An industrial control network risk monitoring method and device based on immune identification

Abstract

The application discloses an industrial control network risk monitoring method based on immune identification, relates to the technical field of network security risk monitoring, and comprises the following steps: acquiring multi-source heterogeneous industrial control protocol flow data collected in real time and a known data set; preprocessing the data to obtain a standardized antigen vector; based on the standardized antigen vector, a preset deep autoencoder and a graph neural network model are mixed trained based on an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population; the standardized antigen vector is input into a lightweight model to obtain a compressed antigen vector; and the compressed antigen vector is detected based on the initial detector population to obtain an antigen vector triggering an alarm. The application improves the clarity and scalability of original protocol semantics, ensures continuous coverage of unknown attacks, and optimizes the deployment and updating process of the model.

Description

Technical Field

[0001] This invention relates to the field of network security risk monitoring technology, and in particular to a method and apparatus for monitoring risks in industrial control networks based on immune recognition. Background Technology

[0002] At present, the most commonly used in the field of industrial control network security risk monitoring is the "static signature + whitelist" intrusion detection / protection method, supplemented by a small number of machine learning-based anomaly detection models.

[0003] Existing methods have made some progress in industrial control network security monitoring, but some technical limitations remain: First, their generalization ability is limited. Many models lack adaptability to environmental changes and new attack variants. Once a working condition or attack variant not covered in the training set appears in a real industrial control scenario, the detection performance often drops sharply. For example, CPS-GUARD has only been validated on specific physical test platforms and datasets, and PCGAT has only been evaluated on two public ICS datasets. Second, model updates are difficult. Traditional intrusion detection is mainly based on static signatures and fixed whitelist strategies, requiring continuous manual maintenance and updates. For example, the CISA guidelines for industrial control system application whitelists protect against attacks by "allowing only predefined programs to run and blocking all other programs," but this requires frequent manual maintenance and is completely powerless against unknown or zero-day attacks. Machine learning models, once deployed, lack online self-evolution mechanisms. For example, the GSIN model and most GNN solutions rely on offline training and require manual retraining to adapt to new processes. In addition, AIm-ADS requires regenerating the detector once the system behavior or self-set changes. In situations of dynamic topology changes or evolving traffic patterns, these static models struggle to adjust in a timely manner, leading to a decrease in true positive rates and an increase in false positive rates, making it impossible to respond to unknown threats in real time. Finally, real-time performance is limited. Some deep learning or graph neural network models have high computational overhead, making it difficult to run in real time on resource-constrained industrial field equipment; during traffic surges, the inference latency and false positives of traditional models are also amplified.

[0004] Therefore, an industrial control network risk monitoring method and device based on immune recognition was developed to solve the above problems. Summary of the Invention

[0005] This invention proposes a risk monitoring method and device for industrial control networks based on immune recognition, in order to solve the problems of limited generalization ability, difficulty in model updating, and limited real-time performance of existing methods.

[0006] The present invention achieves the above objectives through the following technical solutions:

[0007] This invention provides a risk monitoring method for industrial control networks based on immune recognition, comprising:

[0008] Acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets;

[0009] The data is preprocessed to obtain a standardized antigen vector;

[0010] Based on the standardized antigen vector, the preset deep autoencoder and graph neural network model are trained in a hybrid manner using an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model.

[0011] The standardized antigen vector is input into the lightweight model to obtain the compressed antigen vector;

[0012] The compressed antigen vector is detected based on the initial detector population to obtain the antigen vector that triggers the alarm.

[0013] Furthermore, the multi-source heterogeneous industrial control protocol traffic data includes continuously accessed data from deployed lightweight acquisition probes, which include log servers, cloud platform / edge node interfaces, and industrial firewall / intrusion detection device mirror ports.

[0014] Further, the data is preprocessed, including:

[0015] Remove redundant information from the data and retain only the core operational semantics;

[0016] The data is uniformly encoded.

[0017] Furthermore, the training process of a deep autoencoder includes:

[0018] via encoder Temporal features of encoding standardized antigen vectors The standardized antigen vector includes normal samples and attack samples:

[0019]

[0020] in It is a multilayer perceptron, employing a long short-term memory network. For encoder parameters, The output is the time series feature vector within a processed time window. 3D temporal feature vector, then, decoder Reconstruct the original input as 3D time series feature vector :

[0021]

[0022] Through decoder function The decoder parameters are Reconstruct the original input for Reconstruction loss function Defined as:

[0023]

[0024] in, It is the reconstruction loss function of the autoencoder, used to quantify the difference between the original input data and the decoder's reconstructed output. This represents the number of semantic tuples contained within the time window, i.e., the total number of time steps. The square of the Euclidean distance. For time step The original input feature vector, For time step The reconstructed output feature vector.

[0025] Furthermore, the training of the graph neural network model includes:

[0026] A dynamic topology graph is constructed based on the association relationships of standardized antigen vector samples within the same time window. Nodes in the dynamic topology graph represent devices, and node features include device type and status. Edges represent communication relationships between devices, and edge weights are communication frequency or traffic volume. The graph convolutional layer propagation formula is as follows:

[0027]

[0028] in, This represents the adjacency matrix plus self-loop connections. It is the identity matrix. An adjacency matrix representing the real-time communication relationships between devices is reconstructed for each time window based on real-time communication data. Used for real-time connection between dynamic encoding devices; The degree matrix is ​​used for weighted aggregation of the adjacency matrix features; For the first Layer node features; These are learnable weights; This is an activation function in a neural network that updates node features by aggregating information from the adjacency matrix, ultimately outputting a node feature matrix. The embedding matrix H has a dimension of . ,in It is the number of nodes. It is a set of nodes. It is the feature dimension, node ∈ initial features It consists of two parts: the first part is a dense vector formed by transforming the discrete attributes of the device or hardware through the embedding layer; the second part is a direct concatenation of the normalized runtime states of the device.

[0029]

[0030] in, ( ) represents the discrete device type of a node, through an embedding layer. Mapped to a 3D dense vector; This represents the node's running state vector, normalized by the Min-Max function. After normalization, a 3D standardized vector is obtained, which is then processed. The concatenation function produces a 6-dimensional vector. =[0.8,−0.2,1.1,0.85,0.60,1.0];

[0031] For any traffic or event within the time window, extract the topological characteristics of its source and destination nodes. and the corresponding time series vector ,according to[ ∥ ∥ The input vector is compressed to 128 dimensions using a random projection hash algorithm through concatenation. The specific implementation method is as follows: Let the concatenated input vector be... =[ ∥ ∥ ]∈ , For the original dimension, through the random projection matrix Compress it to 128 dimensions to obtain the compressed sample. ,in For normal vectors ( =1,…, ), For attack vector ( =1,…, ):

[0032]

[0033] in, It is a standardized function. It is a scaling factor used to control variance, ultimately generating a normal sample set. , and attack sample set .

[0034] Furthermore, the process of generating the initial detector includes:

[0035] A cluster of self-detectors is constructed using a large number of normal flow vectors. Then, non-self detector clusters are derived from the gaps in the self-clusters. Finally, through continuous evolution via crossover and mutation, in the stage of generating self-detectors, the normal sample vector is first... Merged into multiple intermediate clusters And calculate the Euclidean distance between clusters. ( ):

[0036]

[0037] in, Indicates intermediate cluster The centroid vector, The meaning is intermediate cluster The centroid vector, = Total number of clusters in the current loop, from the normal vector (Decrementing to the final number of clusters). If the distance between clusters exceeds a preset splitting threshold, merging stops, and the currently merged clusters are used to generate a self-detector cluster. :

[0038]

[0039] in, Let be the tolerance radius of the cluster;

[0040] Subsequently, in the non-self detector generation stage, the system inputs typical attack vectors into the training process, assuming the input for this round is the attack sample set. The attack vector is randomly injected into the self-boundary gap using a negative selection algorithm. Attack samples with high similarity to the self-detector are removed to filter out attack features that are significantly different from the normal pattern. Attack samples are then filtered by cosine similarity. This attack sample meets the following conditions. Considered a non-self detector, denoted as :

[0041]

[0042] in, For attack sample vectors, This is the initial cosine similarity threshold.

[0043] Furthermore, based on the initial detector population, the compressed antigen vector is detected to obtain the antigen vector that triggers the alarm, including:

[0044] When the deep autoencoder-graph neural network model outputs a new compressed antigen vector At that time, antigen vectors were processed in the order of "self first, then non-self". To conduct screening;

[0045] First, iterate through the set of self detectors. Calculate their Euclidean distance in vector space; if this distance does not exceed the radius scaling factor of the corresponding detector... Then the vector is considered If the condition falls within the normal boundaries, the process should be terminated immediately.

[0046] If all self-detectors fail to "match successfully" It was identified as a "survival antigen" and entered the second level of verification, subsequently being searched by index for other related antigens. Recent subset of non-self detectors And calculate the comprehensive anomaly score. :

[0047]

[0048] in For new antigen vectors Cosine similarity with candidate detectors, The attention weights (reflecting topological anomalies) of a graph neural network. For time window parameters, The original input vector, To reconstruct the input, It is a reconstruction error. For the index betweenness centrality of the topological graph, The calculation formula is:

[0049]

[0050] in, antigen vector The probability distribution function, whose values ​​include cosine similarity value, reconstruction error value, and betweenness centrality value; antigen vector The logarithmic probability; The entropy value is used to quantify the randomness of the feature distribution; the denominator is the entropy value. It is the sum of the entropy values ​​of the three feature dimensions, used to normalize the weights. The input is the feature distribution within the real-time statistical window. It is the first Each weight coefficient (i=1,2,3) As a weight for similarity with the detector, As the weight of the time series reconstruction error, The weights for topological anomalies;

[0051] like Exceeding the dynamic detection threshold If the condition is met, an alarm is immediately triggered and the detector database is updated synchronously; otherwise, it is classified as "to be observed" and the compressed 128-dimensional antigen vector is recorded in a short-term buffer.

[0052] Furthermore, it also includes optimizations for non-self detectors, including:

[0053] First, there is dynamic population evolution: Let the first... generation( Initial antibody detector population (iterated every 24 hours) for:

[0054]

[0055] in, This is the sum of the "anti-observation" antigen vectors in the short-term buffer and the original number of non-self detectors. For the current number of self-detectors, the population Includes non-self detectors With self-detector , The input population is generated using a negative selection algorithm and satisfies the following conditions:

[0056]

[0057] in The set of self detectors is the input. For the initial self detector The self-detector individual;

[0058] Next, antibody fitness assessment is performed at the initial antibody detector population screening stage, and the results are retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. (For crossover probability), for the parent detector Perform uniform crossover, randomly select gene sources at each position, and generate offspring. :

[0059]

[0060] in, It is a function that generates random numbers in the range [0,1). for Location data, then for offspring Applying Gaussian perturbation to enhance diversity yields mutated offspring. :

[0061]

[0062] in, Adjusted dynamically based on population diversity Let be a random perturbation vector that follows a normal distribution. With a mean of 0 and a covariance of Multidimensional Gaussian distribution ( (It is the identity matrix); The formula for dynamic adjustment is:

[0063]

[0064] in, Basic variation amplitude, The attenuation coefficient is... For the first Diversity indicators of generational populations The number of non-self detectors in the population. For any two distinct non-self detectors in the population , );

[0065] Next, parameter adjustments will be performed, among which... For state space, The action space is responsible for adjusting the detection threshold and fitness weights. For the reward function:

[0066]

[0067]

[0068] in, For dynamic detection threshold, As a weight for recall rate, As a weight for false alarm rate, To improve coverage against new types of attacks, To maintain population diversity, the parameters are then updated based on real-time feedback. During operation, the parameters are automatically corrected based on real-time alarms and false alarm statistics.

[0069] Furthermore, it also includes screening the initial antibody detector population, including:

[0070] The first step is to assess the fitness of the initial antibody detector population using the fitness function. Overall performance of the dynamic balance detector:

[0071]

[0072] in:

[0073]

[0074]

[0075]

[0076] Calculated based on real-time alarm verification results, Obtained through false alarm statistics A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, , The true positive rate, The false negative rate, It was a false positive. It is a true negative. For a new set of attack samples (i.e., attack types that did not appear during the training phase), Non-self detector With attack samples cosine similarity, For dynamic detection thresholds;

[0077] Next, selection and crossover are performed: a tournament selection algorithm is used, starting from the... Initial antibody detector population Five detectors were randomly selected from the pool, and the remaining ones were retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. , The crossover probability;

[0078] After the new generation detector is deployed to the test environment, it collects data over 24 hours. If the actual recall rate deviates from the simulated value by more than a threshold, the population re-initialization mechanism is triggered.

[0079] The present invention also provides an apparatus for the aforementioned method for risk monitoring of industrial control networks based on immune recognition, comprising:

[0080] The acquisition module is used to acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets.

[0081] A preprocessing module is used to preprocess the data to obtain a standardized antigen vector;

[0082] The training module is used to perform hybrid training on a preset deep autoencoder and graph neural network model based on a standardized antigen vector and an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model.

[0083] A compression module is used to input a standardized antigen vector into a lightweight model to obtain a compressed antigen vector.

[0084] The detection module is used to detect the compressed antigen vector based on the initial detector population to obtain the antigen vector that triggers the alarm.

[0085] The beneficial effects of this invention are as follows:

[0086] The proposed method and device for risk monitoring of industrial control networks based on immune recognition improves the clarity and scalability of the original protocol semantics through unified abstraction and pre-coding. The designed antibody detector population evolution mechanism ensures continuous coverage of unknown attacks by updating the generation every 24 hours in the cloud, combined with crossover and mutation methods. The cloud-edge collaborative training and inference separation framework optimizes the model deployment and update process. Attached Figure Description

[0087] Figure 1 This is a flowchart of the industrial control network risk monitoring method based on immune recognition according to the present invention.

[0088] Figure 2 This is a multi-layer system architecture diagram of network security risk monitoring for industrial control systems based on immune recognition, as described in an embodiment of the present invention.

[0089] Figure 3 This is a flowchart of the detector generation and training process in an embodiment of the present invention;

[0090] Figure 4 This is a flowchart of the dual-view encoding process based on a deep autoencoder-graph neural network model in an embodiment of the present invention;

[0091] Figure 5 This is a flowchart illustrating the screening and identification process based on detector-based antigen vectors in an embodiment of the present invention.

[0092] Figure 6 This is a flowchart of crossover mutation and parameter control in an embodiment of the present invention. Detailed Implementation

[0093] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0094] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0095] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0096] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0097] like Figure 1 As shown, the present invention provides a risk monitoring method for industrial control networks based on immune recognition, comprising:

[0098] S1: Acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets;

[0099] S2: Preprocess the data to obtain a standardized antigen vector;

[0100] S3: Based on the standardized antigen vector, the preset deep autoencoder and graph neural network model are trained in combination using the immune algorithm to obtain the trained deep autoencoder-graph neural network model and the initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model.

[0101] S4: Input the standardized antigen vector into the lightweight model to obtain the compressed antigen vector;

[0102] S5: Detect the compressed antigen vector based on the initial detector population to obtain the antigen vector that triggers the alarm.

[0103] The following description further illustrates the invention through its application in a multi-layered system for monitoring cybersecurity risks in industrial control systems based on immune recognition. This multi-layered system mainly comprises a data acquisition layer, an edge computing layer, and a cloud-based decision-making layer.

[0104] like Figure 2 As shown, the present invention provides a network security risk monitoring method for industrial control systems based on immune recognition, aiming to achieve rapid identification and diagnosis of unknown and known network threats to industrial control systems within a cloud-edge collaborative framework. The core of this method lies in employing immune technology, introducing a "self / non-self" recognition and evolution process, and constructing a population of antibody detectors capable of mutation and evolution by "antigenizing" multi-source traffic. The specific steps are as follows:

[0105] 1. Data Acquisition Layer: Data Acquisition and Preprocessing

[0106] This solution proposes a Lightweight Synthetic Probe (LSP), deployed at the edge nodes of industrial control networks (including log servers, cloud platform / edge node interfaces, and mirror ports of industrial firewalls / intrusion detection devices) to collect multi-source heterogeneous industrial control protocol traffic. Multi-source heterogeneous industrial control protocols refer to data from different devices, protocols, or transmission methods, such as Modbus, IEC-104, and MVB protocols. These typically employ different data formats and communication methods, creating a complex data environment within the industrial control system. The LSP combines embedded device hardware with data preprocessing software. The hardware utilizes an embedded single-board computer configured with a quad-core 1.5GHz processor, 2GB of RAM, and 16GB of storage, and includes two network interfaces (1× mirror traffic input, 1× management / backhaul). The operating system is a lightweight, trimmed-down version of Linux, retaining only the kernel, network stack, and drivers.

[0107] (1) Data collection

[0108] The core task of data acquisition is to capture multi-source heterogeneous industrial control protocol traffic in real time.

[0109] For example, the vehicle-mounted PLC converts MVB bus data into Ethernet frames via an Ethernet gateway and connects to the LSP's ETH1 port. Subsequently, the system slices the traffic for each protocol type according to a time window, generating raw data blocks (each block <1MB). For example, if there are 850 Modbus packets per second, the slice size = 850 × 128 bytes ≈ 109KB. The raw packets are written to a circular buffer (1MB) in arrival order, simultaneously marking the timestamp and source interface (ETH0 / ETH1). The buffer address is 0x0000-0xFFFF, and the write pointer resets to zero every 1MB. The timestamp field is appended to the header of each packet (8 bytes).

[0110] There are also expandable data collection points such as trackside equipment (e.g., signals, transponders), station equipment (e.g., platform door controllers, ticketing terminals), and cloud management platform interfaces.

[0111] This method enables real-time interception of multi-source heterogeneous industrial control protocol traffic.

[0112] (2) Data preprocessing

[0113] The core task of data preprocessing is to transform multi-source heterogeneous industrial control protocol messages into standardized semantic representations. First, redundant information (such as frame headers and checksums) is stripped from the original messages, retaining only the core operational semantics. Taking Modbus TCP as an example, its 12-byte MBAP header (containing addressing and message control information) is completely discarded during the conversion process. For the IEC-104 protocol, the type identifier 0x2E (6 bytes) in the remote control command “68 0E 00 00 00 00 00 00 00 00 2E 01 06 00 01 00 00 01” is mapped to the semantic label {single_point}, ultimately generating a dictionary storage with the structure {single_point: signal_light_23, ON}. For example, the original byte string of Modbus function code 03 (containing device address, register address, etc.) is simplified to the {operation:read_holding_registers} format.

[0114] To achieve unified encoding across protocols, the Protocol Buffers TLV (Tag-Length-Value) standard is adopted. Protocol Buffers is a data description language. Each field is encoded by first generating a composite Tag byte: the field number defined by the Protocol Buffers protocol is left-shifted by 3 bits and then bitwise ORed with the Wire Type (e.g., the Tag value of field number 1 + WireType 2 is 0x0A), where the Wire Type defines the data type parsing rules (e.g., 0 = Varint integer, 2 = length-separated string). Subsequently, binary data is optimized: numeric fields are compressed using the Varint algorithm (e.g., register address 0 is encoded as 0x00), and strings are converted to ASCII code (e.g., "L1" is encoded as 0x4C31).

[0115] The processed antigen vectors are transmitted to the edge server, where they are format-validated and then stored in the antigen pool of the edge computing layer. This method makes the semantics of the original data clearer and enhances its scalability after encoding. Simultaneously, by pre-encoding the protocol semantics, the protocol decoding load on the central server is reduced, significantly improving the monitoring performance of large-scale industrial control networks. The field encoding comparison table is shown in Table 1 below.

[0116] Table 1

[0117]

[0118] 2. Cloud-based decision-making layer: detector generation and model training

[0119] The goal of model training is to complete the training and compression of the Deep Autoencoder-Graph Neural Network model in the cloud, and generate an initial population of autologous / non-autologous antibody detectors. (Refer to...) Figure 3 This process employs a hybrid training strategy, where the cloud server mixes data from the known dataset with the actual industrial control network operation data collected by the LSP for training. This addresses the issue that specific devices in industrial control networks are not covered in the public dataset, ensuring the model's adaptability to specific industrial control network scenarios.

[0120] (1) Training of deep autoencoders

[0121] Deep autoencoders (DAs) are used to extract temporal features within a time window. First, through an encoder... Temporal features of encoding standardized antigen vectors The standardized antigen vector includes normal samples and attack samples.

[0122]

[0123] in It is a multilayer perceptron, employing a Long Short-Term Memory (LSTM) network. For encoder parameters, The output is the time series feature vector within a processed time window. 3D temporal feature vector. Next, the decoder... Reconstruct the original input as 3D time series feature vector :

[0124]

[0125] Through decoder function The decoder parameters are Reconstruct the original input for This ensures that key temporal information is preserved in the features. Reconstruction loss function. Defined as:

[0126]

[0127] in, It is the reconstruction loss function of the autoencoder, used to quantify the difference between the original input data and the decoder's reconstructed output. The number of semantic tuples contained within the time window (i.e., the total number of time steps). , The square of the Euclidean distance. For time step The original input feature vector, For time step The reconstructed output feature vector is obtained. If the loss function converges, it means that the original input of the reconstruction correctly preserved the key temporal information.

[0128] (2) Training of graph neural network encoder

[0129] Graph Neural Network (GNN) This is used to construct a dynamic topology graph based on the association relationships of standardized antigen vector samples within the same time window. Nodes in the graph represent devices (such as PLCs, switches, etc.), and node features include device type and status. Edges represent communication relationships between devices, and edge weights are the communication frequency or traffic volume. The graph convolutional layer propagation formula is as follows:

[0130]

[0131] in, This represents the adjacency matrix plus self-loop connections. It is the identity matrix. An adjacency matrix representing the real-time communication relationships between devices. This matrix is ​​reconstructed for each time window based on the real-time communication data. Used for real-time connection between dynamic encoding devices; The degree matrix is ​​used for weighted aggregation of the adjacency matrix features; For the first Layer node features ( Use 2-3 layers, employing a shallow network to prevent over-smoothing. These are learnable weights; This refers to the activation function in a neural network. It updates node features by aggregating information from the adjacency matrix, ultimately outputting the node feature matrix. Embedding matrix H (dimension 1) ,in It is the number of nodes. It's the feature dimension. Node ∈ initial features It consists of two parts: the first part is discrete attributes such as device type (e.g., PLC, switch, ATS) and hardware model, which are converted into dense vectors through an embedding layer; the second part is the device's runtime status (CPU load, memory usage, port status) after normalization and direct concatenation.

[0132]

[0133] in, ( The node's discrete device type (e.g., "PLC" / "ATS") is indicated by the embedded layer. The mapping is a 3D dense vector, for example, PLC → [0.8,−0.2,1.1]; Represents the node's running state vector Such as CPU load, memory usage, port status After Min-Max normalization function After normalization, a 3-dimensional standardized vector is obtained, for example, [cpu=85%,mem=60%,port=1] → [0.85,0.60,1.0]. Through... The concatenation function produces a 6-dimensional vector. =[0.8,−0.2,1.1,0.85,0.60,1.0].

[0134] Vector fusion and mapping are then performed. For any traffic or event within the time window, the topological features of its source and destination nodes are extracted. (These are all features of the final output layer) and their corresponding time vectors ,according to[ ∥ ∥ The input vector is cascaded in a [concatenation method]. This allows the immune detector to simultaneously acquire information on temporal anomalies and topological dependencies. The input vector is compressed to 128 dimensions using a Random Projection (RP) hash algorithm. The specific implementation method is as follows: Let the cascaded input vector be... =[ ∥ ∥ ]∈ ( (original dimension), through a random projection matrix Compress it to 128 dimensions to obtain the compressed sample. ,in For normal vectors ( =1,…, ). For attack vector ( =1,…, ):

[0135]

[0136] in, It is a standardized function. This is a scaling factor used to control variance. The final result is a set of normal samples. With attack sample set .

[0137] (3) Initial detector generation

[0138] Based on the "self / non-self" partitioning concept in biological immunology, the initialization process employs a hybrid training strategy. The cloud server mixes the existing CIC Modbus dataset 2023 with actual industrial control system (ICS) operation data for initial training. The CIC dataset includes the Modbus TCP protocol and contains nine typical ICS attacks (scanning, flooding, payload delivery, response delay, length modification, spoofing, frame stacking, brute-force writing, replay attacks, etc.), simultaneously covering both publicly available datasets and relevant ICS protocol datasets collected in practice.

[0139] First, a cluster of self-detectors is constructed using a large number of normal traffic vectors. Then, non-self detector clusters are derived from the gaps in the self-clusters. Finally, it continues to evolve through crossover and mutation to ensure long-term sensitivity to unknown attacks. In the self-detector generation stage, the normal sample vector is first... Merged into multiple intermediate clusters And calculate the Euclidean distance between clusters. ( ):

[0140]

[0141] in, Indicates intermediate cluster The centroid vector, = Total number of clusters in the current loop, from the normal vector (Decrementing to the final number of clusters). If the distance between clusters exceeds a preset splitting threshold, merging stops, and the currently merged clusters are used to generate a self-detector cluster. :

[0142]

[0143] in, Let be the tolerance radius of the cluster. This allows for the rapid delineation of the "normal boundary" using a small number of representative centers.

[0144] Subsequently, in the non-self detector generation stage, the system inputs typical attack vectors into the training process, assuming the input for this round is the attack sample set. Attack vectors are randomly injected into the self-boundary gaps using a negative selection algorithm. Attack samples with high similarity to the self-detector are removed to filter out attack features that are significantly different from the normal pattern. Attack samples are then filtered using cosine similarity. This attack sample meets the following conditions. Considered a non-self detector, denoted as :

[0145]

[0146] in, This is an attack sample vector (malicious traffic characteristics). =0.15 is the initial cosine similarity threshold.

[0147] (4) Model compression

[0148] The core objective of model parameter compression is model lightweighting. This is achieved through lightweight knowledge distillation during the training of the deep autoencoder-graph neural network model. A large teacher model is used in the cloud to train a small student model (a compressed version of the model). The teacher model learns normal / attack modes, and the student model mimics its output, achieving high-precision compression. Next, layer pruning is performed, removing redundant layers (the deep decoder of the autoencoder) and retaining only the encoder and shallow graph neural network, focusing on key feature extraction. Finally, deployment optimization is implemented. The compressed model is serialized in Protocol Buffers format and periodically distributed through a cloud-edge collaborative framework to ensure that the edge model is lightweight and up-to-date.

[0149] 3. Edge Computing Layer: Vector Antigenization Based on Deep Autoencoder-Graph Neural Network Model

[0150] This part resides in the edge computing layer and employs a training and inference separation mechanism. After training and compressing the behavioral features such as periodic instructions and register operations in the cloud, the edge server only needs to use the compressed, lightweight model for inference.

[0151] Reference Figure 4 The input is a standardized antigen vector (corresponding to the flow rate of a time window) generated by data preprocessing. First, a trained deep autoencoder... Extracting temporal features .

[0152] Subsequently, a graph neural network encoder was used to construct a dynamic graph based on real-time communication data and to calculate node features. For each traffic / event, the source node topology characteristics are... Target node topology features Cascaded with time series features Applying a random projection matrix These features are compressed to output the compressed antigen vector. .

[0153] 4. Edge computing layer: Detection based on antigen vectors from detectors

[0154] like Figure 5 As shown, when the deep autoencoder-graph neural network model outputs a new antigen vector At that time, the platform performs the screening in the order of "self-identified first, then non-self-identified". The system first traverses the set of self-identified detectors. Calculate their Euclidean distance in vector space; if this distance does not exceed the radius scaling factor of the corresponding detector... Then the vector is considered If the data falls within the normal boundaries, the process is terminated immediately. This filters out a large amount of regular traffic at a low computational cost while maintaining a high recall rate for normal behavior patterns. If all self-detectors fail to "match," It was identified as a "survival antigen" and entered the second level of verification. The system then retrieved the remaining related antigens by index. Recent subset of non-self detectors And calculate the comprehensive anomaly score. :

[0155]

[0156] in For new antigen vectors Cosine similarity with candidate detectors, The attention weights (reflecting topological anomalies) of a graph neural network. For time window parameters, The original input vector, To reconstruct the input, It is a reconstruction error. The index betweenness centrality in the topological graph. The calculation formula is:

[0157]

[0158] in, antigen vector The probability distribution function, whose values ​​include cosine similarity value, reconstruction error value, and betweenness centrality value; antigen vector The logarithmic probability; The entropy value is used to quantify the randomness of the feature distribution; the denominator is the entropy value. It is the sum of the entropy values ​​of the three feature dimensions, used to normalize the weights. The input is the feature distribution within the real-time statistical window. It is the first Each weight coefficient ( =1,2,3), As a weight for similarity with the detector, As the weight of the time series reconstruction error, The weights for topological anomalies.

[0159] like Exceeding the dynamic detection threshold If the condition is met, the system will immediately trigger an alarm and synchronously update the detector database of the cloud decision layer; otherwise, it will be classified as "to be observed" and the compressed 128-dimensional antigen vector will be recorded in a short-term buffer and subsequently sent for cross-mutation to correct subsequent thresholds without affecting normal business operations.

[0160] 5. Cloud-based decision-making layer: Cross-variation and parameter regulation

[0161] The core objective of this section is the dynamic optimization of non-self detectors. The specific process is as follows: Figure 6 As shown.

[0162] (1) Crossover variation

[0163] First, there is dynamic population evolution: Let the first... generation( Antibody detector population (iterates every 24 hours) for:

[0164]

[0165] in, This is the sum of the "anti-observation" antigen vectors in the short-term buffer and the original number of non-self detectors. The current number of self-detectors. Population. Includes non-self detectors With self-detector , The input population is generated using a negative selection algorithm and satisfies the following conditions:

[0166]

[0167] in The set of self detectors is the input. For the initial self detector The self-detector individual in the process.

[0168] The next step is to assess antibody fitness in the antibody detector population screening. The results of the assessment are retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. (For crossover probability). For the parent detector Perform uniform crossover, randomly select gene sources at each position, and generate offspring. :

[0169]

[0170] in, It is a function that generates random numbers in the range [0,1). for Locational data. Then, for offspring... Applying Gaussian perturbation to enhance diversity yields mutated offspring. :

[0171]

[0172] in, Adjusted dynamically based on population diversity Let be a random perturbation vector that follows a normal distribution. With a mean of 0 and a covariance of Multidimensional Gaussian distribution ( It is the identity matrix. The formula for dynamic adjustment is:

[0173]

[0174] in, Basic variation amplitude, The attenuation coefficient is... For the first Diversity indicators of generational populations The number of non-self detectors in the population. For any two distinct non-self detectors in the population , ).

[0175] (2) Parameter control

[0176] Next, parameter adjustments will be performed, among which... For state space, The action space is responsible for adjusting the detection threshold and fitness weights. For the reward function:

[0177]

[0178]

[0179] in, For dynamic detection threshold, As a weight for recall rate, This is the weight for the false alarm rate. To improve coverage against new types of attacks, To maintain population diversity, the system then updates these parameters based on real-time feedback. During operation, the system automatically corrects the parameters based on real-time alarm and false alarm statistics to optimize detection performance.

[0180] 6. Cloud-based decision-making layer: Antibody detector population screening

[0181] The first step is to assess the fitness of the antibody detector population, using the fitness function. Overall performance of the dynamic balance detector:

[0182]

[0183] in:

[0184]

[0185]

[0186]

[0187] Calculated based on real-time alarm verification results, Obtained through false alarm statistics A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, . The true positive rate, The false negative rate, It was a false positive. It is a true negative. For a new set of attack samples (i.e., attack types that did not appear during the training phase), Non-self detector With attack samples cosine similarity, This is the dynamic detection threshold.

[0188] Next, we proceed with selection and crossover: using a tournament selection method, starting from the [number]th [stage / section / section]... Antibody detector population Five detectors were randomly selected from the pool, and the remaining ones were retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. (This refers to the crossover probability).

[0189] After the new generation detector is deployed to the test environment, it collects data over 24 hours. If the actual recall rate deviates from the simulated value by more than a threshold (i.e., ... If this occurs, the population reinitialization mechanism will be triggered.

[0190] The present invention also provides an apparatus for the aforementioned method for risk monitoring of industrial control networks based on immune recognition, comprising:

[0191] The acquisition module is used to acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets.

[0192] A preprocessing module is used to preprocess the data to obtain a standardized antigen vector;

[0193] The training module is used to perform hybrid training on a preset deep autoencoder and graph neural network model based on a standardized antigen vector and an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector population. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model.

[0194] A compression module is used to input a standardized antigen vector into a lightweight model to obtain a compressed antigen vector.

[0195] The detection module is used to detect the compressed antigen vector based on the initial detector population to obtain the antigen vector that triggers the alarm.

[0196] The advantages of this invention compared to the prior art are as follows:

[0197] 1. This paper proposes an antigenicization method for industrial control protocol traffic based on "probe acquisition – semantic abstraction – dual-view encoding". Existing methods struggle to achieve unified modeling when processing multi-source heterogeneous industrial control protocol traffic, and suffer from heavy computational burden and poor real-time performance in central decoding. This invention designs a lightweight edge acquisition and encoding scheme. First, lightweight acquisition probes deployed at the edge enable real-time capture and protocol abstraction of multi-source traffic. A compact byte compression strategy is used to standardize the expression of fields such as operation type and address, reducing the decoding overhead of the central server. Subsequently, the processing results are fed into a dual-view encoding module, which integrates topological relationships and temporal features to complete the immune antigen expression of the traffic, providing a unified vector input for subsequent antigen vector detection.

[0198] 2. A novel unknown attack detector generation method based on a dual-cluster modeling and evolution mechanism of "self / non-self" is proposed. Existing detection methods generally rely on known samples for training, making it difficult to effectively identify unknown threats that deviate from normal characteristics. This invention draws on biological immune mechanisms, first constructing a self-detector cluster using normal flow, and then deriving a non-self-detector cluster from its feature gaps. Through tournament selection, uniform crossover, and mutation, the non-self-detector population is continuously evolved to achieve adaptive detection of unknown threats. This method supports a 24-hour self-updating strategy for the detectors, possessing long-term detection sensitivity and generalization ability.

[0199] 3. A training-inference separation immune detection method based on a cloud-edge collaborative architecture is proposed. Traditional intrusion detection methods struggle to simultaneously achieve both detection accuracy and operational efficiency on limited devices, especially when updating detector models or adapting to environmental changes, where deployment bottlenecks exist. This invention designs a collaborative architecture of cloud-based training and edge-based inference. The training, compression, and detector optimization of the deep autoencoder-graph neural network model are completed in the cloud, while only a lightweight model needs to be deployed at the edge for rapid inference. A 128-dimensional antigen vector is generated through random projection compression, and a new generation of detectors and parameters are periodically distributed to achieve dynamic adaptation and low-latency operation of the detection strategy, meeting the real-time monitoring requirements of large-scale industrial control networks.

[0200] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A risk monitoring method for industrial control networks based on immune recognition, characterized in that, include: Acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets; The data is preprocessed to obtain a standardized antigen vector; Based on the standardized antigen vector, the pre-set deep autoencoder and graph neural network model are trained in a hybrid manner using an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model. The standardized antigen vector is input into the lightweight model to obtain the compressed antigen vector; The compressed antigen vector is detected based on the initial detector to obtain the antigen vector that triggers the alarm; The process of generating the initial detector includes: Constructing a cluster of self-detectors using normal flow vectors Then, non-self detector clusters are derived from the gaps in the self-clusters. , It is a non-self detector. As a self-detector, it continues to evolve through crossover and mutation. In the stage of generating the self-detector, the normal sample vector is first... Merge into multiple intermediate clusters C, and calculate the Euclidean distance between the clusters. , The Euclidean distance calculation formula is: in, Indicates intermediate cluster The centroid vector, Indicates intermediate cluster The centroid vector, k = the total number of clusters in the current loop, decreasing from the normal vector n to the final number of clusters. If the distance between clusters exceeds a preset splitting threshold, merging stops, and the currently merged clusters are used to generate the self-detector cluster S. in, Let be the tolerance radius of the cluster; Subsequently, in the non-self detector generation stage, the system inputs typical attack vectors into the training process, assuming the input for this round is the attack sample set. The attack vector is randomly injected into the self-boundary gap using a negative selection algorithm. Attack samples are then filtered by cosine similarity. If the cosine similarity... This attack sample meets the following conditions. Considered a non-self detector, denoted as : in, For attack sample vectors, This is the initial cosine similarity threshold.

2. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, Multi-source heterogeneous industrial control protocol traffic data includes continuously accessed data from deployed lightweight acquisition probes, which include log servers, cloud platform or edge node interfaces, industrial firewalls or intrusion detection device mirror ports.

3. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, Preprocessing the data includes: Remove redundant information from the data and retain only the core operational semantics; The data is uniformly encoded.

4. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, The training process of a deep autoencoder includes: via encoder Temporal features of encoding standardized antigen vectors The standardized antigen vector includes normal samples and attack samples: in It is a multilayer perceptron, employing a long short-term memory network. Here, X represents the encoder parameters, X is the temporal feature vector within a processed time window, and the output is a d-dimensional temporal feature vector. Then, the decoder... Reconstruct the original input into a d-dimensional temporal feature vector : Through decoder function The decoder parameters are Reconstruct the original input X as Reconstruction loss function Defined as: in, It is the reconstruction loss function of the autoencoder, used to quantify the difference between the original input data and the decoder's reconstructed output. T is the number of semantic tuples contained in the time window, i.e., the total number of time steps. The square of the Euclidean distance. This is the original input feature vector at time step t. The reconstructed output feature vector is given at time step t.

5. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, Training a graph neural network model includes: A dynamic topology graph is constructed based on the association relationships of standardized antigen vector samples within the same time window. Nodes in the dynamic topology graph represent devices, and node features include device type and status. Edges represent communication relationships between devices, and edge weights are communication frequency or traffic volume. The graph convolutional layer propagation formula is as follows: in, This represents the adjacency matrix plus the identity matrix, where I is the identity matrix and Z represents the adjacency matrix of real-time communication relationships between devices. Z is reconstructed based on real-time communication data for each time window, and is used to dynamically encode real-time connections between devices. The degree matrix is ​​used for weighted aggregation of the adjacency matrix features; For the first Layer node features; These are learnable weights; This is an activation function in a neural network that updates node features by aggregating information from the adjacency matrix, ultimately outputting a node feature matrix. The embedding matrix H has a dimension of . Where |V| is the number of nodes, V is the set of nodes, K is the feature dimension, and the number of nodes is... Initial features of ∈V It consists of two parts: the first part is a dense vector formed by transforming the discrete attributes of the device or hardware through the embedding layer; the second part is a direct concatenation of the normalized runtime states of the device. in, Indicates the discrete device type of the node. Through the embedding layer Mapped to a 3D dense vector; The node's running state vector is normalized using the Min-Max normalization function Norm() to obtain a 3D normalized vector, and then concatenated using the Concat() function to obtain a 6D vector. =[0.8,−0.2,1.1,0.85,0.60,1.0]; For any traffic or event within the time window, extract the topological characteristics of its source and destination nodes. and the corresponding time series vector ,according to[ ∥ ∥ The input vector is compressed to 128 dimensions using a random projection hash algorithm through concatenation. The specific implementation method is as follows: Let the concatenated input vector be... [ ∥ ∥ ]∈ d is the original dimension, projected through a random projection matrix. Compress it to 128 dimensions to obtain the compressed sample. ,in For normal vectors, i=1,…,k, Let j = 1, ..., m be the attack vector and the sample. The expression is: in, It is a standardized function. It is a scaling factor used to control variance, ultimately generating a normal sample set. , and attack sample set .

6. The industrial control network risk monitoring method based on immune recognition according to claim 5, characterized in that, Based on the initial detector, the compressed antigen vector is detected to obtain the antigen vector that triggers the alarm, including: When the deep autoencoder-graph neural network model outputs a new compressed antigen vector At that time, antigen vector x is screened in the order of self first, then non-self; First, iterate through the set S of self-detectors and calculate their Euclidean distance in the vector space; if the distance does not exceed the radius scaling factor of the corresponding detector... If the vector x falls within the normal boundary, the process is immediately terminated. If all self-detectors fail to match, x is identified as a viable antigen and enters the second-level validation stage. Subsequently, the remaining subsets of non-self-detectors closest to x are retrieved by index. And calculate the comprehensive anomaly score. : in Let x be the cosine similarity between the new antigen vector x and the candidate detector. Here, T represents the attention weights in the graph neural network, reflecting the topological anomaly, and T is the time window parameter. The original input vector, To reconstruct the input, It is a reconstruction error. For the index betweenness centrality of the topological graph, The calculation formula is: Wherein, P(x) is the probability distribution function of the antigen vector x, and its values ​​include cosine similarity value, reconstruction error value and betweenness centrality value; Let x be the logarithmic probability of the antigen vector algebra. The entropy value is used to quantify the randomness of the feature distribution; the denominator is the entropy value. It is the sum of the entropy values ​​of the three feature dimensions, used to normalize the weights. The input is the feature distribution within the real-time statistical window. It is the i-th weight coefficient, i=1,2,3. As a weight for similarity with the detector, As the weight of the time series reconstruction error, The weights for topological anomalies; like Exceeding the dynamic detection threshold If the target is found to be positive, an alarm will be triggered immediately and the detector database will be updated synchronously; otherwise, it will be classified as pending observation and the compressed 128-dimensional antigen vector will be recorded in a short-term buffer.

7. The industrial control network risk monitoring method based on immune recognition according to claim 6, characterized in that, This also includes optimizations for non-self detectors, including: First, let's consider the dynamic population evolution: Let's say it's generation t, and t iterates every 24 hours, starting with the initial antibody detector population. for: Where k is the sum of the antigen vector to be observed in the short-term buffer and the original number of non-self detectors, m is the current number of self detectors, and the population... Includes non-self detectors With self-detector , The input population is generated using a negative selection algorithm and satisfies the following conditions: in The set of self detectors is the input. The set of self detectors for input The self-detector individual in the middle, The set of non-self detectors for input; Next, antibody fitness assessment is performed at the initial antibody detector population screening stage, and the results are retained. The two detectors with the highest fitness They enter the mating pool and repeat the process of uniform cross-pollination until the mating pool reaches a certain size. , , For the crossover probability, the parent detector Perform uniform crossover, randomly select gene sources at each position, and generate offspring. : in, It is a function that generates random numbers in the range [0,1). For the data at position num, then for the child generation Applying a Gaussian perturbation yields the mutated offspring. : in, Adjusted dynamically based on population diversity Let be a random perturbation vector that follows a normal distribution. With a mean of 0 and a covariance of The multidimensional Gaussian distribution of , where I is the identity matrix; The formula for dynamic adjustment is: in, Basic variation amplitude, The attenuation coefficient is... Let be the diversity index of the t-th generation population, and k be the number of non-self detectors in the population. For any two distinct non-self detectors in the population. , ; Next, parameter adjustments will be performed, among which... For state space, The action space is responsible for adjusting the detection threshold and fitness weights. For the reward function: in, For dynamic detection threshold, As a weight for recall rate, As a weight for false alarm rate, To improve coverage against new types of attacks, For population diversity, For recall rate, The false positive rate is set, and the above parameters are then updated based on real-time feedback. During operation, the parameters are automatically corrected based on real-time alarms and false alarm statistics.

8. The industrial control network risk monitoring method based on immune recognition according to claim 1, characterized in that, This also includes screening the initial antibody detector population, including: The first step is to assess the fitness of the initial antibody detector population using the fitness function. Overall performance of the dynamic balance detector: in: Calculated from real-time alarm verification results, FPR is obtained through false alarm statistics. A coefficient used to measure coverage against new types of attacks. Dynamically adjusted by crossover mutation, TP represents the true positive rate, FN represents the false negative rate, FP represents the false positive rate, and TN represents the true negative rate. This is a new set of attack samples, i.e., attack types that did not appear during the training phase. Non-self detector Cosine similarity to attack sample a For dynamic detection thresholds; Next, selection and crossover are performed: a tournament selection algorithm is used, starting from the initial antibody detector population in generation t. Five detectors were randomly selected from the pool, and the remaining ones were retained. The two detectors with the highest fitness Enter the mating pool and repeat the uniform crossover until the mating pool reaches a certain size. , The crossover probability; After the new generation detector is deployed to the test environment, it collects TP, FP, and FN data within 24 hours. If the actual recall rate deviates from the simulated value by more than a threshold, the population re-initialization mechanism is triggered.

9. An apparatus for use in the industrial control network risk monitoring method based on immune recognition as described in any one of claims 1-8, characterized in that, include: The acquisition module is used to acquire data, which includes real-time collected multi-source heterogeneous industrial control protocol traffic data and known datasets, including normal sample sets and attack sample sets. A preprocessing module is used to preprocess the data to obtain a standardized antigen vector; The training module is used to perform hybrid training on a preset deep autoencoder and graph neural network model based on a standardized antigen vector and an immune algorithm to obtain a trained deep autoencoder-graph neural network model and an initial detector. During training, the deep autoencoder-graph neural network model is compressed and encoded to obtain a lightweight model. A compression module is used to input a standardized antigen vector into a lightweight model to obtain a compressed antigen vector. The detection module is used to detect the compressed antigen vector based on the initial detector to obtain the antigen vector that triggers the alarm.

Images