Data filtering method and system for digital twin industrial control safety target range

Abstract

The invention discloses a data filtering method and system for a digital twin industrial control safety target range. The method comprises the following steps: firstly, marking an IP address of an industrial control system network in a segmented manner; feature extraction is carried out on the network behavior data of each IP segment, and splicing is carried out on the IP segment label to serve as a feature sample for constructing an industrial control network security identification model; a plurality of inverted residual modules with the same structure are adopted as core construction units, network behavior features in the feature samples are extracted and learned, and classification training is carried out; deploying the trained industrial control network security identification model to a pre-filtering module of a digital twin industrial control security target range, and carrying out classification, identification and filtering on network behavior data flowing in each IP segment in real time; and the misjudged sample is subjected to backtracking analysis, and the IP marking rule is updated. According to the technical scheme, the accuracy of network behavior data identification can be improved, so that the effectiveness of industrial control system simulation is improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of power system information security, and in particular to a data filtering method and system for a digital twin industrial control security target range. BACKGROUND

[0002] A digital twin target range refers to a simulation and verification environment constructed based on a digital twin (DT) technology, which is used to simulate the running state of an industrial control system (ICS) or an information system, a security threat, an attack scenario and a response process of a defense strategy. The core idea is to model and synchronize a physical model, running data and control logic of a real industrial object in real time, to construct a "mirrored" and "interactive" virtual system, and to realize visual presentation of network attack behavior, evaluation and training of security strategies.

[0003] The patent application with publication number CN118657891A realizes a high-visualization, intelligent and real-time response target range security monitoring system through a real-virtual fusion digital twin architecture, which integrates multi-source perception collection, three-dimensional point cloud modeling, abnormal monitoring and early warning and adaptive communication optimization. The patent application with publication number CN115811472A constructs a power network security target range system that integrates module modeling, automatic deployment, attack and defense drills, digital twin fusion and multi-dimensional evaluation, forms a complete closed-loop process, and improves the systematization and intelligent level of real combat training and network security situation research. The patent application with publication number CN115544672A integrates multi-source perception data collection, three-dimensional modeling visualization, intelligent early warning and communication link adaptive adjustment and other key technologies, and constructs a virtual-real fusion, real-time response and dynamically displayable digital twin target range monitoring system, which realizes comprehensive perception and accurate monitoring of the running state of the target range.

[0004] The existing digital twin security target range construction method has the following deficiencies:

[0005] (1) Lack of intelligent data credibility identification mechanism, unable to dynamically evaluate the credibility according to the data source and behavior characteristics, resulting in a large amount of false data entering the digital twin model, seriously interfering with the simulation results. (2) The data processing process mostly adopts static rule configuration, lacks dynamic identification ability based on learning models, and is difficult to adapt to the increasingly diverse attack behaviors and system response characteristics. (3) The filtering mechanism often takes "whether the feature is hit" as the criterion, and fails to integrate deep semantics such as historical behavior patterns and inter-service dependency relationships, resulting in single judgment results and weak generalization ability. (4) The simulation system and the data filtering system are disconnected, lacking a closed-loop feedback mechanism, resulting in a lack of accuracy in attack effect evaluation and a dependence on manual intervention for system optimization. SUMMARY

[0006] The application provides a data filtering method and system for a digital twin industrial control safety target range. First, the IP addresses of the industrial control system network are segmented and labeled; the network behavior data of each IP segment is feature extracted and spliced with the corresponding IP segment label as a feature sample for constructing an industrial control network security identification model; a plurality of inverted residual modules with the same structure are used as core construction units to extract and learn the network behavior features in the feature sample and perform classification training; the trained industrial control network security identification model is deployed to the front-end filtering module of the digital twin industrial control safety target range to classify and identify the network behavior data flowing in real time from each IP segment; and the misclassified samples are analyzed and the IP labeling rules are updated.

[0007] The first aspect of the application discloses a data filtering method for a digital twin industrial control safety target range, which adopts the following technical solution:

[0008] Segment the IP addresses of the industrial control system network and label each IP segment according to the network behavior of the IP segment to obtain the corresponding IP segment label;

[0009] Feature extraction is performed on the network behavior data of each IP segment, and the feature sample for constructing the industrial control network security identification model is obtained by splicing the feature sample with the corresponding IP segment label after dimension reduction;

[0010] The industrial control network security identification model is constructed, a plurality of inverted residual modules with the same structure are used as core construction units to extract and learn the network behavior features in the feature sample, and classification training is performed;

[0011] The trained industrial control network security identification model is deployed to the front-end filtering module of the digital twin industrial control safety target range to classify and identify the network behavior data flowing in real time from each IP segment;

[0012] The misclassified network behavior data is captured and analyzed, and the IP segment labeling rules are updated.

[0013] Further, the IP segment label acquisition step comprises:

[0014] The access frequency, historical alarm number and network behavior of each IP segment are obtained;

[0015] The communication frequency f i between the i th IP segment and the host in a unit time is counted according to the access frequency i , and the ranking of the communication frequency f i in all N IP segments is obtained; i The access frequency score of the i th IP segment is obtained according to the ratio of the communication frequency f i to the ranking of the communication frequency f i in all N IP segments;

[0016] The alarm number a i triggered by the i th IP segment in a set time window is counted from the historical alarm numberi Based on the number of alarms a i The ratio of the highest number of alarms among all N IP segments is normalized to obtain the normalized value of the historical alarm count for the i-th IP segment;

[0017] Extract abnormal features of network behavior, perform weighted calculation on all abnormal features in the i-th IP segment, and obtain the abnormal behavior score of the i-th IP segment;

[0018] Furthermore, by combining the access frequency score, the normalized value of the historical alarm count, and the abnormal behavior score, a risk score for the IP segment is calculated using a linear model; expressed as:

[0019]

[0020] In the formula, S ip (i) represents the risk score of the i-th IP segment, R freq (i) and C abn (i) represents the access frequency score, normalized value of historical alarm count, and abnormal behavior score of the i-th IP segment, respectively; ε is the error term; α, β, and γ are R... freq (i) and C abn The weighting coefficients of (i),

[0021] Based on the risk score S of the i-th IP segment ip The value of (i) is used to divide the IP segment according to the set segmentation and labeling threshold, and the i-th IP segment is labeled.

[0022] Furthermore, the industrial control network security identification model includes an input layer, a feature learning layer, and an output layer;

[0023] The feature learning layer employs a lightweight convolutional neural network with three stacked inverted residual modules. The first inverted residual module is used to convert feature samples into temporal features, forming primary features with preliminary temporal representation capabilities.

[0024] The second-layer inverted residual module takes the primary features output from the first layer as input, combines the primary features to generate complex pattern representations; the third-layer inverted residual module takes the complex pattern representations output from the second layer as input, extracts robust features and suppresses noise.

[0025] Furthermore, the network behavior data flowing into each IP segment in real time is classified, identified, and filtered.

[0026] The maximum probability distribution output by the output layer of the industrial control network security identification model is used as the corresponding category for the real-time network behavior data of each IP segment, including trusted, suspicious and malicious.

[0027] If the category of the real-time network behavior data is trusted, it is sent to the digital twin security range as simulation data; if the category of the real-time network behavior data is malicious, it is discarded;

[0028] If the category of the real-time network behavior data is suspicious, the data connection between the IP segment to which the real-time network behavior data belongs and the digital twin security range is suspended, and a secondary judgment mechanism is performed on the IP segment;

[0029] Further, the steps of the secondary judgment mechanism include: continuously collecting network behavior data and performing feature extraction on the IP segment to which the real-time network behavior data of the suspicious category belongs;

[0030] When constructing the feature sample, the IP segment label is replaced with the probability value of the suspicious category; and the reconstructed feature sample is input into the industrial control network security identification model for identification;

[0031] If the identification results of the K-k+1 to K rounds are all "trusted" after the secondary judgment mechanism of the set K rounds, the data connection between the IP segment and the digital twin security range is restored, otherwise the subsequent network behavior data of the IP segment is automatically discarded;

[0032] In the K rounds of secondary judgment mechanism, the IP segment label bit of each round is replaced with the probability value of the suspicious category obtained in the last round.

[0033] Further, the misclassified network behavior data captured from the range simulation process includes:

[0034] The misclassification judgment includes control deviation and false alarm;

[0035] If the network behavior data is judged to be trusted, and the control behavior it triggers in the range deviates from the predetermined behavior rule beyond the allowable error range, it is a control deviation;

[0036] If the network behavior data is judged to be malicious and discarded, but the subsequent network behavior data of the IP segment to which it belongs are all trusted, do not cause abnormal characteristics of the range, and do not have malicious behavior characteristics, it is a false alarm;

[0037] The feature sample corresponding to the misclassified network behavior data is traced back and marked as a misjudgment sample.

[0038] Further, the IP segment label of the misjudgment sample is corrected, and the statistical characteristics of the IP segment, including access frequency, historical alarm times and network behavior, are inductively analyzed;

[0039] According to the performance of the statistical characteristics of the IP segment to which all the misjudgment samples belong, the weight coefficients of the access frequency score, the historical alarm times normalized value and the behavior anomaly score in the linear model are adjusted.

[0040] The second aspect of the application discloses a data filtering system for a digital twin industrial control security target range, which executes the data filtering method as described in the first aspect of the application, and the system comprises:

[0041] An IP segment marking module is used to segment the IP address of the industrial control system network and mark each IP segment according to the network behavior of the IP segment to obtain the corresponding IP segment label.

[0042] A sample construction module is used to extract features from the network behavior data of each IP segment, splice the corresponding IP segment label after dimension reduction, and use the spliced data as a feature sample for constructing an industrial control network security identification model.

[0043] An identification model training module is used to construct an industrial control network security identification model, adopt a plurality of inverted residual modules with the same structure as the core construction unit, extract and learn the network behavior features in the feature sample, and perform classification training.

[0044] A data filtering module is used to deploy the trained industrial control network security identification model to the front-end filtering module of the digital twin industrial control security target range, and perform classification and identification filtering on the real-time network behavior data of each IP segment.

[0045] A feedback optimization module is used to capture misclassified network behavior data and update the IP segment marking rules.

[0046] Compared with the prior art, the present application has at least one of the following beneficial effects:

[0047] 1. The present application segments the IP address of the industrial control system network and marks each IP segment based on network behavior features. By using access frequency, historical alarm times and behavior anomaly features, the risk value of each IP segment is dynamically evaluated, and accurate label marking (such as trusted, suspicious and malicious) is performed according to the set threshold. This label is spliced with the network behavior features to improve the classification accuracy and filtering efficiency and reduce the probability of false positives and false negatives.

[0048] 2、The application adopts a multi-layer stacked inverted residual module as the core building unit, and performs efficient feature extraction and learning on the feature samples of the IP segment through a lightweight convolutional neural network. The first layer of inverted residual module extracts primary spatio-temporal features from the original data, the second layer of module further generates complex behavior pattern representation, and the third layer of module extracts robust features and suppresses noise. This hierarchical feature learning structure enables the model to effectively capture the complexity of network behavior from multiple levels, improving the classification ability and generalization ability of the model in complex industrial control environments. In addition, using inverted residual modules with the same structure can avoid the problem of gradient disappearance, improving the training efficiency and stability of the model in deep networks,

[0049] 3、The application introduces a misclassification feedback mechanism, which captures and analyzes misclassified network behavior data to form a dynamic closed-loop learning process. For misclassified data (control bias and false alarms), the model will perform backtracking analysis and update the IP segment labels, thereby optimizing the training samples. This mechanism ensures that the industrial control network security recognition model can continuously optimize itself in practical applications, improving the recognition ability of edge samples and overall accuracy. Through continuous feedback adjustment, the model can adapt to changes in the network environment, reduce false alarm rates, and improve the robustness and adaptive ability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a flowchart of a data filtering method for a digital twin industrial control security range. DETAILED DESCRIPTION

[0051] In order to more clearly illustrate the technical solutions of the present application, the present application will be described in detail below based on the drawings in the embodiments. In addition, the embodiments described herein are only used to explain the present application, and all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0052] Embodiment one

[0053] The present embodiment provides a data filtering method for a digital twin industrial control security range, which can be used for network data filtering of power information systems. Referring to Figure 1 , Figure 1 is a flowchart of a data filtering method for a digital twin industrial control security range. The present embodiment adopts the following specific implementation.

[0054] The traffic data of the industrial system network is filtered and identified through steps 1 to 3.

[0055] Step 1: Segment the IP addresses of the industrial control system network and obtain the labels of each IP segment;

[0056] The IP addresses of the industrial control system network are divided into / 24 subnet segments by default according to the CIDR rule, and the access frequency, historical alarm number and behavior anomaly of each IP segment are obtained;

[0057] By The access frequency score R of the i-th IP segment is calculated freq (i), the value range is [0, 1]; wherein f i is the communication frequency of the i-th IP segment with the host in unit time, and rank(f i ) is the ranking of f i in all N IP segment communication frequencies.

[0058] By The historical alarm number normalization value of the i-th IP segment is calculated The value range is [0, 1]; wherein a i is the number of alarms triggered in the set time window of the i-th IP segment, a max is the maximum alarm number in all IP segments, and z-score() represents the normalization operation.

[0059] By The behavior anomaly score C of the i-th IP segment is calculated abn (i), the value range is [0, 1]; wherein e j is the score of the j-th abnormal feature in the i-th IP segment, m is the number of abnormal features in the i-th IP segment, and ω j is the weight of the j-th abnormal feature score,

[0060] The abnormal features include but are not limited to abnormal port access, burst rate change, protocol use anomaly, and command behavior anomaly. In the initialization phase of the power information system, the default weight of each abnormal feature can be set based on the experience of domain experts or preset rules. For example: the high-risk port access behavior has high correlation with actual attack, and can be given a higher initial weight (such as ω=0.35); the burst rate change is greatly affected by normal business fluctuations, and the initial weight can be set to a lower value (such as ω=0.15); the protocol use anomaly and the command behavior anomaly (such as ω=0.25), in the model training and actual operation process, the weight can be dynamically updated and adjusted based on statistical correlation or feature importance. Among them,

[0061] (1) The score of abnormal port access is obtained by calculating the ratio of the number of high-risk access ports and / or unauthorized ports in the i-th IP segment to the total number of accesses.

[0062] (2) The score of burst rate change is obtained by calculating the number of data packets of the i-th IP segment in a unit time window, and using the coefficient of variation (CV) to measure the variability of the number of data packets, which is expressed as CV = σ / μ; wherein CV is the coefficient of variation value, and σ and μ represent the standard deviation and mean of the number of data packets of the i-th IP segment in multiple time windows, respectively.

[0063] An abnormal score segmentation function is set to divide the score according to different coefficient of variation values, and CV is mapped to a score e. In this embodiment, the segmentation function is set as

[0064]

[0065] When the coefficient of variation value reaches and exceeds the normal behavior reference threshold (such as 1.5), it is considered that the i-th IP segment has burst traffic behavior.

[0066] (3) The score of protocol use anomaly is obtained by calculating the protocol packet anomaly rate with the ratio of data packets using abnormal protocols to the total number of packets in the i-th IP segment data packet, and obtaining the score of protocol use anomaly. The abnormal protocol refers to a protocol that does not conform to the scene specification (such as using HTTP in the Modbus environment), or illegal parameters, error command codes, etc. appear in the protocol field.

[0067] (4) The score of command behavior anomaly is obtained by analyzing the protocol instruction sequence sent by the IP segment in a unit time window, and comparing it with the set of valid instructions predefined in the industrial control protocol, and quantifying the deviation degree, and the quantification method is e = N illegal / N total ; wherein N illegal and N total represent the number of illegal instructions and the total number of instructions in a unit time window, respectively.

[0068] In this embodiment, the access frequency score is used to measure the network activity frequency of a certain IP segment in a unit time, reflects the communication activity, and high access frequency may mean malicious behaviors such as scanning, worm spreading or command forwarding; the historical alarm trigger frequency normalization value is used to measure the frequency of a certain IP segment being identified as a potential attacker by a security system in a historical time window, reflects the frequency of the target IP segment in historical security events, and assists in modeling the threat level; the behavior anomaly index is evaluated by comparing with the normal communication model, and the deviation degree of the target IP segment in multiple dimensions is reflected, which is a key index for determining suspicious or hidden attacks. The three indexes are continuous quantitative features calculated based on measured data, which are used as the basis for risk weight allocation in the scoring function.

[0069] Based on the access frequency score, the historical alarm number normalized value, and the behavior anomaly score, a linear model of IP segment risk score is constructed:

[0070]

[0071] wherein: S ip (i) represents the risk score of the i-th IP segment, a, b, and g are weight coefficients of R freq (i), and C abn (i), and e is an error term.

[0072] According to the S ip value of a certain IP segment, the IP segment is labeled: when the S ip of a certain IP segment is greater than or equal to 0.7, the IP segment is labeled as “malicious”; when the S ip of a certain IP segment is between 0.3 and 0.7, the IP segment is labeled as “suspicious”; when the S ip of a certain IP segment is less than 0.3, the IP segment is labeled as “trusted”. In this embodiment, the threshold range of segment labeling is set by domain personnel.

[0073] Considering the possible multicollinearity problem among access frequency, historical alarm number, and behavior anomaly, as well as preventing overfitting, the ridge regression method is used to train the IP segment risk score model in this embodiment. In addition, in order to maintain the adaptability of the IP segment risk score model in different network environments and time stages, the access frequency, historical alarm number, and behavior anomaly of each IP segment are updated rolling every fixed maintenance period, and the linear model is retrained to automatically adjust the values of a, b, and g, reflecting the latest contribution of each index to the risk prediction ability.

[0074] Step 2: Feature extraction and PCA dimensionality reduction are performed on the network behavior data of each IP segment.

[0075] 2.1: Feature extraction is performed on the network behavior data corresponding to each segment, and Table 1 gives an example of part of the network behavior data feature extraction.

[0076] Table 1: Example of network behavior data feature extraction

[0077] Feature type Example feature Network statistics class Average packet length, traffic peak Protocol behavior class Modbus / TCP ratio, Modbus RTU baud rate Time series class Second-level request frequency, response interval mean Spatial distribution class Number of communication target IPs, Hop count Security indicator class High-risk port access rate, blacklist hit rate

[0078] 2.2: The network behavior data of each IP segment is structured and processed to construct the original feature sample, each subnet segment corresponds to a sample, and all samples constitute a sample matrix The number of rows of the sample matrix corresponds to the number n of IP segments, and the number of columns corresponds to the dimension d of the multi-dimensional feature vector, that is, the feature vector dimension of each IP segment. In this embodiment, the original feature vector dimension is 60 dimensions.

[0079] The network statistics type features include the average packet length and the traffic peak value. The average packet length is the average value of the lengths of all data packets of each IP segment in a set statistical period; and the traffic peak value is the maximum network traffic value of each IP segment in a set statistical period.

[0080] The protocol behavior type features include the Modbus / TCP ratio and the Modbus RTU baud rate. The Modbus / TCP ratio is the ratio of the Modbus / TCP protocol data packets to the total data packets of each IP segment in a set statistical period.

[0081] 2.2: Dimensionality reduction of the sample matrix by using PCA: standardize each feature vector in the sample matrix, and on the basis of the standardized sample matrix , calculate the covariance matrix for subsequent feature principal component extraction.

[0082] Decompose the covariance matrix, and select the first k principal components to make the cumulative contribution rate exceed 95%.

[0083] Step 3: Construct an efficient and lightweight industrial control network security identification model for processing network behavior features and performing classification identification;

[0084] This step splices each IP segment label and its feature after PCA dimensionality reduction as the input of the model. In step 2, 60-dimensional original network behavior features of each IP segment are extracted, covering five categories of features: network statistics type, protocol behavior type, time series type, spatial topology type, and security index type. After using PCA dimensionality reduction processing, the first k principal components (such as k=20) are selected to make the cumulative contribution rate exceed 95%, and the behavior features of each IP segment are compressed into a 20-dimensional vector z i ; and the IP segment label l ip-i (trust “0”, suspicious “1”, malicious “2”) in step 1 is spliced to obtain the input vector x i = [z i , l ip-i ], with a dimension of 21.

[0085] The industrial control network security identification model proposed in this application includes an input layer, a feature learning layer, and an output layer; an inverted residual structure (Inverted Residual Block) is introduced into a convolutional neural network (CNN) as a core construction unit. After being processed by three residual modules with the same structure, each inverted residual module is composed of three parts. Specifically:

[0086] The input layer is used to process the input vector; for the input vector x i = [z i , l ip-i ], this embodiment first expands it into the standard tensor format of PyTorch [1, 1, 1, 21], the elements in the input tensor represent the batch size, the number of channels, the height, and the width in turn, and then uses a 1x1 convolution to upgrade to 21 channels, that is, an input tensor of [1, 21, 1, 21] is input to the feature learning layer;

[0087] The feature learning layer is used to learn abnormal patterns in industrial control network communication. This embodiment uses a lightweight CNN network that introduces a 3-layer stacked inverted residual module. The functions of the 3-layer stacked inverted residual module are as follows:

[0088] The first inverted residual module is mainly responsible for extracting primary spatio-temporal features from the input tensor of [1, 21, 1, 21]. Through channel expansion and deep convolution, the first layer module can effectively convert the time sequence features in the input tensor to form a feature representation with preliminary time sequence expression capability. This step mainly performs preliminary feature extraction on the input data, captures the basic patterns and structures of network behavior, and lays the foundation for the combination of complex features in the subsequent steps.

[0089] The second inverted residual module takes the primary spatio-temporal features output by the first layer as input, and its main task is to combine the primary features to form complex pattern representations. Through further processing by deep convolution, it retains the key mutation and periodic components in network behavior and enhances the model's expression capability for behavior patterns. The role of the second layer is to capture more complex feature combinations, such as frequency changes, bursty communication, or interactive patterns of protocol behavior, so that the model can recognize more complex abnormal behaviors.

[0090] The third inverted residual module takes the complex pattern representations output by the second layer as input, and its core goal is to extract robust features and suppress noise. The third layer focuses on enhancing the model's significance for persistent abnormal patterns and suppressing the interference of transient noise, thereby improving the robustness of the features. Through channel compression and deep convolution, the model can extract stable and efficient feature representations.

[0091] Each inverted residual module includes three parts: each module contains three sub-parts: a channel expansion layer (1x1 convolution), a deep convolution layer (1x3 convolution), and a channel compression layer (1x1 convolution), and a residual connection is introduced when the input and output dimensions are consistent. Specifically:

[0092] Channel expansion layer: used for global channel expansion of the input tensor of [1, 21, 1, 21], expanded to [1, 126, 1, 21]. The channel expansion layer expands the input feature channel dimension from d to txd (t is an expansion factor, usually 6; d=21 in this embodiment) through pointwise convolution (1x1 convolution), enhancing the feature expression capability; the original channel is mapped to a higher-dimensional space through txd 1x1 convolution kernels.

[0093] Deep convolution layer: used for independent convolution operation on each channel to extract local features. Using left and right padding of 1 column of zero, i.e. padding=(0,1), to keep the output the same width as the input, at this time the output tensor is [1, 126, 1, 21].

[0094] Channel compression layer: the channel is compressed again through pointwise convolution, and the channel number is compressed to 21 through 1x1 convolution, i.e. [1, 21, 1, 21];

[0095] The output of the third inverted residual module is the output of the feature learning layer, and the output form is a tensor of [1, 21, 1, 21], containing high-order robust features as the direct input of the output layer;

[0096] Output layer: the output of the feature learning layer is averaged and pooled, and then a fully connected layer containing 128 nodes is used to further extract deep features; a Dropout layer is connected after the fully connected layer to prevent overfitting, and finally a Softmax function is used to output the classification probability distribution of each IP segment network behavior feature (credible "0", suspicious "1", malicious "2").

[0097] In the training process of the industrial control network security identification model, this embodiment uses a cross-entropy loss function and an Adam optimizer, the learning rate is initially set to 0.001, the training rounds are 100, and EarlyStopping is used to prevent overfitting.

[0098] This embodiment stacks three inverted residual modules to ensure that the gradient reaches the bottom layer and alleviate the gradient vanishing problem in deep networks. Specifically, by using residual structures with the same structure, features can be extracted evenly in each inverted residual module, ensuring the consistency and stability of feature learning. At the same time, each inverted residual module is connected through a residual connection to ensure that features can be effectively transmitted in the deep network, enhance the feature expression capability, and ensure that the gradient can be stably returned, thereby avoiding the gradient vanishing problem and improving the training efficiency and stability of the model in the deep network. In short, the inverted residual modules with the same structure make the model training more simplified and can also improve the generalization ability of the model.

[0099] Step 4: The trained industrial control network security recognition model is deployed to the front-end filtering module of the digital twin security target range. The real-time network behavior data of each IP segment is identified, and the classification results of the real-time input data are output.

[0100] In this embodiment, the maximum output probability of the industrial control network security recognition model is used as the category corresponding to the real-time network behavior data of each IP segment.

[0101] When the category of the real-time network behavior data is trusted, it can be directly sent to the subsequent digital twin security target range for use.

[0102] When the category of the real-time network behavior data is suspicious, the data connection between the IP segment and the subsequent digital twin security target range is suspended, and the secondary judgment mechanism is performed on the IP segment.

[0103] When the category of the real-time network behavior data is malicious, it is directly discarded.

[0104] The secondary judgment mechanism includes the following steps:

[0105] For suspicious category network data corresponding to the IP segment, step 2 is performed, that is, the network behavior data is continuously collected and the network behavior features after dimension reduction are obtained; the IP segment label bit is replaced with the softmax output probability value of the "suspicious category network data", and the network behavior features are spliced to serve as the input of the industrial control network security recognition model for identification.

[0106] If the identification results of the K-k+1 to K rounds are all "trusted" after the secondary judgment mechanism of the set K rounds, the data connection between the IP segment and the subsequent digital twin security target range is restored, otherwise the subsequent network behavior data of the IP is automatically discarded.

[0107] In the K-round secondary judgment mechanism, the IP segment label bit of each round is replaced with the softmax output probability value obtained in the previous round.

[0108] Step 5: The simulation feedback results of the industrial control target range are used to optimize the training samples and update the labeling rules to form a closed-loop learning mechanism, which continuously improves the recognition accuracy and system robustness. Specifically:

[0109] When the digital twin simulation platform detects abnormal situations caused by misjudgment of the industrial control network security recognition model during simulation, such as control deviation or false alarms caused by incorrect classification of data, the corresponding feature samples are traced back and labeled as misjudgment samples.

[0110] The judgment basis of the control deviation is that when the misjudged trusted network behavior data enters the industrial control target field and triggers the preset control operation in the system, if the control operation has a significant deviation from the expected control logic (such as device start, stop, load control in the industrial control process), it is judged as a control deviation. Specifically:

[0111] When the industrial control network security identification model misjudges the network behavior data at a certain moment as trusted and allows it to enter the target field, but the network behavior data of the IP segment corresponding to the data shows abnormal communication characteristics, such as sudden change in communication frequency or abnormal data packet size, and causes abnormal start, stop or load abnormality of the device in the target field, it can be judged as a control deviation.

[0112] In short, if the network behavior data is judged as trusted, and the control behavior it causes in the target field deviates from the predetermined behavior rule beyond the error tolerance range, it is a control deviation. The feature sample corresponding to the network behavior data is traced back and marked as a misjudged sample.

[0113] The judgment basis of the false alarm is that when the industrial control network security identification model judges the network behavior data at a certain moment as malicious and performs a discard operation, the IP segment to which the network behavior data belongs is continuously monitored for a certain period of time; if the subsequent network behavior data of the IP segment is all trusted data and does not introduce any abnormality or trigger any alarm mechanism in the target field. Analyze the communication behavior characteristics of the IP segment, including but not limited to communication rules, request frequency, port access. If no malicious behavior characteristics are found, it can be judged as a false alarm.

[0114] In short, if the network behavior data is judged as malicious and discarded, but the subsequent network behavior data of the IP segment it belongs to is all trusted, does not cause abnormality in the target field, and does not have malicious behavior characteristics, it is a false alarm. The feature sample corresponding to the network behavior data is traced back and marked as a misjudged sample.

[0115] For example, the network behavior data is misjudged as malicious by the industrial control network security identification model, but the actual data shows periodicity, protocol field integrity, and reasonable response logic, and the IP segment label is updated. The re-labeled sample will be supplemented to the training set for model incremental training or periodic retraining to further optimize the classification boundary of the industrial control network security identification model and enhance the recognition ability and generalization performance of the edge samples.

[0116] Meanwhile, the statistical characteristics of the IP segments of these misjudged samples are analyzed, such as the distribution of their access frequency, historical alarm frequency, and behavior anomaly indicators. If it is found that a certain type of misjudged sample generally has the commonality of "high access frequency but low alarm frequency", the weight a of the access frequency indicator in the scoring function will be reduced, and the weights of the alarm-related indicators β or γ will be increased, so as to adaptively adjust the parameter combination in the IP tagging rule, so that the risk scoring function can better reflect the actual risk characteristics.

[0117] For example, suppose that within 72 consecutive hours of operation, a batch of network behavior data is determined by the industrial control network security identification model to be "malicious" data and discarded, but no security event is triggered in the simulation platform. However, the IP segment corresponding to this batch of network behavior data exhibits high access frequency (e.g., more than 300 times per hour); almost zero historical alarm triggering frequency; no high-risk ports, no abnormal burst traffic, etc. According to the scoring function, if the weight a is large in the initial setting, this IP segment may be misjudged as high-risk. Then reduce the value of a, for example, from 0.5 to 0.2, and correspondingly increase the proportion of β and γ, so that the tagging result is more consistent with the actual performance, thereby improving the classification accuracy of the network behavior data of these IP segments in the subsequent industrial control security identification model.

[0118] It should be noted that for adaptive adjustment of the weight combination in the IP tagging rule, the present embodiment proposes two ways: the first is to analyze the statistical characteristics of the IP segment to which the misjudged sample belongs, and the second is the periodic maintenance of the ridge regression model in step 1; when the two conflict in time, the adjustment result of the first is used as the criterion.

[0119] Finally, this "misjudgment identification - sample backflow - parameter readjustment" process constitutes a dynamic evolution scoring and discrimination mechanism, ensuring that the system continuously improves discrimination accuracy, reduces false positives, and enhances long-term adaptive ability in complex industrial environments.

[0120] As an optional embodiment, the present application uses the filtered network behavior data to output a digital twin model to perform control process simulation, security event reproduction, and policy effectiveness verification.

[0121] The digital twin simulation platform is built based on the existing industrial control system architecture and can support real-time data interaction and dynamic simulation.

[0122] The modeling method and details are as follows: the physical model is constructed according to the physical parameters and operation logic of the actual industrial equipment, including sensors, controllers, and actuators, etc.

[0123] The virtual model is mapped to the virtual environment through digital twin technology, realizing real-time simulation of the running state of the equipment.

[0124] In terms of data driving, the simulation platform is driven by real-time collected real data, which has been filtered by the industrial control network security identification model, ensuring the credibility and accuracy of the data.

[0125] The digital twin simulation platform supports real-time data updating and simulation, and can reflect the running state of the industrial control system in real time.

[0126] The trusted data filtered by the industrial control network security identification model is input into the digital twin model simulation platform. The simulation platform simulates the running state of the industrial control system according to the input data, including device operation, network communication and security events, etc. Then, various network attack scenarios are simulated in the simulation environment to evaluate the vulnerability and response capability of the system. According to the simulation results, the security policy is verified and optimized to improve the defense capability of the system. Finally, the simulation results and evaluation report are fed back for further optimization of system configuration and security policy

[0127] Embodiment two

[0128] The embodiment provides a data filtering system for a digital twin industrial control security range, which executes the specific implementation of the data filtering method as described in embodiment one, and the system comprises:

[0129] An IP segment marking module is used to segment the IP addresses of the industrial control system network, and mark each IP segment according to the network behavior of the IP segment to obtain the corresponding IP segment label.

[0130] A sample construction module is used to extract features from the network behavior data of each IP segment, and splice the features after dimension reduction with the corresponding IP segment label as a feature sample for constructing an industrial control network security identification model.

[0131] An identification model training module is used to construct an industrial control network security identification model, which uses multiple inverted residual modules with the same structure as the core construction unit to extract and learn the network behavior features in the feature sample and perform classification training.

[0132] A data filtering module is used to deploy the trained industrial control network security identification model to the front-end filtering module of the digital twin industrial control security range, and perform classification and identification filtering on the real-time network behavior data flowing into each IP segment.

[0133] A feedback optimization module is used to capture misclassified network behavior data and update the IP segment marking rules.

[0134] The embodiment discloses a DT industrial control security target based on a filtering platform suitable for a power information system. By introducing an IP marking mechanism and a deep learning filtering model, efficient identification and filtering of false data are realized, and the accuracy and robustness of digital twin simulation are significantly improved. The system intelligently identifies multi-dimensional network behavior characteristics through a CNN model, and forms a data closed loop with a digital twin engine, effectively reducing false positives and interference, and providing reliable data support for the security simulation of industrial control systems. The scheme has good expansibility and self-adaptability, and can be widely applied to key scenes such as industrial security testing, situation simulation, attack reproduction, etc.

[0135] The above only describes the embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application is included in the protection scope of the present application.

Claims

1. A data filtering method for a digital twin industrial control security range, characterized in that, The method comprises the following steps: segmenting IP addresses of an industrial control system network, and marking each IP segment according to network behaviors of the IP segment to obtain corresponding IP segment labels; extracting features of network behaviors of each IP segment, and splicing the features after dimension reduction with the corresponding IP segment labels as feature samples for constructing an industrial network security recognition model; constructing the industrial network security recognition model by using multiple inverted residual modules with the same structure as core construction units to extract and learn network behavior features in the feature samples and perform classification training; deploying the trained industrial network security recognition model to a front-end filtering module of a digital twin industrial security target range to perform classification and identification filtering on real-time network behavior data of each IP segment; grabbing misclassified network behavior data and performing analysis to update IP segment marking rules.

2. The data filtering method for digital twin industrial control safety target field according to claim 1, wherein, The step of obtaining the IP segment label comprises: obtaining access frequency, historical alarm times and network behaviors of each IP segment; According to the access frequency statistics, the communication frequency f between the i-th IP segment and the host in a unit time i , the communication frequency f i , and the ratio of its ranking in the communication frequency of all N IP segments, the access frequency score of the i-th IP segment is obtained; The number of alarms triggered by the i-th IP segment in a set time window is counted from the historical alarm number a i The historical alarm number of the i-th IP segment is normalized by the ratio of the maximum alarm number in all N IP segments i The normalized value of the historical alarm number of the i-th IP segment is obtained extracting abnormal features of the network behaviors, and performing weighted calculation on all abnormal features in the i-th IP segment to obtain a behavior abnormality score of the i-th IP segment.

3. The data filtering method for the digital twin industrial security target range according to claim 2, wherein: the risk score of the IP segment is calculated by a linear model based on the score of the access frequency, the normalized value of the historical alarm times and the behavior abnormality score, and is expressed as: where S ip (i) represents the risk score of the i-th IP segment, R freq (i), T alert (i), and C abn (i) are the access frequency score, the historical alarm number normalized value, and the behavior anomaly score of the i-th IP segment, respectively; ε is an error term; α, β, and γ are weight coefficients of R freq (i), T alert (i), and C abn (i), respectively. The risk score S according to the i-th IP segment ip The i-th IP segment is labeled by the value of (i) and the segment label threshold set by the contrast.

4. The data filtering method for the digital twin industrial security target range according to claim 1, wherein: the industrial network security recognition model comprises an input layer, a feature learning layer and an output layer; the feature learning layer adopts a lightweight convolutional neural network with three stacked inverted residual modules; the first layer of inverted residual modules is used to convert the feature samples into time sequence features to form primary features with preliminary time sequence expression ability; the second layer of inverted residual modules takes the primary features output by the first layer as input, combines the primary features to generate complex pattern representations, and the third layer of inverted residual modules takes the complex pattern representations output by the second layer as input, extracts robust features and suppresses noise.

5. The data filtering method for the digital twin industrial security target range according to claim 1, wherein: the real-time network behavior data of each IP segment is classified and identified for filtering; the maximum value of the probability distribution output by the output layer of the industrial network security recognition model is taken as the corresponding category of the real-time network behavior data of each IP segment, including trusted, suspicious and malicious; if the category of the real-time network behavior data is trusted, the data is sent to the digital twin security target range as simulation data; if the category of the real-time network behavior data is malicious, the data is discarded; if the category of the real-time network behavior data is suspicious, the data connection between the IP segment to which the real-time network behavior data belongs and the digital twin security target range is suspended, and a secondary judgment mechanism is performed on the IP segment.

6. The data filtering method for digital twin industrial control security target field according to claim 5, wherein, The secondary judgment mechanism comprises the following steps: continuously collecting network behavior data and extracting features of the IP segment to which the real-time network behavior data belongs. In the construction of the feature sample, the IP segment label is replaced by the probability value of the suspicious category; the reconstructed feature sample is input into the industrial control network security recognition model for recognition; If the recognition results of the K-k+1 to K rounds are all "trusted" after the set K rounds of secondary judgment mechanism, the data connection of the IP segment and the digital twin security range is restored, otherwise the subsequent network behavior data of the IP segment is automatically discarded; In the K rounds of secondary judgment mechanism, the IP segment label bit of each round is replaced by the probability value of the suspicious category obtained in the last round.

7. The data filtering method for digital twin industrial control security target field of claim 1, wherein, The misclassified network behavior data is captured from the target simulation process, including: The misclassification judgment includes control deviation and false alarm; If the network behavior data is judged to be trusted, and the control behavior triggered by it in the range deviates from the predetermined behavior rule beyond the error tolerance range, it is a control deviation; If the network behavior data is judged to be malicious and discarded, but the subsequent network behavior data of the IP segment is all trusted, does not cause abnormal characteristics of the range, and does not exist malicious behavior characteristics, it is a false alarm; The feature sample corresponding to the misclassified network behavior data is traced back and marked as a misjudgment sample.

8. The data filtering method for the digital twin industrial control security range according to claim 7, characterized in that, The IP segment label of the misjudgment sample is corrected, and the statistical characteristics of the IP segment are inducted and analyzed, including access frequency, historical alarm times and network behavior; According to the performance of the statistical characteristics of the IP segment of all misjudgment samples, the weight coefficients of the access frequency score, the historical alarm times normalized value and the behavior anomaly score in the linear model are adjusted.

9. A data filtering system for a digital twin industrial control security range, running the data filtering method of any one of claims 1-8, characterized in that, The system comprises: An IP segment labeling module; for segmenting the IP addresses of the industrial control system network, and labeling the IP segments according to the network behavior of each IP segment to obtain the corresponding IP segment label; A sample construction module; for extracting features from the network behavior data of each IP segment, and splicing the corresponding IP segment label after dimension reduction as a feature sample for constructing an industrial control network security recognition model; An identification model training module; for constructing an industrial control network security recognition model, using multiple inverted residual modules with the same structure as the core construction unit to extract and learn the network behavior characteristics in the feature sample and perform classification training; A data filtering module; for deploying the trained industrial control network security recognition model to the front-end filtering module of the digital twin industrial control security range, and classifying and identifying the real-time network behavior data of each IP segment; A feedback optimization module; for capturing misclassified network behavior data and updating the IP segment labeling rules.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is loaded into the processor to realize the data filtering method according to any one of claims 1-8. The computer program is loaded into the processor to realize the data filtering method according to any one of claims 1-8.

Images