Power industrial control flow application layer message anomaly detection method and device and electronic equipment

Abstract

The application discloses a power industrial control flow application layer message anomaly detection method and device and electronic equipment. The method comprises the following steps: collecting all messages of an industrial control network of a power system in real time; based on a preset industrial control protocol behavior characteristic map, filtering out suspicious flow segments deviating from a normal communication paradigm from the all messages of the industrial control network to generate a suspicious flow event chain; performing protocol field normalization processing on the suspicious flow event chain to extract a cross-level attack feature set; inputting the cross-level attack feature set into an attack identification model trained by federated learning for multi-round verification to obtain a determined attack sample with an attack confidence meeting a preset standard; and determining an attack category and a propagation path based on attack sample tracing through an attack feature pedigree. In the application, unknown attacks are captured through a protocol behavior characteristic map, cross-level feature extraction improves recognition ability, federated learning and multi-round verification reduce false negatives and false positives, and event chains and pedigree tracing track the whole process of attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric power, in particular to an electric power industrial control flow application layer message anomaly detection method and device and electronic equipment. BACKGROUND

[0002] With the acceleration of the intelligentization process of the electric power system, the industrial control network has become the core infrastructure to ensure the stable operation of electric power, which carries key business data transmission such as substation automation control, distribution terminal monitoring, and load dispatching. However, the industrial control network is facing increasingly serious network attack threats. Once a network attack occurs, it will cause abnormal shutdown of electric power equipment, data leakage, and even large-scale power outage accidents. Therefore, it is of great practical significance to accurately identify attack behaviors in industrial control flow.

[0003] At present, the attack identification of electric power industrial control flow mainly adopts a static detection method based on a feature library. This kind of method pre-defines the feature codes of known attacks (such as specific malicious instruction sequences and abnormal port access patterns), and performs feature matching on the collected flow data. When a flow segment consistent with the feature library is detected, it is determined as an attack behavior. At the same time, some schemes will combine a simple threshold judgment mechanism, such as setting the fluctuation range of message length and the upper limit of instruction interaction frequency, and if the threshold is exceeded, an alarm will be triggered.

[0004] In the above-mentioned existing scheme, the known attack feature library is excessively relied on, and the identification ability of unknown attacks or variant attacks is weak, which is difficult to cope with the dynamic evolution of attack means. Moreover, the threshold setting is mostly a fixed value, which cannot adapt to the differences in communication characteristics of different protocols and different time periods in the electric power industrial control network, and is prone to high false positive rate and false negative rate, especially in complex attack scenarios, it is difficult to effectively track the complete chain and root cause of the attack, which brings great hidden dangers to the security protection of the electric power system. SUMMARY

[0005] The embodiments of the present application provide an electric power industrial control flow application layer message anomaly detection method and device and electronic equipment to solve or alleviate the technical defects in the prior art.

[0006] An electric power industrial control flow application layer message anomaly detection method, comprising the following steps:

[0007] Step 1, collecting all messages of the industrial control network of the electric power system in real time;

[0008] Step 2, based on a pre-set industrial control protocol behavior feature map, filtering suspicious flow segments deviating from the normal communication paradigm from the all messages of the industrial control network to generate a suspicious flow event chain;

[0009] Step 3, performing protocol field normalization processing on the suspicious flow event chain to extract a cross-level attack feature set;

[0010] Step 4, input the cross-level attack feature set into the attack discrimination model trained by federated learning for multiple rounds of verification, and obtain determined attack samples with attack confidence meeting preset standards;

[0011] Step 5, determine the attack category and propagation path based on attack sample tracing through the attack feature pedigree.

[0012] Optionally, step 1, real-time collection of industrial control network full message of the power system, specifically including:

[0013] Step 11: Obtain the multi-protocol message collected by the key communication link deployed in the power industrial control network;

[0014] Step 12: Time stamp alignment of the multi-protocol message to construct an initial full message database containing message arrival time, protocol type, source / destination address and load content;

[0015] Step 13: Integrity check of the initial full message database, and remove damaged message data in the transmission process through CRC redundancy check to obtain an effective full message database.

[0016] Optionally, step 2, based on the preset industrial control protocol behavior feature map, suspicious traffic segments deviating from the normal communication paradigm are screened from the industrial control network full message to generate suspicious traffic event chains, specifically including:

[0017] Step 21: Calculate the matching degree of each message sequence in the industrial control network full message with the corresponding protocol behavior mode in the industrial control protocol behavior feature map to generate behavior deviation quantization value;

[0018] Step 22: Set a deviation threshold dynamically adjusted based on the protocol type, and when the behavior deviation quantization value of the message sequence exceeds the deviation threshold, mark the message sequence as a suspicious traffic segment;

[0019] Step 23: Correlation analysis of the marked suspicious traffic segments, merging segments belonging to the same communication session to form suspicious traffic event chains.

[0020] Optionally, step 22: Set a deviation threshold dynamically adjusted based on the protocol type, and when the behavior deviation quantization value of the message sequence exceeds the deviation threshold, mark the message sequence as a suspicious traffic segment, specifically including:

[0021] Step 221, construct a protocol type-threshold mapping table, and initialize the baseline deviation threshold for different industrial control protocols based on the behavior deviation distribution characteristics of historical normal communication samples;

[0022] Step 222, based on the protocol communication load fluctuation coefficient, real-time monitoring of each protocol in the message sequence corresponding to the current period of communication busy degree, to dynamically adjust the baseline deviation threshold to obtain the adjusted deviation threshold;

[0023] Step 223, when the behavior deviation of the message sequence exceeds the adjusted deviation threshold, mark it as a suspicious traffic segment.

[0024] Optionally, step 3, performing protocol field normalization processing on the suspicious traffic segment to extract a cross-layer attack feature set, specifically including:

[0025] Step 31: Construct an event chain analysis engine to perform session integrity verification on the suspicious traffic event chain, associate dispersed traffic segments of the same attack event through session identification to form an attack behavior sequence;

[0026] Step 32: For the attack behavior sequence, use protocol field hierarchical parsing to extract structured fields of different industrial control protocols, and convert unstructured load data into quantifiable feature parameters containing field offset, data type and check value;

[0027] Step 33: According to the time sequence position of the field appearing in the suspicious traffic event chain and the correlation degree with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the suspicious traffic event chain corresponding to the session initialization stage and the instruction execution stage;

[0028] Step 34: Map heterogeneous fields of different industrial control protocols to a unified feature space to construct a standardized field matrix containing a timestamp dimension;

[0029] Step 35: Based on the standardized field matrix and the key fields, cross-event chain feature extraction is performed to generate a cross-layer attack feature set, including protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

[0030] Optionally, step 4, input the cross-layer attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain determined attack samples with attack confidence meeting the preset standard, specifically including:

[0031] Step 41: Perform feature dimension verification on the cross-layer attack feature set, use principal component analysis combined with maximum information coefficient to filter core features, remove redundant features, and at the same time, perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set;

[0032] Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set.

[0033] Step 43: Initiate a three-round progressive verification mechanism. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. The comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

[0034] Optionally, step 5, determining the attack category and propagation path based on attack sample tracing through attack feature genealogy, specifically includes:

[0035] Step 51: Extract the core feature vector of the identified attack sample, including abnormal patterns of protocol fields, command interaction sequences, target device type, and attack payload characteristics;

[0036] Step 52: Calculate the similarity matrix between the core feature vector and the features of each node in the attack feature spectrum;

[0037] Step 53: When the maximum similarity in the similarity matrix exceeds the spectrum matching threshold, trace the corresponding attack category node in the attack feature spectrum, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

[0038] Optionally, step 53: When the maximum similarity in the similarity matrix exceeds the lineage matching threshold, trace the corresponding attack category node in the attack feature lineage, and determine the attack propagation path by combining the propagation feature library associated with the attack category node, specifically including:

[0039] Step 531: Based on the index value corresponding to the maximum similarity in the similarity matrix, locate the matching attack category node in the attack feature spectrum, extract the attack type identifier, typical attack vector and historical propagation record stored in the node, and generate attack category benchmark information.

[0040] Step 532: Extract propagation feature parameters from the attack category baseline information, retrieve typical propagation ports, device penetration priorities and communication protocol preferences of this type of attack from the propagation feature library associated with the attack category node, and construct a preliminary propagation pattern outline.

[0041] Step 533, time sequence correlation processing is performed on the preliminary propagation mode profile, the source / destination device sequence in the determined attack sample and the message interaction time sequence are dynamically compared with the propagation mode profile, and a potential propagation chain that meets the propagation rule is screened out through a time sequence correlation algorithm;

[0042] Step 534, topological reachability verification is performed on the potential propagation chain, the actual connection relationship of each device on the link is verified in combination with the power industrial control network physical topology graph, false paths that are not topologically reachable are eliminated, and the actual propagation path of the attack in the physical network is finally determined.

[0043] A power industrial control flow application layer message anomaly detection device comprises:

[0044] An acquisition unit is configured to acquire full-volume messages of an industrial control network of a power system in real time.

[0045] A screening unit is configured to screen suspicious flow segments deviating from normal communication norms from the full-volume messages of the industrial control network based on a preset industrial control protocol behavior feature map to generate a suspicious flow event chain.

[0046] A normalization unit is configured to perform protocol field normalization processing on the suspicious flow event chain to extract a cross-level attack feature set.

[0047] A verification unit is configured to input the cross-level attack feature set into an attack identification model trained through federated learning for multiple rounds of verification to obtain a determined attack sample with an attack confidence meeting a preset standard.

[0048] An attack identification unit is configured to determine an attack category and a propagation path based on attack sample tracing through an attack feature pedigree.

[0049] An electronic device comprises a memory and a processor, the memory has stored thereon a computer executable program, and the processor executes the computer executable program to implement the method according to any one of the embodiments of the present application.

[0050] In the embodiment of the present application, suspicious traffic fragments deviating from the normal communication paradigm are screened based on the preset industrial control protocol behavior feature map, which is no longer limited to known attack features, and can capture various abnormalities deviating from the normal paradigm, including unknown and variant attacks; by performing protocol field normalization processing on the suspicious traffic event chain and extracting a cross-layer attack feature set, attack-related features can be fully mined, and the recognition ability of new attacks can be improved. In addition, screening based on the preset industrial control protocol behavior feature map can be combined with different protocol characteristics; by inputting the cross-layer attack feature set into the attack identification model trained by federated learning for multiple rounds of verification, federated learning training can adapt the model to different scenarios, and the multiple-round verification mechanism can dynamically adjust the judgment standard to reduce the false positive rate and the false negative rate. The suspicious traffic event chain is generated, which can integrate attack-related scattered traffic to determine the attack category and propagation path based on attack sample tracing through the attack feature spectrum, which can clearly track the complete process and root cause of the attack, and provide accurate basis for power system security protection. BRIEF DESCRIPTION OF DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0052] Figure 1 The flowchart of a power industrial control traffic application layer message anomaly detection method according to an embodiment of the present application.

[0053] Figure 2 The structural diagram of a power industrial control traffic application layer message anomaly detection device according to an embodiment of the present application.

[0054] Figure 3 The structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments only constitute some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0056] As shown in Figure 1 The present application provides a power industrial control traffic application layer message anomaly detection method, which includes the following steps:

[0057] Step 1, real-time collection of industrial control network full message of power system;

[0058] Step 2, based on the preset industrial control protocol behavior feature map, the suspicious traffic fragments deviating from the normal communication paradigm are screened out from the industrial control network full message to generate a suspicious traffic event chain;

[0059] Step 3, performing protocol field normalization processing on the suspicious traffic event chain to extract a cross-layer attack feature set;

[0060] Step 4, inputting the cross-layer attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain a determined attack sample with an attack confidence meeting a preset standard;

[0061] Step 5, determining the attack category and propagation path based on attack sample tracing through the attack feature spectrum.

[0062] Optionally, step 1, real-time collection of industrial control network full message of power system, specifically comprising:

[0063] Step 11: obtaining multi-protocol messages collected by key communication links deployed in the power industrial control network;

[0064] Step 12: time stamp alignment of the multi-protocol messages to construct an initial full message database containing message arrival time, protocol type, source / destination address and load content;

[0065] Step 13: integrity check of the initial full message database, removing damaged message data in the transmission process through CRC redundancy check to obtain an effective full message database.

[0066] Preferably, for step 11, distributed traffic collection nodes based on industrial-grade embedded chips (such as ARMCortex-A9 architecture) are deployed at key communication link positions such as core switch redundant ports of power industrial control network, substation communication gateway serial interfaces, etc. The nodes are built-in 1000BASE-T adaptive Ethernet interface to adapt to different speed links. These nodes copy all bidirectional messages flowing through the link by starting the port mirroring function (SPAN technology), and for ModbusRTU / ASCII, OPCUAoverTCP, EtherNet / IP protocol messages, real-time frame synchronization is performed using a dedicated protocol preprocessing chip to ensure that the message boundary recognition accuracy is above 99.9%. The collection node stores the captured messages in blocks of 512KB size to the local DDR4 cache area, and when the cache occupancy rate reaches 80%, the data transfer mechanism is triggered, and the data is transmitted to the backend storage server through an encrypted channel to avoid data overflow loss in high traffic scenarios.

[0067] Preferably, for step 12, the multi-protocol packets uploaded by the distributed nodes are subjected to time synchronization calibration, each acquisition node is internally provided with a high-precision RTC clock module (clock deviation ≤ 1 ppm), and is subjected to periodic time synchronization with a power system time server (Stratum 2 level) through the NTPv4 protocol, and the synchronization period is set to 1 minute / time. For cross-node packets of the same communication session, the TCP sequence number or application layer session identifier is extracted for correlation, and the linear interpolation algorithm is used to correct the timestamp deviation between different nodes (the correction accuracy is controlled within ± 5 ms), to ensure the time sequence consistency. The calibrated packets are marked with a timestamp in the format of “year-month-day-hour-minute-second-millisecond”, and are sequentially stored in a time sequence database based on PostgreSQL, to build an initial full-quantity packet database containing the packet arrival time, protocol type (dual identification through port number and protocol characteristic code), source / destination IP address (including IPv4 / IPv6 dual stack support), transmission layer port number, application layer function code and load hexadecimal data, and the database adopts a partition table design, and is automatically partitioned by hour granularity to improve the query efficiency.

[0068] Preferably, for step 13, a three-level integrity verification mechanism is started for each packet in the initial full-quantity packet database, the first level verifies the Ethernet frame CRC32 field, the frame check sequence (FCS) is calculated through a hardware acceleration module and is compared with the frame tail check value; the second level verifies the application layer protocol, such as the matching of function code and data length for the Modbus protocol, and the length consistency of message header and message body for the OPCUA protocol; the third level adds SHA-256 hash verification for key control instruction packets (such as circuit breaker opening / closing instructions), to ensure the instruction integrity. The packets that fail the verification will be marked as “invalid” and the failure reason (such as CRC error, length anomaly, instruction tampering) is recorded, and finally the complete packets that pass the three-level verification are screened out from the initial database, are re-indexed according to the protocol type and time range, to generate an effective full-quantity packet database supporting millisecond-level query response, and the database simultaneously enables a data backup mechanism, generates an incremental backup every hour and a full-quantity backup every day, to guarantee the data traceability.

[0069] Optionally, for step 2, the suspicious traffic segments deviating from the normal communication paradigm are screened out from the industrial control network full-quantity packets based on the preset industrial control protocol behavior characteristic map, to generate a suspicious traffic event chain, which specifically includes:

[0070] Step 21: the matching degree of each packet sequence in the industrial control network full-quantity packets with the corresponding protocol behavior mode in the industrial control protocol behavior characteristic map is calculated, to generate a behavior deviation quantization value;

[0071] Step 22: a deviation threshold value based on the dynamic adjustment of the protocol type is set, and when the behavior deviation quantization value of the packet sequence exceeds the deviation threshold value, the packet sequence is marked as a suspicious traffic segment;

[0072] Step 23: Perform correlation analysis on the marked suspicious traffic fragments, merge fragments belonging to the same communication session to form a suspicious traffic event chain.

[0073] Preferably, in step 21, the message data classified by protocol type is retrieved from the effective full message database, a differentiated time window is set for each protocol (such as a 5-second window for Modbus protocol and a 15-second window for OPCUA protocol), and the interactive message groups of the same source / destination IP address and port pair within each window are extracted to form a message sequence; the protocol-specific features are parsed from the message sequence, including the function code sequence of Modbus, the service call type of OPCUA, the message priority identifier of EtherNet / IP, etc., while the general features such as the standard deviation of message interval, the retransmission rate of instructions, and the coefficient of variation of load length are extracted; these features are compared with the standard mode features of the corresponding protocol in the industrial control protocol behavior feature map, the overall coincidence is calculated by weighted summation (the weights are pre-set according to the importance of the features to attack identification), and the difference between 1 and the coincidence is taken as the behavior deviation quantification value, which ranges from 0 to 1, 0 represents complete coincidence with the normal mode, and 1 represents complete deviation.

[0074] Preferably, in step 23, all traffic fragments marked as suspicious are summarized, a timestamp index and a protocol type label are added to each fragment; the multi-level session identification of each fragment is extracted, including the IP five-tuple (source IP, destination IP, protocol type, source port, destination port) of the network layer, the session sequence number of the transport layer, and the transaction identification (such as the transaction handler identifier of Modbus) of the application layer; the correlation rule library is constructed based on the multi-level session identification, for example, when the IP five-tuple of two fragments completely matches and the application layer transaction identification is continuous, it is determined as the same session; the suspicious traffic fragments are clustered and grouped according to the correlation rule library, and the fragments in the same group are arranged in ascending order of timestamp to form a preliminary sequence; the preliminary sequence is logically checked to check the correspondence between the request and response messages in the sequence (such as the Modbus request function code 0x03 should correspond to the response message containing data), the legality of instruction interaction (such as the write instruction should contain a legal address range), and the abnormal fragments with logical discontinuity are removed; the fragments that pass the check are integrated into a suspicious traffic event chain, which contains the complete event trajectory of the session establishment time, the key instruction sequence, the abnormal behavior trigger point, and the session termination state.

[0075] Optionally, step 22: set a deviation threshold value based on dynamic adjustment of protocol type, when the behavior deviation quantification value of the message sequence exceeds the deviation threshold value, mark the message sequence as a suspicious traffic fragment, which specifically includes:

[0076] Step 221, constructing a protocol type-threshold mapping table, initializing the baseline deviation threshold value for each protocol based on the behavior deviation distribution characteristics of historical normal communication samples;

[0077] Step 222, based on the protocol communication load fluctuation coefficient, real-time monitoring of the communication busy degree of each protocol in the message sequence corresponding to the current period, to dynamically adjust the baseline deviation threshold value to obtain the adjusted deviation threshold value;

[0078] Step 223, when the behavior deviation quantization value of the message sequence exceeds the adjusted deviation threshold value, it is marked as a suspicious traffic segment.

[0079] Preferably, in step 221, when constructing a protocol type-threshold mapping table, initializing the baseline deviation threshold value for each protocol based on the behavior deviation distribution characteristics of historical normal communication samples, 30 consecutive days of normal communication traffic data is obtained from the traffic collection system, and is stored by protocol type (Modbus, DNP3, OPCUA, etc.); For each protocol, extract 20+ dimensional behavior characteristics such as message field length, instruction execution period, response time, etc.; Calculate the historical distribution curve of each feature; Use kernel density estimation (KDE) algorithm to generate probability density function of feature space, get feature fluctuation range under 95% confidence interval through Monte Carlo sampling; Calculate the comprehensive deviation index based on the feature fluctuation range, determine the initial baseline threshold value by using the three quantile method, form a multi-dimensional mapping table containing protocol type, feature weight vector and baseline threshold value; To improve the adaptability of the threshold, a parameter optimization mechanism based on genetic algorithm is designed, and the feature weights are automatically adjusted through the simulation evolution process, so that the threshold can cover both normal fluctuations and abnormal behaviors.

[0080] Preferably, in step 222, based on the protocol communication load fluctuation coefficient, real-time monitoring of the communication busy degree of each protocol in the message sequence corresponding to the current period, to dynamically adjust the baseline deviation threshold value to obtain the adjusted deviation threshold value, deploy distributed traffic monitoring nodes, implement fine-grained monitoring of each protocol communication link, collect load indicators such as the number of messages, byte traffic, and connection number in a 5-minute sliding window; Use time series decomposition technology to decompose the load data into trend items, seasonal items and residual items to identify periodic traffic patterns; Calculate the fluctuation coefficient of the current period load and the historical load of the same period, the fluctuation coefficient = (current load-historical mean) / historical standard deviation; Construct a threshold dynamic adjustment function, when the fluctuation coefficient exceeds 1.5 times the standard deviation, relax the baseline threshold value according to the exponential decay function (relaxation amplitude = baseline threshold value x e^(-k x fluctuation coefficient), k is the protocol sensitivity coefficient); Introduce autoregressive integrated moving average model (ARIMA) to predict the future 5-minute load trend, realize the forward adjustment of the threshold value, and reduce the false alarm caused by sudden traffic.

[0081] Preferably, in step 223, when the behavioral deviation quantification value of a message sequence exceeds the adjusted deviation threshold, and it is marked as a suspicious traffic segment, a parallel computing framework is used to quickly compare the real-time calculated behavioral deviation quantification value with the dynamically adjusted threshold. A two-layer filtering mechanism is designed: the first layer uses a Bloom filter for rapid screening, and the second layer uses an exact matching algorithm for confirmation. For message sequences exceeding the threshold, suspicious tags containing timestamps, protocol types, deviation values, and triggering features are automatically generated. A multi-dimensional anomaly scoring system is constructed, combining factors such as deviation degree, duration, and impact range to calculate a comprehensive risk score. The DS evidence theory is applied to integrate multi-source judgment criteria, and the credibility of the tag is improved when multiple features trigger anomalies simultaneously. Suspicious traffic segments are stored in an anomaly event database based on a graph database, establishing a correlation with asset information and historical attack cases to provide contextual support for subsequent analysis.

[0082] Optionally, step 3 involves performing protocol field normalization on suspicious traffic segments to extract cross-layer attack feature sets, specifically including:

[0083] Step 31: Build an event chain parsing engine to perform session integrity verification on the suspicious traffic event chain, and associate scattered traffic fragments of the same attack event through session identifiers to form an attack behavior sequence;

[0084] Step 32: For the attack behavior sequence, use protocol field layered parsing to extract the private fields of different industrial control protocols in a structured manner, and convert the unstructured payload data into quantifiable feature parameters containing field offsets, data types and verification values.

[0085] Step 33: Based on the temporal position of the fields in the suspicious traffic event chain and their correlation with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the corresponding session initialization stage and command execution stage in the suspicious traffic event chain;

[0086] Step 34: Map heterogeneous fields from different industrial control protocols to a unified feature space and construct a standardized field matrix that includes the timestamp dimension;

[0087] Step 35: Based on the standardized field matrix and key fields, perform cross-event chain feature extraction to generate a cross-level attack feature set, which includes protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

[0088] Preferably, in step 31, a construction event chain parsing engine is built, which integrates a protocol parsing module, a session association module and an integrity checking module. First, multi-level session identifiers are extracted from each segment of the suspicious traffic event chain, including the IP five-tuple of the network layer, the TCP sequence number / UUID session identifier of the transport layer, and the transaction ID of the application layer (such as the transaction identifier of Modbus and the session handle of OPCUA); the session association module groups the dispersed segments with the same or continuous session identifiers through an improved DBSCAN clustering algorithm, and introduces a time decay factor during the grouping process, giving priority to associating adjacent segments with a time interval of less than 10 seconds; the integrity checking module checks the full life cycle of the grouped segment sequence, checks whether the session contains a complete cycle of "establishment-interaction-termination", and intelligently fills in the missing intermediate segments through an LSTM prediction model based on historical interaction rules (filling accuracy ≥ 92%), and finally arranges the verified segments in ascending order of timestamp to form a complete attack behavior sequence containing the attack from initiation to spread, which is accompanied by session duration, total number of interaction instructions, and abnormal interruption markers and other metadata.

[0089] Preferably, in step 32, for the attack behavior sequence, a three-layer analysis architecture of "physical layer-protocol layer-application layer" is adopted. The physical layer analysis module extracts the transmission rate fluctuation, signal attenuation coefficient and other link characteristics of the message. The protocol layer analysis module calls a custom industrial protocol analysis rule library (with 200+ private field analysis logic) to extract the private fields of Modbus function code extension field, DNP3 object group variation field, OPCUA node attribute tampering field, etc. Unstructured hexadecimal payload data is converted into quantifiable feature parameters including field offset (accurate to byte bits), data type (such as INT16 / BOOL / STRING), check value (including CRC16 / 32 double check), and field interaction dependency (such as the sequential association of "write instruction" and "confirmation instruction"). To adapt to heterogeneous protocols, the analysis rule library supports dynamic expansion, and the visual rule editor can add field analysis logic of new protocols in real time, with an analysis delay control within 5ms.

[0090] Preferably, in step 33, based on the attack behavior stage division model, the suspicious traffic event chain is divided into five key stages of session initialization, command detection, privilege escalation, data theft, and trace removal, each stage corresponding to different field importance weights; the association degree of the field and the attack behavior sequence is calculated through the attack influence factor, the influence factor = (field appearance frequency x field variation rate x target device importance), wherein the target device importance is associated with the power system asset weight library; the cleaning weight is optimized in real time by using the reinforcement learning algorithm, with the goal of maximizing the ratio of "reserved key field number / total field number", and the reserved threshold of each stage field is iteratively adjusted (the reserved threshold of the initialization stage field is set to 0.8, and the reserved threshold of the instruction execution stage is set to 0.95); during the cleaning process, redundant fields (such as the same heartbeat packet field with an interval of less than 1 second) and noise fields (such as incomplete fields with CRC check failure) caused by electromagnetic interference are removed through an adaptive filtering algorithm, and finally the key information such as the identity authentication field in the session initialization stage and the control instruction field in the instruction execution stage is reserved, laying a high-quality data foundation for subsequent feature extraction.

[0091] Optionally, in step 4, the cross-level attack feature set is input into the attack identification model trained by federated learning for multiple rounds of verification to obtain determined attack samples with attack confidence meeting preset standards, specifically including:

[0092] Step 41: Perform feature dimension verification on the cross-level attack feature set, filter core features by using principal component analysis combined with maximum information coefficient, remove redundant features, and simultaneously perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set;

[0093] Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model, which uses the global feature mapping matrix obtained through federated learning to perform consistency conversion of the optimized feature set in different regional substation feature spaces to obtain a cross-regional consistency feature set, and then dynamically allocates the weight proportion of different regional substation feature spaces through the attention mechanism to generate a fusion feature vector by fusing the cross-regional consistency feature set;

[0094] Step 43: Start a three-round progressive verification mechanism, in the first round, calculate the initial attack confidence based on the fusion feature vector through the model basic classifier, in the second round, modify the initial attack confidence to obtain an optimized attack confidence combined with the real-time running state of the power equipment, and in the third round, perform secondary verification on the optimized attack confidence through the attack feature pedigree library to obtain a verified attack confidence, and calculate the comprehensive confidence based on the initial attack confidence, the optimized attack confidence, and the verified attack confidence. When the comprehensive confidence exceeds the preset threshold, the corresponding suspicious traffic event chain is marked as a determined attack sample.

[0095] Preferably, in step 41, the cross-level attack feature set is subjected to dimension integrity verification, and an effective feature subset with a missing rate below 5% is screened out by a feature missing rate calculation (missing rate = missing feature number / total feature number); principal component analysis is used to linearly reduce the dimension of the effective feature subset, and principal components with a cumulative contribution rate exceeding 95% are retained, while a maximum information coefficient is introduced to calculate the nonlinear correlation degree between features, and redundant features with a correlation degree exceeding 0.85 are removed; in order to highlight key attack features, an adaptive enhancement mechanism based on attack scenarios is designed, core features such as "instruction tampering features" and "lateral movement path features" are given dynamic amplification factors (factor value = 1 + feature appearance frequency in historical attacks / total attack sample number), and targeted enhancement is achieved through a feature weighting matrix, and finally an optimized feature set with reduced dimension and highlighted key features is obtained, and the process is compressed to less than 100 ms through a parallel computing framework.

[0096] Preferably, in step 42, the optimized feature set is input into the federal feature fusion layer of the attack identification model, the layer calls the global feature mapping matrix generated by federated learning training, the matrix elements are aggregated by local model parameters of each regional substation, and dynamic alignment of different substation feature spaces is supported; the fusion layer is built-in with a regional feature adapter, and initial weights are assigned to each regional feature space according to the historical attack identification accuracy of the substation (the higher the accuracy, the greater the weight proportion); the weights are adjusted in real time through an improved attention mechanism, the mechanism is based on the matching degree of "current features and regional typical attack features", dynamically improves the weight proportion of high matching degree regions, and realizes differentiated fusion of cross-regional consistent feature sets; a feature conflict resolution strategy is introduced in the fusion process, when different regional features are contradictory, the regional features with more associated devices are preferentially adopted, and finally a fusion feature vector considering global consistency and regional specificity is generated.

[0097] Preferably, in step 43, a three-round progressive verification mechanism is started. In the first round, the integrated module of basic classifiers (including three sub-models of random forest, gradient boosting tree and lightweight neural network) is used to perform parallel inference on the fusion feature vector, and the weighted voting method (the sub-model weight is dynamically allocated according to the historical accuracy) is used to calculate the initial attack confidence. In the second round, the real-time state library of power equipment is called to extract the current load rate, communication link quality, protection device action state and other parameters of the equipment, construct the state influence factor (factor value = 1-equipment abnormal operation probability), and modify the initial attack confidence to obtain the optimized attack confidence that fits the actual state of the equipment. In the third round, the optimized attack confidence is deeply associated with the attack characteristic spectrum library, the characteristic path matching (matching the evolution path of the attack characteristic in the spectrum tree) is used to calculate the spectrum fit degree, and the optimized attack confidence is secondarily checked by using the fit degree. The comprehensive confidence is calculated by using a hierarchical weighted algorithm (the first round weight is 0.4, the second round weight is 0.3, and the third round weight is 0.3). When the comprehensive confidence exceeds the preset threshold (the default is 0.9), the corresponding suspicious traffic event chain is marked as a determined attack sample, and the verification details of each round are recorded for model iteration optimization.

[0098] Specifically, in step 43, in the first round, the random forest consists of 100 CART decision trees, each tree is trained based on a different random subset of the fusion feature vector, Gini coefficient splitting is used for discrete fields in the features (such as protocol type identification), and squared error splitting is used for continuous fields (such as time interval), the attack probability output by each single tree is averaged to obtain the sub-model result; the gradient boosting tree uses decision trees as weak learners, the first round of tree fitting is based on the initial error of the fusion feature vector and the attack label, and each subsequent round of tree is iteratively optimized based on the residual of the previous model, focusing on strengthening the capture of key features such as "instruction exception frequency" and "device interaction mutation", and outputting the attack probability after 30 rounds of cumulative iteration; the lightweight neural network adopts a 3-layer fully connected structure (input layer-hidden layer-output layer), the input layer performs standardization processing on the fusion feature vector, the hidden layer extracts nonlinear correlation features through the ReLU activation function, and the output layer outputs the attack probability through the Sigmoid function, and the model is compressed to within 1MB through knowledge distillation technology to ensure real-time performance. The inference results of the three sub-models are aggregated through weighted voting, the weights are dynamically allocated according to the accuracy of the last 1000 validations (weight = sub-model accuracy / total accuracy of the three sub-models), and the initial attack confidence is generated; in the second round, the real-time state library of the power device is called to extract parameters such as the current load rate of the device (the ratio of the actual load to the rated load), the communication link packet loss rate, and the protection device action signal, and the device anomaly probability model (0.2 when the load rate exceeds 90%, 0.3 when the packet loss rate exceeds 5%, and 0.5 when the protection device acts) is used to calculate the comprehensive abnormal operation probability, which is substituted into the state influence factor formula (factor value = 1 - abnormal operation probability) to modify the initial attack confidence (modified confidence = initial confidence x factor value), and the optimized attack confidence is obtained according to the actual state of the device; in the third round, the optimized attack confidence is associated with the attack feature spectrum library, the spectrum library stores the attack feature evolution path in a tree structure (the root node is the original attack feature, and the child node is the mutated feature), the matching degree of the current attack feature with each path in the spectrum tree is calculated (matching degree = average matching rate of features in the path), the optimal matching path is determined, and the optimized attack confidence is verified again (verified confidence = optimized confidence x matching degree); the comprehensive confidence is calculated according to the hierarchical weighting algorithm (the first round weight is 0.4, which reflects the stable recognition ability of the model; the second round weight is 0.3, which is related to the real-time state of the device; and the third round weight is 0.3, which reflects the evolution rule of the attack feature), when the comprehensive confidence exceeds the preset threshold (default 0.9), the corresponding suspicious traffic event chain is marked as a confirmed attack sample, and the single round output of the three sub-models, the device state parameters, and the spectrum matching details are recorded for subsequent optimization of the sub-model weight and verification threshold.

[0099] Optionally, in step 5, the attack category and propagation path are determined based on the attack sample traceability through the attack feature spectrum, specifically including:

[0100] Step 51: Extract the core feature vector of the attack sample, including protocol field abnormal pattern, instruction interaction sequence, target device type and attack payload characteristics;

[0101] Step 52: Calculate the similarity matrix of the core feature vector and each node feature in the attack feature pedigree;

[0102] Step 53: When the maximum similarity in the similarity matrix exceeds the pedigree matching threshold, trace back to the corresponding attack category node in the attack feature pedigree, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

[0103] Preferably, in step 51, the complete traffic data packet of the attack sample is obtained, which is structurally analyzed by a feature hierarchical extraction framework. First, the protocol field abnormal pattern is extracted from the protocol syntax layer, including field length mutation points (such as Modbus function code field changing from 1 byte to 3 bytes), mismatched check value positions, and non-standard private field filling contents, etc. The variation degree (mild / moderate / severe) is marked for each abnormal point. Then, the instruction interaction sequence is extracted from the communication session layer, and the instruction execution chain is generated by sorting according to the timestamp, and the abnormal jump (such as "read instruction" directly changing to "firmware write instruction") and repeated execution pattern in the chain are identified. Finally, the target device type (associated with the power device asset library to obtain the device model, firmware version and power grid level) and attack payload characteristics (including payload encryption method, compression algorithm and embedded malicious code segment hash value) are extracted from the application layer. A feature importance dynamic evaluation mechanism is introduced, and the extracted features are given weights (the weight sum is 1) according to the association strength of each feature with the attack type in historical attack cases (such as "firmware write instruction abnormal jump" with an association degree of 0.92). Finally, the core feature vector containing 128-dimensional feature parameters and corresponding weights is integrated, and the vector is attached with the feature extraction confidence (reflecting the feature integrity, not less than 0.85).

[0104] Preferably, in step 52, the attack feature pedigree library is called, which stores attack features in a heterogeneous graph structure, where nodes represent attack feature sets (including protocol, instruction, payload, etc. multidimensional features), and edges represent feature variation relationships (weight is variation probability); the feature vectors of all nodes are extracted from the pedigree library, and the core feature vector is calculated for multidimensional similarity: the improved edit distance algorithm (introducing field importance weight, key field difference weight doubling) is used to calculate text similarity for protocol field anomaly mode, dynamic time warping algorithm (allowing time stretching matching) is used to calculate time sequence similarity for instruction interaction sequence, asset correlation algorithm (correlation degree of same model is 1, and correlation degree of same manufacturer but different models is 0.7) is used to calculate matching degree for target device type, and the weighted value (weight ratio 6:4) of hash similarity and feature bag matching degree is used for attack payload features; the multidimensional similarity is weighted and fused according to the feature weight of the core feature vector (fusion similarity = Σ (dimension similarity x feature weight)), to generate the comprehensive similarity value of the core feature vector and each pedigree node; these values are arranged as an N x 1 matrix (N is the total number of pedigree nodes) according to the corresponding relationship of "core feature vector-pedigree node", and the higher the matrix element value, the higher the matching degree, that is, the similarity matrix, and the matrix is accompanied by the calculation log of each dimensional similarity for subsequent traceability result explanation.

[0105] Optionally, step 53: when the maximum similarity in the similarity matrix exceeds the pedigree matching threshold, the corresponding attack category node is traced back in the attack feature pedigree, and the attack propagation path is determined in combination with the propagation feature library associated with the attack category node, specifically including:

[0106] Step 531, according to the index value corresponding to the maximum similarity in the similarity matrix, the matched attack category node is located in the attack feature pedigree, and the attack type identifier, typical attack vector and historical propagation record stored in the node are extracted to generate attack category reference information;

[0107] Step 532, propagation feature parameter extraction is performed on the attack category reference information, the typical propagation port, device penetration priority and communication protocol preference of the attack are called from the propagation feature library associated with the attack category node, and the preliminary propagation mode profile is constructed;

[0108] Step 533, time sequence correlation processing is performed on the preliminary propagation mode profile, the source / destination device sequence and message interaction time sequence in the determined attack sample are dynamically compared with the propagation mode profile, and the potential propagation chain that meets the propagation rule is filtered out through the time sequence correlation algorithm;

[0109] Step 534, topological reachability verification is performed on the potential propagation chain, the actual connection relationship of each device on the link is verified in combination with the power industrial control network physical topology graph, false paths that are not topologically reachable are eliminated, and the actual propagation path of the attack in the physical network is finally determined.

[0110] Preferably, in step 531, the index value corresponding to the maximum value in the similarity matrix is extracted, the matching attack category node is located in the node index table of the attack feature pedigree through the index, and the node adopts a multi-layer nested structure to store information; first, the attack type identifier (such as "SQL injection attack") and its associated MITREATT&CK tactic label (such as "lateral movement") are extracted, then the typical attack vector of the node (including the source IP feature of the attack initiation, the exploit tool feature code used, and the Payload format template) is extracted, and finally the historical propagation record (containing the propagation path of 100+ similar attacks, the average propagation speed, and the number distribution of infected devices) is extracted; the extracted information is structured and integrated to generate attack category benchmark information containing attack type metadata, attack vector feature library, and propagation statistical parameters, and the confidence of the benchmark information is calculated (based on the hierarchical depth of the node in the pedigree and the historical matching accuracy rate to dynamically generate).

[0111] Preferably, in step 532, the attack category benchmark information is input into the propagation feature extraction engine, which includes three sub-modules: a protocol analyzer, a device priority evaluator, and a timing modeler; the protocol analyzer identifies the communication protocol used (such as HTTP, Modbus-TCP) from the attack vector in the benchmark information, calls the typical propagation port list of the corresponding protocol (such as 80 / 443 for HTTP and 502 for Modbus) in the propagation feature library, and calculates the use probability of each port (based on historical attack frequency); the device priority evaluator associates the power system asset library to evaluate the penetration priority of different devices for this type of attack (such as RTU > SCADA server > smart meter), and generates a device priority vector; the timing modeler analyzes the time interval features in the historical propagation record to build a timing model containing attack incubation period, propagation peak period, and infection stable period; the output results of the three sub-modules are fused to construct a preliminary propagation mode profile containing protocol port probability distribution, device penetration priority matrix, and propagation timing features, and the profile is accompanied by an uncertainty interval (reflecting the fluctuation range of the propagation features).

[0112] Preferably, in step 533, the preliminary propagation pattern profile is time-correlated with the source / destination device sequence and packet interaction timing of the attack sample, a sliding time window is first constructed (the window size is dynamically adjusted based on the timing characteristics of the propagation pattern profile), the matching degree of the device sequence and the device priority matrix in the propagation pattern profile is calculated within each window, and the degree of fit between the packet interaction timing and the propagation timing model is calculated; a dynamic programming algorithm is used to find the optimal matching path in the time dimension, which introduces a time decay factor (the weight of recent interactions is higher) and a device importance factor (the matching error of key devices is punished more); the generated matching path is pruned to eliminate paths with time inconsistencies (such as responses earlier than requests) and logical conflicts (such as direct communication between unauthorized devices), and finally potential propagation chains that conform to the propagation law are selected, each chain containing key parameters such as device jump order, attack time point, and propagation protocol type, and the confidence score of each chain is calculated (based on timing matching degree and device correlation degree).

[0113] Preferably, in step 534, the potential propagation chain is introduced into a topology reachability verification system, which maintains a real-time physical topology graph of the power industrial control network (including device connection relationships, network segmentation information, and security domain boundaries); for each potential propagation chain, the connection relationship between adjacent devices in the chain is extracted, and it is verified in the topology graph whether there is a physical link or a logical channel (such as a VPN tunnel) to support the connection; an access control list (ACL) verification mechanism is introduced to check whether each communication step in the chain conforms to the current effective security policy (such as firewall rules and port access restrictions); for propagation paths across security domains, it is verified whether there is an authorized trust relationship or trusted agent; paths that do not conform to the topology connection relationship or security policy are marked and all unreachable false paths are removed; the remaining valid paths are evaluated for attack cost (based on device protection level and authentication mechanism complexity), and the path with the lowest attack cost is selected as the final determined actual propagation path, which is accompanied by detailed information such as device jump list, network traversal point, and security policy breakthrough point, for subsequent attack trace evidence and defense reinforcement.

[0114] As shown in Figure 2 , the embodiment of the present application provides a power industrial control flow application layer message anomaly detection device, which comprises:

[0115] The acquisition unit is configured to acquire all messages of the industrial control network of the power system in real time.

[0116] The screening unit is configured to screen suspicious traffic segments deviating from normal communication paradigms from the all messages of the industrial control network based on a preset industrial control protocol behavior feature map to generate suspicious traffic event chains.

[0117] A normalization unit is configured to perform protocol field normalization processing on the suspicious traffic event chain to extract a cross-layer attack feature set;

[0118] A verification unit is configured to input the cross-layer attack feature set into an attack identification model trained through federated learning for multi-round verification to obtain a determined attack sample with an attack confidence meeting a preset standard;

[0119] An attack identification unit is configured to determine an attack category and a propagation path based on attack sample tracing through an attack feature pedigree.

[0120] The exemplary explanation of each unit in the above device embodiment is described in the above Figure 1 Embodiment.

[0121] As Figure 3 shown, the embodiments of the present application provide an electronic device, which comprises a memory and a processor, the memory has stored computer executable programs, and the processor runs the computer executable programs to implement the method according to any one of the embodiments of the present application.

[0122] Although the preferred embodiments of the present application have been described, those skilled in the art who have the benefit of the basic inventive concept can make further changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0123] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A method for detecting anomalies in power industrial control flow application layer messages, characterized in that, Includes the following steps: Step 1: Real-time acquisition of all packets from the power system's industrial control network; Step 2: Based on the preset industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages to generate suspicious traffic event chains; Step 3: Perform protocol field normalization on the suspicious traffic event chain to extract cross-level attack feature sets; Step 4: Input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets the preset standard. Step 5: Determine the attack category and propagation path based on the attack sample source by analyzing the attack feature spectrum; Step 4, which involves inputting the cross-level attack feature set into an attack identification model trained through federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets a preset standard, specifically includes: Step 41: Perform feature dimension verification on the cross-level attack feature set, use principal component analysis combined with maximum information coefficient to screen core features, remove redundant features, and at the same time perform weighted amplification processing on the core features through feature enhancement to obtain an optimized feature set; Step 42: Input the optimized feature set into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set. Step 43: Initiate a three-round progressive verification mechanism. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. The comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

2. The method as described in claim 1, characterized in that, Step 1: Real-time collection of all packets from the power system's industrial control network, specifically including: Step 11: Obtain multi-protocol messages collected from key communication links deployed in the power industrial control network; Step 12: Timestamp alignment of multi-protocol messages to build an initial full message database containing message arrival time, protocol type, source / destination address, and payload content; Step 13: Perform integrity verification on the initial full message database, and remove damaged message data during transmission by CRC redundancy check to obtain a valid full message database.

3. The method as described in claim 1, characterized in that, Step 2: Based on a pre-defined industrial control protocol behavior feature map, filter out suspicious traffic segments that deviate from normal communication patterns from the full volume of packets in the industrial control network to generate a suspicious traffic event chain, specifically including: Step 21: Calculate the matching degree between each message sequence in the full set of industrial control network messages and the corresponding protocol behavior pattern in the industrial control protocol behavior feature map, so as to generate a behavior deviation quantification value; Step 22: Set a deviation threshold that is dynamically adjusted based on the protocol type. When the deviation quantification value of the packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Step 23: Perform correlation analysis on the marked suspicious traffic segments, merge segments belonging to the same communication session, and form a suspicious traffic event chain.

4. The method as described in claim 1, characterized in that, Step 22: Set a deviation threshold that is dynamically adjusted based on protocol type. When the behavioral deviation quantification of a packet sequence exceeds the deviation threshold, the packet sequence is marked as a suspicious traffic segment. Specifically, this includes: Step 221: Construct a protocol type-threshold mapping table. For different industrial control protocols, initialize their respective baseline deviation thresholds based on the behavioral deviation distribution characteristics of historical normal communication samples. Step 222: Based on the protocol communication load fluctuation coefficient, monitor the communication busyness of each protocol in the current time period corresponding to the message sequence in real time, and dynamically adjust the baseline deviation threshold to obtain the adjusted deviation threshold. Step 223: When the behavior of a message sequence deviates from the quantified value by more than the adjusted deviation threshold, it is marked as a suspicious traffic segment.

5. The method as described in claim 1, characterized in that, Step 3: Perform protocol field normalization on suspicious traffic segments to extract cross-layer attack feature sets, specifically including: Step 31: Build an event chain parsing engine to perform session integrity verification on the suspicious traffic event chain, and associate scattered traffic fragments of the same attack event through session identifiers to form an attack behavior sequence; Step 32: For the attack behavior sequence, use protocol field layered parsing to extract the private fields of different industrial control protocols in a structured manner, and convert the unstructured payload data into quantifiable feature parameters containing field offsets, data types and verification values. Step 33: Based on the temporal position of the fields in the suspicious traffic event chain and their correlation with the attack behavior sequence, dynamically adjust the cleaning weight to retain the key fields in the corresponding session initialization stage and command execution stage in the suspicious traffic event chain; Step 34: Map heterogeneous fields from different industrial control protocols to a unified feature space and construct a standardized field matrix that includes the timestamp dimension; Step 35: Based on the standardized field matrix and key fields, perform cross-event chain feature extraction to generate a cross-level attack feature set, which includes protocol syntax layer field variation features, communication session layer timing anomaly features, and application layer instruction semantic deviation features.

6. The method as described in claim 1, characterized in that, Step 5: Determine the attack category and propagation path based on the attack sample source by analyzing the attack feature spectrum. This includes: Step 51: Extract the core feature vector of the identified attack sample, including abnormal patterns of protocol fields, command interaction sequences, target device type, and attack payload characteristics; Step 52: Calculate the similarity matrix between the core feature vector and the features of each node in the attack feature spectrum; Step 53: When the maximum similarity in the similarity matrix exceeds the spectrum matching threshold, trace the corresponding attack category node in the attack feature spectrum, and determine the attack propagation path by combining the propagation feature library associated with the attack category node.

7. The method as described in claim 6, characterized in that, Step 53: When the maximum similarity in the similarity matrix exceeds the lineage matching threshold, trace the corresponding attack category node in the attack feature lineage, and determine the attack propagation path by combining the propagation feature library associated with the attack category node. Specifically, this includes: Step 531: Based on the index value corresponding to the maximum similarity in the similarity matrix, locate the matching attack category node in the attack feature spectrum, extract the attack type identifier, typical attack vector and historical propagation record stored in the node, and generate attack category benchmark information. Step 532: Extract propagation feature parameters from the attack category baseline information, retrieve typical propagation ports, device penetration priorities and communication protocol preferences of this type of attack from the propagation feature library associated with the attack category node, and construct a preliminary propagation pattern outline. Step 533: Perform time-series correlation processing on the preliminary propagation pattern outline. Dynamically compare the source / destination device sequence and message interaction timing in the determined attack sample with the propagation pattern outline. Use the time-series correlation algorithm to filter out potential propagation chains that conform to the propagation rules. Step 534: Perform topology reachability verification on potential propagation chains. Combine the physical topology map of the power industrial control network to verify the actual connection relationship of each device on the link, eliminate false paths that are topologically unreachable, and finally determine the actual propagation path of the attack in the physical network.

8. A device for detecting abnormal messages in the power industrial control flow application layer, characterized in that, include: The data acquisition unit is used to collect all messages from the industrial control network of the power system in real time. The filtering unit is used to filter out suspicious traffic segments that deviate from the normal communication paradigm from the full volume of industrial control network messages based on a preset industrial control protocol behavior feature map in order to generate a suspicious traffic event chain. The normalization unit is used to perform protocol field normalization processing on suspicious traffic event chains in order to extract cross-level attack feature sets; The verification unit is used to input the cross-level attack feature set into the attack identification model trained by federated learning for multiple rounds of verification to obtain a confirmed attack sample whose attack confidence meets the preset standard. The attack identification unit is used to determine the attack type and propagation path based on the attack sample by analyzing the attack feature spectrum. Specifically, the cross-level attack feature set is input into an attack identification model trained by federated learning for multiple rounds of verification to obtain confirmed attack samples whose attack confidence meets a preset standard, including: The feature dimension of the cross-level attack feature set is verified. Principal component analysis is used in combination with the maximum information coefficient to screen the core features. Redundant features are eliminated, and the core features are weighted and amplified through feature enhancement to obtain an optimized feature set. The optimized feature set is input into the federated feature fusion layer of the attack identification model. This layer uses the global feature mapping matrix obtained by federated learning to perform a consistency transformation of the feature space of different regional substations on the optimized feature set to obtain a cross-regional consistent feature set. Then, the weight ratio of the feature space of different regional substations is dynamically allocated through the attention mechanism to generate a fused feature vector by fusing the cross-regional consistent feature set. A three-round progressive verification mechanism is initiated. In the first round, the initial attack confidence is calculated based on the fused feature vector using the model's basic classifier. In the second round, the initial attack confidence is corrected by combining the real-time operating status of the power equipment to obtain an optimized attack confidence. In the final round, the optimized attack confidence is verified a second time using the attack feature spectrum library to obtain a verified attack confidence. A comprehensive confidence is calculated based on the initial attack confidence, optimized attack confidence, and verified attack confidence. When the comprehensive confidence exceeds a preset threshold, the corresponding suspicious traffic event chain is marked as a confirmed attack sample.

9. An electronic device, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer-executable program, and the processor runs the computer-executable program to implement the method of any one of claims 1-7.

Images