Intelligent attack prevention trapping method and system based on adversarial generation

Abstract

The invention discloses an intelligent attack prevention trapping method and system based on adversarial generation, and relates to the technical field of network security data processing. An original voiceprint signal substrate is constructed based on deep sea drilling platform coupling acoustic impedance characteristics; voiceprint characteristic data are fused to generate a sound wave propagation impedance value, and a deceptive sound wave time domain waveform equation is deduced in combination with historical sound wave parameters; the equation parameters are encoded into an industrial protocol format, attack sample data sets are synthesized and stored in a classified mode, trapping feature data are constructed through a dynamic confusion technology, and edge equipment verifies protocol field abnormity and signature validity according to the trapping feature data, triggers alarm in real time and drives attack samples to be updated; the effect of improving the network security attack prevention environment adaptability of the deep sea drilling platform edge computing equipment is achieved, and the problem that the network security attack prevention environment adaptability of the deep sea drilling platform edge computing equipment is insufficient in the prior art is solved.

Description

Technical Field

[0001] This invention relates to the field of network security data processing technology, and in particular to a method and system for trapping intelligent anti-attack based on adversarial generation. Background Technology

[0002] Against the backdrop of rapid development in information technology, efficient data processing and intelligent analysis have become core drivers for industry upgrading. Traditional technical methods rely heavily on manual rule construction and static model design. While these methods have solved fundamental problems to a certain extent, they often reveal bottlenecks such as poor scalability, high iteration costs, and insufficient decision-making accuracy when faced with new challenges such as massive heterogeneous data, increased real-time requirements, and adaptability to complex scenarios.

[0003] For example, the invention patent with announcement number CN117634501 B discloses a computer file confidentiality inspection method and system, which includes: based on deep learning, using a transformer algorithm and convolutional neural network, performing deep semantic analysis and key feature extraction on text and image content, and integrating feature data to generate text and image feature data. Through deep learning, transformer algorithms, and image processing technology, deep semantic analysis and key feature extraction of text and images are achieved. Combined with natural language processing and image recognition algorithms, the accuracy of identifying confidential information in files is improved, the false alarm rate and omission rate are reduced, an adversarial network simulation mechanism is generated to enhance the early warning capability for potential system security vulnerabilities and attack behaviors, data flow analysis methods improve the monitoring and prevention of data leakage, and blockchain technology is used for file integrity verification.

[0004] For example, the invention patent with publication number CN114616568A discloses a defense generator, method, and computer-readable storage medium for preventing attacks on AI units, including: determining the distribution function of model data. This application is based on the assumption that the model data belongs to the model manifold or has similar statistical behavior. Therefore, it is possible to determine whether the data in the input dataset can be associated with adversarial attacks. For example, if a statistical anomaly is found in the input dataset, it can be determined that the data in the input dataset can be associated with adversarial attacks.

[0005] However, in the process of implementing the inventive technical solution in the embodiments of this application, it was found that the above-mentioned technology has at least the following technical problems:

[0006] Existing network security protection technologies have several potential technical problems in edge computing scenarios on deep-sea drilling platforms. Protocol compliance verification and physical layer data authenticity verification are isolated from each other, allowing attackers to use acoustic sensor interference and the timing difference of protocol tampering to carry out escape attacks. Existing industrial protocol extension fields only perform format verification and do not convert geological constraints into protocol-level mathematical criteria, allowing physical layer attacks to penetrate protocol filtering mechanisms. Therefore, there is a problem of insufficient adaptability to network security attack prevention for edge computing devices on deep-sea drilling platforms. Summary of the Invention

[0007] This application provides an intelligent anti-attack trapping method and system based on adversarial generation, which solves the problem of insufficient adaptability of the prior art to the network security anti-attack environment of edge computing equipment on deep-sea drilling platforms, and achieves the effect of improving the network security anti-attack environment adaptability of edge computing equipment on deep-sea drilling platforms.

[0008] This application provides an intelligent attack prevention and trapping method based on adversarial generation, comprising the following steps: constructing an original acoustic signature signal substrate using the coupled acoustic impedance characteristics of a deep-sea drilling platform; performing training and transformation processing on the original acoustic signature signal substrate to obtain deep-sea drilling platform coupled acoustic wave induced attack data; performing dynamic obfuscation attack trapping processing on the deep-sea drilling platform coupled acoustic wave induced attack data to obtain dynamic obfuscation attack trapping feature data; the deep-sea drilling platform edge computing device performing attack prevention and trapping processing on the dynamic obfuscation attack trapping feature data and issuing an alarm; and updating the attack sample based on the attack prevention and trapping processing results.

[0009] Furthermore, an original acoustic signature signal substrate is constructed using the coupled acoustic impedance characteristics of the deep-sea drilling platform. Specifically, the process is as follows: The original acoustic signature signal substrate is constructed using the coupled acoustic impedance characteristics of the deep-sea drilling platform; training and transformation processing is performed on the original acoustic signature signal substrate to obtain coupled acoustic wave-induced attack data; dynamic obfuscation attack trapping processing is applied to the coupled acoustic wave-induced attack data to obtain dynamic obfuscation attack trapping feature data; the edge computing device of the deep-sea drilling platform performs anti-attack trapping processing using the dynamic obfuscation attack trapping feature data and issues an alarm; attack sample-driven updates are performed based on the anti-attack trapping processing results.

[0010] Furthermore, the original acoustic signature signal substrate is constructed by coupling the acoustic impedance characteristics of the deep-sea drilling platform. The specific process is as follows: the cuttings friction coefficient is obtained by fitting the changes in friction angle and cohesion in the core shear test with the corresponding acoustic impedance characteristics; the drilling fluid density is obtained by the edge computing equipment of the deep-sea drilling platform through the corresponding mud pump real-time sensor; the P-wave velocity is obtained by the edge computing equipment of the deep-sea drilling platform through the formation elastic modulus inversion of the corresponding drilling acoustic logging; the cuttings formation type correction factor is directly extracted from the deep-sea drilling platform coupled cross-layer anti-uniform ring database; the cuttings concentration is obtained by the edge computing equipment of the deep-sea drilling platform through the ratio of return volume to annular velocity; the results of the coupling analysis of cuttings friction coefficient and drilling fluid density are then combined with the results of the coupling analysis of P-wave velocity, cuttings formation type correction factor and cuttings concentration to obtain the acoustic wave propagation impedance value affected by cuttings migration.

[0011] Furthermore, constructing the original acoustic signature signal substrate using the coupled acoustic impedance characteristics of the deep-sea drilling platform includes: directly obtaining the formation absorption coefficient corresponding to different axial distances along the wellbore through data regression using historical acoustic attenuation data; extracting the sound source propagation distance using historical attack acoustic distance data from the edge computing equipment of the deep-sea drilling platform; extracting the initial acoustic frequency using historical attack acoustic frequency data from the edge computing equipment of the deep-sea drilling platform; recording the duration between corresponding digital sampling timestamps in the edge computing equipment of the deep-sea drilling platform as the time variable of acoustic propagation; extracting the initial acoustic phase using historical attack acoustic phase data from the edge computing equipment of the deep-sea drilling platform; and performing trigonometric function processing on the initial acoustic frequency, acoustic propagation time variable, sound source propagation distance, longitudinal wave velocity, and initial acoustic phase, followed by coupling analysis with the acoustic propagation impedance value affected by cuttings transport, formation absorption coefficient, and sound source propagation distance to obtain the characteristic constraint formula of the deceptive acoustic time-domain waveform equation.

[0012] Furthermore, training and transformation processing is performed based on the original acoustic signal basis. The specific process is as follows: the synthetic acoustic wave time-domain waveform is processed by the feature constraint formula of the deceptive acoustic wave time-domain waveform equation to obtain the synthetic acoustic wave time-domain waveform; in the reserved fields of the industrial data protocol, the parameters in the feature constraint formula of the deceptive acoustic wave time-domain waveform equation are converted into binary codes, while keeping the overall checksum of the industrial data protocol unchanged; the synthetic acoustic wave time-domain waveform is discretized and encoded according to the sample format of the industrial data protocol to obtain the original dataset of the attack sample; the original dataset of the attack sample is mixed with the real signal dataset according to a predefined ratio to obtain the original mixed dataset of the attack sample.

[0013] Furthermore, the training and transformation processing based on the original acoustic signature signal substrate also includes: classifying and storing the original mixed dataset of attack samples according to predefined attack types to obtain different categories of original mixed datasets of attack samples; performing frame segmentation and normalization processing on the original mixed datasets of attack samples of different categories to obtain different categories of deep-sea drilling platform coupled acoustic wave induced attack data, and deploying them to the edge computing device of the deep-sea drilling platform.

[0014] Furthermore, dynamic obfuscation attack trapping processing is performed on the deep-sea drilling platform coupled acoustic wave induced attack data. Specifically, this includes: directly extracting fields with no signal meaning and out-of-range acoustic wave parameter fields from the deep-sea drilling platform coupled acoustic wave dynamic obfuscation attack database; setting the fields with no signal meaning in the extended text header block of the industrial data protocol of the deep-sea drilling platform coupled acoustic wave induced attack data; and setting the out-of-range acoustic wave parameter fields in the extended text header block of the corresponding parameters of the industrial data protocol of the deep-sea drilling platform coupled acoustic wave induced attack data.

[0015] Furthermore, the dynamic obfuscation attack trapping processing for deep-sea drilling platform coupled acoustic wave induced attack data also includes: directly extracting the initial seed and corresponding hash value from the deep-sea drilling platform coupled acoustic wave dynamic obfuscation attack database; setting the channel code corresponding to the deep-sea drilling platform coupled acoustic wave induced attack data in the channel digital segment of the extended text header block of the corresponding industrial data protocol; embedding the key signature generated according to the hash value into the deep-sea drilling platform coupled acoustic wave induced attack data to obtain dynamic obfuscation attack trapping feature data.

[0016] Furthermore, the edge computing equipment on the deep-sea drilling platform employs dynamic obfuscation attack trapping feature data for attack prevention and trapping. Specifically, the edge computing equipment verifies the key signature of the dynamic obfuscation attack trapping feature data corresponding to the channel using a hash chain key. If the verification fails, it is determined to be an attack, an alarm is issued, and the corresponding channel is sent to relevant personnel. If the hash verification passes, the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol of the dynamic obfuscation attack trapping feature data are extracted. The acoustic parameters of the out-of-range acoustic parameter field are then judged according to the deep-sea drilling platform's coupled acoustic impedance characteristic constraint formula. If the acoustic parameters of the out-of-range acoustic parameter field satisfy the deep-sea drilling platform's coupled acoustic impedance characteristic constraint formula... If the acoustic parameters of the out-of-range acoustic parameter field meet the constraints of the predefined acoustic parameter range, an attack is detected, an alarm is issued, and the corresponding channel is sent to relevant personnel. Otherwise, fields without signal meaning in the extended text header of the industrial data protocol for dynamic obfuscation attack trapping feature data are extracted and verified. If the fields without signal meaning are covered or tampered with, an attack is detected, an alarm is issued, and the corresponding channel is sent to relevant personnel. If the verification analysis of the fields without signal meaning passes, it is determined that the corresponding channel has not been attacked or tampered with, and the corresponding dynamic obfuscation attack trapping feature data in the channel is automatically cleared after data transmission is completed.

[0017] Furthermore, attack sample-driven updates are performed based on the attack prevention and trapping results. Specifically, this includes: recording the dynamic obfuscation attack trapping feature data of all channels identified as attacks and issuing alarms, while simultaneously recording the attack frequency; adjusting the sampling rate of all data and the channel switching frequency corresponding to the dynamic obfuscation attack trapping feature data of the deep-sea drilling platform edge computing device based on the attack frequency; if the attack frequency remains below the predefined attack frequency detection threshold for an extended period, gradually reducing the sampling rate of all data of the deep-sea drilling platform edge computing device to a predefined initial device sampling rate, and gradually reducing the dynamic obfuscation attack trapping feature data... The channel switching frequency corresponding to the feature data is set to the predefined initial channel switching frequency; if the attack tampers with the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol in the dynamic obfuscation attack trap feature data, the corresponding acoustic parameters are recorded; the initial seed and the corresponding hash value are directly extracted from the deep-sea drilling platform coupled acoustic dynamic obfuscation attack database; the corresponding acoustic parameters are used to generate the corresponding acoustic parameter offset based on the hash value, and the acoustic parameter offset is coupled with the acoustic parameters for analysis to update the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol in the corresponding dynamic obfuscation attack trap feature data.

[0018] This application provides an intelligent attack prevention and trapping system based on adversarial generation, including a raw acoustic signature signal base construction module, a training and transformation induced attack data module, a dynamic obfuscation attack trapping feature construction module, an attack prevention and trapping processing alarm module, and an attack prevention and trapping processing iteration module: The raw acoustic signature signal base construction module is used to construct a raw acoustic signature signal base using the coupling acoustic impedance characteristics of a deep-sea drilling platform; the training and transformation induced attack data module is used to perform training and transformation processing based on the raw acoustic signature signal base to obtain deep-sea drilling platform coupled acoustic wave induced attack data; the dynamic obfuscation attack trapping feature construction module is used to perform dynamic obfuscation attack trapping processing on the deep-sea drilling platform coupled acoustic wave induced attack data to obtain dynamic obfuscation attack trapping feature data; the attack prevention and trapping processing alarm module is used for the deep-sea drilling platform edge computing device to perform attack prevention and trapping processing using the dynamic obfuscation attack trapping feature data, and to issue an alarm; the attack prevention and trapping processing iteration module is used to drive updates based on the attack prevention and trapping processing results.

[0019] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0020] 1. In the acoustic attack defense scenario of deep-sea drilling platforms, by coupling multiple source parameters such as the friction coefficient of rock core shear tests, real-time drilling fluid density, P-wave velocity obtained from drilling acoustic inversion, formation correction factor, and cuttings concentration, the acoustic wave propagation impedance value affected by cuttings migration is generated. This represents a significant improvement over the impedance calculation deviation problem caused by the failure to consider the dynamic migration of cuttings in traditional acoustic models. Furthermore, by combining historical formation absorption coefficients, sound source distance, initial frequency, and phase, a characteristic constraint formula for the time-domain waveform equation of deceptive acoustic waves is established, enabling the generated acoustic pattern substrate to accurately simulate the acoustic wave attenuation and phase distortion characteristics under real drilling conditions. This makes the subsequently synthesized decoy signal more adaptable to the geological environment when physically resisting attacks, reducing the risk of missed detection caused by model distortion.

[0021] 2. Addressing the resource-constrained scenarios of edge computing devices on deep-sea drilling platforms, the parameters of the deceptive acoustic wave equations are converted into binary encoding of industrial data protocols while maintaining the checksum, ensuring protocol compatibility and operability. Through discretization, acoustic time-domain waveforms are synthesized and mixed with real datasets to generate a categorized and stored original hybrid dataset of attack samples. After frame segmentation and normalization, this dataset is directly deployed to edge devices. This process solves the latency problem caused by the need for cloud training of traditional attack samples; it eliminates the overhead of data format conversion in protocol field-level encoding; the pre-classified sample library allows edge devices to quickly access multiple types of induced attack features; and the normalization process adapts to the input range of different acoustic sensors, significantly improving the real-time operation capability of the decoy signal on actual deep-sea drilling platform edge computing devices.

[0022] 3. Based on the unique acoustic parameter range constraints of deep-sea drilling, meaningless fields and out-of-range acoustic parameters are pre-embedded in the industrial protocol extension header as decoy tags. Combined with hash chain key signatures, dynamic obfuscation attack decoy feature data is constructed, enabling edge devices to perform a triple criterion during attack detection and verification: first, key signature hash verification; second, whether out-of-range parameters simultaneously violate the acoustic impedance constraint formula and preset threshold; and finally, meaningless field integrity checks. This mechanism can effectively distinguish between malicious tampering and normal data fluctuations when the drilling platform suffers an acoustic injection attack, transforming geological acoustic constraints into mathematical criteria at the protocol layer, thus intercepting physical layer attacks during the protocol parsing stage.

[0023] 4. Based on the trapping results, the system dynamically optimizes defense, records attack channel characteristics and attack frequencies, increases the sampling rate and switching frequency of high-threat channels to enhance monitoring density, and adaptively adjusts edge computing resource allocation based on the attack frequency to avoid continuous high-load operation. When an attack tampers with out-of-range acoustic parameters, the system generates parameter offsets based on hash seeds and updates the trapping fields to ensure that field updates are unpredictable and verifiable. When deep-sea drilling platforms face new attack patterns, the system can proactively reconstruct the trapping logic to maintain the continuity and effectiveness of the defense mechanism, improving adaptability to the vulnerability of static trapping libraries to attackers learning and circumventing them. Attached Figure Description

[0024] Figure 1 A flowchart of the intelligent attack prevention method based on adversarial generation provided in this application embodiment;

[0025] Figure 2 This is a structural diagram of an intelligent anti-attack trapping system based on adversarial generation provided in an embodiment of this application. Detailed Implementation

[0026] This application provides a method and system for trapping devices to prevent cyberattacks based on adversarial generation, addressing the problem of insufficient adaptability to cybersecurity attack environments for edge computing devices on deep-sea drilling platforms in existing technologies. The method constructs an original acoustic signature signal basis based on the coupled acoustic impedance characteristics of the deep-sea drilling platform; it then fuses the acoustic signature data to generate acoustic wave propagation impedance values ​​and derives the time-domain waveform equation of the deceptive acoustic wave by combining historical acoustic wave parameters. The equation parameters are encoded into an industrial protocol format, and an attack sample dataset is synthesized and categorized for storage. Trapping feature data is constructed using dynamic obfuscation technology, allowing edge devices to verify protocol field anomalies and signature validity, triggering real-time alarms and driving attack sample updates. This improves the adaptability of edge computing devices on deep-sea drilling platforms to cybersecurity attack environments, resolving the problem of insufficient adaptability in existing technologies.

[0027] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0028] like Figure 1 The diagram shows a flowchart of an intelligent attack prevention and trapping method based on adversarial generation provided in this application. The method includes the following steps: constructing an original acoustic signature signal substrate using the coupled acoustic impedance characteristics of a deep-sea drilling platform; performing training and transformation processing on the original acoustic signature signal substrate to obtain coupled acoustic wave-induced attack data for the deep-sea drilling platform; performing dynamic obfuscation attack trapping processing on the coupled acoustic wave-induced attack data for the deep-sea drilling platform to obtain dynamic obfuscation attack trapping feature data; performing attack prevention and trapping processing on the edge computing device of the deep-sea drilling platform using the dynamic obfuscation attack trapping feature data, and issuing an alarm; and updating the attack sample based on the attack prevention and trapping processing results.

[0029] In this embodiment, the physical feature-protocol fusion attack modeling breaks through the limitations of traditional single-layer attacks, simulating a composite attack mode in which attackers simultaneously manipulate sensor data and communication protocols, thus addressing composite targeted threat attack scenarios.

[0030] Furthermore, an original acoustic signature signal substrate was constructed using the coupled acoustic impedance characteristics of the deep-sea drilling platform. Specifically, this process involved: obtaining the cuttings friction coefficient by fitting the changes in friction angle and cohesion from core shear tests to the corresponding acoustic impedance characteristics; obtaining the drilling fluid density from the corresponding mud pump real-time sensor using the deep-sea drilling platform's edge computing equipment; obtaining the P-wave velocity by inverting the formation elastic modulus from corresponding logging-while-drilling (LWD) acoustic logging data using the deep-sea drilling platform's edge computing equipment; directly extracting the cuttings formation type correction factor from the deep-sea drilling platform's coupled cross-layer anti-uniform ring database; obtaining the cuttings concentration from the ratio of return flow to annular velocity using the deep-sea drilling platform's edge computing equipment; and then performing a proportion analysis of the results of the coupled analysis of the cuttings friction coefficient and drilling fluid density with the results of the coupled analysis of P-wave velocity, cuttings formation type correction factor, and cuttings concentration to obtain the acoustic wave propagation impedance value affected by cuttings transport.

[0031] In this embodiment, the edge computing devices of the deep-sea drilling platform are numbered, j = 1, 2, 3, ..., J, where j represents the number of the edge computing device of the deep-sea drilling platform and J represents the total number of edge computing devices of the deep-sea drilling platform.

[0032] The formula for constraining the coupled acoustic impedance characteristics of a deep-sea drilling platform is as follows:

[0033] The coupled acoustic impedance characteristic constraint formula for deep-sea drilling platforms is used to describe the coupled acoustic impedance characteristics of deep-sea drilling platforms, where ψ represents the acoustic wave propagation impedance value affected by cuttings transport, and is dimensionless. j This represents the acoustic wave propagation impedance value of the edge computing device of the j-th deep-sea drilling platform affected by cuttings transport. The acoustic wave propagation impedance value affected by cuttings transport directly determines the phase distortion and amplitude attenuation characteristics of the acoustic wave signal in the original acoustic wave signal substrate in the following steps.

[0034] A represents the cuttings friction coefficient, which is dimensionless and is obtained by fitting the changes in friction angle and cohesion in core shear tests with the corresponding acoustic impedance characteristics. It is used to describe the formation response of high-friction deep-sea drilling platforms. An increase in the cuttings friction coefficient will cause the acoustic wave propagation impedance value affected by cuttings migration to shift positively.

[0035] P j The dimensionless value represents the drilling fluid density obtained by the edge computing device of the j-th deep-sea drilling platform through the corresponding mud pump real-time sensor. It is used to describe the level of propagation impedance distortion caused by abnormal drilling fluid density on the deep-sea drilling platform.

[0036] V j The longitudinal wave velocity is dimensionless, obtained by the edge computing device of the j-th deep-sea drilling platform through the formation elastic modulus inversion of the corresponding drilling acoustic logging.

[0037] XZ represents the cuttings formation type correction factor, directly extracted from the deep-sea drilling platform coupled cross-layer anti-uniform ring database. Specifically, it is obtained through experimental or numerical simulation fitting and is used to correct the influence of cuttings concentration on acoustic impedance. For example, in cuttings transport experiments, different formation types of cuttings cause acoustic signal attenuation. Different fitting coefficients are obtained through data regression. Based on the difference level between different fitting coefficients corresponding to different geological hardness of different cuttings formation types, further data regression is performed to obtain different fitting coefficients, which are the cuttings formation type correction factors. Inputting different cuttings formation types yields the corresponding cuttings formation type correction factors.

[0038] C j This represents the rock cuttings concentration obtained by the edge computing device of the j-th deep-sea drilling platform through the ratio of return volume to annular velocity, used to quantify the relative level of concentration increase in reducing the effective wave impedance scale.

[0039] Furthermore, constructing the original acoustic signature signal substrate using the coupled acoustic impedance characteristics of the deep-sea drilling platform includes: directly obtaining the formation absorption coefficient corresponding to different axial distances along the wellbore through data regression using historical acoustic attenuation data; extracting the sound source propagation distance using historical attack acoustic distance data from the edge computing equipment of the deep-sea drilling platform; extracting the initial acoustic frequency using historical attack acoustic frequency data from the edge computing equipment of the deep-sea drilling platform; recording the duration between corresponding digital sampling timestamps in the edge computing equipment of the deep-sea drilling platform as the time variable of acoustic propagation; extracting the initial acoustic phase using historical attack acoustic phase data from the edge computing equipment of the deep-sea drilling platform; and performing trigonometric function processing on the initial acoustic frequency, acoustic propagation time variable, sound source propagation distance, longitudinal wave velocity, and initial acoustic phase, followed by coupling analysis with the acoustic propagation impedance value affected by cuttings transport, formation absorption coefficient, and sound source propagation distance to obtain the characteristic constraint formula of the deceptive acoustic time-domain waveform equation.

[0040] In this embodiment, the characteristic constraint formula of the time-domain waveform equation of the deceptive sound wave is as follows:

[0041] Where x represents the propagation distance of the sound wave from the source to the receiver, i.e., the sound source propagation distance, in meters; x represents the axial distance along the wellbore; the positional difference of x directly affects signal attenuation and phase delay. The sound wave distance range data is obtained by using historical attack sound wave distance data from the edge computing equipment of the deep-sea drilling platform. The sound source propagation distance is set within the sound wave distance range data; t represents the time variable of sound wave propagation, in seconds, used to represent the time component characterizing the time evolution process of the sound wave signal. In the actual edge computing equipment of the deep-sea drilling platform, it corresponds to the duration between specific digital sampling timestamps; u(x, t) is used to describe the instantaneous amplitude of the sound wave signal at position x and time t. It is dimensionless and used to represent the spatiotemporal distribution characteristics of the sound pressure. By modifying its amplitude and phase through the steps below, attack training samples can be constructed.

[0042] ψ j This represents the acoustic wave propagation impedance value of the edge computing device of the j-th deep-sea drilling platform affected by cuttings transport.

[0043] e represents the natural constant. π represents pi.

[0044] β represents the formation absorption coefficient, which is used to indicate the relative level of sound wave attenuation caused by the additional absorption of sound waves by the formation in deep-sea drilling. The formation absorption coefficient is different for different axial distances along the wellbore. The formation absorption coefficient corresponding to different axial distances along the wellbore can be obtained directly by data regression through historical sound wave attenuation data.

[0045] f represents the initial acoustic frequency, which is set using historical attack acoustic frequency data from edge computing devices on deep-sea drilling platforms. The initial acoustic frequency is within this range.

[0046] V j The longitudinal wave velocity is dimensionless, obtained by the edge computing device of the j-th deep-sea drilling platform through the formation elastic modulus inversion of the corresponding drilling acoustic logging.

[0047] The initial acoustic phase is used to quantify the phase shift at the initial time point. It is determined by using historical attack acoustic phase data from the edge computing equipment of the deep-sea drilling platform to set the acoustic phase range. The initial acoustic phase is within this acoustic phase range, and its value range is (0, 2π).

[0048] Furthermore, training and transformation processing is performed based on the original voiceprint signal substrate. Specifically, the tampered parameters and the synthesized voiceprint are encoded into an industrial data protocol to achieve a physical and digital mapping of the attack logic; the synthesized sound wave time-domain waveform is processed using the feature constraint formula of the deceptive sound wave time-domain waveform equation to obtain the synthesized sound wave time-domain waveform; in the SEG-YRev1 extended text header block, the parameters in the feature constraint formula of the deceptive sound wave time-domain waveform equation are converted into binary encoding; the parameters in the feature constraint formula of the deceptive sound wave time-domain waveform equation include the listed parameters from the previous embodiment; SEG-Y The Rev1 file's checksum field retains the original checksum value to avoid triggering protocol anomalies; the checksum field is not modified to ensure that the modified header checksum is consistent with the original checksum, preserving the overall checksum of the industrial data protocol; u(x,t) is discretized into a time-series signal according to the sampling frequency, limiting the signal amplitude to the range supported by the SEG-Y format, selecting continuous sample segments to directly cover the attack waveform, superimposing the attack signal with historical normal signals proportionally, and randomly selecting several historical normal signal segments to inject into the attack signal to reduce time-domain correlation, and incorporating pseudo-random noise consistent with drilling rig vibration noise into the attack signal to simulate background noise in the real environment, thus obtaining the original mixed dataset of attack samples.

[0049] In this embodiment, u(x,t) serves as the attack carrier, and the acoustic wave propagation impedance value affected by cuttings transport directly influences the overall amplitude of u(x,t). If the acoustic wave propagation impedance value increases due to cuttings transport, it indicates an abnormally high signal amplitude, corresponding to the characteristics of a simulated high-impedance formation, which may lead to misjudgment of the reservoir. Conversely, if the acoustic wave propagation impedance value decreases due to cuttings transport, it indicates an abnormally low signal amplitude, which may simulate wellbore fluid intrusion or casing damage, triggering a false alarm.

[0050] The training effect of generating different attack sample training sets by varying different parameters in u(x,t) can be achieved. For example, by interfering with the sound source propagation distance or P-wave velocity, the arrival time of reflected waves can be faked, leading to errors in the calculation of stratigraphic depth. By interfering with the discrete sampling interval of the time variable of sound wave propagation, high-frequency acoustic wave signals can be aliased, obscuring real stratigraphic information.

[0051] Attack voiceprints are generated through random parameter perturbation and physical constraints, avoiding the inefficiency of manual tampering. Combined with the SEG-Y protocol structure, dual contamination of metadata and payload is achieved, ensuring that attacks can penetrate traditional verification mechanisms.

[0052] Furthermore, the training and transformation processing based on the original voiceprint signal basis also includes: classifying and storing the original mixed dataset of attack samples according to predefined attack types to obtain different categories of original mixed datasets of attack samples; cutting the original mixed dataset of attack samples according to time windows to generate input sequences; linearly scaling each frame of data to the range of (-1,1); marking different attack types with 8-bit binary codes in the extended text header block of the original mixed dataset of attack samples; and deploying it to the edge computing device of the deep-sea drilling platform.

[0053] In this embodiment, the original mixed dataset of the attack sample is cut into time windows to generate an input sequence; each frame of data is linearly scaled to the range of (-1,1) to adapt to the model input size of the edge computing device of the deep-sea drilling platform. Depending on the corresponding model input size of the edge computing device of the deep-sea drilling platform, the time window cutting size or the linear scaling range of each frame of data of the original mixed dataset of the attack sample can vary.

[0054] Furthermore, dynamic obfuscation attack trapping processing is performed on the deep-sea drilling platform coupled acoustic wave induced attack data. Specifically, this includes: directly extracting fields with no signal meaning and out-of-range acoustic wave parameter fields from the deep-sea drilling platform coupled acoustic wave dynamic obfuscation attack database; setting the fields with no signal meaning in the extended text header block of the industrial data protocol of the deep-sea drilling platform coupled acoustic wave induced attack data, specifically setting the position that does not overlap with the position of u(x,t) transformation, that is, the position of the field further processed in subsequent embodiments will not affect the position of the previously processed field; setting the out-of-range acoustic wave parameter fields in the extended text header block of the corresponding parameter of the industrial data protocol of the deep-sea drilling platform coupled acoustic wave induced attack data.

[0055] In this embodiment, the edge computing device of the deep-sea drilling platform must have a corresponding recognition mechanism for fields without signal meaning and fields that will be further processed in subsequent embodiments. That is, the defense mechanism of the edge computing device of the deep-sea drilling platform must recognize the defined fields.

[0056] The out-of-range acoustic parameter field is set in the extended text header block of the corresponding parameter in the industrial data protocol for deep-sea drilling platform coupled acoustic wave-induced attack data. For example, in the acoustic frequency data mentioned above, a frequency range is set, with the initial acoustic frequency within this range. The out-of-range acoustic parameter field represents the acoustic frequency data outside the corresponding frequency range. This out-of-range acoustic frequency error data replaces the original acoustic frequency data, making this deep-sea drilling platform coupled acoustic wave-induced attack data usable for subsequent attack behavior capture.

[0057] It should be noted that the fields mentioned here that have no signal meaning can be set to all zeros or to random numbers. This has no impact on other fields that are set subsequently. At the same time, the edge device records the content of the corresponding fields that have no signal meaning.

[0058] Furthermore, the dynamic obfuscation attack trapping process for deep-sea drilling platform coupled acoustic wave induced attack data also includes: directly extracting the initial seed and corresponding hash value from the deep-sea drilling platform coupled acoustic wave dynamic obfuscation attack database; setting the channel code corresponding to the deep-sea drilling platform coupled acoustic wave induced attack data in the channel digital segment of the extended text header block of the corresponding industrial data protocol; and embedding the key signature generated based on the hash value into the last byte of the deep-sea drilling platform coupled acoustic wave induced attack data.

[0059] In this embodiment, the initial seed and corresponding hash value are directly extracted from the deep-sea drilling platform coupled acoustic dynamic obfuscation attack database. For example, the cloud-based deep-sea drilling platform coupled acoustic dynamic obfuscation attack database generates a random number as the initial seed, which is transmitted to the edge computing device through a quantum encryption channel. After transmission, the cloud permanently deletes the seed, retaining only the hash value as a verification credential.

[0060] A new key is generated each cycle. The edge device only retains the key for the current cycle and the next cycle, and destroys all other historical keys to prevent the risk of leakage caused by long-term key retention.

[0061] When data from a deep-sea drilling platform coupled with acoustic wave-induced attacks is deployed within the actual edge computing equipment of the platform, it originates from different data sources. These different signal paths from which the data is acquired can be denoted as channels, and their codes recorded. Furthermore, any attacks that attempt to tamper with the data also originate from these channels. Therefore, the channel code corresponding to the deep-sea drilling platform's coupled acoustic wave-induced attack data is set in the channel number segment of the extended text header of the corresponding industrial data protocol. This means recording the channel code of the deep-sea drilling platform's coupled acoustic wave-induced attack data in the channel number segment of the extended text header, facilitating rapid location of the attack's channel position during subsequent attack detection.

[0062] Furthermore, the edge computing equipment on the deep-sea drilling platform employs dynamic obfuscation attack trapping feature data for attack prevention and trapping. Specifically, the edge computing equipment verifies the key signature of the dynamic obfuscation attack trapping feature data corresponding to the channel using a hash chain key. If the verification fails, it is determined to be an attack, an alarm is issued, and the corresponding channel is sent to relevant personnel. If the hash verification passes, the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol of the dynamic obfuscation attack trapping feature data are extracted. The acoustic parameters of the out-of-range acoustic parameter field are then judged according to the deep-sea drilling platform's coupled acoustic impedance characteristic constraint formula. If the acoustic parameters of the out-of-range acoustic parameter field satisfy the deep-sea drilling platform's coupled acoustic impedance characteristic constraint formula... If the acoustic parameters of the out-of-range acoustic parameter field meet the constraints of the predefined acoustic parameter range, an attack is detected, an alarm is issued, and the corresponding channel is sent to relevant personnel. Otherwise, fields without signal meaning in the extended text header of the industrial data protocol for dynamic obfuscation attack trapping feature data are extracted and verified. If the fields without signal meaning are covered or tampered with, an attack is detected, an alarm is issued, and the corresponding channel is sent to relevant personnel. If the verification analysis of the fields without signal meaning passes, it is determined that the corresponding channel has not been attacked or tampered with, and the corresponding dynamic obfuscation attack trapping feature data in the channel is automatically cleared after data transmission is completed.

[0063] In this embodiment, regardless of whether the attacker covers or superimposes the attack signal, as long as the data in the dynamic obfuscation attack trap feature data corresponding to the channel is tampered with, the integrity of the data is verified by the hash chain key. If the verification fails, it is determined to be an attack.

[0064] The predefined acoustic parameter range is the parameter range corresponding to the sub-parameters in a series of u(x,t) including the set acoustic frequency range in the above embodiment.

[0065] If an attacker uses a signal overlay attack, the signal in the channel will be overlaid with an attack signal carrying acoustic wave characteristic peaks. The acoustic parameters in the dynamic obfuscation attack decoy feature data will be set to erroneous signals exceeding a threshold. This allows for rapid detection if erroneous signals exceeding the threshold in the dynamic obfuscation attack decoy feature data are overlaid with attack signals carrying acoustic wave characteristic peaks. At the same time, only the dynamic obfuscation attack decoy feature data will carry erroneous signals exceeding the threshold, and these will be discarded when received and identified by the edge computing device. Therefore, intelligent anti-attack decoy detection is performed without affecting normal signals.

[0066] It is important to note that in actual attack induction, different rules can be set for different channels. Specifically, the acoustic parameters in the dynamic obfuscation attack trapping feature data of some channels can be initially set to erroneous signals exceeding a threshold, while the acoustic parameters in the dynamic obfuscation attack trapping feature data of other channels can be initially set to reasonable signals that meet the threshold. This makes the detection of attackers using signal overlay attacks more accurate. It is also important to note that edge computing devices can identify fields in the dynamic obfuscation attack trapping feature data to determine which signals are dynamic obfuscation attack trapping feature data and which are normal deep-sea drilling sensor signals. When no attack is detected, deep-sea drilling sensor signals in the same channel will be retained, while dynamic obfuscation attack trapping feature data will be discarded. If an attack is detected, both deep-sea drilling sensor signals and dynamic obfuscation attack trapping feature data in the same channel will be discarded, achieving protocol-level attack isolation.

[0067] If, for example, an attacker uses a traditional injection tool and the attack sample does not modify fields that have no signaling meaning, it is considered legitimate traffic. If the attacker detects fields that have no signaling meaning and tampers with the parameters to attack the sample, an alarm is triggered.

[0068] Furthermore, attack sample-driven updates are performed based on the attack prevention and trapping results. Specifically, this includes: recording the dynamic obfuscation attack trapping feature data of all channels identified as attacks and issuing alarms, while simultaneously recording the attack frequency; adjusting the sampling rate of all data and the channel switching frequency corresponding to the dynamic obfuscation attack trapping feature data of the deep-sea drilling platform edge computing device based on the attack frequency; if the attack frequency remains below the predefined attack frequency detection threshold for an extended period, gradually reducing the sampling rate of all data of the deep-sea drilling platform edge computing device to a predefined initial device sampling rate, and gradually reducing the dynamic obfuscation attack trapping feature data... The channel switching frequency corresponding to the feature data is set to the predefined initial channel switching frequency; if the attack tampers with the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol in the dynamic obfuscation attack trap feature data, the corresponding acoustic parameters are recorded; the initial seed and the corresponding hash value are directly extracted from the deep-sea drilling platform coupled acoustic dynamic obfuscation attack database; the corresponding acoustic parameters are used to generate the corresponding acoustic parameter offset based on the hash value, and the acoustic parameter offset is coupled with the acoustic parameters for analysis to update the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the industrial data protocol in the corresponding dynamic obfuscation attack trap feature data.

[0069] In this embodiment, the corresponding acoustic parameters are generated into corresponding acoustic parameter offsets based on hash values. The acoustic parameter offsets are then coupled with the acoustic parameters for analysis. For example, the edge device uses the hash value of the current period, taking the first bit of the hash value as the sign bit, where 0 represents a positive offset and 1 represents a negative offset. The middle bit segments are mapped to predefined offset levels, corresponding to thresholds that exceed the reasonable range of historical data. Combined with the threshold of the reasonable range of historical data, including historical attack acoustic frequency data of edge computing devices on deep-sea drilling platforms, as described in the above embodiment, if the offset does not exceed the threshold, the level is automatically increased to ensure that the acoustic parameter offset always deviates from the actual data distribution. The dynamic generation of acoustic parameter offsets relies on the randomness and unidirectionality of the hash chain key. Through the unpredictability of hash values, the direction and magnitude of the increase and decrease of acoustic parameter offsets change dynamically in each period, making it impossible for attackers to predict or deduce patterns from historical data.

[0070] like Figure 2 The diagram shown is a structural diagram of the intelligent attack prevention system based on adversarial generation provided in this application embodiment. The intelligent attack prevention system based on adversarial generation provided in this application embodiment includes: an original acoustic signature signal base construction module, a training and transformation induced attack data module, a dynamic obfuscation attack trapping feature construction module, an attack prevention trapping processing alarm module, and an attack prevention trapping processing iteration module. The original acoustic signature signal base construction module is used to construct an original acoustic signature signal base using the coupling acoustic impedance characteristics of the deep-sea drilling platform. The training and transformation induced attack data module is used to perform training and transformation processing based on the original acoustic signature signal base to obtain deep-sea drilling platform coupled acoustic wave induced attack data. The dynamic obfuscation attack trapping feature construction module is used to perform dynamic obfuscation attack trapping processing on the deep-sea drilling platform coupled acoustic wave induced attack data to obtain dynamic obfuscation attack trapping feature data. The attack prevention trapping processing alarm module is used for the deep-sea drilling platform edge computing device to perform attack prevention trapping processing through the dynamic obfuscation attack trapping feature data and to issue an alarm. The attack prevention trapping processing iteration module is used to perform attack sample-driven updates based on the attack prevention trapping processing results.

[0071] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0072] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0073] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0074] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0075] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0076] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A trapping method for intelligent anti-attack based on adversarial generation, characterized in that, Includes the following steps: The original acoustic signature signal substrate was constructed by coupling the acoustic impedance characteristics of the deep-sea drilling platform. Training and transformation processing were performed on the original acoustic signature signal basis to obtain coupled acoustic wave-induced attack data for deep-sea drilling platforms. Dynamic obfuscation attack trapping processing is performed on coupled acoustic wave-induced attack data of deep-sea drilling platforms to obtain dynamic obfuscation attack trapping feature data. The edge computing equipment on the deep-sea drilling platform uses dynamic obfuscation attack trapping feature data to prevent attack trapping and then issues an alarm. Attack sample-driven updates are performed based on the results of the attack prevention trapping process.

2. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The process of constructing the original acoustic signature signal substrate by coupling the acoustic impedance characteristics of the deep-sea drilling platform is as follows: The friction coefficient of rock cuttings was obtained by fitting the changes in friction angle and cohesion in the rock core shear test with the corresponding acoustic impedance characteristics. The drilling fluid density is obtained in real time by the edge computing equipment of the deep-sea drilling platform through the corresponding mud pump sensor. The longitudinal wave velocity is obtained by inverting the formation elastic modulus through the corresponding drilling acoustic logging using the edge computing equipment of the deep-sea drilling platform. The rock cuttings formation type correction factor was directly extracted from the deep-sea drilling platform coupled cross-layer anti-uniform ring database. The rock cuttings concentration is obtained by using the ratio of return flow rate to annular velocity through the edge computing equipment of a deep-sea drilling platform. The acoustic wave propagation impedance value affected by cuttings migration is obtained by combining the results of coupled analysis of cuttings friction coefficient and drilling fluid density with the results of coupled analysis of P-wave velocity, cuttings formation type correction factor and cuttings concentration.

3. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 2, characterized in that, The method of constructing the original acoustic signature signal substrate by coupling the acoustic impedance characteristics of the deep-sea drilling platform also includes: The formation absorption coefficients at different axial distances along the wellbore can be obtained directly through data regression using historical acoustic attenuation data. The propagation distance of the sound source was extracted by using historical attack sound wave distance data of edge computing devices on deep-sea drilling platforms. The initial acoustic frequency was extracted by using historical attack acoustic frequency data of edge computing devices on deep-sea drilling platforms. The duration between the corresponding digital sampling timestamps in the edge computing equipment of the deep-sea drilling platform is recorded as the time variable of sound wave propagation. The initial acoustic phase was extracted by using historical attack acoustic phase data of edge computing devices on deep-sea drilling platforms. By performing trigonometric function processing on the initial sound wave frequency, sound wave propagation time variable, sound source propagation distance, longitudinal wave velocity, and initial sound wave phase, and then coupling analysis with the sound wave propagation impedance value affected by rock debris transport, the formation absorption coefficient, and the sound source propagation distance, the characteristic constraint formula of the deceptive sound wave time domain waveform equation is obtained.

4. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The specific process of training and transformation based on the original voiceprint signal basis is as follows: Synthetic sound wave time-domain waveform is obtained by processing the synthetic sound wave time-domain waveform through the characteristic constraint formula of the deceptive sound wave time-domain waveform equation. In the reserved fields of the industrial data protocol, the parameters in the characteristic constraint formula of the deceptive acoustic wave time-domain waveform equation are converted into binary codes, while keeping the overall checksum of the industrial data protocol unchanged. The synthesized acoustic wave time-domain waveform is discretized and encoded according to the sample format of the industrial data protocol to obtain the original dataset of the attack sample. The original dataset of the attack sample is mixed with the real signal dataset in a predefined ratio to obtain the original mixed dataset of the attack sample.

5. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The training and transformation process based on the original voiceprint signal substrate also includes: The original mixed dataset of attack samples is classified and stored according to predefined attack types, resulting in original mixed datasets of attack samples of different categories; The original mixed datasets of attack samples of different categories were processed by frame segmentation and normalization to obtain deep-sea drilling platform coupled acoustic wave induced attack data of different categories, which were then deployed to the edge computing device of the deep-sea drilling platform.

6. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The dynamic obfuscation and trapping processing of coupled acoustic wave-induced attack data for deep-sea drilling platforms specifically includes: Fields with no signal meaning and out-of-range acoustic parameter fields are directly extracted from the database of dynamic obfuscation attacks on coupled acoustic waves from deep-sea drilling platforms. Fields with no signal meaning are set in the extended text header block of the industrial data protocol that couples acoustic wave-induced attack data to deep-sea drilling platforms; The out-of-range acoustic parameter field is set in the extended text header block of the corresponding parameter in the industrial data protocol for coupling acoustic-induced attack data of deep-sea drilling platforms.

7. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The dynamic obfuscation and trapping processing of coupled acoustic wave-induced attack data for deep-sea drilling platforms also includes: The initial seed and corresponding hash value were directly extracted from the database of dynamic obfuscation attacks coupled with acoustic waves from deep-sea drilling platforms. The channel coding corresponding to the deep-sea drilling platform coupled acoustic wave induced attack data is set in the channel digital segment of the extended text header block of the corresponding industrial data protocol. By embedding a key signature generated based on a hash value into the data of a deep-sea drilling platform coupled with acoustic wave-induced attacks, dynamic obfuscation attack trapping feature data is obtained.

8. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The edge computing device of the deep-sea drilling platform performs anti-attack trapping processing through dynamic obfuscation of attack trapping feature data. The specific process is as follows: The edge computing equipment of the deep-sea drilling platform verifies the key signature of the dynamic obfuscation attack trap feature data corresponding to the channel through the hash chain key. If it fails, it is determined to be an attack and an alarm is issued and the corresponding channel is sent to the relevant personnel. If the hash verification passes, the acoustic parameters of the out-of-range acoustic parameter field in the extended text header of the industrial data protocol for dynamically obfuscated attack trapping feature data are extracted. The acoustic parameters of the out-of-range acoustic parameter field are judged according to the constraint formula of the coupled acoustic impedance feature of the deep-sea drilling platform. If the acoustic parameters of the out-of-range acoustic parameter field meet the constraint requirements of the coupled acoustic impedance feature constraint formula of the deep-sea drilling platform, and the acoustic parameters of the out-of-range acoustic parameter field meet the constraint requirements of the corresponding predefined acoustic parameter range, then it is determined to be an attack, an alarm is issued, and the corresponding channel is sent to relevant personnel. Otherwise, the fields without signal meaning in the extended text header of the industrial data protocol for dynamically obfuscated attack trapping feature data are extracted, and the fields without signal meaning are verified and analyzed. If the fields without signal meaning are covered or tampered with, it is determined to be an attack, an alarm is issued, and the corresponding channel is sent to relevant personnel. If the verification analysis of a field without signal meaning passes, it is determined that the corresponding channel has not been attacked or tampered with. Then, the corresponding dynamic obfuscation attack trapping feature data in the channel will be automatically cleared after the data transmission is completed.

9. The trapping method for intelligent attack prevention based on adversarial generation as described in claim 1, characterized in that, The attack sample-driven update based on the attack prevention trapping process specifically includes: Record the dynamic obfuscation attack trapping feature data of all channels that are identified as attacks and issue alarms, and record the attack frequency. Based on the attack frequency, increase the sampling rate of all data and the channel switching frequency corresponding to the dynamic obfuscation attack trapping feature data of the corresponding deep-sea drilling platform edge computing device. If the attack frequency is continuously less than the attack frequency detection threshold for a predefined time, then gradually reduce the sampling rate of all data of the deep-sea drilling platform edge computing device to the predefined initial device sampling rate, and gradually reduce the channel switching frequency corresponding to the dynamic obfuscation attack trapping feature data to the predefined initial channel switching frequency. If the attack tampers with the acoustic parameters of the out-of-range acoustic parameter field in the extended text header block of the Industrial Data Protocol in the dynamic obfuscation attack trapping feature data, then the corresponding acoustic parameters are recorded. The initial seed and corresponding hash value were directly extracted from the database of dynamic obfuscation attacks coupled with acoustic waves from deep-sea drilling platforms. The corresponding acoustic parameters are used to generate corresponding acoustic parameter offsets based on hash values. The acoustic parameter offsets are then coupled with the acoustic parameters for analysis. Finally, the acoustic parameters in the out-of-range acoustic parameter field of the extended text header block of the industrial data protocol for the corresponding dynamic obfuscation attack trapping feature data are updated.

10. A trapping system for intelligent attack prevention based on adversarial generation, characterized in that, It includes a module for constructing the original voiceprint signal base, a module for training and transforming data to induce attacks, a module for constructing dynamic obfuscation attack trapping features, a module for preventing attack trapping and alarm processing, and a module for iterative prevention attack trapping processing. Original acoustic signature signal substrate construction module: used to construct the original acoustic signature signal substrate by coupling the acoustic impedance characteristics of the deep-sea drilling platform; Training and Transformation Induced Attack Data Module: Used to perform training and transformation processing based on the original acoustic signature signal substrate to obtain coupled acoustic wave induced attack data for deep-sea drilling platforms; Dynamic Obfuscation Attack Decoy Feature Construction Module: Used to perform dynamic obfuscation attack decoy processing on coupled acoustic wave-induced attack data of deep-sea drilling platforms to obtain dynamic obfuscation attack decoy feature data; Anti-attack trapping and alarm module: Used by edge computing devices on deep-sea drilling platforms to perform anti-attack trapping processing through dynamically obfuscated attack trapping feature data, and to issue alarms accordingly; Attack prevention trapping processing iteration module: used to drive the update of attack samples based on the results of attack prevention trapping processing.

Images