Cloud control system highly hidden attack detection method based on hierarchical state machine behavior modeling

Abstract

The invention relates to the field of network security, in particular to a cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling. The method comprises the following steps: constructing a network system topology layer, describing information paths among system nodes, modeling system node state transition, and generating a system behavior model; detecting skipping of a system node state through deterministic logic or a time sequence association rule, and judging an abnormal behavior according to normal logic or a predefined rule; node state jump time is collected, a normal probability density function is trained, the difference between current monitoring time distribution and normal distribution is calculated through relative entropy, and abnormal behaviors and high hidden attacks are detected. According to the method, modeling is carried out by facing system behaviors, and detection and identification of high-concealment attacks are carried out; from establishment of an entry white list rule to refined modeling of the system, the defects that the rule is simple and static and is difficult to adapt to dynamic changes are overcome; and through fine depiction and characterization of the time dimension, detection and identification of high-concealment intrusion behaviors are supported.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically to a method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling. In particular, it relates to a method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling. Background Technology

[0002] Cloud control systems consist of numerous distributed nodes, primarily consisting of control nodes and controlled nodes. Control nodes mainly implement system operation control and status monitoring, while controlled nodes primarily receive control commands, perform corresponding tasks, and report their status. Through wired / wireless network communication, control nodes enable remote testing and operation control of each controlled node. With the development of information technology, the degree of networked connection and automated control of unmanned nodes is increasing, placing higher demands on the real-time security protection of the system. Existing network security detection methods, which mainly rely on matching known network attack features, have shortcomings in dealing with highly concealed and unknown attacks on system nodes.

[0003] Highly concealed unknown threats refer to attacks where attackers use low-frequency, low-sensitivity attack patterns, new types of malicious code, unknown vulnerability exploitation, and disguised normal network behavior patterns, causing detection methods based on matching known threat characteristics to become inaccurate or even completely ineffective.

[0004] To address the challenge of detecting highly concealed and unknown attacks, researchers have proposed anomaly-based network attack detection methods. These methods model the normal behavioral characteristics of the target system and determine whether an attack has occurred by detecting whether these characteristics violate normal behavioral patterns. For example, detecting the normal traffic volume can help determine if a botnet exists; detecting the energy consumption of nodes in an IoT system can help determine if an attack is occurring; and for distributed networks, monitoring the size and frequency of single-hop packets can help determine if anomalies have occurred.

[0005] Existing anomaly-based detection methods mostly target changes in single system nodes to detect attack behavior, lacking research on detection and analysis from a system-wide perspective. Cloud control systems, however, contain dozens of subsystems and hundreds or thousands of states. Each subsystem executes related operations according to fixed business logic in a tightly coupled and dynamically changing manner. Clearly expressing the system's business logic relationships and states from business data and designing anomaly detection rules is a challenging problem.

[0006] Attackers are employing increasingly sophisticated security intrusion methods, with more and more intrusion channels and greater stealth. Targeting high-level, high-value cyber-physical systems, and considering the time-sensitive and difficult-to-repeat nature of cyberspace intrusions, attackers inevitably adopt highly stealthy attack styles. They utilize advanced techniques such as zero-day vulnerability attacks, fileless Trojans, concealed control channels, and signature obfuscation to penetrate the target's network security defenses, silently camouflaging and lurking before launching a devastating attack. Current security defense systems are based on prior knowledge (including attacker characteristics, behaviors, fingerprints, etc.) and are passive security measures, essentially a "locking the stable door after the horse has bolted" mechanism, which has the following main drawbacks: Passive detection based on prior knowledge is difficult to effectively identify highly covert intrusion threats, and it cannot detect and protect against unknown attack patterns or malicious behaviors not found in the abnormal feature database. The detection database needs to be constantly updated and upgraded, and the detection is severely lagging behind. In some high-level industrial control systems that are isolated from the Internet, it is impossible to update the detection database in real time on a regular basis. The detection protection mechanism also determines that it has inherent defects. Summary of the Invention

[0007] In view of this, the present invention provides a cloud control system high-stealth attack detection method based on hierarchical state machine behavior modeling, which aims to solve the problem of highly targeted and highly stealthy security threat detection in network systems. It does not require feature extraction targeting attackers and attack methods, but focuses on behavior modeling of the system itself. Any behavior inconsistent with its own can be identified as abnormal. It can support the detection and identification of malicious intrusion threats that appear for the first time or that have been targeted to evade detection.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling, characterized by comprising: The system network topology is modeled based on directed graphs to describe the information flow paths between system nodes. A hierarchical finite state machine is used to model the state transitions of system nodes, generating a system behavior model. Based on the system behavior model, the transition of system node states is detected by deterministic logic or temporal association rules to determine whether it conforms to normal logic or predefined rules, and abnormal behavior is judged. The system collects the state transition times of system nodes, trains a normal probability density function, calculates the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detects abnormal behavior and highly covert attacks based on the threshold of the difference.

[0009] In one specific implementation scheme, the modeling of the system network topology based on directed graphs includes: Directed graph symbols express,

[0010] Represents a set of system nodes, each For the first Each system node represents a specific hardware device or virtual functional module in the system. Let the set of directed edges be denoted as . Represents system nodes The running status will affect the system nodes It has an impact.

[0011] In a specific feasible implementation, for each system node Construct a finite state machine model, using symbols It means that, among them:

[0012] Represents system nodes The set of livable states; This represents the set of input events, that is, the set of events that a system node can receive during its operation; This represents the state transition function, which is the rule for state change when a system node receives an event in a certain state. Represents system nodes The initial state.

[0013] In a specific feasible implementation, the modeling of system node state transitions using a hierarchical finite state machine includes: Hierarchical Finite State Machine (HFSM) is represented by a seven-tuple:

[0014] Represents system nodes The set of livable states; This represents the set of input events, that is, the set of events that a system node can receive during its operation; This represents the state transition function, which is the rule for state change when a system node receives an event in a certain state. Represents system nodes The initial state; It is the set of all composite states, where Indicates the first The status of each submodule; This represents the mapping from the child state machine to the parent state, indicating that a transition between child states may affect the parent state. It is a hierarchical mapping of states, representing the changes between parent states. It aggregates the outputs of multiple child state machines at a higher level to characterize the overall health or functional state of system nodes.

[0015] In one specific implementation, the timing logic rule detection includes: Obtain the initial state of system nodes and the jump state after the command is issued; Based on the one-to-many state transition rule, determine whether each system node enters the predetermined state after the instruction is issued; Based on the many-to-one state transition rule, verify whether the state transition of system nodes satisfies the state constraints of other system nodes; If the jump state does not conform to normal logic or predefined rules, it is determined to be abnormal behavior.

[0016] In one specific implementation scheme, the difference-based threshold detection of anomalous behavior and highly covert attacks includes: Collect time samples of the timing logic jumps of each system node and determine the probability distribution that the time samples follow; The probability density function under normal conditions is called the normal probability density function. Obtain the set of state transition times during the monitoring process, and generate the probability density function of the time samples of the monitoring process, i.e., the monitoring probability density function; Calculate the relative entropy between the monitored probability density function and the normal probability density function, and determine whether there are abnormal behaviors and highly covert attacks based on a preset threshold of the relative entropy.

[0017] In one specific implementation scheme, calculating the relative entropy between the monitored probability density function and the normal probability density function, and determining whether abnormal behavior and highly covert attacks exist based on a preset threshold of the relative entropy, includes: Obtain the system business logic state transition time, including network transmission latency and system response time; Model the normal probability density function based on the Gaussian distribution, and determine the mean and variance; Calculate relative entropy ,in Represents the normal probability density function. Represents the monitoring probability density function; If the relative entropy is greater than a preset threshold, it is determined to be a highly covert attack.

[0018] In a specific implementation scheme, when the method is used to perform high-stealth attack detection in a scenario where there is an upstream and downstream correlation between state transition times, the relative entropy of the joint probability density of the upstream and downstream state transition time vectors is used to perform anomaly detection. set up For system nodes The time vector occupied by the transition between consecutive upstream and downstream states; Through the , To aggregate, and under normal circumstances The joint probability density function is trained to obtain the joint probability density function under normal conditions. ; The relative entropy is used to measure the time of the monitored system behavior, and its joint probability distribution is calculated compared with the joint probability density function under normal conditions. The distance is used to determine if there are any anomalies; During the monitoring process The joint probability density function is The relative entropy is then calculated as follows: .

[0019] In one specific implementation, the method is used to perform highly covert attack detection in a distributed self-organizing network, obtaining the global system node jump time through two targeted information diffusions: Initial diffusion: The state transition time of the local system node is sent to the direct neighbor system nodes; Secondary diffusion: The received neighbor system node times are forwarded to non-common neighbor system nodes, and duplicate data is filtered based on network topology; Each system node performs relative entropy calculations using the aggregated global time set.

[0020] Compared with existing technologies, the cloud control system high-stealth attack detection method based on hierarchical state machine behavior modeling described in this invention has the following advantages: 1. Shifting from traditional passive detection to proactive security detection: Existing security detection mainly relies on extracting features of known attacks and building a database for matching, which cannot exhaustively list all kinds of emerging attack behaviors. This invention, by finely modeling the system's own behavior and monitoring whether the system's behavior status meets normal expectations, and by adaptively changing the judgment criteria with the changes in the system status, can turn passive into proactive and effectively detect and identify highly concealed or even newly emerging unknown security threats.

[0021] An anomaly detection method based on deterministic logic rules is proposed. It only needs to focus on the normal state behavior of the system's own business logic and design. Anomaly detection can be implemented by sorting out the system's business logic and defining rules, without having to extract and match features for complex and ever-changing attack behaviors.

[0022] A high-stealth attack detection method based on temporal association rules supports accurate detection and identification of highly stealthy intrusion behaviors through fine characterization and representation of the time dimension.

[0023] 2. Upgrading from establishing itemized whitelist rules to refined system modeling, and using state machines to formally represent system behavior, effectively solves the shortcomings of traditional whitelist-based anomaly detection, such as simple, static whitelist rules and difficulty in adapting to dynamic system changes. It achieves refined characterization of system behavior and supports the effective detection and identification of highly targeted and highly covert attack and intrusion behaviors.

[0024] The cloud control system behavior modeling method based on directed graphs and hierarchical finite state machines can achieve a detailed description and characterization of the system's normal behavior. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0026] Figure 1 This is an overall flowchart of a cloud control system high-stealth attack detection method based on hierarchical state machine behavior modeling, as described in this invention.

[0027] Figure 2 This is the overall architecture of the cloud control system information behavior model.

[0028] Figure 3 This is an information behavior model for cloud control systems.

[0029] Figure 4 This is a schematic diagram of a state machine logic transition model.

[0030] Figure 5 This is a schematic diagram of a distributed logic jump model for a cloud control system with time tags.

[0031] Figure 6 This is a schematic diagram of the distributed self-organizing architecture of a cloud control system. Detailed Implementation

[0032] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Taking a typical cloud control system as an example, the main challenges in conducting system behavior modeling and anomaly detection are as follows: (1) Modeling of complex interactions: There are complex interaction relationships between different system nodes in the system. The model needs to be able to capture these complex interaction relationships and accurately reflect the impact of these interactions on the overall behavior of the system through mathematical expression.

[0034] (2) Consideration of time factors: Complex cloud control systems are usually dynamic systems, and the behavior and state of the system change over time. Therefore, the model needs to be able to accurately capture the dynamic changes of the system at different points in time and reflect the process of the system state evolving over time. This places high demands on the model's time resolution and time dependence.

[0035] (3) How to construct a system model to describe the complete system behavior: Due to the complexity of the system, traditional modeling methods may be insufficient to comprehensively describe all the system's behaviors. A model is needed that can capture the global dynamics of the system while also describing the micro-behavior of each subsystem and system node in detail. This requires us to consider the overall architecture of the system and to deeply analyze the function of each system node and the interactions between system nodes when modeling.

[0036] like Figure 1 As shown, the present invention discloses a high-stealth attack detection method for cloud control systems based on hierarchical state machine behavior modeling, which is applied to cloud control systems and includes the following steps: The system network topology is modeled based on directed graphs to describe the information flow paths between system nodes. A hierarchical finite state machine is used to model the state transitions of system nodes, generating a system behavior model. Based on the system behavior model, the transition of system node states is detected by deterministic logic or temporal association rules to determine whether it conforms to normal logic or predefined rules, and abnormal behavior is judged. The system collects the state transition times of system nodes, trains a normal probability density function, calculates the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detects abnormal behavior and highly covert attacks based on the threshold of the difference.

[0037] For example, a system network topology layer is constructed based on a directed graph, where system nodes represent system device entities and directed edges represent data flow dependencies or control responses between system nodes; The hierarchical finite state machine (HFSM) is used to model the state transitions of system nodes. The HFSM includes a composite set of states and the mapping relationship from sub-state machines to parent states, generating a multi-level system behavior model. Based on the system behavior model, the system node state transition is checked for compliance with constraints by using predefined temporal logic rules. If the state before the transition occurs but the state after the transition does not occur, or the state after the transition occurs but the state before the transition does not occur, it is determined to be abnormal behavior. Collect time samples of the timing logic jumps of each system node and train the normal probability density function; The system acquires the set of state transition times in real time and generates a probability density function for time samples of the monitoring process. Calculate the relative entropy (also known as Kullback-Leibler divergence) between the monitored probability density function and the normal probability density function. If the relative entropy value exceeds a preset threshold, it is determined that a high-coverage attack exists.

[0038] Cloud control systems are characterized by a large number of subsystems and system nodes with complex relationships, deterministic system structure, multi-layered system composition, strong coupling between system actions and time, and finite states of system nodes. This invention employs a system behavior modeling strategy based on directed graphs and hierarchical finite state machines. Specifically, it includes: In the system network topology layer, a directed graph is introduced to describe the paths and dependencies of information flow between system nodes of the cloud control system, reflecting the dynamic adaptability and concurrency characteristics of the system. At the node level, a hierarchical finite state machine (HFSM) is used to model the state transitions between system nodes and their internal subsystems, thus clarifying the hierarchical boundaries and logical structure of the system behavior.

[0039] This layered modeling approach not only enhances the clarity of the overall structure but also improves the adaptability to the concurrency, heterogeneity, and scalability of cloud control systems.

[0040] Based on the above technical solutions, such as Figure 2 As shown, the overall architecture of the cloud control system information behavior model is divided into three levels: system network topology layer, system node layer, and system node internal subsystem layer, which aims to realize the structured expression and modeling of the complex information interaction and internal state evolution of the cloud control system. The system network topology layer, as the top layer, connects the system nodes (including control nodes and controlled nodes) of the cloud control system according to the actual physical scenario. It uses a directed graph model to express the instruction transmission path and state change process, and intuitively describes the information interaction relationship between system nodes. The system node layer is located in the middle and mainly includes the finite set of states of each system node, system node event inputs, initial states, state transition rules and output results. The hierarchical finite state machine modeling method is used to describe the logical linkage and state transition between subsystems within the system node. The subsystem layer within the system node serves as the lowest layer, independently modeling each subsystem within the system node. It describes the internal state transitions using finite state machines and logical rule algebra, ensuring the clarity and independence of the internal state behavior of the system node.

[0041] Based on the above overall architecture division of the cloud control system information behavior model, the cloud control system information behavior model is constructed as follows: Figure 3 As shown, in the system topology, the system flowchart is abstracted into a complete system topology diagram, which includes system nodes, subsystems within system nodes, information interaction logic between system nodes, and information flow paths within the system. The definition of system node names lays the foundation for establishing the relationships and logical operations between system nodes.

[0042] Modeling the system network topology layer focuses on describing the information interaction structure between nodes, especially between control nodes and controlled nodes. A directed graph model is used to present the information flow path in a structured way, avoiding the redundancy and chaos caused by mixing the internal subsystem logic of system nodes into the system topology structure, making the entire transmission process clearer and more intuitive.

[0043] First, the entire cloud control system is defined as a directed graph model, where the directed graph is represented by the symbol... It means that, among them:

[0044] Represents a set of system nodes, each For the first Each system node represents a specific hardware device or virtual functional module in the system. Let the set of directed edges be denoted as . Represents system nodes The running status will affect the system nodes It has an impact, such as data flow dependency, link propagation, or control response.

[0045] Secondly, for each system node Construct a finite state machine model, using symbols It means that, among them:

[0046] Represents system nodes The set of manageable states, which can correspond to hardware layer states such as power-on, power-off, and overheating, or logic layer states such as link congestion and network packet hijacking, are shown in the following examples.

[0047] This represents the set of input events, that is, the set of events that a system node can receive during its operation; This represents the state transition function, which is the rule for the state change of a system node when it receives an event in a certain state. These rules are usually defined by the device firmware or operation and maintenance logic. Record system nodes Full-cycle status (including normal / abnormal critical status). It covers abnormal events that may be triggered by attacks and penetrations (such as illegal commands and unauthorized status), providing a foundation for subsequent cross-system node anomaly propagation analysis; Represents system nodes The initial state.

[0048] Modeling the system node layer considers the structural commonality and behavioral universality among system nodes, adopts a hierarchical finite state mechanism, clarifies the input-output relationship of subsystems between each system node, sets the finite states of system nodes, state transition rules, and connection relationships between system nodes, thereby constructing a multi-level state machine model.

[0049] Hierarchical finite state machines are an extended state machine model used to more effectively represent complex systems; by introducing a hierarchical structure of states, they allow the states themselves to contain sub-state machines.

[0050] Hierarchical Finite State Machine (HFSM) is represented by a seven-tuple:

[0051] in: With finite state machine model The definitions are the same; It is the set of all composite states, where Indicates the first The state of each sub-module, such as the core router or network controller, consists of multiple port management modules, power modules, fan systems, authentication units, etc. These sub-modules have independent operating logic, but together they affect the overall state of the system nodes. This represents the mapping from the child state machine to the parent state, indicating that a transition between child states may affect the parent state. It is a hierarchical mapping of states, representing the changes between parent states. It aggregates the outputs of multiple child state machines at a higher level to characterize the overall health or functional state of system nodes. The output of the aggregated sub-state machine describes the health of system nodes. When the health suddenly changes (e.g., A short-term drop exceeding the threshold This triggers a high-coverage attack warning.

[0052] The aforementioned state machine model provides a temporal logic representation method for the operation of cloud control systems. Under normal circumstances, the cloud control system performs business transitions according to the set state machine model, executing complete business processes and tasks. When attackers launch network attacks, they will inevitably disrupt the original state machine model rules. For example, an attacker launching a network hijacking attack will cause some deterministic state values ​​to be missing, or launching an injection attack will cause some state values ​​to be redundant. The occurrence of attack behavior will cause anomalies in the state machine transition logic. Detection rules can be designed based on these anomaly characteristics to detect network attack events.

[0053] Based on the above technical solutions, this invention further proposes the following system anomaly detection method based on temporal logic rules, specifically including the following order from low to high attack concealment: 1. Anomaly detection method based on deterministic logic rules In the hierarchical state machine model, state transition types can be divided into two types: one is called one-to-many, which generally occurs during the instruction issuance process; the other is called many-to-one, which generally occurs during the business execution process.

[0054] During the instruction issuance process, once an instruction is sent to each system, each system responds immediately and begins executing its own actions according to the instruction content. The mathematical model of this process can be represented as:

[0055] in Represents system nodes The initial state, Represents system nodes The first state after receiving the instruction and beginning to execute the action. When the instruction is issued, two system nodes in total begin to respond; the system node enters this state immediately. In the middle, system node two enters the state. In this context, it indicates that both system node one and system node two have received the instruction and begun executing the action. See also... Figure 4 The diagram shows a schematic of the system state machine logic transition model.

[0056] During business execution, the states of each system node transition according to predetermined logic under given input conditions. The mathematical model of this process can be represented as:

[0057] in This indicates the relationship with system nodes. The logical jump relates to the states of other system nodes, that is, in all The status of the system node is Under these conditions, system nodes It must be determined by state Jump to status If there is a system node The state is not satisfied In this case, then the system node It is impossible to be determined by a state. Jump to status .

[0058] like Figure 4 As shown, for system node one, the state Jump to status The jump model is as follows:

[0059] Other system nodes are similar; For system node two, state Jump to status The jump model is as follows:

[0060] That is, only when system node one is in state Only then can system node two change its state. Jump to status .

[0061] The essence of jump logic is the logical correspondence between the state before the jump and the state after the jump. These two states are mutually constraining conditions and must occur under normal circumstances. When the state before the jump occurs, the state after the jump must also occur; if it doesn't, it indicates an anomaly, such as the data in the state after the jump being hijacked or tampered with. When the state after the jump occurs, it necessarily implies that the state before the jump has already occurred; otherwise, it indicates an anomaly, such as the data in the state after the jump being maliciously injected data. Based on the above analysis, the anomaly detection rules based on logical jumps are designed as follows: When the following situations occur

[0062] or

[0063] This indicates that an abnormal event has occurred. This indicates that the state has not occurred.

[0064] This anomaly detection rule can identify logical errors during state transitions of various system nodes, and is mainly used to detect attacks such as network hijacking, malicious injection, data tampering, and malicious code execution.

[0065] Algorithm 1 presents an anomaly detection algorithm based on logical rules: 1) Initialization: Set the initial state vector That is, for all system nodes Given its initial state ; 2) When an instruction is issued, determine the system nodes associated with that instruction. If system nodes exist satisfy If so, it is judged as abnormal; 3) When system nodes status When it occurs, check if the instruction has already been given. If so... If so, it is judged as abnormal; 4) When system node status , When this occurs, check if the input conditions are normal. If... If so, it is judged as abnormal; 5) When system node status , and When this occurs, check if the output is normal. If so, it is judged as abnormal; 6) The algorithm ends.

[0066] The overall time complexity of Algorithm 1 is Where n is the number of system nodes, This represents the maximum degree of a system node in the network.

[0067] 2. A Highly Covert Attack Detection Method Based on Temporal Association Rules Attackers may employ more covert attack methods to bypass the attack detection rules of Algorithm 1, causing the aforementioned rules to fail. For example, an attacker could hijack normal state data packets, then simulate normal redirection logic and inject carefully crafted state data packets, making it appear normal from the perspective of logical redirection, but the key parameters in the state data packets would become fake injected data.

[0068] To detect this type of highly covert attack, this invention proposes a highly covert attack detection method based on temporal association rules: Cloud control systems execute business operations using a distributed architecture. Multiple system nodes perform related tasks according to the same business logic. An example of the business logic of a complete cloud control system is as follows: Figure 5 As shown.

[0069] First, control commands are simultaneously distributed to all system nodes. Upon receiving the unified control command, each system node executes its business actions concurrently. The time from the control node issuing the command to the controlled node initiating execution and providing feedback is... .

[0070] Secondly, each system node is internally organized according to... Figure 5 The model executes logical jumps, taking into account the time interval between state transitions. , and .

[0071] The time here refers to the time taken for the state transition process. Figure 5 The time in This indicates the state after the instruction is issued. The time difference that occurs is mainly composed of network transmission latency and the system response time after the system node receives the instruction. This indicates that each system node has a state. Jump to The time difference, which is mainly determined by the system nodes' state changes. The initial system uptime and network transmission latency are considered. Statistical analysis of actual data shows the state transition time under normal conditions. It can be modeled as a random variable following a certain probability distribution. Without loss of generality, here we will consider time... Modeled as following a probability distribution In practical applications, probability distribution It can be modeled as a Gaussian distribution, that is:

[0072] in and These represent the mean and variance, respectively.

[0073] The high-stealth attack detection method based on temporal association rules (a system node cluster detection method based on temporal association relative entropy) is based on the premise that when a high-stealth network attack occurs, although it does not cause anomalies in the jump logic, attackers can easily cause anomalies in the probability distribution of state jump times when simultaneously injecting malicious code into multiple system nodes. Based on this fact, abnormal behavior can be detected by observing changes in the probability distribution of identical state jump times across multiple system nodes.

[0074] set up For system nodes The time taken to perform a transition to the same state, through the... , To aggregate, and under normal circumstances The probability density function is trained to obtain the probability density function under normal conditions. Furthermore, relative entropy is used to measure the time of the monitored system behavior, and its probability distribution is calculated compared with the probability density function under normal conditions. The distance is used to determine whether there is an anomaly.

[0075] Specifically, during the monitoring process The probability density function is So there are

[0076] in ,when and The closer they are, the smaller their value; when they are exactly the same, their value is zero. Let the detection threshold be... , then when If so, it is judged as abnormal.

[0077] when When it follows a Gaussian distribution, we have

[0078] This allows for the specific calculation and determination of the detection rules.

[0079] Algorithm 2 presents a highly covert attack detection method based on temporal association rules: 1) Initialization: Under normal circumstances, collect time samples of the timing logic jumps of each system node. Study time probability density function ; 2) After all system nodes complete a certain logical jump, aggregate the time set of that logical jump. , And learn the probability density function using the same function structure. ; 3) Calculate the relative entropy value ; 4) Set the detection threshold to ,if Then an anomaly is determined; 5) The algorithm ends.

[0080] Based on the above technical solutions, this invention further proposes a method extension for specific scenarios, including: In the actual environment of cloud control systems, there are two special scenarios that require modification of the above-mentioned highly covert attack detection method based on time-series association rules to adapt to the special needs of these scenarios.

[0081] Special Scenario 1: The state transition time has an upstream and downstream relationship. The transition time between two consecutive states of system node one and There is a certain correlation, mainly due to two aspects: First, the system operation process has a certain continuity, and the running time of a certain function in the upstream will affect the running time of the downstream function. That is, the running time of the upstream and downstream is not completely independent but has Markov property. Second, since the transition between two consecutive states of the system is generally in the same network environment, the resulting network delays are similar.

[0082] In response to this scenario, the present invention utilizes this correlation to more accurately detect network attack anomalies.

[0083] set up For system nodes The time vector occupied by the transition between consecutive upstream and downstream states is obtained by... , To aggregate, and under normal circumstances The joint probability density function is trained to obtain the joint probability density function under normal conditions. Furthermore, relative entropy is used to measure the time of the monitored system behavior, and its joint probability distribution is calculated as well as the joint probability density function under normal conditions. The distance is used to determine whether an anomaly exists. Assume the monitoring process... The joint probability density function is So there are

[0084] At this point, the relative entropy of the joint probability density of the upstream and downstream state transition time vectors is used for anomaly detection.

[0085] Special Scenario 2: Distributed Self-Organizing Architecture of System Node Clusters In unmanned scenarios, system nodes operate collaboratively in a distributed, self-organizing manner, communicating only with their neighboring system nodes. Figure 6 System node 1 communicates only with system nodes 2, 3, and 4. In this case, there is no central system node for centralized data monitoring and control of the system nodes. Therefore, the state transition times of all system nodes are centrally aggregated. or , This makes it difficult to implement the aforementioned highly covert attack detection method based on temporal association rules.

[0086] To address this scenario, this invention proposes a distributed detection method based on information diffusion. For system nodes... Without loss of generality, it is assumed that the set of its neighbor system nodes is and When a state transition occurs locally, the system node sends the state transition time to its neighboring system nodes. This process involves one information propagation, whereby the system nodes... All neighbor system nodes can be obtained. The state transition times are determined. After a local system node receives the state transition times of its neighboring system nodes, it sends these times to other neighboring system nodes through a second information diffusion. The data sent can be filtered based on topological connections to avoid duplicate transmissions. It can be proven that after a finite number of information diffusions, each system node can obtain the state transition times of all other system nodes. Finally, each system node uses Algorithm 2 for anomaly detection.

[0087] The various embodiments described in this specification are presented in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling, characterized in that, include: The system network topology is modeled based on directed graphs to describe the information flow paths between system nodes. A hierarchical finite state machine is used to model the state transitions of system nodes, generating a system behavior model. Based on the system behavior model, the transition of system node states is detected by deterministic logic or temporal association rules to determine whether it conforms to normal logic or predefined rules, and abnormal behavior is judged. The system collects the state transition times of system nodes, trains a normal probability density function, calculates the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detects abnormal behavior and highly covert attacks based on the threshold of the difference.

2. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling as described in claim 1, characterized in that, The modeling of the system network topology based on directed graphs includes: Directed graph symbols express, ； Represents a set of system nodes, each For the first Each system node represents a specific hardware device or virtual functional module in the system. Let the set of directed edges be denoted as . Represents system nodes The running status will affect the system nodes It has an impact.

3. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 2, characterized in that, For each system node Construct a finite state machine model, using symbols It means that, among them: ； Represents system nodes The set of livable states; This represents the set of input events, that is, the set of events that a system node can receive during its operation; This represents the state transition function, which is the rule for state change when a system node receives an event in a certain state. Represents system nodes The initial state.

4. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling as described in claim 1, characterized in that, The method of modeling the state transitions of system nodes using a hierarchical finite state machine includes: Hierarchical Finite State Machine (HFSM) is represented by a seven-tuple: ； Represents system nodes The set of livable states; This represents the set of input events, that is, the set of events that a system node can receive during its operation; This represents the state transition function, which is the rule for state change when a system node receives an event in a certain state. Represents system nodes The initial state; It is the set of all composite states, where Indicates the first The status of each submodule; This represents the mapping from the child state machine to the parent state, indicating that a transition between child states may affect the parent state. It is a hierarchical mapping of states, representing the changes between parent states. It aggregates the outputs of multiple child state machines at a higher level to characterize the overall health or functional state of system nodes.

5. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The determination of whether the transition of system node states conforms to normal logic or predefined rules through deterministic logic includes: Obtain the initial state of system nodes and the jump state after the command is issued; Based on the one-to-many state transition rule, determine whether each system node enters the predetermined state after the instruction is issued; Based on the many-to-one state transition rule, verify whether the state transition of system nodes satisfies the state constraints of other system nodes; If the jump state does not conform to normal logic or predefined rules, it is determined to be abnormal behavior.

6. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The difference-based threshold detection of abnormal behavior and highly covert attacks includes: Collect time samples of the timing logic jumps of each system node and determine the probability distribution that the time samples follow; The probability density function under normal conditions is called the normal probability density function. Obtain the set of state transition times during the monitoring process, and generate the probability density function of the time samples of the monitoring process, i.e., the monitoring probability density function; Calculate the relative entropy between the monitored probability density function and the normal probability density function, and determine whether there are abnormal behaviors and highly covert attacks based on a preset threshold of the relative entropy.

7. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 6, characterized in that, The calculation of the relative entropy between the monitored probability density function and the normal probability density function, and the determination of whether abnormal behavior and highly covert attacks exist based on a preset threshold of the relative entropy, includes: Obtain the system business logic state transition time, including network transmission latency and system response time; Model the normal probability density function based on the Gaussian distribution, and determine the mean and variance; Calculate relative entropy ,in Represents the normal probability density function. Represents the monitoring probability density function; If the relative entropy is greater than a preset threshold, it is determined to be a highly covert attack.

8. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 6, characterized in that, When performing high-coverage attack detection in scenarios where there is an upstream and downstream correlation between state transition times, the method uses the relative entropy of the joint probability density of the upstream and downstream state transition time vectors to perform anomaly detection. set up For system nodes The time vector occupied by the transition between consecutive upstream and downstream states; Through the , To aggregate, and under normal circumstances The joint probability density function is trained to obtain the joint probability density function under normal conditions. ; The relative entropy is used to measure the time of the monitored system behavior, and its joint probability distribution is calculated compared with the joint probability density function under normal conditions. The distance is used to determine if there are any anomalies; During the monitoring process The joint probability density function is The relative entropy is then calculated as follows: 。 9. The method for detecting highly covert attacks on cloud control systems based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The method described is used to detect highly covert attacks in distributed self-organizing networks, obtaining the global system node jump time through two targeted information diffusions: Initial diffusion: The state transition time of the local system node is sent to the direct neighbor system nodes; Secondary diffusion: The received neighbor system node times are forwarded to non-common neighbor system nodes, and duplicate data is filtered based on network topology; Each system node performs relative entropy calculations using the aggregated global time set.

Images