An AI analysis-based network security reinforcement strategy generation method and system

Abstract

The application is suitable for the technical field of industrial network security protection and intelligent risk assessment, and provides a network security reinforcement strategy generation method and system based on AI analysis, which comprises the following steps: obtaining a target instruction to be evaluated at present, and an initial security risk score value generated for the target instruction, and simultaneously obtaining historical control instruction data of a device corresponding to the target instruction.The application can identify implicit intrusion behaviors that exist operation sequence abnormalities, parameter floating abnormalities or response timing abnormalities, although they conform to the issuing rules, and is particularly suitable for early discovery and trend perception of long-term latent attacks, breaks through the limitation that abnormal behaviors of protocol legal instructions are difficult to identify in the prior art, further alleviates the misjudgment problem caused by the lack of context in the critical area of the scoring system, significantly improves the stability, interpretability and dynamic adaptability of network risk assessment, and has good engineering practicability and popularization value.

Description

Technical Field

[0001] This invention belongs to the field of industrial network security protection and intelligent risk assessment technology, and in particular relates to a method and system for generating network security hardening strategies based on AI analysis. Background Technology

[0002] In the current industrial control network environment, with the increasing intelligence and remote control capabilities, the pressure on network-level security is intensifying. Especially in systems with frequent protocol command interactions and complex control logic, security assessments of control commands typically rely on static rule detection, protocol compliance verification, or anomaly detection mechanisms based on historical alarm patterns. While these methods can identify obvious illegal or unauthorized behavior to some extent, their ability to identify command sequences that appear legitimate but actually conceal abnormal trends is limited. This is particularly true when attackers gradually infiltrate the system by simulating legitimate communication behaviors to carry out low-intensity, covert operations; existing technologies struggle to detect and effectively intercept these attacks in their early stages.

[0003] Furthermore, existing risk scoring mechanisms generally employ fixed thresholds or scoring based on abnormal features, lacking in-depth consideration of the context of control instructions and historical behavioral trends. This leads to false positives or false negatives when the scoring results are critical. While some systems introduce machine learning models for auxiliary identification, they are still limited by the static feature representation of the training data and struggle to effectively handle in-protocol instructions that exhibit slow shifts or variations in behavioral expression. Consequently, the scoring results lack sensitivity and interpretability for long-term latent risks. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for generating network security hardening strategies based on AI analysis, aiming to solve the problems mentioned in the background art.

[0005] This invention is implemented as follows: a method for generating network security hardening strategies based on AI analysis, the method comprising:

[0006] Obtain the target instruction to be evaluated, as well as the initial security risk score generated for the target instruction, and at the same time obtain the historical control instruction data of the device corresponding to the target instruction;

[0007] Filter out several historical control command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command from the historical control command data;

[0008] Analyze several historical instruction data to identify whether the proportion of abnormal operations within the protocol that do not violate protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio.

[0009] If it is determined that the deviation exceeds the preset ratio, the deviation value of the abnormal operation in each protocol relative to the standard instruction behavior is calculated, and the average deviation value is obtained.

[0010] Obtain a preset instruction behavior reference model and determine the standard offset value corresponding to the target instruction. Based on the deviation between the average offset value and the standard offset value, determine the correction factor and correct the initial security risk score based on the correction factor.

[0011] As a further limitation of the technical solution of the present invention, the target instruction refers to the initial security risk score value corresponding to which has not yet reached the preset risk threshold, but is within a predetermined security margin range below the preset risk threshold.

[0012] As a further limitation of the technical solution of this invention embodiment, the step of parsing several historical instruction data and identifying whether the proportion of abnormal operations within the protocol that do not violate protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio includes:

[0013] Each historical instruction data is analyzed sequentially. Based on its deviation from the historical mean in terms of behavior trajectory stability, parameter change magnitude, or response delay mode, it is determined whether there are any measurable slight offset features. If so, the historical instruction data is marked as an abnormal operation within the protocol.

[0014] The percentage of abnormal operations within all protocols in all historical instruction data is statistically analyzed, and this percentage is compared with a preset ratio to determine whether it exceeds the preset ratio.

[0015] As a further limitation of the technical solution of this embodiment of the invention, if it is determined that the deviation value of the abnormal operation in each protocol relative to the standard instruction behavior is exceeded, the step of calculating the deviation value and obtaining the average deviation value includes:

[0016] Retrieve historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol.

[0017] Based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics, the historical abnormal operation commands and corresponding preset standard commands are compared and analyzed from three dimensions: consistency of operation sequence, deviation of key parameters, and difference of response delay.

[0018] The difference metrics of the above dimensions are fused together using a preset weighting coefficient to obtain the offset value corresponding to the abnormal operation within each protocol;

[0019] The average offset value is obtained by averaging the offset values ​​of all abnormal operations within the protocol.

[0020] As a further limitation of the technical solution of this embodiment of the invention, the steps of obtaining a preset instruction behavior reference model, determining the standard offset degree value corresponding to the target instruction from it, determining a correction factor based on the deviation between the average offset degree value and the standard offset degree value, and correcting the initial security risk score value based on the correction factor include:

[0021] Obtain a preset instruction behavior reference model, which is a statistical model constructed based on multi-source historical operating condition data, used to record the standard deviation value generated by normal operators for different types of protocol instructions under safe operating conditions;

[0022] Input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as a correction factor.

[0023] Based on the correction factor, the initial security risk score is corrected to generate a corrected security risk score.

[0024] The revised security risk score will be used to trigger cybersecurity hardening response operations such as security policy updates, risk level adjustments, or alarm level upgrades and downgrades.

[0025] As a further limitation of the technical solution of the present invention, when correcting the initial security risk score, a preset score correction model is adopted;

[0026] The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0;

[0027] In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

[0028] A network security hardening strategy generation system based on AI analysis, the system comprising: a data acquisition module, a data filtering module, an anomaly analysis module, an offset value calculation module, and a score value correction module, wherein:

[0029] The data acquisition module is used to acquire the target instruction to be evaluated, as well as the initial security risk score generated for the target instruction, and to acquire the historical control instruction data of the device corresponding to the target instruction; the target instruction refers to the initial security risk score of which has not yet reached the preset risk threshold, but is within a predetermined security margin range below the preset risk threshold.

[0030] The data filtering module is used to filter out several historical command data from historical control command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command.

[0031] The abnormal operation parsing module is used to parse several historical instruction data and identify whether the proportion of abnormal operations within the protocol that do not violate the protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio.

[0032] The offset value calculation module is used to calculate the offset value of abnormal operation in each protocol relative to the standard instruction behavior if it is determined that the offset exceeds the preset ratio, and to obtain the average offset value.

[0033] The score correction module is used to obtain a preset instruction behavior reference model, determine the standard offset degree value corresponding to the target instruction, determine the correction factor based on the deviation between the average offset degree value and the standard offset degree value, and correct the initial security risk score value based on the correction factor.

[0034] As a further limitation of the technical solution of this embodiment of the invention, the abnormal operation parsing module specifically includes:

[0035] The abnormal operation determination unit is used to parse each historical instruction data in turn, and determine whether there are measurable slight offset features based on the deviation of its historical mean in behavior trajectory stability, parameter change magnitude or response delay mode. If there are, the historical instruction data is marked as an abnormal operation within the protocol.

[0036] The ratio judgment unit is used to count the proportion of abnormal operations within all protocols in all the historical instruction data, and compare the proportion with a preset ratio to determine whether it exceeds the preset ratio.

[0037] As a further limitation of the technical solution of this embodiment of the invention, the offset value calculation module specifically includes:

[0038] The instruction acquisition unit is used to acquire historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol.

[0039] The instruction comparison unit is used to compare and analyze historical abnormal operation instructions with corresponding preset standard instructions based on three dimensions: consistency of operation sequence, deviation of key parameters, and difference of response delay, respectively, based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics.

[0040] The offset degree value calculation unit is used to fuse the difference measurement values ​​of the above dimensions according to the preset weighting coefficient to obtain the offset degree value corresponding to the abnormal operation in each protocol;

[0041] The offset averaging unit is used to average the offset values ​​of all abnormal operations within the protocol to obtain the average offset value.

[0042] As a further limitation of the technical solution of this embodiment of the invention, the scoring value correction module specifically includes:

[0043] The standard value acquisition unit is used to acquire a preset instruction behavior reference model. The instruction behavior reference model is a statistical model constructed based on multi-source historical operating condition data. It is used to record the standard offset values ​​generated by normal operators for different types of protocol instructions under safe operating conditions.

[0044] The correction factor determination unit is used to input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as the correction factor.

[0045] The score correction unit is used to correct the initial safety risk score based on the correction factor and generate the corrected safety risk score.

[0046] The score application unit is used to apply the corrected security risk score to trigger network security hardening response operations such as security policy updates, risk level adjustments, or alarm level upgrades and downgrades.

[0047] When correcting the initial safety risk score, a preset score correction model is used;

[0048] The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0;

[0049] In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] This invention addresses network security hardening methods in industrial control networks that address in-protocol instructions that do not violate protocol specifications but exhibit abnormal behavioral deviations. It proposes a method combining trend deviation identification and scoring correction. By determining whether the proportion of abnormal operations within the protocol exceeds a preset ratio and calculating its average deviation value, which is then compared with a preset standard deviation value, a correction factor is generated to dynamically adjust the initial security risk score.

[0052] This invention can identify covert intrusion behaviors that, while conforming to the rules, exhibit abnormal operation order, abnormal parameter fluctuations, or abnormal response timing. It is particularly suitable for the early detection and trend perception of long-term latent attacks, overcoming the limitations of existing technologies in identifying abnormal behavior of legitimate protocol commands. It further alleviates the problem of misjudgment caused by missing context in critical areas of the scoring system, significantly improving the stability, interpretability, and dynamic adaptability of network risk assessment. It has good engineering practicality and promotional value. Attached Figure Description

[0053] Figure 1 A flowchart of the method provided in the embodiments of the present invention;

[0054] Figure 2 A flowchart illustrating the percentage of abnormal operations within the protocol in the method provided by this embodiment of the invention;

[0055] Figure 3 This is a flowchart illustrating the calculation of the average offset value in the method provided in this embodiment of the invention;

[0056] Figure 4 This is a flowchart illustrating the correction of the initial security risk score in the method provided in this embodiment of the invention;

[0057] Figure 5 Application architecture diagram of the system provided in the embodiments of the present invention;

[0058] Figure 6 This is a structural block diagram of the abnormal operation parsing module in the system provided in the embodiments of the present invention;

[0059] Figure 7 This is a structural block diagram of the offset value calculation module in the system provided in the embodiment of the present invention;

[0060] Figure 8 This is a structural block diagram of the scoring value correction module in the system provided in the embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0062] Figure 1 A flowchart of the method provided by an embodiment of the present invention is shown.

[0063] Specifically, a method for generating cybersecurity hardening strategies based on AI analysis includes the following steps:

[0064] Step S100: Obtain the target instruction to be evaluated and the initial security risk score generated for the target instruction, and simultaneously obtain the historical control instruction data of the device corresponding to the target instruction. The target instruction refers to an instruction whose corresponding initial security risk score has not yet reached a preset risk threshold, but is within a predetermined security margin range below the preset risk threshold.

[0065] In this embodiment of the invention, the target instruction typically refers to a control instruction issued by a host control system, scheduling terminal, or edge control device in an industrial control network via industrial communication protocols (such as Modbus, DNP3, OPC UA, etc.). This type of instruction directly acts on the execution layer of a specific device, such as a PLC controller, frequency converter, sensor, or actuator. The instruction content includes data reading, status writing, threshold setting, and action triggering. The actual meaning of the target instruction depends on its instruction type field, such as reading / writing registers, starting control, or modifying parameter values.

[0066] The target instruction corresponding device refers to the controlled object specified by the control instruction at the protocol layer, such as the physical device corresponding to the target device address or node identifier. This device is the object to which the target instruction is actually issued and executed, and may include a field control terminal, a data acquisition device, or other controlled execution unit. In this embodiment, the system indexes the historical behavior trajectory of the target device to identify its behavior pattern under normal operating conditions.

[0067] In this invention, the definition of "initial security risk score not yet reaching the preset risk threshold, but already within a predetermined security margin range below the preset risk threshold" is explicitly defined. This aims to focus risk identification on behavioral stages that have not yet triggered explicit anomalies but have shown potential trends of change. The instructions and actions at this stage do not constitute explicit attacks or violations, but they exhibit slight fluctuations in behavioral deviation, thus possessing early warning value. This definition eliminates the "gray risk zone" between the normal fluctuation range and the high-risk violation range, and provides a theoretical basis for subsequent correction mechanisms.

[0068] The preset risk threshold is a scoring cutoff value set by the system during the evaluation process based on historical attack samples, false alarm tolerance, and critical equipment indicators. It serves as the boundary between secure and unsafe behaviors. The preset security margin range is the scoring interval below this risk threshold, for example, it can be set to a range of 10% to 20% below the threshold. This range is used to identify command behaviors where the score is not out of bounds but has deviated from normal. Its setting may be based on historical sample statistical results, security policy tolerance ranges, and manually configured rules.

[0069] The initial security risk score is a numerical indicator used in this invention to quantify the security risk level of a target instruction in the current behavioral environment, reflecting the potential abnormal risks of the current instruction. Its value is typically calculated based on factors such as the historical behavioral characteristics of the target instruction, the context, protocol integrity, and operational sensitivity. This scoring mechanism has been applied in existing technologies, such as threat scoring generated based on rule engines, deep packet inspection, or machine learning models. However, most systems only trigger a response when the score exceeds the limit, while this invention focuses on correction and optimization when the score is in a critical offset state.

[0070] The historical control command data should include records of control commands received by the target device at different time periods, specifically including but not limited to command type, issuance time, issuing entity identifier, parameter field values, execution result feedback, communication delay, and associated response device information. This information can be obtained from edge security agents, gateway devices, or control logs, and forms the core data foundation for subsequent offset judgment and behavior trend analysis.

[0071] Furthermore, the method for generating cybersecurity hardening strategies based on AI analysis also includes the following steps:

[0072] Step S200: Select several historical command data from the historical control command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command.

[0073] In this embodiment of the invention, the objective of step S200 is to precisely filter historical control command data to construct a set of historical behavior samples highly similar to the current target command, serving as the foundation dataset for subsequent trend deviation analysis and risk correction. To this end, the system first extracts all historical command records issued by the issuing entity from the historical control command data based on the issuing entity identification information carried in the target command, such as control node number, user ID, or logical source address. Subsequently, it further filters command samples belonging to the same protocol command type as the target command, such as having the same function code, command category, or behavioral intent field, ensuring that the filtered historical samples are comparable to the target command in terms of behavioral logic and trend continuity.

[0074] This filtering process can employ a field-matching-based instruction feature classification method, combined with optimized data indexing structures (such as hash tables, inverted indexes, protocol tag tables, etc.) to improve retrieval efficiency. In actual deployment, a lightweight rule engine or pre-classification model can also be introduced to pre-group and index historical data by issuing entity and instruction type, facilitating rapid retrieval.

[0075] The core purpose of introducing this screening step is to exclude historical data in the system that has no direct behavioral correlation with the target instruction by limiting it to two key dimensions: the issuing entity and the type of instruction. This avoids introducing invalid samples or feature noise during subsequent behavioral deviation analysis. Compared to full historical data analysis, limiting the screening significantly improves the accuracy and specificity of deviation trend judgment, allowing the correction mechanism to model only the deviation of the target entity in a certain type of operational behavior, effectively reducing false alarm rate and correction bias. Furthermore, the operational behavior of the same entity under the same type of instruction usually exhibits strong individual behavioral pattern characteristics, which can serve as a reliable indicator for identifying potential risk evolution trends.

[0076] Furthermore, the method for generating cybersecurity hardening strategies based on AI analysis also includes the following steps:

[0077] Step S300: Analyze several historical instruction data and identify whether the proportion of abnormal operations within the protocol that do not violate protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio.

[0078] Specifically, Figure 2 A flowchart illustrating the percentage of abnormal operations within the analysis protocol is shown.

[0079] The process of analyzing historical instruction data to identify whether the proportion of in-protocol anomalous operations that do not violate protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio includes the following steps:

[0080] Step S301: Analyze each historical instruction data in sequence. Based on its deviation from the historical mean in behavior trajectory stability, parameter change magnitude or response delay mode, determine whether there is a measurable slight offset feature. If so, mark the historical instruction data as an abnormal operation within the protocol.

[0081] Step S302: Calculate the percentage of abnormal operations within all protocols in all historical instruction data, and compare this percentage with a preset ratio to determine whether it exceeds the preset ratio.

[0082] In this embodiment of the invention, the implementation of step S301 aims to identify instruction operations that do not violate communication protocol specifications but exhibit deviation characteristics at the behavioral level through multi-dimensional behavioral feature analysis, thereby capturing potential hidden security risks. The system sequentially traverses historical control instruction data and calculates the degree of behavioral deviation of each instruction sample in three key dimensions: behavioral trajectory stability, parameter change magnitude, and response delay pattern.

[0083] The phrase "not violating protocol specifications" means that the target instruction conforms to the basic requirements of the adopted industrial communication protocol in terms of syntax, field format, and parameter range, does not constitute an illegal instruction or communication error at the protocol layer, and can be normally recognized and executed by the device. However, although such instructions are legal in form, their execution behavior deviates to a certain extent from the standard behavior pre-defined for this instruction type, such as abnormal operation rhythm, abnormal parameter combination, or inconsistent context execution relationship. In other words, such instructions do not exceed the boundaries defined by the protocol, but exhibit abnormal characteristics compared to the preset standard behavior pattern, belonging to deviation behavior within the protocol. This characteristic is more common in the early stages of attacks or in covert manipulation; therefore, this invention uses it as an important object for identifying potential risk behaviors.

[0084] Behavioral trajectory stability refers to the consistency of the operational path followed by control instructions during execution. If an instruction frequently interrupts the expected path within the context instruction sequence, or exhibits abnormal insertions or timing discrepancies, its trajectory stability can be considered to have deviated. Parameter variation amplitude refers to whether the instruction deviates significantly from the historical average or median level of input parameters (such as write values, target register addresses, etc.), such as sudden numerical changes or unit switching. Response latency pattern refers to the time interval characteristics between instruction issuance and device response. Significantly prolonged, premature, or jittery delays can also be considered behavioral fluctuations. These three dimensions are not mutually exclusive and can be evaluated in parallel. The system can determine whether each dimension exceeds acceptable boundaries by setting threshold ranges (such as trajectory variation rate, parameter change ratio, response deviation rate, etc.). Once any dimension meets the deviation judgment condition, the historical instruction data is marked as an abnormal operation within the protocol.

[0085] For example, in industrial control processes, a specific issuing entity typically issues a command chain in a fixed order: "Read temperature register → Determine threshold → Write fan start command → Record log". If the system detects that a historical command is frequently inserted into unexpected positions across multiple execution cycles, such as moving "Write fan start command" before "Read temperature register", and this abnormal insertion behavior accounts for a high proportion in consecutive behavior sequences, its trajectory variation rate will increase significantly. Although such behavior does not violate protocol rules, it disrupts the logical coherence in the equipment control chain and may reflect external intervention, abnormal operator strategies, or malicious spoofing. Therefore, the system can mark this command as an abnormal operation within the protocol.

[0086] The purpose of introducing the aforementioned dimensions for identification is to uncover "atypical behaviors beneath a legitimate appearance" in industrial control networks. While these instructions may not exceed the semantic legitimacy of the protocol, they are often early probing behaviors employed by attackers in disguise or gradual infiltration. For example, attackers might forge control nodes to progressively shorten instruction cycles, adjust write parameters to near-boundary limits, or insert commands that do not conform to logical sequences. By identifying these subtle but measurable deviations, the system can establish a pre-emptive identification mechanism before intrusion causes direct damage, effectively enhancing the early risk perception capability of industrial control networks.

[0087] In step S302, the system statistically analyzes historical instructions marked as abnormal operations within the protocol in the previous stage and calculates their proportion among all filtered historical instruction data. This proportion reflects the density level of suspicious operations in the current behavior pattern. This proportion is then compared with a preset ratio to determine if it exceeds a tolerable range. If it does, it is considered that there is a systematic deviation trend in the behavior pattern of the target instruction, triggering subsequent risk correction calculation procedures.

[0088] The preset ratio is typically set based on historical experience data, security policy sensitivity requirements, and the actual tolerance level of the application scenario. For example, in high-security industrial control networks, this ratio can be set below 10% to detect minor variations as early as possible; while in scenarios with higher fault tolerance, the tolerance threshold can be appropriately increased. The ratio can also be configured hierarchically according to dimensions such as target equipment type, control frequency, and operator behavior stability, thereby achieving an adaptive risk identification mechanism. This ratio control mechanism not only avoids false alarms caused by oversensitivity but also helps ensure that genuine trend deviations are fully identified and responded to.

[0089] Furthermore, the method for generating cybersecurity hardening strategies based on AI analysis also includes the following steps:

[0090] Step S400: If it is determined that the preset ratio is exceeded, calculate the offset value of the abnormal operation in each protocol relative to the standard instruction behavior, and obtain the average offset value.

[0091] Specifically, Figure 3 A flowchart for calculating the average offset value is shown.

[0092] If the deviation exceeds a preset ratio, the deviation of the abnormal operation within each protocol relative to the standard instruction behavior is calculated, and the average deviation value is obtained. This process specifically includes the following steps:

[0093] Step S401: Obtain the historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol;

[0094] Step S402: Based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics, the historical abnormal operation commands are compared and analyzed with the corresponding preset standard commands from three dimensions: consistency of operation sequence, deviation of key parameters, and difference of response delay.

[0095] Step S403: The difference measurement values ​​of the above dimensions are fused according to the preset weighting coefficient to obtain the offset degree value corresponding to the abnormal operation in each protocol;

[0096] Step S404: Average the offset values ​​of all abnormal operations within the protocol to obtain the average offset value.

[0097] In this embodiment of the invention, the preset standard instruction is a standardized reference instruction content manually set by the system during the design phase or before deployment for different instruction types, used as a comparison benchmark for subsequent behavioral offset analysis. This standard instruction is not generated based on data collected during actual operation, but rather is an ideal control content pre-set according to industrial control processes, equipment control logic, or predefined operating specifications. For each protocol instruction type, the system sets a representative standard instruction, clearly defining its key parameter fields, expected content, and typical response form. This standard instruction reflects the system's expected expression of this type of control operation under normal operating conditions and serves as a fixed reference object in offset calculation.

[0098] In step S402, the system compares and analyzes each abnormal operation instruction within the protocol with its corresponding preset standard instruction across three dimensions. Specifically, this includes:

[0099] In terms of operation sequence consistency, the system aligns the target instruction with the expected position of the standard instruction in the sequence based on the context position of the target instruction in the control flow. It uses techniques such as edit distance, dynamic time warping (DTW), or window sliding pattern matching to calculate the trajectory variation rate, that is, the degree of offset between the current instruction position and the standard path.

[0100] In terms of the magnitude of critical parameter offset, the system compares the differences between historical abnormal operation instructions and standard instructions in critical parameter fields, such as written values, register addresses, function codes, etc., and uses indicators such as normalized difference, relative change ratio or Manhattan distance to measure the parameter offset.

[0101] In terms of response latency difference, the system statistically analyzes the average response time of this type of instruction under normal conditions and compares it with the actual response time of abnormal instructions. The degree of response latency deviation can be measured by methods such as relative latency rate, response jitter range, or standard deviation change rate.

[0102] In step S403, the system fuses the difference metrics of the three dimensions using preset weighting coefficients to form a unified offset score. The weighting coefficients can be set according to the command type, device sensitivity, or manual configuration strategy, reflecting the importance of different dimensions to the overall risk assessment. For example, for execution control commands, the weight of trajectory variation can be increased; while for parameter-sensitive commands, the impact of parameter offset can be amplified. The fusion method can employ weighted linear summation, weighted Euclidean distance, or weighted cosine similarity, ultimately outputting a single offset score.

[0103] For example, continuing with the aforementioned "abnormal insertion of wind turbine start command," the system detects that a certain instruction prematurely executes the wind turbine start command. In the trajectory dimension, the system calculates its deviation from the standard sequence as 0.35 using DTW; in the parameter dimension, the written parameter differs from the standard value by 20%, i.e., an offset of 0.20; the response delay is 1.5 seconds ahead, with a relative offset of 0.15. If the weighting coefficients for the three dimensions are 0.5, 0.3, and 0.2 respectively, then the overall offset value of this instruction is:

[0104] 0.5 × 0.35 AI-based network security hardening strategy generation system + 0.3 × 0.20 AI-based network security hardening strategy generation system + 0.2 × 0.15 AI-based network security hardening strategy generation system = 0.275 AI-based network security hardening strategy generation system.

[0105] In step S404, the offset values ​​of all historical instructions marked as anomalous operations within the protocol are averaged to obtain an average offset value. The purpose of introducing this average value is to eliminate the occasional influence of individual anomalous instructions in offset calculation, thereby improving the stability and representativeness of the correction factor. Compared to the discrete offset score of a single instruction, the average value better reflects the overall risk deviation trend of the behavioral sequence to which the target instruction belongs, thus achieving the perception and quantification of systemic potential risks. This mechanism helps reduce the false positive rate, enhances the credibility of the correction score, and provides an objective basis for subsequent dynamic hardening strategies.

[0106] Furthermore, the method for generating cybersecurity hardening strategies based on AI analysis also includes the following steps:

[0107] Step S500: Obtain a preset instruction behavior reference model and determine the standard offset value corresponding to the target instruction. Based on the deviation between the average offset value and the standard offset value, determine the correction factor and correct the initial security risk score based on the correction factor.

[0108] Specifically, Figure 4 A flowchart is shown for revising the initial security risk score.

[0109] The process of acquiring a preset instruction behavior reference model, determining the standard offset value corresponding to the target instruction, determining a correction factor based on the deviation between the average offset value and the standard offset value, and correcting the initial security risk score based on the correction factor specifically includes the following steps:

[0110] Step S501: Obtain a preset instruction behavior reference model. The instruction behavior reference model is a statistical model constructed based on multi-source historical operating condition data. It is used to record the standard offset values ​​generated by normal operators for different types of protocol instructions under safe operating conditions.

[0111] Step S502: Input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as a correction factor.

[0112] Step S503: Based on the correction factor, the initial safety risk score is corrected to generate the corrected safety risk score.

[0113] Step S504: Use the corrected security risk score to trigger network security hardening response operations such as security policy updates, risk level adjustments, or alarm level upgrades and downgrades.

[0114] When correcting the initial safety risk score, a preset score correction model is used;

[0115] The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0;

[0116] In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

[0117] In this embodiment of the invention, the instruction behavior reference model is a statistical offset behavior model constructed based on large-scale normal operating condition data. This model is based on an industrial control system in actual operation, collecting various protocol control instruction behavior data issued by authorized personnel under the premise of no abnormal interference or attack behavior, and classifying and modeling different instruction types. Specifically, the system quantifies the trajectory, parameters, response, and other behavioral characteristics of each type of instruction under normal operating conditions, calculates its average behavioral offset value in the actual environment, and records this value as a standard offset degree value. This standard value reflects the reasonable error tolerance range that a certain type of instruction may produce during normal use by human operation. It is neither a theoretical ideal state nor a global minimum offset point, but rather a "realistic baseline" that fully considers on-site operating habits, equipment response mechanisms, and human rhythm deviations.

[0118] Therefore, this reference model does not rely on sampling results from a single instance or period, but is obtained through long-term accumulation, training, cleaning, analysis, and stable statistics of big data. Its reliability stems from its comprehensive modeling capabilities across multiple devices, scenarios, and user behaviors, exhibiting excellent generalization and adaptability for deployment. In actual deployments, this model can be pre-installed in security policy centers, controller gateways, or behavior assessment nodes, and can be periodically updated and corrected based on on-site feedback.

[0119] In step S502, the system uses the instruction type of the target instruction to be evaluated as the index key, inputs the instruction behavior reference model, and searches for and extracts the standard deviation value corresponding to that type of instruction. Subsequently, the system compares the currently calculated average deviation value with this standard value, calculates the relative deviation between the two, and uses this as a correction factor. This correction factor is used to adjust the initial safety risk score, ensuring that the score accurately reflects the degree of deviation of the current behavior from "normal human deviation behavior."

[0120] The significance of this correction process lies in the fact that existing industrial control system security scoring largely relies on protocol compliance verification, anomaly detection, or established alarm rules. Once the score falls into a critical range, it often leads to false alarms or missed detections due to a lack of consideration for the continuous evolution trend of behavior. This invention first identifies "abnormal operations within the protocol" in historical control command data—that is, command operations that, although they do not violate communication protocol specifications, exhibit measurable slight deviations at the behavioral level—and determines whether the proportion of such abnormal operations in all historical samples exceeds a preset ratio. Only when the proportion exceeds this threshold is the deviation degree of each abnormal operation within the protocol calculated from the preset standard command behavior, and the average deviation value of each deviation value is obtained.

[0121] After obtaining the average offset value, the system compares this value with the standard offset value corresponding to the instruction type and calculates a correction factor accordingly to dynamically adjust the initial safety risk score. In this way, the scoring is no longer limited to fixed rules or simple static thresholds, but rather, based on the completion of percentage threshold judgment and average offset calculation, it makes directional fine-tuning by incorporating the acceptable deviation range of normal human operation. This process can filter out occasional fluctuations while capturing systemic subtle trends, integrating behavioral trend perception into the scoring.

[0122] This improvement in the present invention effectively solves the pain point of traditional industrial control risk scoring being difficult to judge in the critical zone, reduces misjudgments or omissions caused by ignoring context and changes in action density, enhances the interpretability and stability of risk assessment, and fills the gap in the insufficient identification of small offset trends, which helps to discover potential risks in the early stage and trigger more accurate hardening responses.

[0123] The scoring correction model employed in this invention is a weighted scoring adjustment method based on a multiplicative proportional coefficient. Specifically, the corrected score is equal to the initial score multiplied by a linear adjustment factor that includes the offset difference and an adjustment coefficient. The offset difference is calculated by subtracting the standard offset value from the average offset value and then dividing by the standard offset value, reflecting the proportion of deviation of the current behavior from the reference baseline. The adjustment coefficient is a configurable parameter used to control the adjustment intensity, ensuring that score fluctuations remain within a reasonable range.

[0124] This model boasts advantages such as a clear computational structure, well-defined physical meaning of parameters, and easily understandable output trends, making it an intuitive, effective, and widely deployable correction mechanism. In practical applications, besides employing the aforementioned proportional-difference multiplication model, it can be extended to a piecewise function-based correction method. For example, multiple offset intervals can be set to correspond to different risk level correction coefficients, or nonlinear functions such as the sigmoid function or logarithmic function can be used to achieve smoother score adjustments, adapting to the behavioral sensitivity requirements of different industrial scenarios. Machine learning models can also be introduced, using the correction factor as feature input and directly outputting the final score result through regression or classification. All of the above methods can be used complementaryly to the solution of this invention, improving the accuracy and responsiveness of the hardening strategy.

[0125] Furthermore, Figure 5 An application architecture diagram of the system provided in an embodiment of the present invention is shown.

[0126] In another preferred embodiment of the present invention, a network security hardening strategy generation system based on AI analysis includes:

[0127] The data acquisition module 100 is used to acquire the target instruction to be evaluated, as well as the initial security risk score generated for the target instruction, and to acquire the historical control instruction data of the device corresponding to the target instruction; the target instruction refers to the initial security risk score of which has not yet reached the preset risk threshold, but is within a predetermined security margin range below the preset risk threshold.

[0128] Furthermore, the AI-based network security hardening strategy generation system also includes:

[0129] The data filtering module 200 is used to filter out several historical command data from historical control command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command.

[0130] Furthermore, the AI-based network security hardening strategy generation system also includes:

[0131] The abnormal operation parsing module 300 is used to parse several historical instruction data and identify whether the proportion of abnormal operations within the protocol that do not violate the protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio.

[0132] Specifically, Figure 6 The diagram shows the structural block diagram of the abnormal operation parsing module 300 in the system provided in the embodiment of the present invention.

[0133] In a preferred embodiment of the present invention, the abnormal operation parsing module 300 specifically includes:

[0134] The abnormal operation determination unit 301 is used to parse each historical instruction data in turn, and determine whether there is a measurable slight offset feature based on its deviation from the historical mean in behavior trajectory stability, parameter change amplitude or response delay mode. If there is, the historical instruction data is marked as an abnormal operation within the protocol.

[0135] The ratio judgment unit 302 is used to count the proportion of abnormal operations within all protocols in all the historical instruction data, and compare the proportion with a preset ratio to determine whether it exceeds the preset ratio.

[0136] Furthermore, the AI-based network security hardening strategy generation system also includes:

[0137] The offset calculation module 400 is used to calculate the offset degree value of abnormal operation in each protocol relative to the standard instruction behavior if it is determined that the offset exceeds the preset ratio, and to obtain the average offset degree value.

[0138] Specifically, Figure 7 The diagram shows the structural block diagram of the offset value calculation module 400 in the system provided in the embodiment of the present invention.

[0139] In a preferred embodiment of the present invention, the offset value calculation module 400 specifically includes:

[0140] The instruction acquisition unit 401 is used to acquire the historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol.

[0141] The instruction comparison unit 402 is used to compare and analyze historical abnormal operation instructions with corresponding preset standard instructions based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics, from three dimensions: consistency of operation sequence, deviation of key parameters, and difference of response delay.

[0142] The offset degree value calculation unit 403 is used to fuse the difference measurement values ​​of the above dimensions according to a preset weighting coefficient to obtain the offset degree value corresponding to the abnormal operation in each protocol.

[0143] Offset averaging unit 404 is used to average the offset values ​​of all abnormal operations within the protocol to obtain the average offset value.

[0144] Furthermore, the AI-based network security hardening strategy generation system also includes:

[0145] The scoring value correction module 500 is used to obtain a preset instruction behavior reference model, determine the standard offset degree value corresponding to the target instruction, determine the correction factor based on the deviation between the average offset degree value and the standard offset degree value, and correct the initial security risk score value based on the correction factor.

[0146] Specifically, Figure 8 A structural block diagram of the scoring value correction module 500 in the system provided by an embodiment of the present invention is shown.

[0147] In a preferred embodiment of the present invention, the scoring value correction module 500 specifically includes:

[0148] The standard value acquisition unit 501 is used to acquire a preset instruction behavior reference model. The instruction behavior reference model is a statistical model constructed based on multi-source historical working condition data. It is used to record the standard offset value generated by normal operators for different types of protocol instructions under safe operating conditions.

[0149] The correction factor determination unit 502 is used to input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as a correction factor.

[0150] The score correction unit 503 is used to correct the initial safety risk score based on the correction factor and generate the corrected safety risk score.

[0151] The score correction application unit 504 is used to apply the corrected security risk score to trigger network security hardening response operations such as security policy updates, risk level adjustments, or alarm level upgrades and downgrades.

[0152] When correcting the initial safety risk score, a preset score correction model is used;

[0153] The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0;

[0154] In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

[0155] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0156] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

Claims

1. A method for generating cybersecurity hardening strategies based on AI analysis, characterized in that, The method includes: The system acquires the target instruction to be evaluated and the initial security risk score generated for the target instruction, and also acquires the historical control instruction data of the device corresponding to the target instruction. The target instruction refers to an instruction whose initial security risk score has not yet reached the preset risk threshold, but is within a predetermined security margin range below the preset risk threshold. Filter out several historical command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command from the historical control command data; Analyze several historical instruction data to identify whether the proportion of abnormal operations within the protocol that do not violate protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio. The steps include: Each historical instruction data is analyzed sequentially. Based on its deviation from the historical mean in terms of behavior trajectory stability, parameter change magnitude, or response delay mode, it is determined whether there are any measurable slight offset features. If so, the historical instruction data is marked as an abnormal operation within the protocol. The percentage of abnormal operations within all protocols in all historical instruction data is calculated, and this percentage is compared with a preset ratio to determine whether it exceeds the preset ratio. If it is determined that the preset ratio is exceeded, the deviation value of the abnormal operation in each protocol relative to the standard instruction behavior is calculated, and the average deviation value is obtained. The steps include: Retrieve historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol; Based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics, the historical abnormal operation commands and corresponding preset standard commands are compared and analyzed from three dimensions: operation sequence consistency, key parameter offset magnitude, and response delay difference. According to the comparison and analysis, the operation sequence consistency, key parameter offset magnitude, and response delay difference are quantified into the difference measure values ​​of the corresponding dimensions. The difference metrics of the above dimensions are fused together using a preset weighting coefficient to obtain the offset value corresponding to the abnormal operation within each protocol. The average offset value is obtained by averaging the offset values ​​of all abnormal operations within the protocol. Obtain a preset instruction behavior reference model and determine the standard offset value corresponding to the target instruction. Based on the deviation between the average offset value and the standard offset value, determine the correction factor and correct the initial security risk score based on the correction factor. The steps include: Obtain a preset instruction behavior reference model, which is a statistical model constructed based on multi-source historical operating condition data, used to record the standard deviation value generated by normal operators for different types of protocol instructions under safe operating conditions; Input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as a correction factor. Based on the correction factor, the initial security risk score is corrected to generate the corrected security risk score. The revised security risk score will be used to trigger at least one cybersecurity hardening response action, including security policy updates, risk level adjustments, or alarm level upgrades or downgrades.

2. The method for generating network security hardening strategies based on AI analysis according to claim 1, characterized in that, When correcting the initial safety risk score, a preset score correction model is used; The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0; In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

3. A network security hardening strategy generation system based on AI analysis, characterized in that, The system includes: a data acquisition module, a data filtering module, an abnormal operation analysis module, an offset value calculation module, and a score value correction module, wherein: The data acquisition module is used to acquire the target instruction to be evaluated, as well as the initial security risk score generated for the target instruction, and to acquire the historical control instruction data of the device corresponding to the target instruction; the target instruction refers to the initial security risk score of which has not yet reached the preset risk threshold, but is within a predetermined security margin range below the preset risk threshold. The data filtering module is used to filter out several historical command data from historical control command data that were issued by the same issuing entity as the target command and belong to the same command type as the target command. The abnormal operation parsing module is used to parse several historical instruction data and identify whether the proportion of abnormal operations within the protocol that do not violate the protocol specifications but exhibit measurable slight deviations in behavioral characteristics exceeds a preset ratio. The abnormal operation parsing module specifically includes: The abnormal operation determination unit is used to parse each historical instruction data in turn, and determine whether there are measurable slight offset features based on the deviation of its historical mean in behavior trajectory stability, parameter change magnitude or response delay mode. If there are, the historical instruction data is marked as an abnormal operation within the protocol. The ratio judgment unit is used to count the proportion of all abnormal operations within the protocol in all the historical instruction data, and compare the proportion with a preset ratio to determine whether it exceeds the preset ratio. The offset value calculation module is used to calculate the offset value of abnormal operation in each protocol relative to the standard instruction behavior if it is determined that the offset exceeds the preset ratio, and to obtain the average offset value. The offset value calculation module specifically includes: The instruction acquisition unit is used to acquire historical abnormal operation instructions and their corresponding preset standard instructions for each abnormal operation within the protocol. The instruction comparison unit is used to compare and analyze historical abnormal operation instructions with corresponding preset standard instructions based on behavioral trajectory characteristics, parameter change characteristics, and response timing characteristics, respectively, from three dimensions: consistency of operation sequence, deviation of key parameters, and difference of response delay. According to the comparison analysis, the consistency of operation sequence, deviation of key parameters, and difference of response delay are quantified into the difference measurement values ​​of the corresponding dimensions. The offset degree value calculation unit is used to fuse the difference measurement values ​​of the above dimensions according to the preset weighting coefficient to obtain the offset degree value corresponding to the abnormal operation in each protocol; The offset degree value averaging unit is used to average the offset degree values ​​of all abnormal operations within the protocol to obtain the average offset degree value. The score correction module is used to obtain a preset instruction behavior reference model, determine the standard deviation value corresponding to the target instruction, determine the correction factor based on the deviation between the average deviation value and the standard deviation value, and correct the initial security risk score based on the correction factor. The scoring value correction module specifically includes: The standard value acquisition unit is used to acquire a preset instruction behavior reference model. The instruction behavior reference model is a statistical model constructed based on multi-source historical operating condition data. It is used to record the standard offset values ​​generated by normal operators for different types of protocol instructions under safe operating conditions. The correction factor determination unit is used to input the instruction type of the target instruction into the instruction behavior reference model, extract the standard offset value corresponding to the instruction type, calculate the deviation between the average offset value and the standard offset value, and use it as the correction factor. The score correction unit is used to correct the initial safety risk score based on the correction factor and generate the corrected safety risk score. The score correction application unit is used to apply the corrected security risk score to trigger at least one network security hardening response operation, such as security policy update, risk level adjustment, or alarm level upgrade or downgrade.

4. The network security hardening strategy generation system based on AI analysis according to claim 3, characterized in that, When correcting the initial safety risk score, a preset score correction model is used; The scoring value correction model is as follows: ,in This refers to the revised safety risk score. This refers to the initial security risk score. This refers to the average degree of offset. This refers to the standard offset value. This refers to the correction factor, which is the deviation between the average offset value and the standard offset value. This refers to the adjustment coefficient of the correction factor, and Greater than 0; In the score correction model: ,in This refers to the total number of abnormal operations within the protocol. It refers to the first The offset value corresponding to the abnormal operation within the protocol.

Images