A cloud control system high concealment attack detection method based on hierarchical state machine behavior modeling

Abstract

The application relates to the field of network security, in particular to a cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling. The method comprises the following steps: constructing a network system topology layer, describing information paths among system nodes, modeling state transitions of the system nodes, and generating a system behavior model; determining the jumping of the system node state through a deterministic logic or a time sequence association rule, judging abnormal behaviors according to normal logic or predefined rules; collecting node state jumping time, training a normal probability density function, calculating the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detecting abnormal behaviors and high-concealment attacks. The application models behaviors of a system itself and implements detection and identification of high-concealment attacks; from establishing an entry-based white list rule to fine modeling of the system, the application solves the problems of simple rules, static rules and difficulty in adapting to dynamic changes; through fine description and representation in the time dimension, the application supports detection and identification of high-concealment intrusion behaviors.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, more particularly to a cloud control system high concealment attack detection method based on hierarchical state machine behavior modeling. BACKGROUND

[0002] The number of distributed nodes of the cloud control system is large, and the system nodes mainly include control nodes and controlled nodes. The control nodes mainly implement system operation control and state monitoring, and the controlled nodes mainly accept control instructions, complete corresponding task execution actions and report states. Under the communication hinge of wired / wireless network, the control nodes realize remote testing and operation control of each controlled node. With the development of information technology, the degree of unmanned node network connection and automation control is higher and higher, and higher requirements are put forward for real-time security protection of the system. The existing network security detection method mainly uses known network attack feature matching as the mainstream technical framework, and there is a short board in dealing with high concealment unknown attacks of system nodes.

[0003] High concealment unknown threat refers to the use of low-frequency low-sensitivity attack mode, new malicious code, unknown vulnerability, and disguised normal network behavior mode by attackers, which causes the detection method based on known threat feature matching to be inaccurate or even completely ineffective.

[0004] In order to solve the detection problem of high concealment unknown attack, some researchers have proposed an abnormal-based network attack detection method. This kind of method models the normal behavior characteristics of the target system, and judges whether an attack occurs by detecting whether the characteristics violate the normal behavior mode, such as detecting whether there is a botnet by detecting the size of normal traffic, detecting whether an attack event is occurring by detecting the energy consumption size of Internet of Things system nodes, and detecting whether an anomaly occurs by monitoring the single-hop packet size and frequency of distributed network.

[0005] The existing abnormal-based detection method mainly detects attack behavior according to the changes of single system node, and lacks research on detection analysis from the global system. The cloud control system contains dozens of subsystems and hundreds of states, and each subsystem executes related operations in a tightly coupled and dynamically changing manner according to fixed business logic. It is a challenging problem to clearly express the business logic relationship and state of the system from the business data and design abnormal detection rules.

[0006] The security intrusion means of attackers is more and more sophisticated, the intrusion approach is more and more, and the concealment of intrusion is more and more strong. Considering the high timeliness and difficult reuse characteristics of network space intrusion, the attacker must adopt a high-concealment attack style, adopt advanced technical means such as zero-day vulnerability attack, fileless Trojan, concealed control channel and feature confusion, penetrate the network security defense line of the target, and quietly disguise and wait for an opportunity to paralyze. The current security defense system is a passive security protection based on prior knowledge (including the characteristics, behavior and fingerprint of the attacker), which is essentially a "worrying about the sheep after the sheep is lost and waiting for the rabbit after the tree is planted". The main shortcomings are as follows:

[0007] The passive detection based on prior knowledge cannot effectively identify high-concealment intrusion threats. For unknown attack patterns or malicious behaviors not in the abnormal feature library, detection and protection cannot be achieved.

[0008] The detection library needs to be updated and upgraded constantly, and the detection has serious lag. In some high-level industrial control systems isolated from the Internet, the detection library cannot be updated in real time, and the detection and protection mechanism also has natural defects. SUMMARY

[0009] Therefore, the application provides a cloud control system high-concealment attack detection method based on layered state machine behavior modeling, which aims to solve the problem of strong targeting and high-concealment security threat detection of network systems. The method does not need to extract features for attackers and attack means, but focuses on behavior modeling of the system itself. The method can identify abnormal behaviors that are inconsistent with the behavior of the system itself, and can support detection and identification of first-time or targeted malicious intrusion threats.

[0010] In order to achieve the above purpose, the application adopts the following technical solutions:

[0011] A cloud control system high-concealment attack detection method based on layered state machine behavior modeling, characterized in that it comprises:

[0012] Modeling the system network topology based on a directed graph, describing the information flow path between system nodes, modeling the state transition of system nodes using a layered finite state machine, and generating a system behavior model;

[0013] Based on the system behavior model, determining whether the jump of the system node state conforms to the normal logic or the predefined rule through the deterministic logic or the time sequence correlation rule, and judging the abnormal behavior;

[0014] Collecting the state jump time of the system node, training a normal probability density function, calculating the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detecting abnormal behavior and high-concealment attack based on the threshold of the difference.

[0015] In one specific implementation, the modeling of the system network topology based on a directed graph comprises:

[0016] The directed graph is denoted by

[0017]

[0018] denotes a set of system nodes, each is the th system node, representing a specific hardware device or virtual functional module in the system;

[0019] denotes a set of directed edges, where edge denotes the running state of system node has an impact on system node .

[0020] In one specific implementation, a finite state machine model is constructed for each system node , denoted by , where:

[0021]

[0022] denotes the set of states that system node may be in;

[0023] denotes the set of input events, i.e., the set of events that system node can receive during operation;

[0024] denotes the state transition function, i.e., the state change rule of system node when receiving a certain event in a certain state;

[0025] denotes the initial state of system node .

[0026] In one specific implementation, the modeling of the state transition of system nodes using hierarchical finite state machines comprises:

[0027] The hierarchical finite state machine HFSM is denoted by a seven-tuple:

[0028]

[0029] denotes the set of states that system node may be in;

[0030] ​ represents a set of input events, i.e. a set of events that the system node can receive during its running process;

[0031] represents a state transition function, i.e. a rule of state change when a certain event is received by the system node in a certain state;

[0032] represents an initial state of the system node ;

[0033] is a set of all composite states, wherein represents a state of the th sub-module;

[0034] is a mapping of the sub-state machine to the parent state, indicating that the switching of the sub-state can affect the parent state;

[0035] is a hierarchical mapping of the state, indicating the change between parent states, aggregating the outputs of multiple sub-state machines at a high level, and used to depict the overall health or functional state of the system node.

[0036] In one specific implementable embodiment, the timing logic rule detection comprises:

[0037] obtaining the initial state of the system node and the jump state after the instruction is issued;

[0038] judging whether each system node enters a predetermined state after the instruction is issued based on a one-to-many state transition rule;

[0039] verifying whether the jump of the state of the system node satisfies the state constraint of other system nodes based on a many-to-one state transition rule;

[0040] if the jump state does not conform to the normal logic or the predefined rule, determining that it is an abnormal behavior.

[0041] In one specific implementable embodiment, the threshold value detection of abnormal behavior and high-concealment attack based on difference comprises:

[0042] collecting time samples of the timing logic jump of each system node, and determining a probability distribution to which the time samples conform;

[0043] training a probability density function under normal conditions, i.e. a normal probability density function;

[0044] obtaining a set of state jump times in the monitoring process, and generating a probability density function of the time samples of the monitoring process, i.e. a monitoring probability density function;

[0045] The relative entropy of the monitoring probability density function and the normal probability density function is calculated, and whether there is abnormal behavior and high-concealment attack is determined based on a preset threshold of the relative entropy.

[0046] In a specific implementable solution, the calculation of the relative entropy of the monitoring probability density function and the normal probability density function, and the determination of whether there is abnormal behavior and high-concealment attack based on a preset threshold of the relative entropy, include:

[0047] The system service logic state jump time is obtained, including network transmission delay and system response time;

[0048] The normal probability density function is modeled based on Gaussian distribution, and the mean and variance are determined;

[0049] The relative entropy is calculated , wherein represents the normal probability density function, represents the monitoring probability density function;

[0050] If the relative entropy is greater than a preset threshold, it is determined as a high-concealment attack.

[0051] In a specific implementable solution, the method is used for high-concealment attack detection in a scenario where there is an upstream and downstream correlation relationship in the state jump time, and the relative entropy of the joint probability density of the upstream and downstream state jump time vectors is used for abnormal detection;

[0052] Let be a system node The time vector occupied by the same upstream and downstream continuous state jump is performed;

[0053] The joint probability density of , is aggregated, and the joint probability density function of under normal conditions is trained to obtain the joint probability density function under normal conditions;

[0054] The relative entropy is used to measure the system behavior time being monitored, the distance between the joint probability distribution and the joint probability density function under normal conditions is calculated, and whether there is abnormality is determined according to the distance size;

[0055] The joint probability density function of during the monitoring process is , and the relative entropy calculation is:

[0056] .

[0057] In one specific implementation, the method is used to perform high concealment attack detection in a distributed self-organizing network, and the global system node hop time is obtained by twice directional information diffusion:

[0058] First diffusion: the state hop time of the local system node is sent to the direct neighbor system node;

[0059] Second diffusion: the received neighbor system node time is forwarded to the non-common neighbor system node, and the repeated data is filtered based on the network topology;

[0060] Each system node performs relative entropy calculation using the converged global time set.

[0061] Compared with the prior art, the high concealment attack detection method of the cloud control system based on hierarchical state machine behavior modeling has the following beneficial effects:

[0062] 1. From traditional passive detection to active security detection, the existing security detection mainly relies on extracting the features of known attacks and building a library for matching, which cannot exhaustively enumerate various emerging attack behaviors, the present application models the system behavior in detail and monitors whether the system behavior state meets the normal expectation, the criterion changes adaptively with the system state, which can change from passive to active, effectively detecting and identifying high concealment and even unknown security threats.

[0063] An abnormality detection method based on deterministic logic rules is proposed, which only needs to pay attention to the system's own business logic and normal state behavior, and can implement abnormal behavior detection through system business logic analysis and rule definition, without feature extraction and matching for complex and variable attack behaviors.

[0064] The high concealment attack detection method based on time sequence association rules supports accurate detection and identification of high concealment intrusion behavior through fine description and representation in the time dimension.

[0065] 2. From establishing entry-based whitelist rules to system fine modeling, the system behavior is formalized by using state machine, which effectively solves the problems of simple, static and difficult to adapt to system dynamic changes in traditional abnormality detection based on whitelist, realizes fine description of system behavior, and supports effective detection and identification of strong targeted and high concealment attack intrusion behavior.

[0066] The cloud control system behavior modeling method based on directed graph and hierarchical finite state machine can realize fine description and characterization of system normal behavior. BRIEF DESCRIPTION OF DRAWINGS

[0067] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute a part of the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0068] Figure 1 The overall flowchart of the cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling.

[0069] Figure 2 The overall architecture of the cloud control system information behavior model.

[0070] Figure 3 The cloud control system information behavior model.

[0071] Figure 4 The state machine logic jump model schematic diagram.

[0072] Figure 5 The cloud control system distributed logic jump model schematic diagram with time label.

[0073] Figure 6 The cloud control system distributed self-organizing architecture schematic diagram. DETAILED DESCRIPTION

[0074] The technical solutions in the embodiments of the present application will be described clearly and completely below. Obviously, the described embodiments only constitute a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0075] Taking a typical cloud control system as an example, the following difficulties mainly exist when carrying out system behavior modeling and anomaly detection:

[0076] (1) Modeling of complex interactions: In the system, there are complex interaction relationships between different system nodes. The model needs to be able to capture these complex interaction relationships and accurately reflect the influence of these interactions on the overall behavior of the system through mathematical expression.

[0077] (2) Consideration of time factor: Complex cloud control systems are usually dynamic systems, and the behavior and state of the system change over time. Therefore, the model needs to be able to accurately capture the dynamic changes of the system at different time points and be able to reflect the process of evolution of the system state over time. This puts high requirements on the time resolution and time dependence of the model.

[0078] (3) How to build a system model to describe the complete system behavior: Due to the complexity of the system, traditional modeling methods may be difficult to fully describe all behaviors of the system. A model is needed that can capture the global dynamics of the system, while also being able to describe the micro-behavior of each subsystem and system node in detail. This requires us to consider both the overall architecture of the system and the in-depth analysis of the function of each system node and the interaction between system nodes when modeling.

[0079] As shown in Figure 1 , the cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to the application, applied to the cloud control system, comprising the following steps:

[0080] Model the system network topology based on a directed graph, describe the information flow path between system nodes, model the state transition of system nodes using a hierarchical finite state machine, and generate a system behavior model;

[0081] Based on the system behavior model, determine whether the jump of the system node state conforms to the normal logic or the predefined rule through deterministic logic or timing correlation rules, and judge the abnormal behavior;

[0082] Collect the state jump time of the system node, train the normal probability density function, calculate the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detect abnormal behavior and high-concealment attack based on the threshold of the difference.

[0083] For example, a system network topology layer is constructed based on a directed graph, wherein the system nodes represent system device entities, and the directed edges represent data flow dependencies or control responses between system nodes.

[0084] A hierarchical finite state machine (HFSM) is used to model the state transition of the system node, which contains a composite state set and a mapping relationship from the child state machine to the parent state, and generates a multi-level system behavior model;

[0085] Based on the system behavior model, detect whether the jump of the system node state conforms to the constraint condition through the predefined timing logic rule, if the pre-jump state occurs and the post-jump state does not occur, or the post-jump state occurs and the pre-jump state does not occur, then it is determined as abnormal behavior;

[0086] Collect the time samples of the timing logic jump of each system node, and train the normal probability density function;

[0087] Real-time acquisition of the monitored state jump time set, generating the probability density function of the time samples of the monitoring process;

[0088] Calculate the relative entropy of the monitoring probability density function and the normal probability density function (also known as Kullback-Leibler divergence), and if the relative entropy value exceeds a preset threshold, it is determined that there is a high covert attack.

[0089] The cloud control system has a plurality of subsystems and system nodes, complex association, determinism of system structure, the system is composed of multiple layers, strong coupling between each system action and time, and limited state of each system node. The application adopts a system behavior modeling strategy based on directed graph and hierarchical finite state machine. Specifically, it includes:

[0090] At the system network topology layer, a directed graph is introduced to describe the path and dependency relationship of information flow between each system node of the cloud control system, reflecting the dynamic adaptability and concurrency characteristics of the system.

[0091] At the node layer, a hierarchical finite state machine (HFSM) is used to model the state transition of the system node and the internal subsystem of the system node, and the hierarchical boundary and logical structure of the system behavior are clearly defined.

[0092] This hierarchical modeling approach not only enhances the clarity of the overall structure, but also improves the adaptability to the concurrency, heterogeneity and scalability of the cloud control system.

[0093] On the basis of the above technical solution, as shown in Figure 2 The overall architecture of the cloud control system information behavior model is divided into three levels: system network topology layer, system node layer and system node internal subsystem layer, aiming to realize the structured expression and modeling of complex information interaction and internal state evolution of the cloud control system.

[0094] The system network topology layer as the top layer, for the system nodes (including control nodes and controlled nodes) of the cloud control system, connects each system node according to the actual physical scene, and expresses the instruction transmission path and state change process through the directed graph model, directly describing the information interaction relationship between system nodes.

[0095] The system node layer is in the middle position, mainly including the finite state set of each system node, system node event input, initial state, state transition rule and output result, and the hierarchical finite state machine modeling method is used to describe the logical linkage and state transition between the internal subsystems of the system node.

[0096] The system node internal subsystem layer as the bottom layer, independently models the subsystems within the system node, describes the internal state transition through finite state machine and logic rule algebra, and ensures the clarity and independence of the internal state behavior of the system node.

[0097] Based on the above cloud control system information behavior model overall architecture division, the cloud control system information behavior model is constructed as shown in Figure 3 In the system topology structure, the flowchart of the system is abstracted into a complete topology graph of the system, which contains system nodes, internal subsystems of the system nodes, information interaction logic between the system nodes, and information flow path inside the system. Through the definition of the system node name, a foundation is laid for subsequent establishment of the association relationship and logical operation between the system nodes.

[0098] The modeling of the system network topology layer focuses on describing the information interaction structure between nodes, especially between the control nodes and the controlled nodes. The information flow path is presented in a structured manner by using a directed graph model, which avoids the redundancy and confusion caused by mixing the internal subsystem logic of the system nodes into the system topology structure, making the entire transmission process more clear and intuitive.

[0099] First, the entire cloud control system is defined as a directed graph model, wherein the directed graph is represented by the symbol , wherein:

[0100]

[0101] represents a set of system nodes, each is the i-th system node, representing a specific hardware device or virtual functional module in the system;

[0102] represents a set of directed edges, wherein the edge represents that the running state of the system node has an impact on the system node , such as data flow dependence, link conduction, or control response. Second, a finite state machine model is constructed for each system node

[0103] , represented by the symbol , wherein:

[0104]

[0105] represents a set of states that the system node can be in, which can correspond to hardware layer states such as power-on, power-off, over-temperature, or logic layer states such as link congestion, network packet hijacking, etc. For example

[0106]

[0107] ​represents the set of input events, i.e. the set of events that the system node can receive during its runtime;

[0108] represents the state transition function, i.e. the rules of state change when a certain event is received by the system node in a certain state, which are usually defined by the device firmware or operation logic;

[0109] records the initial state of the system node the whole cycle state (including normal / abnormal critical state), covers abnormal events that may be triggered by attack penetration (such as illegal instructions, state overreach), providing a basis for subsequent cross-system node abnormal propagation analysis;

[0110] represents the initial state of the system node .

[0111] Modeling the system node layer considers the structural commonality and behavioral generality among system nodes, adopts a hierarchical finite state machine mechanism, explicitly defines the input-output relationship of subsystems among various system nodes, sets the limited states of the system nodes, state transition rules, and connection relationship among the system nodes, thereby constructing a multi-level state machine model.

[0112] The hierarchical finite state machine is an extended state machine model used to more effectively represent complex systems; by introducing a hierarchical structure of states, it allows the state itself to contain a sub-state machine.

[0113] The hierarchical finite state machine HFSM is represented by a seven-tuple:

[0114]

[0115] Among them:

[0116] is the same as defined in the finite state machine model ;

[0117] is the set of all composite states, where represents the state of the th submodule, for example, a core router or network controller is composed of multiple port management modules, power modules, fan systems, authentication units, etc., which have independent running logic but jointly affect the overall state of the system node;

[0118] is the mapping of the sub-state machine to the parent state, indicating that the switching of the sub-state may affect the parent state;

[0119] is a hierarchical mapping of states, indicating the change between parent states, aggregating multiple child state machine outputs at a high level to depict the overall health or functional state of a system node; Aggregating child state machine outputs to depict system node health, triggering a high-stealth attack warning when health mutates (such as a short time drop exceeds the threshold .

[0120] The above state machine model provides a time sequence logic characterization method for business operation of a cloud control system. Under normal circumstances, the cloud control system performs business jump according to the set state machine model, and executes complete business processes and tasks. When an attacker launches a network attack, the original state machine model rules will inevitably be broken, for example, when the attacker launches a network hijacking attack, some deterministic state values will be missing, or when the attacker launches an injection attack, some state values will be redundant. The occurrence of attack behavior will cause the state machine jump logic to be abnormal. Detection rules can be designed according to the abnormal characteristics to discover network attack events.

[0121] On the basis of the above technical solution, the application further proposes the following system anomaly detection method based on time sequence logic rules, and the order of attack stealth from low to high specifically includes:

[0122] 1. Anomaly detection method based on deterministic logic rules

[0123] In the hierarchical state machine model, the state transition type can be divided into two types, one is called one-to-many, which generally occurs in the instruction issuing process; and the other is called many-to-one, which generally occurs in the business execution process.

[0124] In the instruction issuing process, once the instruction is issued to each system, each system immediately responds and starts to execute the system action according to the instruction content. The mathematical model of this process can be expressed as:

[0125]

[0126] Wherein represents the initial state of the system node , and represents the first state in which the system node starts to execute the action after receiving the instruction. After the instruction is issued, two system nodes in the system node start to respond, the system node one enters the state , the system node two enters the state , indicating that the system node one and the system node two both receive the instruction and start to execute the action. Referring to the system state machine logic jump model schematic diagram shown in Figure 4 .

[0127] In the process of business execution, the state of each system node jumps according to the established logic under the determined input. The mathematical model of this process can be expressed as:

[0128]

[0129] Wherein represents other system node states related to the logic jump of the system node , that is, under the condition that the state of all system nodes is , the system node must jump from state to state . If there is a system node whose state does not meet , then the system node cannot jump from state to state .

[0130] As shown in Figure 4 , for system node one, the jump model of state jumping to state is:

[0131]

[0132] Other system nodes are similar;

[0133] For system node two, the jump model of state jumping to state is:

[0134]

[0135] That is, only after the state of system node one is , can the state of system node two jump from state to state .

[0136] The essence of the jump logic is the logical correspondence between the pre-jump state and the post-jump state, which are mutual constraints and must occur under normal circumstances. When the pre-jump state occurs, the post-jump state must occur, otherwise it indicates an anomaly, such as the post-jump state data being hijacked or tampered with; when the post-jump state occurs, it must be deduced that the pre-jump state has occurred, otherwise it indicates an anomaly, such as the post-jump state data being maliciously injected.

[0137] When the following conditions occur

[0138]

[0139] or

[0140]

[0141] then it is determined that an abnormal event occurs, wherein indicates that the state does not occur.

[0142] The abnormality detection rule can determine the logical error at the time of jump of the state of each system node, and is mainly used to find attack behaviors such as network hijacking, malicious injection, data tampering, malicious code execution and the like.

[0143] Algorithm 1 gives an abnormality detection algorithm based on a logical rule:

[0144] 1) Initialization: set an initial state vector , that is, for all system nodes , the initial state is given;

[0145] 2) When an instruction is issued, the system node related to the instruction is determined, if there is a system node satisfying , then it is determined that an abnormality occurs;

[0146] 3) When the state of the system node occurs, it is determined whether the instruction has occurred, if yes , then it is determined that an abnormality occurs;

[0147] 4) When the state of the system node , occurs, it is determined whether the input condition is normal, if yes , then it is determined that an abnormality occurs;

[0148] 5) When the state of the system node , and occur, it is determined whether the output is normal, if yes , then it is determined that an abnormality occurs;

[0149] 6) The algorithm ends.

[0150] The time complexity of the algorithm 1 as a whole is , wherein n is the number of system nodes, denotes the maximum degree of the system nodes in the network.

[0151] 2. High-concealment attack detection method based on time sequence association rule

[0152] Attackers can adopt more covert attack methods to bypass the attack detection rules of Algorithm 1, causing the above rules to be invalid. For example, an attacker can hijack a normal state packet, then simulate normal jump logic, and inject a carefully constructed state packet, which is normal from the perspective of logical jump, but the key parameters in the state packet become false injected data.

[0153] In order to detect such high-concealment attacks, the present application proposes a high-concealment attack detection method based on time sequence correlation rules:

[0154] The cloud control system performs business work in a distributed architecture, and multiple system nodes perform related tasks according to the same business logic. A complete cloud control system business logic example is shown in Figure 5 .

[0155] First, the control instruction is simultaneously issued to each system node in a distributed manner, and each system node simultaneously performs business actions after receiving the unified control instruction. The time from the issuance of the control node instruction to the feedback of the execution of the controlled node is .

[0156] Second, each system node internally performs logical jump according to the model Figure 5 , which considers the time interval , and between state jumps.

[0157] Here, the time refers to the time occupied by the state jump process. Figure 5 The time in represents the time difference from the issuance of the instruction to the appearance of the state , which is mainly composed of network transmission delay and system response time after the system node receives the instruction. The time represents the time difference from the state jumping to in each system node, which is mainly composed of system running time from the state and network transmission delay. Through statistical analysis of actual data, the state jump time under normal circumstances can be modeled as a random variable subject to a certain probability distribution. Without loss of generality, the time is modeled as subject to a probability distribution . In actual application scenarios, the probability distribution can be modeled as a Gaussian distribution, that is:

[0158]

[0159] where and represent mean and variance respectively.

[0160] The high concealment attack detection method based on time sequence correlation rule (system node cluster detection method based on time sequence correlation relative entropy) has the starting point that when the high concealment network attack occurs, although it does not cause the abnormality of the jump logic, the attacker is extremely easy to cause the abnormality of the probability distribution of the state jump time when simultaneously implementing the malicious injection on multiple system nodes. Based on the fact, the abnormal behavior can be detected according to the probability distribution change of the same state jump time of multiple system nodes.

[0161] Let be the time consumed by the system node to perform the jump of the same state, the time is aggregated by , , and the probability density function of under the normal condition is trained to obtain the probability density function under the normal condition, and the relative entropy is further utilized to measure the behavior time of the system under monitoring, the distance between the probability distribution and the probability density function under the normal condition is calculated, and whether the abnormality exists is judged according to the distance size.

[0162] Specifically, let the probability density function of in the monitoring process be , then

[0163]

[0164] wherein , when and are closer, the value is smaller, and when the two are completely the same, the value is zero. Let the detection threshold be , then when , the abnormality is judged.

[0165] When obeys the Gaussian distribution, there is

[0166]

[0167] Accordingly, the specific calculation and judgment of the detection rule can be performed.

[0168] Algorithm 2 gives the high concealment attack detection method based on time sequence correlation rule:

[0169] 1) Initialization: under the normal condition, the time sample of the time sequence logic jump of each system node is collected , and the probability density function of the time is learned. ;

[0170] 2) When all system nodes complete a certain same logical jump, gather the time set of the logical jump , , and learn the probability density function using the same function structure ;

[0171] 3) Calculate the relative entropy value

[0172] ;

[0173] 4) Set the detection threshold value as , if , it is determined that an anomaly occurs;

[0174] 5) The algorithm ends.

[0175] On the basis of the above technical solutions, the application further proposes a method extension for special scenarios, including:

[0176] In the actual environment of a cloud control system, there are two special scenarios, and the above high-concealment attack detection method based on time sequence association rules needs to be modified to adapt to the special needs of the scenarios.

[0177] Special scenario one: the state jump time exists an upstream and downstream correlation relationship

[0178] The state jump time of the first system node and has a certain correlation, and the main reasons for the correlation mainly include two aspects, one is that there is a certain continuity in the system running process, the running time of an upstream function will affect the running of a downstream function, that is, the upstream and downstream running times are not completely independent but have Markov property, and two is that the network delay formed by the continuous two states of the system is similar because the continuous two states of the system are generally in the same network environment.

[0179] For this scenario, the application utilizes the correlation to more accurately detect network attack anomalies.

[0180] Let be the time vector occupied by the system node to perform the same upstream and downstream continuous state jump, gather , , and train the joint probability density function of under normal circumstances to obtain the joint probability density function under normal circumstances, and further continue to measure the system behavior time being monitored using the relative entropy, calculate the joint probability distribution thereof and the joint probability density function The distance is used to determine whether an anomaly exists. Assume the monitoring process... The joint probability density function is So there are

[0181]

[0182] At this point, the relative entropy of the joint probability density of the upstream and downstream state transition time vectors is used for anomaly detection.

[0183] Special Scenario 2: Distributed Self-Organizing Architecture of System Node Clusters

[0184] In unmanned scenarios, system nodes operate collaboratively in a distributed, self-organizing manner, communicating only with their neighboring system nodes. Figure 6 System node 1 communicates only with system nodes 2, 3, and 4. In this case, there is no central system node for centralized data monitoring and control of the system nodes. Therefore, the state transition times of all system nodes are centrally aggregated. or , This makes it difficult to implement the aforementioned highly covert attack detection method based on temporal association rules.

[0185] To address this scenario, this invention proposes a distributed detection method based on information diffusion. For system nodes... Without loss of generality, it is assumed that the set of its neighbor system nodes is and When a state transition occurs locally, the system node sends the state transition time to its neighboring system nodes. This process involves one information propagation, whereby the system nodes... All neighbor system nodes can be obtained. The state transition times are determined. After a local system node receives the state transition times of its neighboring system nodes, it sends these times to other neighboring system nodes through a second information diffusion. The data sent can be filtered based on topological connections to avoid duplicate transmissions. It can be proven that after a finite number of information diffusions, each system node can obtain the state transition times of all other system nodes. Finally, each system node uses Algorithm 2 for anomaly detection.

[0186] The various embodiments described in this specification are intended to be illustrative of the invention and do not limit the scope of the invention. Although specific embodiments have been described herein, they are not to be taken as the only embodiments of the invention. Various modifications can be made to the embodiments described and other embodiments can be used without departing from the spirit or scope of the invention. Accordingly, the scope of the invention is to be limited only by the claims.

Claims

1. A cloud control system high-stealth attack detection method based on hierarchical state machine behavior modeling, characterized in that, The method comprises the following steps: modeling a system network topology based on a directed graph, describing information flow paths between system nodes, modeling state transitions of system nodes by using a hierarchical finite state machine, and generating a system behavior model; based on the system behavior model, determining whether the state jump of the system node conforms to the normal logic or the predefined rule through deterministic logic or time sequence association rule, and judging the abnormal behavior; collecting the state jump time of the system node, training the normal probability density function, calculating the difference between the current monitoring time distribution and the normal distribution through relative entropy, and detecting the abnormal behavior and the high concealment attack based on the threshold of the difference.

2. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The step of modeling the system network topology based on the directed graph comprises the following steps: Directed graph with symbols are represented, ； represents a collection of system nodes, each is a first system node, representing a specific hardware device or virtual functional module in the system; Let the set of directed edges be denoted as . Represents system nodes The running status will affect the system nodes It has an impact.

3. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 2, characterized in that, For each system node A finite state machine model is constructed, denoted by wherein: ； representing system nodes a set of states in which the system can be represents a set of input events, i.e. a set of events that the system node can receive during its run; represents the state transition function, i.e. the state change rule of the system node when receiving a certain event in a certain state; representing a system node of an initial state.

4. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The step of modeling the state transitions of the system nodes by using the hierarchical finite state machine comprises the following steps: The hierarchical finite state machine HFSM is represented by a seven-tuple: ； representing system nodes a set of states in which the system can be represents a set of input events, i.e. a set of events that the system node can receive during its run; represents the state transition function, i.e. the state change rule of the system node when receiving a certain event in a certain state; representing a system node of an initial state; is the set of all composite states, where represents the state of the th sub-module. For a child state machine to parent state mapping, indicating that a switch of the child state can affect the parent state; is a hierarchical mapping of states, representing changes between parent states, aggregating outputs of multiple child state machines at a high level, used to characterize the overall health or functional state of a system node.

5. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The step of determining whether the state jump of the system node conforms to the normal logic or the predefined rule through the deterministic logic comprises the following steps: obtaining the initial state of the system node and the jump state after the instruction is issued; judging whether each system node enters the predetermined state after the instruction is issued based on one-to-many state transition rules; verifying whether the state jump of the system node satisfies the state constraint of other system nodes based on many-to-one state transition rules; if the jump state does not conform to the normal logic or the predefined rule, the abnormal behavior is determined.

6. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The step of detecting the abnormal behavior and the high concealment attack based on the threshold of the difference comprises the following steps: collecting time samples of the time sequence logic jump of each system node, and determining the probability distribution to which the time samples are subjected; training the probability density function under the normal condition, i.e. the normal probability density function; obtaining a set of state jump times in the monitoring process, and generating the probability density function of the time samples of the monitoring process, i.e. the monitoring probability density function; calculating the relative entropy of the monitoring probability density function and the normal probability density function, and judging whether there is an abnormal behavior and a high concealment attack based on a preset threshold of the relative entropy.

7. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 6, characterized in that, The step of calculating the relative entropy of the monitoring probability density function and the normal probability density function, and judging whether there is an abnormal behavior and a high concealment attack based on a preset threshold of the relative entropy comprises the following steps: obtaining the system business logic state jump time, including the network transmission delay and the system response time; modeling the normal probability density function based on the Gaussian distribution, and determining the mean and the variance; Computing relative entropy where denotes the normal probability density function, denotes the monitoring probability density function; if the relative entropy is greater than the preset threshold, the high concealment attack is determined.

8. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 6, characterized in that, The method is used for performing high concealment attack detection in a scene where there is an upstream and downstream correlation relationship between the state jump times, and the relative entropy of the joint probability density of the state jump time vectors of the upstream and downstream is used for abnormal detection; Let To system node Time vector occupied to perform the jump of the same up- and downstream continuous state; By converging the , , and training the joint probability density function under normal circumstances , the joint probability density function under normal circumstances is obtained. The relative entropy is used to measure the time of the monitored system behavior, and its joint probability distribution is calculated compared with the joint probability density function under normal conditions. The distance is used to determine if there are any anomalies; During the monitoring process The joint probability density function of The relative entropy is calculated as 。 9. The cloud control system high-concealment attack detection method based on hierarchical state machine behavior modeling according to claim 1, characterized in that, The method is used for performing high concealment attack detection in a distributed self-organizing network, and the global system node jump time is obtained through twice directional information diffusion: first diffusion: sending the state jump time of the local system node to the direct neighbor system node; second diffusion: forwarding the time of the neighbor system node received to the non-common neighbor system node, and filtering the repeated data based on the network topology; each system node performs relative entropy calculation by using the converged global time set.

Images