methods, and improving the intelligence of industrial network security log acquisition systems.

[0087] The step of determining whether a sudden change in entropy value occurs in the current operation instruction sequence based on the instruction information entropy value, and obtaining the result of the entropy value change, is as follows:

[0088] Step S51: Based on the instruction information entropy value, combine the instruction information entropy value with the corresponding timestamp to form an instruction information entropy value time series;

[0089] Step S52: Set the allowable range of change in the entropy value of instruction information between adjacent sliding time windows, and generate an entropy value mutation threshold;

[0090] Step S53: Calculate the difference in instruction information entropy values ​​between any two adjacent sliding time windows, compare the difference in instruction information entropy values ​​with the entropy value mutation threshold, and determine whether the current operation instruction sequence has an information entropy value mutation.

[0091] Step S54: If the difference in the instruction information entropy value exceeds the entropy value mutation threshold, it is determined that the current operation instruction sequence has an information entropy value mutation in the sliding time window, and the information entropy value mutation result is output.

[0092] In practical applications, the instruction information entropy value calculated for each sliding time window is associated with its timestamp to construct a time series of information entropy values ​​with a time dimension. This series records the continuous changes in the complexity of operational behavior over different time periods, helping to identify whether system behavior is stable, whether there are periodic interruptions, and whether there are sudden abnormal operations. In industrial control systems, instruction behavior exhibits a certain degree of normal fluctuation; therefore, it is necessary to set a reasonable tolerance range for changes, i.e., an entropy value change threshold. This can filter out small entropy differences caused by normal operations while significantly amplifying abnormal signals caused by sudden changes. By calculating the entropy value difference between adjacent windows, the micro-change trends of stable and abrupt changes in system behavior can be captured. When an operational behavior causes a significant change in the instruction structure, the entropy value difference will exceed the change threshold, triggering a mutation judgment. This provides a highly real-time anomaly identification mechanism for safety systems, significantly enhancing the system's ability to perceive blind spots in log collection and behavioral anomalies.

[0093] The steps for determining whether the current operation instruction sequence falls within the empty window region of the policy effectiveness coverage matrix, based on the policy effectiveness coverage matrix, and obtaining the policy effectiveness blind zone result, are as follows:

[0094] Step S71: Extract the real-time operation time, target device identifier, and target operation type from the current operation instruction sequence;

[0095] Step S72: Based on the policy effectiveness coverage matrix, using the real-time operation time, target device identifier, and target operation type as indexes, query the policy effectiveness coverage matrix to see if there is an effective log collection policy.

[0096] Step S73: If there is no log collection policy effective identifier at the corresponding index position in the policy effective coverage matrix, then it is determined that the current operation instruction sequence falls into the empty window area of ​​the policy effective coverage matrix, and the policy effective blind zone result is output.

[0097] In practical applications, the current operational behavior is transformed into three-dimensional index information for policy comparison, specifically including three dimensions: time, device, and operation type. By accurately locating the time, location, and action point of the behavior, a semantically complete query entry point is established for subsequent comparison with the policy coverage matrix. By using the extracted triples as indexes, the system can quickly retrieve whether the current operational behavior is covered by a defined log collection policy. If a match is successful, it indicates that the behavior has been effectively monitored by the collection configuration; otherwise, it proceeds to the next step, providing the system with a precise policy applicability judgment mechanism and avoiding the collection policy being ineffective or redundant configurations wasting resources. If no corresponding policy identifier is found in the coverage matrix, it indicates that the current operational behavior is not covered by any effective collection policy, belonging to a policy configuration gap, which may lead to the loss of important behavior logs, a significant risk source for log collection integrity and security. Dynamic verification of log collection coverage is achieved, endowing the industrial network security log collection system with dynamic adaptation, rule closure, and leak prevention capabilities.

[0098] Based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spots, the steps to trigger a compensatory log collection signal and adjust the current collection behavior are as follows:

[0099] Step S81: Based on the semantic path deviation result, extract the edit distance between the current operation instruction sequence and the standard semantic path, calculate the semantic deviation degree of the current operation instruction sequence, normalize the semantic deviation degree, and obtain the first trigger intensity value of semantic path deviation.

[0100] Step S82: Based on the information entropy value mutation result, calculate the instruction information entropy value difference within adjacent sliding time windows, normalize the instruction information entropy value difference, and obtain the second trigger intensity value of the information entropy value mutation.

[0101] Step S83: Based on the policy effective blind zone result, the coverage degree of the current operation instruction sequence in the policy effective coverage matrix is ​​statistically analyzed, its reverse coverage degree is calculated, and the reverse coverage degree is normalized to obtain the third trigger strength value of the policy effective blind zone.

[0102] Step S84: Combine the first trigger strength value, the second trigger strength value, and the third trigger strength value to trigger a compensatory log collection signal and adjust the current collection behavior.

[0103] In practical applications, edit distance is used as a quantitative indicator to measure the structural difference between the current operational behavior and the standard semantic path. The greater the deviation, the more likely the behavior is to be abnormal. By normalizing this difference and converting it into a standardized trigger strength value, the semantic sensitivity of the collection system is enhanced, which can distinguish between minor errors and high-risk anomalies, and helps to optimize log collection resource allocation strategies. Entropy changes are used as a signal of behavioral complexity fluctuations. The larger the entropy difference, the more drastic the system behavior changes in a short period of time. Through normalization, the entropy difference under different operating environments is converted into a uniform-scale strength value, reflecting the dynamic sensitivity of the system. The severity of the current behavior falling into the blind zone of the collection strategy is quantified. Low coverage indicates a lack of policy support for the behavior and a high risk of missing collection data. By calculating the reverse coverage rate, i.e., the uncovered proportion, and normalizing it, the trigger strength value of the current behavior in the policy configuration is obtained, reflecting the pressure of policy configuration vulnerabilities in the system. This can be used to dynamically identify policy coverage failure areas, trigger enhanced collection, and avoid missing critical logs. By integrating three dimensions of indicators—semantic deviation strength, information entropy mutation strength, and policy blind spot strength—a comprehensive risk perception mechanism is formed, which automatically triggers compensatory log collection behavior. This makes the log collection mechanism no longer a passive rule-triggered mechanism, but has dynamic, adaptive, and on-demand enhanced intelligent capabilities.

[0104] The steps for triggering compensatory log collection behavior and adjusting the current collection behavior by combining the first trigger strength value, the second trigger strength value, and the third trigger strength value are as follows:

[0105] Step S841: Set corresponding abnormal weight values ​​for semantic path deviation, information entropy value mutation, and policy effectiveness blind spot, respectively;

[0106] Step S842: Based on the corresponding abnormal weight value, the compensation trigger index is calculated by weighted comprehensive calculation according to the first trigger strength value, the second trigger strength value and the third trigger strength value.

[0107] Step S843: Set a compensation trigger threshold and compare the compensation trigger index with the set compensation trigger threshold;

[0108] Step S844: When the compensation trigger index exceeds the set compensation trigger threshold, a compensatory log collection behavior is triggered to dynamically adjust the current collection behavior.

[0109] In practical applications, different types of anomalies in real-world industrial scenarios have varying degrees of importance and impact. For example, semantic deviation may indicate high-risk control logic anomalies, while strategy blind spots may imply data omission risks. By assigning independent anomaly weight values ​​to each type of anomaly, the system's level of attention to different types of anomalies can be reflected, providing strategic support for subsequent weighted fusion calculations and enabling more flexible and scenario-adaptive compensation acquisition control logic. By weighting and combining the trigger intensity values ​​of the three types of anomalies, a unified compensation trigger index is generated. This index, representing the overall anomaly intensity of the current system, integrates the degree of semantic deviation, sudden changes in instruction complexity, and the risk of acquisition strategy blind spots, forming a more comprehensive and unified compensation acquisition risk measurement indicator. By setting a compensation trigger threshold, the system will only adjust the acquisition strategy when the overall anomaly level caused by the current operation sequence, i.e., the compensation trigger index, exceeds the threshold. Compensatory data collection may include increasing log collection granularity, extending log retention time, temporarily activating bypass collection modules, and starting real-time upload mechanisms to ensure that the system can respond promptly when critical risks occur, improve log coverage and traceability, and thus enhance the overall security resilience and responsiveness of the system without interrupting business processes.

[0110] An industrial network security log collection system, by applying the industrial network security log collection method described above, includes:

[0111] The semantic model building module constructs instruction semantic models for industrial tasks and extracts semantic path fragments based on historical task execution data to form standard semantic paths.

[0112] The operation command acquisition module acquires the sequence of operation commands in the current industrial network at the acquisition node to obtain the current operation command sequence;

[0113] The semantic deviation analysis module extracts the semantic path of the current operation instruction sequence, determines whether there is semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtains the semantic path deviation result.

[0114] The information entropy calculation module divides the current operation instruction sequence into a sliding time window of fixed length and calculates the instruction information entropy value of the current operation instruction sequence within the sliding time window.

[0115] The information entropy value analysis module, based on the instruction information entropy value, determines whether there is a sudden change in information entropy value in the current operation instruction sequence, and obtains the information entropy value change result;

[0116] The log collection strategy construction module establishes log collection strategy rules and constructs a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules.

[0117] The strategy blind zone identification module determines whether the current operation instruction sequence falls into the empty window area of ​​the strategy effectiveness coverage matrix based on the strategy effectiveness coverage matrix, and obtains the strategy effectiveness blind zone result.

[0118] The compensation collection control module, based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results, triggers compensatory log collection behavior to adjust the current collection behavior.

[0119] In practical applications, the semantic model construction module extracts semantic path fragments from historical task execution data to build a standardized instruction semantic model, providing a benchmark for subsequent abnormal semantic behavior judgment. The operation instruction acquisition module acquires operation instruction sequences from the industrial network in real time at acquisition nodes, serving as the core data source for system analysis and judgment. The semantic deviation analysis module analyzes whether the current instruction semantic path deviates from the standard path, identifying potential illegal control logic or abnormal operation behavior. The information entropy calculation module segments the operation instruction sequence into time windows and calculates information entropy, quantifying the complexity change characteristics of operation behavior. Then, the information entropy analysis module detects abrupt changes in instruction entropy values, identifying sudden changes in operation behavior, batch operations, or potential abnormal events. The acquisition strategy construction module constructs a strategy coverage matrix based on the time, device, and operation dimensions of the log acquisition strategy, defining the boundaries of acquisition rules. The strategy blind spot identification module then identifies whether the current operation falls into a policy-uncovered area, discovering security blind spots or missing log points in the acquisition strategy configuration. Finally, the compensation acquisition control module integrates multi-source abnormal signals and dynamically triggers compensatory log acquisition behavior, achieving adaptive enhancement and closed-loop adjustment of log acquisition.

[0120] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for collecting industrial network security logs, characterized in that, Includes the following steps: Constructing an instruction semantic model for industrial tasks, extracting semantic path fragments based on historical task execution data, and forming a standard semantic path, the specific steps are as follows: Acquire historical task execution data recorded in the industrial control system and extract the historical operation instruction sequence corresponding to the historical task. The historical operation instruction sequence is converted into corresponding semantic path fragments, and multiple semantic path fragments are clustered based on similarity. Noisy paths are removed, main paths and variant paths are extracted, an instruction semantic model is constructed, and a standard semantic path is formed. The current operation instruction sequence is obtained by acquiring the sequence of operation instructions in the current industrial network at the acquisition node; Extract the semantic path of the current operation instruction sequence, and determine whether there is semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtain the semantic path deviation result; Divide the current operation instruction sequence into a sliding time window of fixed length, and calculate the instruction information entropy value of the current operation instruction sequence within the sliding time window; Based on the instruction information entropy value, determine whether there is a sudden change in the information entropy value in the current operation instruction sequence, and obtain the information entropy value change result; Establish log collection strategy rules, and construct a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules; Based on the policy coverage matrix, determine whether the current operation instruction sequence falls into the empty window area of ​​the policy coverage matrix to obtain the policy coverage blind zone result; Based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spots, compensatory log collection behavior is triggered to adjust the current collection behavior.

2. The industrial network security log collection method according to claim 1, characterized in that, The steps of extracting the semantic path of the current operation instruction sequence, determining whether there is a semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtaining the semantic path deviation result are as follows: Convert the current operation instruction sequence into a semantic tag sequence to form the current operation semantic path; The current operation semantic path is compared with the standard semantic path at the node level to determine whether there is a semantic path deviation in the current operation instruction sequence. If the current operation semantic path contains an illegal semantic node not included in the standard semantic path, or if the current operation semantic path exhibits an illegal path jump, then it is determined that the current operation instruction sequence has a semantic path deviation, and a semantic path deviation result is generated.

3. The industrial network security log collection method according to claim 1, characterized in that, The step of dividing the current operation instruction sequence into a sliding time window of fixed length and calculating the instruction information entropy value of the current operation instruction sequence within the sliding time window is as follows: Divide the current sequence of operation instructions into multiple fixed-length sliding time windows based on instruction timestamps; The operation instructions within each sliding time window are identified and coded according to their function categories. The frequency of operation instructions of each function category in the sliding time window is counted to generate an operation instruction frequency distribution table. Based on the operation instruction frequency distribution table, the information entropy value of the current operation instruction sequence within each sliding time window is calculated using the Shannon entropy calculation formula to obtain the instruction information entropy value.

4. The industrial network security log collection method according to claim 1, characterized in that, The step of determining whether a sudden change in information entropy value occurs in the current operation instruction sequence based on the instruction information entropy value, and obtaining the result of the information entropy value change, specifically includes: Based on the instruction information entropy value, the instruction information entropy value and the corresponding timestamp are combined to form an instruction information entropy value time series; Define the allowable range of change in the entropy value of instruction information between adjacent sliding time windows, and generate an entropy value mutation threshold; Calculate the difference in instruction information entropy values ​​between any two adjacent sliding time windows, compare the difference in instruction information entropy values ​​with the entropy value mutation threshold, and determine whether there is a mutation in information entropy values ​​in the current operation instruction sequence; If the difference in the entropy value of the instruction information exceeds the entropy value mutation threshold, it is determined that the current operation instruction sequence has experienced an entropy value mutation in the sliding time window, and the entropy value mutation result is output.

5. The industrial network security log collection method according to claim 4, characterized in that, The step of determining whether the current operation instruction sequence falls within the empty window region of the policy effectiveness coverage matrix based on the policy effectiveness coverage matrix, and obtaining the policy effectiveness blind zone result, specifically includes: Extract the real-time operation time, target device identifier, and target operation type from the current operation instruction sequence; Based on the policy effectiveness coverage matrix, using the real-time operation time, target device identifier, and target operation type as indexes, query the policy effectiveness coverage matrix to see if there is an effective log collection policy. If there is no log collection policy effective identifier at the corresponding index position in the policy effective coverage matrix, it is determined that the current operation instruction sequence falls into the empty window area of ​​the policy effective coverage matrix, and the policy effective blind zone result is output.

6. The industrial network security log collection method according to claim 1, characterized in that, The step of triggering a compensatory log collection signal and adjusting the current collection behavior based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results is as follows: Based on the semantic path deviation results, the edit distance between the current operation instruction sequence and the standard semantic path is extracted, the semantic deviation degree of the current operation instruction sequence is calculated, and the semantic deviation degree is normalized to obtain the first trigger intensity value of semantic path deviation. Based on the information entropy value mutation result, the instruction information entropy value difference within adjacent sliding time windows is calculated, and the instruction information entropy value difference is normalized to obtain the second trigger intensity value of the information entropy value mutation. Based on the policy effective blind zone results, the coverage degree of the current operation instruction sequence in the policy effective coverage matrix is ​​statistically analyzed, its reverse coverage degree is calculated, and the reverse coverage degree is normalized to obtain the third trigger strength value of the policy effective blind zone. By combining the first trigger strength value, the second trigger strength value, and the third trigger strength value, a compensatory log collection signal is triggered to adjust the current collection behavior.

7. The industrial network security log collection method according to claim 6, characterized in that, The step of combining the first trigger strength value, the second trigger strength value, and the third trigger strength value to trigger compensatory log collection behavior and adjust the current collection behavior is as follows: Set corresponding abnormal weight values ​​for semantic path deviation, information entropy value mutation, and policy effectiveness blind spot; Based on the corresponding abnormal weight value, the compensation trigger index is calculated by weighted comprehensive calculation according to the first trigger strength value, the second trigger strength value and the third trigger strength value; Set a compensation trigger threshold and compare the compensation trigger index with the set compensation trigger threshold; When the compensation trigger index exceeds the set compensation trigger threshold, a compensatory log collection behavior is triggered to dynamically adjust the current collection behavior.

8. An industrial network security log collection system, characterized in that, The industrial network security log collection method described in any one of claims 1-7 includes: The semantic model building module constructs an instruction semantic model for industrial tasks, extracts semantic path fragments based on historical task execution data, and forms a standard semantic path. The specific steps are as follows: Acquire historical task execution data recorded in the industrial control system and extract the historical operation instruction sequence corresponding to the historical task. The historical operation instruction sequence is converted into corresponding semantic path fragments, and multiple semantic path fragments are clustered based on similarity. Noisy paths are removed, main paths and variant paths are extracted, an instruction semantic model is constructed, and a standard semantic path is formed. The operation command acquisition module acquires the sequence of operation commands in the current industrial network at the acquisition node to obtain the current operation command sequence; The semantic deviation analysis module extracts the semantic path of the current operation instruction sequence, determines whether there is semantic path deviation in the current operation instruction sequence based on the standard semantic path, and obtains the semantic path deviation result. The information entropy calculation module divides the current operation instruction sequence into a sliding time window of fixed length and calculates the instruction information entropy value of the current operation instruction sequence within the sliding time window. The information entropy value analysis module, based on the instruction information entropy value, determines whether there is a sudden change in information entropy value in the current operation instruction sequence, and obtains the information entropy value change result; The log collection strategy construction module establishes log collection strategy rules and constructs a log collection strategy coverage matrix based on the effective time, scope, and operation type of the log collection strategy rules. The strategy blind zone identification module determines whether the current operation instruction sequence falls into the empty window area of ​​the strategy effectiveness coverage matrix based on the strategy effectiveness coverage matrix, and obtains the strategy effectiveness blind zone result. The compensation collection control module, based on semantic path deviation results, information entropy value mutation results, and policy effectiveness blind spot results, triggers compensatory log collection behavior to adjust the current collection behavior.

Images