Industrial data security protection method and system

Abstract

This application relates to the field of intrusion detection technology through monitoring programs, and particularly to a method and system for industrial data security protection. The industrial data security protection method includes the following steps: collecting metadata information of data packets in an industrial network; identifying different industrial devices based on the metadata information, and calculating the time-domain relative metric and the sequence-domain relative metric for each device in parallel according to the metadata information; establishing the baseline distribution of each device in the time domain and the sequence-domain; calculating the time-domain anomaly metric and the sequence-domain anomaly metric based on the time-domain relative metric, the sequence-domain relative metric, and their respective baseline distributions; selecting a judgment domain based on the comparison results of the time-domain anomaly metric and the sequence-domain anomaly metric; performing anomaly detection within the selected judgment domain, and determining a network attack when the detection result meets the alarm conditions. This application can better guarantee the authenticity and availability of industrial data.

Description

Technical Field

[0001] This application relates to the field of intrusion detection technology through monitoring programs, and in particular to a method and system for industrial data security protection. Background Technology

[0002] Traditional industrial control systems were not designed with external network access in mind. However, with the increasing demand for enterprise information technology and the widespread adoption of remote maintenance, more and more industrial networks are connecting to new control devices. This has led to industrial equipment that was not originally designed with data security in mind starting to connect to enterprise intranets and the Internet, thus exposing older industrial equipment to cyberattacks.

[0003] In industrial environments where old and new equipment coexist, older equipment typically uses local clocks, which have low accuracy and significant jitter. Modern industrial equipment, on the other hand, generally supports time protocols such as NTP, offering higher clock accuracy and faster response times. Communication between old and new equipment requires conversion through protocol gateways. These gateways, during data format conversion, further amplify existing time differences, creating a complex heterogeneous time domain.

[0004] Cyber ​​attackers can exploit these temporal differences to launch attacks. By observing the timing characteristics of different devices, attackers can launch attacks during periods of high network jitter, masking the timing anomalies of malicious data packets with normal device jitter. For example, attackers can insert forged control commands when older devices have significant response delays, or exploit the timing differences between new and old devices to perform replay attacks, disguising expired data packets as the latest control information. This allows such attacks to bypass newly added security mechanisms even when the output data of older industrial equipment is encrypted, simply through timing manipulation.

[0005] Existing solutions primarily rely on deep packet inspection technology, which identifies attack behavior by analyzing packet payload content. However, this approach faces compliance limitations in industrial environments. This is because data in industrial control systems often involves sensitive information such as production process parameters and equipment status data, requiring that reading and storing this payload data be avoided.

[0006] Therefore, existing technologies cannot effectively identify and protect against network attacks that exploit the time-domain heterogeneity in an environment where new and old equipment coexist, relying solely on metadata information of data packets (such as timestamps, sequence numbers, directions, and other non-sensitive information), and cannot guarantee the authenticity and availability of industrial data. Summary of the Invention

[0007] To address, or at least partially address, the aforementioned technical problems, this application provides an industrial data security protection method and system that can better guarantee the authenticity and availability of industrial data.

[0008] Firstly, this application provides an industrial data security protection method, which includes the following steps:

[0009] Collect metadata information of data packets in industrial networks;

[0010] Different industrial equipment is identified based on the metadata information, and the time domain relative metric and the sequence number domain relative metric of each equipment are calculated in parallel based on the metadata information.

[0011] Establish baseline distributions of each device in the time and sequence number domains;

[0012] The time-domain anomaly metric and the sequence-domain anomaly metric are calculated based on the time-domain relative metric, the sequence-domain relative metric, and their respective baseline distributions.

[0013] The judgment domain is selected based on the comparison results of the time domain anomaly measurement index and the sequence number domain anomaly measurement index.

[0014] Anomaly detection is performed within the selected judgment domain, and when the detection result meets the alarm conditions, it is determined to be a network attack.

[0015] Secondly, this application provides an industrial data security protection method, which collects data packets passing through the protocol conversion gateway between new and old equipment, and extracts the timestamp, sequence number and source IP address of the data packets;

[0016] Identify the industrial equipment to which the data packet belongs based on its source IP address, and calculate the Inter-Arrival Time (IAT) between adjacent data packets from the same equipment based on the timestamp.

[0017] For each industrial device, the time domain relative metric and the sequence number domain relative metric are calculated in parallel. The time domain relative metric is the difference in IAT between the current data packet and the previous data packet of the device, and the sequence number domain relative metric is the difference in sequence number between the current data packet and the previous data packet of the device.

[0018] During the preset learning period, collect the time-domain relative metric and the ordinal domain relative metric for each device, and establish their respective baseline probability density distributions to obtain the baseline distributions in the time domain and the ordinal domain respectively.

[0019] Calculate the likelihood values ​​of the current time domain relative measure and the ordinal domain relative measure in the baseline distribution, and obtain the time domain surprise and ordinal domain surprise respectively, which can be used as the time domain anomaly measure index and the ordinal domain anomaly measure index respectively.

[0020] Calculate the absolute value of the difference between the surprise index in the time domain and the surprise index in the ordinal domain;

[0021] When the absolute value of the difference exceeds the surprise threshold, and the surprise in the time domain is greater than the surprise in the sequence domain, the judgment domain is set to the sequence domain.

[0022] Otherwise, set the decision domain to the time domain;

[0023] The judgment is made based on the indicators used to characterize anomalies in the current judgment domain. When the judgment result meets the corresponding preset alarm conditions, it is judged as a network attack.

[0024] Optionally, making a determination based on the indicators used to characterize anomalies in the current judgment domain includes the following steps:

[0025] When the decision domain is the time domain:

[0026] Based on the arrival interval (IAT) of adjacent data packets from the same device collected during the preset learning period, the baseline control period of the device is extracted through frequency domain analysis.

[0027] Centered on the timestamp of the data packet that triggers the anomaly, an anomaly determination time window is defined, and the length of the anomaly determination time window is adjusted to an integer multiple of the baseline control period to form a control period shaping window;

[0028] Within the control cycle shaping window, the arrival intervals (IATs) of adjacent data packets of the current device are arranged in chronological order to form the IAT change sequence of the device within the control cycle shaping window;

[0029] Each arrival interval (IAT) in the IAT variation sequence is compared with the jitter baseline of the device. The arrival intervals (IAT) with fluctuations within the jitter tolerance range are replaced with the baseline standard value, while the arrival intervals (IAT) exceeding the jitter tolerance range are kept at their original values ​​to output the jitter-normalized timing pattern.

[0030] The normalized temporal pattern is matched with a preset temporal domain attack fingerprint database.

[0031] When a match is successful and the match confidence exceeds a preset threshold, it is determined to be a network attack.

[0032] Optionally, making a determination based on the indicators used to characterize anomalies in the current judgment domain also includes the following steps:

[0033] When the decision field is a sequence number field:

[0034] Based on the sequence number increment pattern of adjacent data packets from the same device collected during the preset learning period, establish a normal sequence number increment baseline for the device.

[0035] Set the preset length of the serial number field analysis window;

[0036] Within the sequence number field analysis window, the sequence numbers of adjacent data packets of the current device are extracted in chronological order to form a sequence of sequence number changes for the device within the sequence number field analysis window.

[0037] The sequence of changing numbers is compared with the normal sequence number increment baseline to detect abnormal sequence number patterns such as sequence number jumps, sequence number rollbacks, sequence number repetitions, or unexpected sequence number increments.

[0038] When an abnormal sequence number pattern is detected, it is directly identified as a network attack.

[0039] Optionally, during a preset learning period, time-domain relative metrics and ordinal-domain relative metrics are collected for each device to establish their respective baseline probability density distributions, including the following steps:

[0040] Collect time-domain relative metric samples and sequence-domain relative metric samples for each industrial device within a preset learning period;

[0041] Kernel density estimation is performed on the time-domain relative metric samples to establish a time-domain baseline probability density function;

[0042] The empirical distribution function is estimated for the relative metric samples in the sequence domain, and the discrete values ​​are processed by the median allocation method to establish the baseline probability density function of the sequence domain.

[0043] Optionally, the likelihood values ​​of the current time-domain relative measure and the ordinal-domain relative measure in the baseline distribution are calculated respectively to obtain the time-domain surprise and the ordinal-domain surprise, including the following steps:

[0044] Input the current time domain relative metric into the corresponding time domain baseline probability density function to calculate the probability density Pt of the current time domain relative metric;

[0045] Calculate the time-domain surprise S t =-log(P t );

[0046] Input the relative metric of the current index domain into the corresponding index domain baseline probability density function, and calculate the probability density P of the relative metric of the current index domain. seq ;

[0047] Calculate the surprise level S of the serial number domain seq =-log(P seq ).

[0048] Optionally, the surprise threshold is obtained through the following steps:

[0049] Within the preset learning period, calculate a sample set of absolute values ​​of the difference between the time domain surprise and the ordinal domain surprise for each industrial device;

[0050] Perform statistical analysis on the sample set of absolute differences and calculate its quantile distribution;

[0051] Based on the preset false alarm tolerance rate, select the corresponding quantile as the initial surprise threshold for the device;

[0052] During operation, a sliding window method is used to continuously collect new surprise difference samples;

[0053] When the number of samples in the sliding window reaches the preset update threshold, the quantile distribution is recalculated and the surprise threshold is updated.

[0054] Thirdly, this application proposes an industrial data security protection system, the system including a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the industrial data security protection method as described in either the first or second aspect.

[0055] The technical solution provided in this application has the following advantages compared with the prior art:

[0056] Its beneficial effects and working principle are as follows:

[0057] In industrial environments where old and new equipment coexist, the timing characteristics of cyberattacks overlap with the timing characteristics of differences in normal equipment.

[0058] Due to hardware aging and local clock drift, older devices exhibit a long-tailed distribution in their Inter-Arrival Time (IAT) differences. Detection methods using time-domain relative metrics (IAT differences) are highly sensitive to network jitter and device performance differences, potentially leading to false alarms in environments where old and new devices coexist.

[0059] When older devices experience increased response latency due to load changes, simple time-domain detection may misinterpret this as a slow denial-of-service attack. Similarly, buffer queue latency fluctuations caused by protocol conversions at the gateway can be misinterpreted as timing attacks, leading to the discarding of genuine industrial data packets or compromising their authenticity. However, increasing the detection threshold to reduce false alarms can result in missed attacks, creating a dilemma.

[0060] While the relative sequence number metric (sequence number difference) is insensitive to jitter caused by time delay, it has a blind spot for attacks that manipulate timing without changing the packet sequence number. Attackers can control the timing of packet transmission to launch attacks without violating the monotonicity of sequence numbers, such as exploiting time window attacks by taking advantage of the response latency differences between old and new devices.

[0061] This technical solution collects data packet metadata at the protocol conversion gateway, establishes two sets of relative measurement systems in parallel for each device, namely the time domain and the sequence number domain, collects historical data of each device during the preset learning period to establish an individualized baseline probability density distribution, and then obtains the surprise index by calculating the likelihood value of the current observation in the baseline distribution. Finally, adaptive domain switching is achieved based on the difference between the surprise in the two domains.

[0062] Its working principle is that the surprise level reflects the degree of anomaly of the current observation in the historical baseline distribution. When the surprise level in the time domain is much greater than that in the sequence domain, it indicates that the current time feature anomaly is mainly caused by environmental factors such as network congestion or changes in device load, rather than malicious network attacks. In this case, the detection is switched to the sequence domain, which is less sensitive to jitter. When the surprise levels in the two domains are similar, it indicates that the changes in time and sequence features are consistent. In this case, the time domain, which is more sensitive to time-series anomalies, is used for detection. This ensures that the optimal detection strategy under the current environment is always dynamically selected and used.

[0063] Therefore, this application can significantly reduce the false alarm rate, avoid false alarms caused by environmental noise through the domain switching mechanism, dynamically select the most sensitive detection domain during judgment, improve the detection rate of real attacks, avoid the industrial data being discarded due to the misjudgment of real industrial data as attacks, and improve the authenticity and usability of industrial data. Attached Figure Description

[0064] Figure 1 A flowchart illustrating the industrial data security protection method provided in this application embodiment. Detailed Implementation

[0065] The technical solutions in this application will now be described with reference to the accompanying drawings.

[0066] Many specific details are set forth in the following description to provide a thorough understanding of this application, but this application may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some embodiments of this application, and not all embodiments. It should be noted that, unless otherwise specified, the embodiments of this application and the features in the embodiments can be combined with each other.

[0067] like Figure 1 As shown, this application provides an industrial data security protection method, which includes the following steps:

[0068] S101: Collect data packets passing through the protocol conversion gateway between the old and new devices, and extract the timestamp, sequence number, and source IP address of the data packets;

[0069] The industrial equipment to which the data packet belongs is identified based on the source IP address of the data packet, and the Inter-Arrival Time (IAT) of adjacent data packets of the same industrial equipment is calculated based on the timestamp.

[0070] Specifically, the protocol conversion gateway is used to connect older PLC systems and newer smart sensor networks. The gateway performs protocol conversion and is the essential pathway for communication between old and new devices, essentially serving as the main entry and exit point for the entire PLC control system.

[0071] In this embodiment, by configuring a mirror port on the network switch of the protocol conversion gateway of the old device, all bidirectional traffic passing through the gateway is copied to the monitoring device, so as to simultaneously monitor all communication data packets of the old and new devices.

[0072] By establishing a mapping table from IP address to device identifier, the source industrial device that sent the current data packet can be identified based on the source IP address of the data packet.

[0073] When a new data packet is received, the difference between the current timestamp of the device corresponding to the data packet and the timestamp of the previous data packet of the device is calculated, which is the arrival interval (IAT).

[0074] S102: For each industrial device, calculate the time domain relative metric and the sequence number domain relative metric in parallel. The time domain relative metric is the IAT difference between the current data packet and the previous data packet of the device, and the sequence number domain relative metric is the sequence number difference between the current data packet and the previous data packet of the device.

[0075] Specifically, in the embodiments of this application, when a new data packet arrives, the time domain relative metric (the difference between the current IAT and the previous IAT) and the sequence number domain relative metric (the difference between the current sequence number and the previous sequence number) are calculated simultaneously.

[0076] S103: Collect time-domain relative metrics and serial number-domain relative metrics for each device during the preset learning period, and establish their respective baseline probability density distributions.

[0077] Specifically, during the preset learning period, time-domain relative metrics and ordinal-domain relative metrics are collected for each device to establish their respective baseline probability density distributions, including the following steps:

[0078] Collect time-domain relative measurement samples (i.e., all time-domain relative measurements within the preset learning period) and sequence-domain relative measurement samples (i.e., all sequence-domain relative measurements within the preset learning period) for each industrial device within the preset learning period.

[0079] Kernel density estimation is performed on the time-domain relative metric samples to establish a time-domain baseline probability density function;

[0080] The empirical distribution function is estimated for the relative metric samples in the sequence domain, and the discrete values ​​are processed by the median allocation method to establish the baseline probability density function of the sequence domain.

[0081] Specifically, in this embodiment, the industrial network is disconnected from the external internet during a preset learning period to ensure the learning process is not interfered with by external attacks. This ensures that the initially collected baseline data comes entirely from normal internal device communication and does not contain any external attack traffic.

[0082] In this embodiment of the application, the preset learning period is 24 hours, and this period can be adjusted based on the experience of the staff.

[0083] During the preset learning period, two-domain relative metric samples are continuously collected from each device.

[0084] The process of constructing the time-domain baseline probability density function is as follows:

[0085] Kernel density estimation is performed on the collected time-domain relative metric samples. Kernel density estimation requires a kernel function and a bandwidth parameter. In this embodiment, a Gaussian kernel function is used to construct a continuous probability density function. The bandwidth parameter is automatically selected using the Scott method to ensure that the probability density function captures the detailed features of the data without overfitting. The Scott method is an existing technique that can be implemented in Python by calling the `scipy.stats.gaussian_kde` function and setting the `bw_method=scott` parameter, or by leaving it at the default value.

[0086] The process of constructing the baseline probability density function for the sequence domain is as follows:

[0087] Empirical distribution function estimation is performed on the collected relative metric samples (i.e., index differences) in the index domain. First, the frequency of occurrence of each index difference is counted, and the empirical probability of each difference pattern is calculated. For index differences not observed during the learning period, a Laplace smoothing technique is used to assign a minimum probability value to ensure that subsequent probability calculations do not result in zero values.

[0088] Calculate the likelihood values ​​of the current time-domain relative measure and the ordinal-domain relative measure in the baseline distribution, and obtain the time-domain surprise and ordinal-domain surprise respectively.

[0089] Specifically:

[0090] Input the current time-domain relative metric into the corresponding time-domain baseline probability density function to calculate the probability density P of the current time-domain relative metric. t ;

[0091] Calculate the time-domain surprise S t =-log(P t);

[0092] Input the relative metric of the current index domain into the corresponding index domain baseline probability density function, and calculate the probability density P of the relative metric of the current index domain. seq ;

[0093] Calculate the surprise level S of the serial number domain seq =-log(P seq ).

[0094] In this embodiment, the Python function `numpy.log()` is used, and the base of the log function is assumed to be a natural constant. Those skilled in the art should understand that the purpose of using the log function is to employ a linear scaling method for data processing, and therefore it is not limited to a specific base. This is because there is a fixed linear conversion relationship between the logarithms of different bases, and therefore using other bases does not affect the anomaly detection logic.

[0095] S104: Calculate the absolute value of the difference between the surprise index in the time domain and the surprise index in the ordinal domain, i.e., |S t -S seq |;

[0096] When the absolute value of the difference exceeds the surprise threshold, and the surprise in the time domain is greater than the surprise in the sequence domain, the judgment domain is set to the sequence domain.

[0097] Otherwise, set the decision domain to the time domain.

[0098] Specifically, the surprise threshold is obtained through the following steps:

[0099] Within the preset learning period, calculate a sample set of absolute values ​​of the difference between the time domain surprise and the ordinal domain surprise for each industrial device;

[0100] Perform statistical analysis on the sample set of absolute differences and calculate its quantile distribution;

[0101] Specifically:

[0102] The absolute value samples of the differences are sorted, and each quantile is calculated using linear interpolation.

[0103] The formula for calculating quantiles is:

[0104] The kth quantile corresponds to the value at the (k / 100×n)th position after sorting, where n is the total number of samples.

[0105] The value of k depends on the false alarm tolerance rate set manually. For example, the 98th quantile corresponds to k=98, and the false alarm tolerance rate is 2%.

[0106] In quantile calculation, k represents the percentile value. For the Pk quantile, k ranges from 0 to 100. To calculate the k-th quantile, its position index in the sorted sample is first determined: position = (k / 100) × (n-1) + 1, where n is the total number of samples. When the position is not an integer, linear interpolation is used to calculate between two adjacent sample values.

[0107] Based on the preset false alarm tolerance rate, select the corresponding quantile as the initial surprise threshold for the device;

[0108] During operation, a sliding window method is used to continuously collect new surprise difference samples;

[0109] When the number of samples in the sliding window reaches the preset update threshold, the quantile distribution is recalculated and the surprise threshold is updated.

[0110] S105: Make a judgment based on the indicators used to characterize anomalies in the current judgment domain. When the judgment result meets the corresponding preset alarm conditions, it is judged as a network attack.

[0111] Specifically, when the decision domain is the time domain:

[0112] Based on the arrival interval (IAT) of adjacent data packets from the same device collected during the preset learning period, the baseline control period of the device is extracted through frequency domain analysis.

[0113] Specifically, the IAT data collected during the preset learning period is analyzed by Fast Fourier Transform (FFT), and the dominant frequency components are found through power spectral density analysis. The corresponding period is the baseline control period of the device.

[0114] Centered on the timestamp of the data packet that triggers the exception, an exception determination time window is defined, and the length of the exception determination time window is adjusted to an integer multiple of the baseline control period to form a control period shaping window.

[0115] Specifically, when S104 detects that the surprise difference of a data packet exceeds the threshold, it defines an initial anomaly determination time window by extending the device's baseline control cycle by 1.5 times both forward and backward, using the timestamp of the triggering data packet as the center point. Then, it divides the length of the initial anomaly determination time window by the baseline control cycle and rounds up to obtain the cycle multiple. Finally, it multiplies the cycle multiple by the baseline control cycle to obtain the final control cycle shaping window length.

[0116] The purpose of this step is to align the start time of the window with the nearest control cycle boundary, ensuring that the analysis window is synchronized with the device's operating cycle.

[0117] Within the control cycle shaping window, the arrival intervals (IATs) of adjacent data packets of the current device are arranged in chronological order to form the IAT change sequence of the device within the control cycle shaping window;

[0118] Specifically, within a defined control period shaping window, all data packets of the device are extracted in ascending order of timestamp, the arrival interval between adjacent data packets is calculated, and a continuous IAT sequence is formed.

[0119] Each arrival interval (IAT) in the IAT variation sequence is compared with the jitter baseline of the device. The arrival intervals (IAT) with fluctuations within the jitter tolerance range are replaced with the baseline standard value, while the arrival intervals (IAT) exceeding the jitter tolerance range are kept at their original values ​​to output the jitter-normalized timing pattern.

[0120] Specifically, the jitter baseline is established using the Median Absolute Deviation (MAD) method.

[0121] MAD=median(|IAT-median(IAT)|)

[0122] The formula for calculating the median absolute deviation (MAD) is an existing technique, and median() represents the median function, which is used to return the median.

[0123] The tolerance range was set at the baseline median ± 2.5 × MAD.

[0124] For each value in the IAT sequence, calculate its deviation from the baseline median. If the deviation is within the tolerance range, replace it with the baseline median; otherwise, keep the original value as an outlier.

[0125] The normalized temporal pattern is matched with a preset temporal domain attack fingerprint database.

[0126] When a match is successful and the match confidence exceeds a preset threshold, it is determined to be a network attack.

[0127] Specifically, the temporal attack fingerprint database stores temporal feature templates for various known attacks. Each template contains a standardized temporal pattern and a matching threshold. A dynamic time warping algorithm is used to calculate the similarity between the normalized temporal pattern and each fingerprint template, and the matching result with the highest similarity is selected. When the highest similarity exceeds a preset threshold, it is determined to be a network attack of the corresponding type.

[0128] When the decision field is a sequence number field:

[0129] Based on the sequence number increment pattern of adjacent data packets from the same device collected during the preset learning period, establish a normal sequence number increment baseline for the device.

[0130] Specifically, during the preset learning period, the serial number increment pattern of each device is statistically analyzed, and the distribution characteristics of the serial number difference are analyzed.

[0131] Establishing a normal sequence number increment baseline includes: single-step increment ratio (frequency of Δseq=+1) and batch operation ratio (frequency of Δseq=+2 to +5).

[0132] Set the preset length of the serial number field analysis window;

[0133] Specifically, the sequence number field analysis window length is a manually set value, typically between 10 and 20. This value is set only to ensure that there are enough samples to detect anomalies in the sequence number pattern.

[0134] Within the sequence number field analysis window, the sequence numbers of adjacent data packets of the current device are extracted in chronological order to form a sequence of sequence number changes for the device within the sequence number field analysis window.

[0135] Specifically, starting from the current abnormal data packet, we trace back and collect the sequence numbers of the N most recent data packets of the device (N is the length of the sequence number field analysis window).

[0136] Arrange these numbers in chronological order, calculate the difference between adjacent numbers, and form a sequence of number changes. Each element in the sequence represents the increment step of the number.

[0137] The sequence of changing numbers is compared with the normal sequence number increment baseline to detect abnormal sequence number patterns such as sequence number jumps, sequence number rollbacks, sequence number repetitions, or unexpected sequence number increments.

[0138] When an abnormal sequence number pattern is detected, it is directly identified as a network attack.

[0139] Specifically, the frequency of occurrence of various sequence number differences in the current sequence number change sequence is counted, and the actual ratio of single-step increment and batch operation is calculated.

[0140] Calculate the single-step increment ratio, batch operation ratio, and whether there is sequence number rollback (Δseq<0), sequence number repetition (Δseq=0), or sequence number jump (Δseq>+5) in the sequence.

[0141] A single-step increment ratio below 80% of the baseline is considered abnormal, and a batch operation ratio exceeding the baseline expectation by more than 3 times is also considered abnormal.

[0142] Any sequence number jump, sequence number rollback, or sequence number duplication is considered abnormal.

[0143] When any anomaly is detected, the alarm conditions are met, it is determined to be a network attack, and the data packet is dropped.

[0144] This application also proposes an industrial data security protection system, which includes a processor and a memory. The memory stores at least one instruction, at least one program, a code set, or an instruction set. The at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the industrial data security protection method as described in any of the above embodiments.

[0145] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. Moreover, in the description of the embodiments of this application, unless otherwise stated, " / " signifies "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist, for example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more.

[0146] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An industrial data security protection method, characterized by, The industrial data security protection method comprises the following steps: Collecting data packets passing through the gateway at the protocol conversion gateway between the old and new devices, extracting the time stamp, sequence number and source IP address of the data packet; Identifying the industrial device to which the data packet belongs according to the source IP address of the data packet, and calculating the arrival interval IAT of adjacent data packets of the same device based on the time stamp; Calculating the time domain relative measure and the sequence number domain relative measure of each industrial device in parallel, the time domain relative measure being the IAT difference value of the current data packet and the previous data packet of the device, and the sequence number domain relative measure being the sequence number difference value of the current data packet and the previous data packet of the device; Collecting the time domain relative measure and the sequence number domain relative measure of each device within a preset learning period, and establishing the respective baseline probability density distribution to obtain the baseline distribution of the time domain and the sequence number domain respectively; Calculating the likelihood value of the current time domain relative measure and the sequence number domain relative measure in the baseline distribution respectively to obtain the time domain surprise degree and the sequence number domain surprise degree respectively as the time domain anomaly measure index and the sequence number domain anomaly measure index respectively; Calculating the absolute value of the difference between the time domain surprise degree and the sequence number domain surprise degree; When the absolute value of the difference exceeds the surprise threshold, and the time domain surprise degree is greater than the sequence number domain surprise degree, setting the judgment domain as the sequence number domain; Otherwise, setting the judgment domain as the time domain; Based on the index for representing anomaly in the current judgment domain, making a judgment, and when the judgment result meets the corresponding preset alarm condition, determining a network attack.

2. The industrial data security protection method of claim 1, wherein, Based on the index for representing anomaly in the current judgment domain, making a judgment, and when the judgment result meets the corresponding preset alarm condition, determining a network attack. When the judgment domain is the time domain: According to the arrival interval IAT of adjacent data packets of the same device collected within the preset learning period, extracting the baseline control period of the device through frequency domain analysis; Centering on the time stamp of the data packet triggering the anomaly, defining an anomaly judgment time window, adjusting the length of the anomaly judgment time window to be an integer multiple of the baseline control period to form a control period shaping window; Within the control period shaping window, arranging the arrival interval IAT of adjacent data packets of the current device in time sequence to form the IAT change sequence of the device within the control period shaping window; Comparing each arrival interval IAT in the IAT change sequence with the jitter baseline of the device, replacing the arrival interval IAT within the jitter tolerance range with a baseline standard value, and keeping the arrival interval IAT exceeding the jitter tolerance range unchanged to output the jitter normalized time sequence mode; Matching the jitter normalized time sequence mode with a preset time domain attack fingerprint library; When the matching is successful and the matching confidence exceeds the preset threshold, determining a network attack.

3. The industrial data security protection method of claim 1, wherein, Based on the index for representing anomaly in the current judgment domain, making a judgment, and when the judgment result meets the corresponding preset alarm condition, determining a network attack. When the judgment domain is the sequence number domain: According to the sequence number incremental pattern of adjacent data packets of the same device collected within the preset learning period, establishing the normal sequence number incremental baseline of the device; Setting the length of a preset sequence number domain analysis window; Within the sequence number domain analysis window, extracting the sequence numbers of adjacent data packets of the current device in time sequence to form the sequence number change sequence of the device within the sequence number domain analysis window; comparing the sequence number change sequence with a normal sequence number increment baseline to detect sequence number anomaly patterns of sequence number jump, sequence number rollback, sequence number repetition or sequence number unexpected increment pattern; when detecting the sequence number anomaly pattern, directly determining as network attack.

4. The industrial data security protection method of claim 1, wherein, collecting time domain relative metrics and sequence number domain relative metrics of each device within a preset learning period, and establishing respective baseline probability density distributions, including the following steps: collecting time domain relative metric samples and sequence number domain relative metric samples of each industrial device within a preset learning period; performing kernel density estimation on the time domain relative metric samples to establish a time domain baseline probability density function; performing empirical distribution function estimation on the sequence number domain relative metric samples, and processing discrete values by median assignment method to establish a sequence number domain baseline probability density function.

5. The industrial data security protection method of claim 4, wherein, calculating the likelihood values of the current time domain relative metric and sequence number domain relative metric in the baseline distribution respectively to obtain time domain surprise degree and sequence number domain surprise degree, including the following steps: inputting a current time-domain relative metric into a corresponding time-domain baseline probability density function, calculating a probability density P of the current time-domain relative metric t ; Computing time-domain surprise S t = -log(P t ); inputting the current sequence number field relative metric into a corresponding sequence number field baseline probability density function, calculating a probability density P of the current sequence number field relative metric seq ; The sequence number field surprise S is calculated as seq = -log(P seq ).

6. The industrial data security protection method of claim 1, wherein, the surprise degree threshold is obtained by the following steps: within a preset learning period, calculating the absolute value sample set of the difference between the time domain surprise degree and the sequence number domain surprise degree for each industrial device; performing statistical analysis on the absolute value sample set to calculate its quantile distribution; according to the preset false alarm tolerance rate, selecting the corresponding quantile as the initial surprise degree threshold of the device; during the running period, continuously collecting new surprise degree difference samples in a sliding window manner; when the number of samples in the sliding window reaches the preset update threshold, recalculate the quantile distribution and update the surprise degree threshold.

7. An industrial data security protection system, characterized by, The system includes a processor and a memory, the memory stores at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to realize the industrial data security protection method as claimed in any one of claims 1-6.

Images