Industrial control security deception detection method and system based on container technology

Abstract

The application provides an industrial control security deception detection method and system based on a container technology, relates to the technical field of industrial control network security, and comprises the following steps: introducing an abnormal access request to a simulation service instance in a container environment, extracting an interactive operation to construct a multi-layer directed graph, calculating branch entropy and semantic deviation to form a feature vector, determining an attack stage based on a state transition matrix and an attack behavior knowledge base, controlling response data, and implementing network isolation. The application can actively induce an attacker to expose an intention, accurately identify an attack stage, and effectively protect an industrial control system from network attacks.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security technology, and in particular to a method and system for detecting industrial control security deception based on container technology. Background Technology

[0002] As the nerve center of critical infrastructure, industrial control systems bear the important responsibility of monitoring production processes and executing commands. With the rapid development of the Industrial Internet, industrial control systems are gradually becoming networked and information-based, but they also face increasingly severe cybersecurity threats. Traditional industrial control systems were initially designed primarily for system reliability and real-time performance, resulting in relatively weak security mechanisms. Once attacked, they can lead to serious consequences such as production interruptions, equipment damage, and even personal injury or death.

[0003] In the field of industrial control system (ICS) security, signature-based intrusion detection systems and anomaly-based behavior analysis systems are currently the mainstream protection methods. Signature detection identifies malicious behavior by comparing it with known attack signatures, while anomaly detection detects operations that deviate from normal patterns by establishing a baseline of normal behavior. In addition, boundary protection measures such as security isolation and access control are also widely used in ICS environments. In recent years, honeypot technology, as a proactive defense method, attracts attackers by simulating real ICS environments, providing valuable threat intelligence for security analysis.

[0004] Existing industrial control system (ICS) security technologies still have some shortcomings and deficiencies. Traditional ICS security detection methods have limited ability to detect attack behavior, especially against complex attacks such as advanced persistent threats (APS). They struggle to effectively identify attacks through simple feature matching, resulting in low detection rates and high false positive rates. These complex attacks often employ multi-stage penetration strategies, making it difficult for single-point detection to grasp the full picture. Existing ICS deception defense systems lack intelligent interaction capabilities, mostly providing only static responses or limited interaction logic. They cannot dynamically adjust defense strategies based on attacker behavior, making it difficult to attract attackers for extended periods and collect complete attack evidence, thus reducing the effectiveness and forensic value of deception defenses. Furthermore, the semantic understanding of ICS protocol interactions is insufficient. Existing technologies mainly focus on network and transport layer features, lacking in-depth analysis of the semantic correlation and impact propagation of command parameters in ICS protocols. This makes it difficult to accurately identify attack intent at the protocol semantic level, especially for sophisticated attacks that utilize legitimate commands but with abnormal parameters, resulting in limited detection effectiveness. Summary of the Invention

[0005] This invention provides a method and system for detecting industrial control system security deception based on container technology, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a method for detecting industrial control system security deception based on container technology, comprising:

[0007] Obtain access requests from the industrial control system, and when the preset abnormal behavior judgment conditions are met, redirect the access request to the simulation service instance in the container environment;

[0008] Extract multiple interaction operations from the simulation service instance, map the interaction operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value.

[0009] Parse the control commands in the interactive operation and extract the parameter fields. Compare the parameter fields with the predefined data types and value ranges, construct the parameter dependency graph and track the influence propagation path, calculate the semantic deviation, and combine the branch entropy value and semantic deviation into a feature vector.

[0010] The feature vector is input into the state transition matrix to calculate the transition probability value. The stage cycle features and standard transition probability distribution of each attack stage are extracted from the preset attack behavior knowledge base. The current attack stage is determined by weighted fusion of cycle matching degree and probability distribution divergence.

[0011] Based on the current attack phase, determine the delay time parameters and response template to generate response data, and control the simulation service instance to return response data;

[0012] Isolate network access requests based on the current stage of the attack.

[0013] In one optional embodiment, multiple interaction operations of the simulation service instance are extracted, the interaction operations are mapped to nodes in a multi-layered directed graph, and directed edges carrying transition weights are established. Based on the transition weights, the weighted connectivity of each node is calculated, and the branch entropy value is calculated, including:

[0014] The network data packets of each interaction operation received by the simulation service instance are analyzed, and the timestamp, operation type identifier and protocol layer identifier of each interaction operation are extracted. The interaction operations are sorted according to the timestamp, and the interaction operations are divided into application layer operations and transport layer operations based on the protocol layer identifier. The sorted interaction operations are mapped to nodes in a multi-layer directed graph.

[0015] Traverse each node in the multi-level directed graph. When the timestamp of the previous node is earlier than that of the subsequent node, extract the operation type identifier combination of the previous node and the subsequent node, query the preset operation transfer constraint table to determine whether the operation type identifier combination constitutes a valid transfer path. When it constitutes a valid transfer path, establish a directed edge carrying the transfer weight between the previous node and the subsequent node.

[0016] Taking each node in the multi-layer directed graph as the target node, the number of directed edges pointing to the target node is counted to determine the number of predecessor nodes, and the number of directed edges pointed to by the target node is counted to determine the number of successor nodes. Based on the corresponding transition weights, the number of predecessor nodes and the number of successor nodes are weighted and accumulated to obtain the weighted connectivity of each node.

[0017] The probability distribution of each node is determined by the ratio of the weighted connectivity of each node to the sum of the weighted connectivity of all nodes. The information entropy is then calculated based on the probability distribution to determine the branch entropy value of the operation sequence.

[0018] In one optional embodiment, parsing control commands in the interactive operation and extracting parameter fields, comparing the parameter fields with predefined data types and value ranges, constructing a parameter dependency graph and tracing the influence propagation path, calculating semantic deviation, and synthesizing the branch entropy value and semantic deviation into a feature vector includes:

[0019] Parse the control commands in each interactive operation, extract the command operation code and parameter fields, query the corresponding parameter definition rules from the industrial control protocol specification library, and obtain the predefined data types, predefined value ranges and constraint relationships between parameters;

[0020] The actual data type of the parameter field is matched with the predefined data type. When the actual data type is inconsistent with the predefined data type, it is marked as a data type deviation. The actual value of the parameter field is compared with the predefined value range. When the actual value exceeds the predefined value range, it is marked as a value range deviation. The total number of data type deviations and value range deviations determines the number of parameter deviations.

[0021] A parameter dependency graph is constructed based on the constraint relationship between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path.

[0022] The basic deviation rate is calculated based on the number of parameter deviations and the total number of parameter fields. The diffusion deviation rate is calculated based on the influence diffusion degree of each parameter deviation field and the total number of parameter nodes in the parameter dependency graph. The semantic deviation rate is obtained by fusing the basic deviation rate and the diffusion deviation rate.

[0023] The feature vector is constructed by combining the branch entropy value and semantic deviation of the operation sequence after normalization.

[0024] In one optional embodiment, a parameter dependency graph is constructed based on the constraint relationships between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path, including:

[0025] The constraints between parameters are analyzed, and the numerical association constraints and temporal sequence constraints between parameter fields are extracted. Each parameter field is used as a parameter node. When there is a numerical association constraint between the first parameter field and the second parameter field, an association edge is established in the direction from the first parameter field to the second parameter field and the constraint conditions are marked. When there is a temporal sequence constraint between the first parameter field and the second parameter field, a temporal sequence edge is established and the temporal interval is marked. A parameter dependency graph containing association edges and temporal sequence edges is constructed.

[0026] In the parameter dependency graph, the parameter fields where the data type or value range deviates are located to determine the deviation source node. Starting from each deviation source node, a propagation simulation is performed along the associated edges and time-series edges. During the propagation process, the constraint conditions marked on each edge are extracted, and it is determined whether the downstream parameter node triggers a constraint violation when the current deviation source node deviates. When the downstream parameter node triggers a constraint violation, the downstream parameter node is marked as an affected node and the propagation continues downstream. When the downstream parameter node does not trigger a constraint violation, the propagation branch is terminated, and the propagation link formed from the deviation source node to each affected node is recorded to determine the impact propagation path.

[0027] The number of affected nodes corresponding to each deviation from the source node is counted, and the number of edges traversed in each influence propagation path is extracted as the propagation depth. The influence diffusion degree of each deviation from the source node is calculated based on the number of affected nodes and the propagation depth.

[0028] In one optional embodiment, the feature vector is input into the state transition matrix to calculate the transition probability value. Stage cycle features and standard transition probability distributions for each attack stage are extracted from a pre-defined attack behavior knowledge base. The current attack stage is determined based on a weighted fusion of cycle matching degree and probability distribution divergence, including:

[0029] Extract predefined attack phase sequences and state transition matrices corresponding to each attack phase from a pre-defined attack behavior knowledge base. Input the feature vector into the state transition matrix to calculate the transition probability value from the current state to each candidate state and construct the current observation transition probability distribution.

[0030] Historical interaction sequence samples of each attack stage are extracted from the attack behavior knowledge base, a state transition directed graph of each attack stage is constructed, a loop path is identified in the state transition directed graph, the loop length and loop frequency of the loop path are calculated, the loop path is divided into multiple loop pattern groups, and the core features of the loop pattern are extracted to determine the stage loop features.

[0031] The state transition sequence corresponding to the current observed transition probability distribution is analyzed, and the state transition sequence is pattern matched with the phase cycle features of each attack phase. The ratio of the number of matched state nodes to the total number of nodes in the state transition sequence is calculated to determine the cycle matching degree.

[0032] Calculate the probability distribution divergence between the current observed transition probability distribution and the standard transition probability distribution of each attack stage. Then, weight and fuse the probability distribution divergence with the cyclic matching degree of the corresponding attack stage to obtain the stage matching degree. Select the attack stage with the highest stage matching degree as the current attack stage.

[0033] In one optional embodiment, cyclic paths are identified in the directed graph of state transitions, the cycle length and cycle frequency of the cyclic path are calculated, the cyclic path is divided into multiple cyclic pattern groups, and the core features of the cyclic patterns are extracted to determine the stage cyclic features, including:

[0034] In the directed graph of state transition, the depth-first traversal algorithm is used to identify the loop path that starts from the starting state node, passes through multiple intermediate state nodes, and returns to the starting state node. The state node sequence and state transition edge sequence in the loop path are extracted, the number of state nodes in the loop path is calculated to determine the loop length, and the frequency of the loop path in the historical interaction sequence samples is calculated to determine the loop frequency.

[0035] Calculate the difference in cycle length and the difference in cycle frequency between each cycle path. When the difference in cycle length is less than a preset length threshold and the difference in cycle frequency is less than a preset frequency threshold, the cycle path is divided into the same cycle pattern group. Extract the common state node subsequence and common state transition edge subsequence of the cycle path in each cycle pattern group to determine the core features of the cycle pattern. Combine the core features of the cycle pattern with the corresponding cycle length range and cycle frequency range to determine the stage cycle features.

[0036] In one optional embodiment, based on the current attack phase, determining the delay time parameter and the response template to generate response data, and controlling the simulation service instance to return response data includes:

[0037] Based on the current attack phase, extract the corresponding attack phase delay time parameters and response templates from the preset strategy library;

[0038] The adjustment field in the response template is parsed to obtain the data type and value constraint range of the adjustment field. Based on the attack characteristics of the current attack stage, the induction direction of the adjustment field is determined. Boundary values ​​are selected as induction values ​​along the induction direction within the value constraint range.

[0039] Replace the initial value of the adjustment field with the induced value, keep the initial value of the non-adjustment field in the response template unchanged, generate response data containing the induced value, and calculate the response sending time based on the current time and the delay time parameter;

[0040] The control simulation service instance returns the response data to the attack source at the time the response is sent.

[0041] A second aspect of this invention provides an industrial control system security deception detection system based on container technology, comprising:

[0042] The first unit is used to obtain access requests from the industrial control system. When the preset abnormal behavior judgment conditions are met, the access request is directed to the simulation service instance in the container environment.

[0043] The second unit is used to extract multiple interactive operations of simulation service instances, map the interactive operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value.

[0044] The third unit is used to parse control commands in interactive operations and extract parameter fields, compare parameter fields with predefined data types and value ranges, construct parameter dependency graphs and track influence propagation paths, calculate semantic deviation, and synthesize branch entropy values ​​and semantic deviation into feature vectors.

[0045] The fourth unit is used to input the feature vector into the state transition matrix to calculate the transition probability value, extract the stage cycle features and standard transition probability distribution of each attack stage from the preset attack behavior knowledge base, and determine the current attack stage based on the weighted fusion of cycle matching degree and probability distribution divergence.

[0046] The fifth unit is used to determine the delay time parameters and response template based on the current attack phase, generate response data, and control the simulation service instance to return response data;

[0047] Unit 6 is used to isolate network access requests based on the current stage of the attack.

[0048] A third aspect of the present invention provides an electronic device, comprising:

[0049] processor;

[0050] Memory used to store processor-executable instructions;

[0051] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0052] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0053] In this embodiment of the invention, by guiding suspicious access requests to simulation service instances in a container environment, and combining multi-layer directed graph and parameter dependency graph analysis techniques, accurate identification and classification of attack behaviors are achieved, effectively improving the accuracy and reliability of industrial control system security protection. Based on the feature vector analysis method synthesized from branch entropy and semantic deviation, combined with state transition matrix and attack behavior knowledge base, the current stage of the attack can be accurately identified, achieving early warning of attack intent and enhancing the proactive defense capability of the industrial control system. By adopting dynamically adjusted delay time parameters and response template generation mechanism, it can not only effectively deceive attackers and delay the attack process, but also implement precise isolation when an attack occurs, maximizing the safe operation of the industrial control system, while providing sufficient response time for security personnel. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating the industrial control security deception detection method based on container technology according to an embodiment of the present invention.

[0055] Figure 2 A flowchart is provided to define the attack phases based on the fusion of state transition probability and cyclic features. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0058] Figure 1 This is a flowchart illustrating the industrial control security deception detection method based on container technology according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0059] Obtain access requests from the industrial control system, and when the preset abnormal behavior judgment conditions are met, redirect the access request to the simulation service instance in the container environment;

[0060] Extract multiple interaction operations from the simulation service instance, map the interaction operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value.

[0061] Parse the control commands in the interactive operation and extract the parameter fields. Compare the parameter fields with the predefined data types and value ranges, construct the parameter dependency graph and track the influence propagation path, calculate the semantic deviation, and combine the branch entropy value and semantic deviation into a feature vector.

[0062] The feature vector is input into the state transition matrix to calculate the transition probability value. The stage cycle features and standard transition probability distribution of each attack stage are extracted from the preset attack behavior knowledge base. The current attack stage is determined by weighted fusion of cycle matching degree and probability distribution divergence.

[0063] Based on the current attack phase, determine the delay time parameters and response template to generate response data, and control the simulation service instance to return response data;

[0064] Isolate network access requests based on the current stage of the attack.

[0065] In one optional implementation, multiple interaction operations of the simulation service instance are extracted, the interaction operations are mapped to nodes in a multi-layered directed graph, and directed edges carrying transition weights are established. Based on the transition weights, the weighted connectivity of each node is calculated, and the branch entropy value is calculated, including:

[0066] The network data packets of each interaction operation received by the simulation service instance are analyzed, and the timestamp, operation type identifier and protocol layer identifier of each interaction operation are extracted. The interaction operations are sorted according to the timestamp, and the interaction operations are divided into application layer operations and transport layer operations based on the protocol layer identifier. The sorted interaction operations are mapped to nodes in a multi-layer directed graph.

[0067] Traverse each node in the multi-level directed graph. When the timestamp of the previous node is earlier than that of the subsequent node, extract the operation type identifier combination of the previous node and the subsequent node, query the preset operation transfer constraint table to determine whether the operation type identifier combination constitutes a valid transfer path. When it constitutes a valid transfer path, establish a directed edge carrying the transfer weight between the previous node and the subsequent node.

[0068] Taking each node in the multi-layer directed graph as the target node, the number of directed edges pointing to the target node is counted to determine the number of predecessor nodes, and the number of directed edges pointed to by the target node is counted to determine the number of successor nodes. Based on the corresponding transition weights, the number of predecessor nodes and the number of successor nodes are weighted and accumulated to obtain the weighted connectivity of each node.

[0069] The probability distribution of each node is determined by the ratio of the weighted connectivity of each node to the sum of the weighted connectivity of all nodes. The information entropy is then calculated based on the probability distribution to determine the branch entropy value of the operation sequence.

[0070] In one specific implementation, parsing the network data packets received by the simulation service instance is fundamental to constructing the interactive operation model. Each network data packet undergoes deep parsing to extract its timestamp information, typically recording the packet's arrival time in milliseconds. Simultaneously, operation type identifiers are extracted from the data packets; for example, for industrial control protocol data packets, the operation type identifier might be "read," "write," or "control." Furthermore, protocol layer identifiers need to be extracted to distinguish between application layer operations and transport layer operations. For example, transport layer operations include TCP connection establishment and data transmission, while application layer operations include specific business requests and responses. After extraction, the interactive operations are sequentially ordered according to their timestamps to ensure that the subsequently constructed directed graph accurately reflects the order of operations. The ordered set of operations is then divided into application layer operation sets and transport layer operation sets based on the protocol layer identifiers. In the multi-layered directed graph, each operation is mapped to a node, with node attributes including a timestamp, operation type identifier, and protocol layer identifier.

[0071] To construct the connections between nodes in a multi-layered directed graph, all node pairs in the graph need to be traversed. Once the temporal order of a pair of nodes is determined (i.e., the timestamp of the preceding node is earlier than the timestamp of the following node), the operation type identifiers of these two nodes are extracted and formed into a tuple. Then, a predefined operation transition constraint table is queried to determine whether the tuple constitutes a valid transition path. The operation transition constraint table is a two-dimensional matrix, where rows and columns represent different operation types, and matrix element values ​​represent the validity and weight of the transition from a row operation type to a column operation type. For example, a transition from a "read" operation to a "write" operation might be a valid transition path, while a transition from a "control" operation to an "authenticate" operation might not be allowed. When it is determined that the combination of operation type identifiers constitutes a valid transition path, a directed edge is established between the corresponding preceding and following nodes, and the directed edge is assigned a corresponding transition weight. The transition weight can be set based on the importance, frequency, or security sensitivity of the operation; a higher weight value indicates a more important transition path.

[0072] After constructing the multi-layered directed graph, it is necessary to calculate the weighted connectivity of each node. For each node, count the number of directed edges pointing to it, i.e., the number of predecessor nodes; count the number of directed edges pointing from it, i.e., the number of successor nodes. Considering the different importance of different transition paths, the number of predecessor and successor nodes needs to be weighted. Specifically, for each incoming edge of a node, multiply the weight of the incoming edge by the number of predecessor nodes; for each outgoing edge of a node, multiply the weight of the outgoing edge by the number of successor nodes. The weighted connectivity of the node is obtained by summing the contributions of all weighted incoming and outgoing edges. The weighted connectivity reflects the importance and activity of a node in the interactive network.

[0073] Based on the weighted connectivity of nodes, the probability distribution of each node is calculated. For each node in the graph, its probability value is equal to its weighted connectivity divided by the sum of the weighted connectivity of all nodes. This probability distribution satisfies the constraint that the sum of all probability values ​​equals 1. The probability distribution reflects the relative importance of each node in the interaction operation. Based on the obtained probability distribution, the information entropy is calculated as the branch entropy value of the operation sequence. Specifically, for the probability value of each node, its natural logarithm is calculated and multiplied by the probability value. This multiplication is accumulated for all nodes and the negative value is taken to obtain the branch entropy value. The higher the branch entropy value, the greater the uncertainty of the interaction operation and the higher the complexity of the operation sequence.

[0074] For example, in a set of interactive operations in an industrial control environment, assuming 10 network data packets are captured, the extracted information includes: Data packet 1 (timestamp: 1634567890123, operation type: connection request, protocol layer: transport layer), Data packet 2 (timestamp: 1634567890456, operation type: connection confirmation, protocol layer: transport layer), Data packet 3 (timestamp: 1634567891234, operation type: authentication request, protocol layer: application layer), Data packet 4 (timestamp: 1634567892345, operation type: authentication response, protocol layer: application layer), and Data packet 5 (timestamp: 1634567893456). Data packets 6 (timestamp: 1634567894567, operation type: read response, protocol layer: application layer), 7 (timestamp: 1634567895678, operation type: write request, protocol layer: application layer), 8 (timestamp: 1634567896789, operation type: write response, protocol layer: application layer), 9 (timestamp: 1634567897890, operation type: disconnect request, protocol layer: transport layer), and 10 (timestamp: 1634567898901, operation type: disconnect confirmation, protocol layer: transport layer).

[0075] After sorting by timestamp and dividing into protocol layers, a multi-layered directed graph is constructed. The application layer contains data packets 3, 4, 5, 6, 7, and 8, and the transport layer contains data packets 1, 2, 9, and 10. Valid transition paths are established by querying the operation transition constraint table. For example, the weight from "connection request" to "connection confirmation" is 0.8, the weight from "connection confirmation" to "authentication request" is 0.9, the weight from "authentication request" to "authentication response" is 0.7, and so on.

[0076] For the node "Authentication Request", its predecessor node is "Connection Confirmation" and its successor node is "Authentication Response". The incoming edge weight is 0.9, the outgoing edge weight is 0.7, and there is one predecessor node and one successor node. Therefore, its weighted connectivity is 0.9 × 1 + 0.7 × 1 = 1.6. Similarly, the weighted connectivity of other nodes is calculated. Assuming the total weighted connectivity of all nodes is 15.2, the probability of the "Authentication Request" node is 1.6 ÷ 15.2 ≈ 0.105.

[0077] After calculating the probabilities of all nodes, the probability distribution is as follows: Connection Request (0.053), Connection Confirmation (0.079), Authentication Request (0.105), Authentication Response (0.092), Read Request (0.118), Read Response (0.105), Write Request (0.132), Write Response (0.118), Disconnect Request (0.105), Disconnect Confirmation (0.092). Based on this probability distribution, the branch entropy value is calculated to be 2.28, indicating that the interaction sequence has a certain degree of complexity and uncertainty. By calculating the branch entropy value, the behavioral characteristics of the interaction can be quantitatively evaluated, providing data support for subsequent anomaly detection and behavior analysis.

[0078] In one optional implementation, the control commands in the interactive operation are parsed and parameter fields are extracted. The parameter fields are compared with predefined data types and value ranges to construct a parameter dependency graph and trace the influence propagation path. The semantic deviation is calculated, and the branch entropy value and semantic deviation are combined into a feature vector, including:

[0079] Parse the control commands in each interactive operation, extract the command operation code and parameter fields, query the corresponding parameter definition rules from the industrial control protocol specification library, and obtain the predefined data types, predefined value ranges and constraint relationships between parameters;

[0080] The actual data type of the parameter field is matched with the predefined data type. When the actual data type is inconsistent with the predefined data type, it is marked as a data type deviation. The actual value of the parameter field is compared with the predefined value range. When the actual value exceeds the predefined value range, it is marked as a value range deviation. The total number of data type deviations and value range deviations determines the number of parameter deviations.

[0081] A parameter dependency graph is constructed based on the constraint relationship between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path.

[0082] The basic deviation rate is calculated based on the number of parameter deviations and the total number of parameter fields. The diffusion deviation rate is calculated based on the influence diffusion degree of each parameter deviation field and the total number of parameter nodes in the parameter dependency graph. The semantic deviation rate is obtained by fusing the basic deviation rate and the diffusion deviation rate.

[0083] The feature vector is constructed by combining the branch entropy value and semantic deviation of the operation sequence after normalization.

[0084] In one specific implementation, control instructions typically include an opcode and a parameter field. Interactive operation data streams are captured from the industrial control network, and key information for each control instruction is extracted. For a write-to-a-register instruction in the Modbus protocol, the opcode is 0x06, and the parameter field includes the register address and the write value. For example, if the captured instruction is "06 00 01 01F4", the parsed opcode is 06, the register address is 0001, and the write value is 01F4 (decimal 500). A pre-established industrial control protocol specification library is consulted, which defines the data types and value ranges of various registers in the Modbus protocol. For the register at address 0001, its predefined data type is a 16-bit unsigned integer, with a value range of 0-400.

[0085] During the parameter verification phase, the conformity of the actual data with the predefined rules is checked. The data type of the written value 500 conforms to the definition of a 16-bit unsigned integer, so the data type match is correct; however, its value 500 exceeds the predefined value range of 0-400, so this parameter is marked as a value range deviation. For another instruction in the same operation sequence, "06 00 02 FF FF", the value FFFF (decimal 65535) is parsed to be written to register address 0002. According to the protocol specification library, this register is predefined as a 16-bit signed integer with a value range of -100 to 100. The actual written FFFF is interpreted as 65535 as an unsigned integer and as -1 as a signed integer, resulting in ambiguity in the data type interpretation, and is marked as a data type deviation; at the same time, although -1 is within the value range under signed interpretation, it is still recorded in the parameter deviation statistics due to the type deviation.

[0086] A parameter dependency graph is constructed based on parameter constraints in the protocol specification library. For example, in a PLC control program, register 0001 stores the temperature setpoint, register 0002 stores the control mode (0 for manual, 1 for automatic), and register 0003 stores the valve opening. In automatic mode, the valve opening depends on the temperature setpoint. Based on this, the following dependencies are constructed: register 0002 → register 0003, register 0001 → register 0003 (conditionally dependent on register 0002 being 1). When a deviation in the value of register 0001 is detected, propagation simulation starts from that node along the dependency graph. Since register 0002 is currently in manual mode, the temperature setpoint deviation will not propagate to the valve opening; the impact path is limited to the node itself, with an impact diffusion of 1 / 3 (number of affected nodes / total number of nodes). However, when another operation changes register 0002 to automatic mode, the deviation in register 0001 will propagate to register 0003 through the dependency path, increasing the impact diffusion to 2 / 3.

[0087] The semantic deviation calculation consists of two parts: the base deviation rate and the diffusion deviation rate. The base deviation rate is the ratio of the number of parameter deviations to the total number of parameter fields. In an operation sequence containing 10 instructions and 20 parameter fields, if two parameters are detected to be deviating, the base deviation rate is 2 / 20 = 0.1. The diffusion deviation rate considers the diffusion degree of the influence of each deviating parameter. If the diffusion degrees of the influence of two deviating parameters are 1 / 3 and 2 / 3 respectively, the combined diffusion deviation rate is (1 / 3 + 2 / 3) / 3 = 1 / 3 (the total number of nodes in the parameter dependency graph is 3). Finally, by weighted averaging the base deviation rate and the diffusion deviation rate, the semantic deviation is calculated to be 0.2 (assuming the weights are 0.6 and 0.4 respectively, then 0.6 × 0.1 + 0.4 × 0.33 ≈ 0.2).

[0088] Branch entropy represents the uncertainty of an operation sequence and is calculated by statistically analyzing the frequency of different types of instructions in the sequence. For example, in an operation sequence with 20 instructions, if the read instruction appears 8 times and the write instruction appears 12 times, the normalized branch entropy value is approximately 0.97. The normalized semantic deviation of 0.2 is combined with the branch entropy value of 0.97 to form a two-dimensional feature vector [0.2, 0.97]. This feature vector can be used for subsequent anomaly detection or behavior analysis.

[0089] The above method can effectively identify semantic deviations in industrial control command parameters. By combining the branching characteristics of the operation sequence, a feature vector that can reflect the abnormality of operation behavior can be constructed, providing data support for the safety protection of industrial control systems.

[0090] In one optional implementation, a parameter dependency graph is constructed based on the constraints between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path, including:

[0091] The constraints between parameters are analyzed, and the numerical association constraints and temporal sequence constraints between parameter fields are extracted. Each parameter field is used as a parameter node. When there is a numerical association constraint between the first parameter field and the second parameter field, an association edge is established in the direction from the first parameter field to the second parameter field and the constraint conditions are marked. When there is a temporal sequence constraint between the first parameter field and the second parameter field, a temporal sequence edge is established and the temporal interval is marked. A parameter dependency graph containing association edges and temporal sequence edges is constructed.

[0092] In the parameter dependency graph, the parameter fields where the data type or value range deviates are located to determine the deviation source node. Starting from each deviation source node, a propagation simulation is performed along the associated edges and time-series edges. During the propagation process, the constraint conditions marked on each edge are extracted, and it is determined whether the downstream parameter node triggers a constraint violation when the current deviation source node deviates. When the downstream parameter node triggers a constraint violation, the downstream parameter node is marked as an affected node and the propagation continues downstream. When the downstream parameter node does not trigger a constraint violation, the propagation branch is terminated, and the propagation link formed from the deviation source node to each affected node is recorded to determine the impact propagation path.

[0093] The number of affected nodes corresponding to each deviation from the source node is counted, and the number of edges traversed in each influence propagation path is extracted as the propagation depth. The influence diffusion degree of each deviation from the source node is calculated based on the number of affected nodes and the propagation depth.

[0094] In one specific implementation, during the parameter dependency graph construction phase, the constraint relationships between parameter fields are extracted from the database. Taking an industrial control system as an example, it includes parameters such as temperature sensor parameter "temp", pressure parameter "pressure", flow parameter "flow", and valve opening parameter "valve". By analyzing system documentation and historical data, the following constraint relationships can be extracted: when "temp" exceeds 80℃, "pressure" must be less than 2.5MPa; "flow" must reach the corresponding value within 5 seconds after "valve" is adjusted, and the "flow" value should be the "valve" opening percentage multiplied by the maximum flow rate of 10m³. 3 These constraints are categorized into two types: numerical correlation constraints and temporal sequence constraints.

[0095] For numerical correlation constraints, establish correlation edges from the constraint parameter to the constrained parameter. For example, establish a correlation edge from "temp" to "pressure" and label it with the constraint "temp>80℃ → pressure<2.5MPa". For the relationship between "valve" and "flow", establish a correlation edge from "valve" to "flow" and label it with the constraint "flow =valve% × 10m". 3 / h".

[0096] For timing constraints, timing edges are created to represent the timing relationships between parameters. For example, a timing edge is created from "valve" to "flow", labeled with a timing interval of "5 seconds", indicating that the flow rate should reach the corresponding value within 5 seconds after the valve is adjusted. In this way, a complete parameter dependency graph containing parameter nodes, associated edges, and timing edges is constructed.

[0097] When a parameter deviation is detected, an impact propagation simulation is initiated. Assuming the "temp" parameter value reaches 95℃, exceeding the normal operating range of 80℃, the "temp" node is marked as the source node of the deviation. From this node, the propagation simulation proceeds along the parameter dependency graph. Examining the associated edges connected to "temp," an edge pointing to "pressure" is found, and the constraint condition "temp>80℃ → pressure<2.5MPa" is extracted from the edge. Since the current "temp" value of 95℃ satisfies the condition "temp>80℃," it is determined that the "pressure" parameter is affected by the constraint and should remain below 2.5MPa. If the current actual "pressure" value is 2.8MPa, violating the constraint condition, the "pressure" node is marked as the affected node, and the propagation path from "temp" to "pressure" is recorded.

[0098] Continue propagating downstream from the "pressure" node, checking the edges connected to "pressure". If an associated edge pointing to "flow" is found, label it with the constraint "pressure>2.5MPa → flow2.5MPa", and determine if the "flow" parameter is also affected by the constraint. If the current "flow" value is 9m... 3 If the constraint is violated, the "flow" node will also be marked as an affected node, and the propagation path from "temp" through "pressure" to "flow" will be recorded.

[0099] For the propagation of timing constraints, the time dimension is considered. For example, after the "valve" parameter changes, the timing edges connected to it are checked. It is found that the timing edge pointing to "flow" is marked with a timing interval of "5 seconds". The changes in the "flow" parameter are monitored over the next 5 seconds. If "flow" does not reach the expected value "valve% × 10m" after 5 seconds... 3 If " / h" is used, then "flow" is marked as a node affected by timing constraints.

[0100] Through the above propagation simulation, the complete impact propagation path is obtained. For the deviation of "temp" in this example, its impact propagation path is "temp→pressure→flow", the number of affected nodes is 2 (including "pressure" and "flow"), and the propagation depth is 2 (passing through two edges).

[0101] The impact diffusion degree is calculated based on the propagation path, using a weighted average of the number of affected nodes and the propagation depth. For example, the impact diffusion degree is set as "number of affected nodes × (1 + propagation depth / 10)". For the above case of "temp" deviation, the impact diffusion degree is 2 × (1 + 2 / 10) = 2.4. If the deviation of another parameter "valve" only affects the "flow" node, with a propagation depth of 1, then its impact diffusion degree is 1 × (1 + 1 / 10) = 1.1. By comparing the impact diffusion degrees of different parameters, the key parameter "temp" is identified as having a greater impact and is given priority for anomaly handling.

[0102] In one optional implementation, the feature vector is input into the state transition matrix to calculate the transition probability value. Stage cycle features and standard transition probability distributions for each attack stage are extracted from a pre-defined attack behavior knowledge base. The current attack stage is determined based on a weighted fusion of cycle matching degree and probability distribution divergence, including:

[0103] Extract predefined attack phase sequences and state transition matrices corresponding to each attack phase from a pre-defined attack behavior knowledge base. Input the feature vector into the state transition matrix to calculate the transition probability value from the current state to each candidate state and construct the current observation transition probability distribution.

[0104] Historical interaction sequence samples of each attack stage are extracted from the attack behavior knowledge base, a state transition directed graph of each attack stage is constructed, a loop path is identified in the state transition directed graph, the loop length and loop frequency of the loop path are calculated, the loop path is divided into multiple loop pattern groups, and the core features of the loop pattern are extracted to determine the stage loop features.

[0105] The state transition sequence corresponding to the current observed transition probability distribution is analyzed, and the state transition sequence is pattern matched with the phase cycle features of each attack phase. The ratio of the number of matched state nodes to the total number of nodes in the state transition sequence is calculated to determine the cycle matching degree.

[0106] Calculate the probability distribution divergence between the current observed transition probability distribution and the standard transition probability distribution of each attack stage. Then, weight and fuse the probability distribution divergence with the cyclic matching degree of the corresponding attack stage to obtain the stage matching degree. Select the attack stage with the highest stage matching degree as the current attack stage.

[0107] In one specific implementation, an attack behavior knowledge base is established, containing various types of network attacks and their corresponding behavioral characteristics. This knowledge base predefines various stages of network attacks, such as the reconnaissance stage, initial access stage, privilege escalation stage, and data theft stage. For each attack stage, the knowledge base stores the state transition matrix, historical interaction sequence samples, and standard transition probability distribution for that stage.

[0108] When suspicious behavior is detected on the network, relevant feature vectors are extracted. These feature vectors contain multiple dimensions, such as IP address access frequency, port scanning behavior, and abnormal packet characteristics. Assuming the extracted feature vector is [0.8, 0.2, 0.5, 0.3], representing four different behavioral characteristic indicators, a predefined state transition matrix corresponding to each attack stage is obtained from a knowledge base. For example, the state transition matrix for the reconnaissance stage stores the transition probabilities from one state to another. The feature vectors are input into the state transition matrix to calculate the probability values ​​for transitioning from the current state to each candidate state. For example, the calculation results show that the probability of transitioning from the current state to state A is 0.6, the probability of transitioning to state B is 0.3, and the probability of transitioning to state C is 0.1, which constitutes the currently observed transition probability distribution.

[0109] Further, historical interaction sequence samples for each attack phase are extracted from the attack behavior knowledge base. These samples record the behavioral sequences of attackers observed in each phase. Taking the reconnaissance phase as an example, historical samples may contain multiple interaction sequences such as "port scanning → vulnerability detection → information gathering → port scanning". A directed graph of state transitions is constructed based on these historical samples, where nodes represent different states and edges represent the transition relationships between states. Cyclic paths are identified in the directed graph, such as "port scanning → vulnerability detection → port scanning" forming a cycle. The cycle length and frequency of each cyclic path are calculated. The cycle length is the number of states contained in the path, and the cycle frequency is the number of times the cycle appears in the historical samples. For example, a cycle length of 3 and a cycle frequency of 15 indicate that the cyclic pattern occurs frequently. Cyclic paths with similar characteristics are grouped into the same cyclic pattern group, for example, all cycles containing "port scanning" and "vulnerability detection" are grouped together. By analyzing the common features of each cyclic pattern group, core features are extracted as the cyclic features of that attack phase. A possible cyclic feature of the reconnaissance phase is "frequent alternation between port scanning and vulnerability detection".

[0110] When analyzing the current observed transition probability distribution, the transition probability values ​​are sorted, and the top few transition relationships with the highest probabilities are selected to form a state transition sequence. For example, if the currently observed behavior sequence is "port scan → vulnerability detection → firewall test → port scan", this sequence is matched with the loop features of each attack stage. The matching process calculates the number of state nodes in the state transition sequence that match the stage loop features, and divides it by the total number of nodes in the state transition sequence to obtain the loop matching degree. Assuming that the sequence matches 3 nodes with the loop features of the reconnaissance stage, and the total number of nodes is 4, the loop matching degree is 0.75.

[0111] Calculate the probability distribution divergence between the current observed transition probability distribution and the standard transition probability distribution for each attack phase. The standard transition probability distribution is extracted from the knowledge base and represents the typical state transition probability patterns for each attack phase. A simplified information divergence calculation method is used, quantifying the divergence by comparing the differences in corresponding state transition probabilities between the two distributions. For example, if the current observed transition probability distribution is [0.6, 0.3, 0.1], while the standard transition probability distribution for the reconnaissance phase is [0.65, 0.25, 0.1], the calculated divergence value is smaller, indicating a high similarity between the two distributions.

[0112] The probability distribution divergence and cyclic matching degree are weighted and fused to obtain the stage matching degree for each attack stage. The weighting process can use predefined weight coefficients, such as a cyclic matching degree weight of 0.6 and a probability distribution divergence weight of 0.4. Assuming an attack behavior has a cyclic matching degree of 0.75 for the reconnaissance stage and a similarity of 0.85 after probability distribution divergence transformation, the weighted and fused stage matching degree is 0.75 × 0.6 + 0.85 × 0.4 = 0.79. The matching degree between the current observed behavior and all predefined attack stages is calculated, and the attack stage with the highest matching degree is selected as the current attack stage. If the matching degree for the reconnaissance stage is 0.79, the matching degree for the initial access stage is 0.45, and the matching degree for the privilege escalation stage is 0.32, the system determines that the current attack is in the reconnaissance stage.

[0113] In this embodiment, the current stage of a network attack can be accurately identified, providing an important basis for subsequent defense measures. The method in this embodiment combines state transition probability analysis and cyclic feature matching, effectively addressing complex and ever-changing network attack behaviors.

[0114] like Figure 2 As shown, a flowchart illustrating the attack phase determination based on the fusion of state transition probability and cyclic features is presented.

[0115] In one optional implementation, cyclic paths are identified in the directed graph of state transitions, the cycle length and cycle frequency of the cyclic path are calculated, the cyclic path is divided into multiple cyclic pattern groups, and the core features of the cyclic patterns are extracted to determine the stage cyclic features, including:

[0116] In the directed graph of state transition, the depth-first traversal algorithm is used to identify the loop path that starts from the starting state node, passes through multiple intermediate state nodes, and returns to the starting state node. The state node sequence and state transition edge sequence in the loop path are extracted, the number of state nodes in the loop path is calculated to determine the loop length, and the frequency of the loop path in the historical interaction sequence samples is calculated to determine the loop frequency.

[0117] Calculate the difference in cycle length and the difference in cycle frequency between each cycle path. When the difference in cycle length is less than a preset length threshold and the difference in cycle frequency is less than a preset frequency threshold, the cycle path is divided into the same cycle pattern group. Extract the common state node subsequence and common state transition edge subsequence of the cycle path in each cycle pattern group to determine the core features of the cycle pattern. Combine the core features of the cycle pattern with the corresponding cycle length range and cycle frequency range to determine the stage cycle features.

[0118] In one specific implementation, in the directed graph of state transitions, each node represents an operating state of the industrial control system, and the directed edges between nodes represent the transition relationship from one state to another. To identify cyclic paths in the state transition process, a depth-first search algorithm is used to search the directed graph. The depth-first search starts from the initial state node and delves deeper along the directed edges, recording the nodes already visited. When a successor node of the current node is found to be a visited node during the traversal, it indicates that a cyclic path has been found. For industrial control systems, such cyclic paths typically reflect periodic operating patterns, such as equipment switching cycles or data acquisition cycles.

[0119] The specific implementation of loop path identification is as follows: Maintain a node access stack and a node access marker array. Initially, the starting state node is pushed onto the stack and marked as visited. Then, a recursive traversal process is entered, iterating through each unvisited successor node of the current node. If a successor node is found already in the access stack during the traversal, it indicates that a loop path has been found. This path is determined by the node sequence from the current successor node to the top node in the access stack. For example, in the monitoring of a container environment in an industrial control system, there exists the following state sequence: authentication request, authentication response, read request, read response, control request, control response, read request. Through depth-first traversal, the loop path "read request, read response, control request, control response, read request" can be identified.

[0120] For identified loop paths, feature information needs to be extracted. The loop length is the number of state nodes contained in the loop path, reflecting the complexity of the loop. In the example above, the loop length is 5. The loop frequency refers to the number of times the loop path appears in historical interaction sequence samples, reflecting the stability and importance of the loop. By statistically analyzing historical data, assuming that the loop path has appeared 15 times in the past 24 hours, its loop frequency is 15. The complete representation of a loop path includes a sequence of state nodes and a sequence of state transition edges. The former records all the states traversed in the loop, and the latter records the transition relationships between states. For example, the state node sequence is [read request, read response, control request, control response, read request], and the state transition edge sequence is [(read request → read response), (read response → control request), (control request → control response), (control response → read request)].

[0121] To effectively categorize cyclic patterns, the identified cyclic paths need to be grouped. Grouping is based on the difference in cycle length and the difference in cycle frequency. The difference in cycle length is the absolute value of the difference between the cycle lengths of two cyclic paths, and the difference in cycle frequency is the absolute value of the difference between the cycle frequencies of two cyclic paths. When the difference in cycle length between two cyclic paths is less than a preset length threshold (e.g., 2), and the difference in cycle frequency is less than a preset frequency threshold (e.g., 5), the two cyclic paths are considered to belong to the same cyclic pattern group. The preset length threshold and preset frequency threshold can be adjusted according to the actual application scenario and requirements; smaller thresholds will produce more refined groupings, while larger thresholds will result in broader groupings.

[0122] For a set of cyclic paths belonging to the same cyclic pattern group, the core features of the cyclic pattern are determined by extracting its common state node subsequence and common state transition edge subsequence. The common state node subsequence refers to the sequence of state nodes that appear in all cyclic paths, which can be extracted using a sequence alignment algorithm. The common state transition edge subsequence refers to the sequence of state transition relationships that appear in all cyclic paths. These two subsequences together constitute the core features of the cyclic pattern, reflecting its essential content. Taking two cyclic paths in an industrial control container environment as an example: Path 1 is [read request, read response, control request, control response, read request], and Path 2 is [read request, read response, status query request, status query response, control request, control response, read request]. The cycle lengths of these two paths are 5 and 7 respectively, with a difference of 2; assuming the cycle frequencies are 15 and 12 respectively, with a difference of 3. If the preset length threshold is 2 and the preset frequency threshold is 5, then these two paths can be classified into the same cyclic pattern group. Through sequence alignment, the extracted common state node subsequence is [read request, read response, control request, control response, read request], and the common state transition edge subsequence is [(read request → read response), (read response → ...), (... → control request), (control request → control response), (control response → read request)], where "..." indicates that there are other states in between.

[0123] The phased loop feature is a combination of the core features of the loop pattern and the corresponding loop length and frequency ranges. The loop length range is the interval formed by the minimum and maximum loop lengths within the loop pattern group, and the loop frequency range is the interval formed by the minimum and maximum loop frequencies within the loop pattern group. The phased loop feature comprehensively describes the characteristics of the loop pattern, including its core content, complexity range, and stability range. In the aforementioned example, the phased loop feature can be represented as follows: the core feature is [read request → read response → ... → control request → control response → read request], the loop length range is [5, 7], and the loop frequency range is [12, 15]. This feature indicates that the loop pattern is centered on data reading and control operations, has moderate loop complexity, and possesses high stability.

[0124] In industrial control system (ICS) container security deception detection applications, extracting and analyzing the loop characteristics of these stages can establish a behavioral baseline for the normal operation of the ICS. When the loop pattern that occurs during actual operation does not match the baseline characteristics, such as an abnormally increased loop length, a significantly reduced loop frequency, or changes in core characteristics, it may indicate that the system has been attacked or an anomaly has occurred. For example, an attacker might inject malicious code into the container to alter the normal operating loop and execute unauthorized operations. By comparing the loop characteristics monitored in real time with the pre-established baseline of normal loop characteristics, such security threats can be detected in a timely manner, allowing for appropriate protective measures to be taken.

[0125] In one optional implementation, based on the current attack phase, determining the delay time parameter and the response template to generate response data, and controlling the simulation service instance to return response data includes:

[0126] Based on the current attack phase, extract the corresponding attack phase delay time parameters and response templates from the preset strategy library;

[0127] The adjustment field in the response template is parsed to obtain the data type and value constraint range of the adjustment field. Based on the attack characteristics of the current attack stage, the induction direction of the adjustment field is determined. Boundary values ​​are selected as induction values ​​along the induction direction within the value constraint range.

[0128] Replace the initial value of the adjustment field with the induced value, keep the initial value of the non-adjustment field in the response template unchanged, generate response data containing the induced value, and calculate the response sending time based on the current time and the delay time parameter;

[0129] The control simulation service instance returns the response data to the attack source at the time the response is sent.

[0130] In one specific implementation, when the industrial control system container environment detects a potential attack, it needs to extract the corresponding latency parameters and response template from a preset policy library based on the current attack stage. Attack stages typically include reconnaissance, access control, and control hijacking. The preset policy library is a structured storage entity containing a set of response policies for different attack stages. Each policy set contains at least two key parameters: latency parameters and response templates. The latency parameters define the time characteristics of the system response, including a base latency value and a random fluctuation range. The response template is a pre-designed data structure template containing multiple data fields and their default values. These fields are divided into two categories: adjustment fields and non-adjustment fields. Taking the Modbus industrial control protocol as an example, when an attack is detected in the reconnaissance stage, the latency parameters that the policy library might extract are a base latency of 200 milliseconds and a random fluctuation range of ±50 milliseconds; the response template might contain fields such as function code, starting address, data length, and data content, where the data content is marked as an adjustment field.

[0131] For the response template extracted from the strategy library, the adjustment field needs to be parsed to obtain its data type and value constraint range. The data type may be integer, floating-point, Boolean, or string, and the value constraint range defines the minimum and maximum allowed values ​​for that field. In industrial control environments, different types of data points have specific reasonable value ranges; for example, the value range of a temperature sensor may be -40 to 100 degrees Celsius, and the value range of a pressure sensor may be 0 to 16 MPa. Based on the attack characteristics of the current attack phase, the induction direction of the adjustment field is determined. The induction direction can be upward, downward, or a specific value. Attack characteristics refer to the behavioral characteristics exhibited by the attacker at the current stage, such as frequently querying specific registers or attempting to modify specific parameters. If the attacker shows interest in high-temperature data, the induction direction is set upward, guiding the attacker to continue probing higher temperature thresholds; if the attacker attempts to lower the pressure threshold, the induction direction can be set downward, misleading the attacker into believing that pressure control has been breached. After determining the induction direction, boundary values ​​are selected along that direction within the value constraint range as the induction values. Boundary values ​​refer to values ​​that are close to the limit within a reasonable range. These values ​​neither obviously violate the laws of physics and alert attackers, nor prevent attackers from probing further in a specific direction. For example, if the normal operating range of a temperature sensor is 20 to 80 degrees Celsius, and the current value is 50 degrees Celsius, and the attacker shows interest in high temperatures, then 75 degrees Celsius can be chosen as the inducing value. This value is close to the upper boundary but still within a reasonable range.

[0132] After determining the inducement value, the initial value of the adjustment field is replaced with the inducement value, while keeping the initial values ​​of the non-adjustment fields in the response template unchanged, generating response data containing the inducement value. Non-adjustment fields typically include standard fields such as protocol headers, function codes, and checksums; keeping these fields' initial values ​​unchanged ensures the legality and consistency of the response data. For adjustment fields, appropriate format conversion is performed according to their data type to ensure that the representation of the inducement value in the data packet conforms to the protocol specification. For example, if the adjustment field is a 16-bit unsigned integer and the inducement value is 75, then 75 needs to be converted to its corresponding two-byte hexadecimal representation. After generating the response data, the response sending time is calculated based on the current time and delay time parameters. The response sending time equals the current time plus the base delay value plus a random value within a random fluctuation range. Introducing a random delay makes the system response more natural and prevents attackers from identifying deception through fixed time characteristics. For example, if the current time is 10:15:30.500, the base delay is 200 milliseconds, the random fluctuation range is ±50 milliseconds, and the randomly generated fluctuation value is +30 milliseconds, then the response sending time is 10:15:30.730.

[0133] The simulation service instance controls the timing of response data transmission, returning it to the attack source at the calculated response time. This simulation service instance is a containerized program that mimics the communication behavior of industrial control equipment. By precisely controlling the content and timing of the response data, a realistic deception environment can be created, making it difficult for attackers to distinguish between genuine and fake responses. Simultaneously, the simulation service instance records all interaction history, including received request data and sent response data; these records are used for subsequent attack analysis and strategy optimization.

[0134] For example, the industrial control container environment detects that an attacker is in the reconnaissance phase, frequently querying the current temperature value of the temperature controller. The corresponding reconnaissance phase strategy is extracted from the preset strategy library, with a base delay of 200 milliseconds and a random fluctuation range of ±50 milliseconds. The response template is a Modbus read holding register response, containing fields such as function code (0x03), number of bytes (0x04), data content (currently 0x01A4, i.e., 420, representing 42.0 degrees Celsius), and CRC checksum. The data content is marked as an adjustment field. Parsing the adjustment field reveals that its data type is a temperature value with one decimal place, with a value constraint range of -40.0 to 100.0 degrees Celsius. Based on the attacker's frequent temperature queries and attempts to query higher temperature ranges multiple times, the induction direction is determined to be upward. Within the value constraint range, a boundary value is selected along the upward direction, choosing 95.0 degrees Celsius (0x03B6) as the induction value. The initial value of the adjustment field, 0x01A4, is replaced with the induced value 0x03B6. Non-adjustment fields such as the function code, byte count, and CRC checksum remain unchanged, generating a complete response data packet. The current time is 14:22:45.300, and the calculated random fluctuation value is +25 milliseconds; therefore, the response is sent at 14:22:45.525. The simulation service instance returns the generated response data to the attack source at this time and records this interaction.

[0135] In this embodiment, the deception system presents an attacker with a sensor reading close to the high-temperature limit, inducing the attacker to potentially attempt to increase the temperature setpoint or trigger a high-temperature alarm mechanism, thereby exposing more of their attack intent. Simultaneously, the carefully designed delay time ensures the response behavior matches the characteristics of a real device, enhancing the deception effect. This container-based industrial control system security deception detection method can dynamically adapt to different attack stages, generating targeted deception responses and effectively guiding attack behavior into a controllable range, providing a new technical means for industrial control system security protection.

[0136] The industrial control security deception detection system based on container technology according to this invention includes:

[0137] The first unit is used to obtain access requests from the industrial control system. When the preset abnormal behavior judgment conditions are met, the access request is directed to the simulation service instance in the container environment.

[0138] The second unit is used to extract multiple interactive operations of simulation service instances, map the interactive operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value.

[0139] The third unit is used to parse control commands in interactive operations and extract parameter fields, compare parameter fields with predefined data types and value ranges, construct parameter dependency graphs and track influence propagation paths, calculate semantic deviation, and synthesize branch entropy values ​​and semantic deviation into feature vectors.

[0140] The fourth unit is used to input the feature vector into the state transition matrix to calculate the transition probability value, extract the stage cycle features and standard transition probability distribution of each attack stage from the preset attack behavior knowledge base, and determine the current attack stage based on the weighted fusion of cycle matching degree and probability distribution divergence.

[0141] The fifth unit is used to determine the delay time parameters and response template based on the current attack phase, generate response data, and control the simulation service instance to return response data;

[0142] Unit 6 is used to isolate network access requests based on the current stage of the attack.

[0143] A third aspect of the present invention provides an electronic device, comprising:

[0144] processor;

[0145] Memory used to store processor-executable instructions;

[0146] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0147] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0148] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting industrial control system security deception based on container technology, characterized in that, include: Obtain access requests from the industrial control system, and when the preset abnormal behavior judgment conditions are met, redirect the access request to the simulation service instance in the container environment; Extract multiple interaction operations from the simulation service instance, map the interaction operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value. Parse the control commands in the interactive operation and extract the parameter fields. Compare the parameter fields with the predefined data types and value ranges, construct the parameter dependency graph and track the influence propagation path, calculate the semantic deviation, and combine the branch entropy value and semantic deviation into a feature vector. The feature vector is input into the state transition matrix to calculate the transition probability value. Stage cycle features and standard transition probability distributions for each attack stage are extracted from a pre-defined attack behavior knowledge base. The current attack stage is determined based on a weighted fusion of cycle matching degree and probability distribution divergence, including: Extract predefined attack phase sequences and state transition matrices corresponding to each attack phase from a pre-defined attack behavior knowledge base. Input the feature vector into the state transition matrix to calculate the transition probability value from the current state to each candidate state and construct the current observation transition probability distribution. Historical interaction sequence samples of each attack stage are extracted from the attack behavior knowledge base, a state transition directed graph of each attack stage is constructed, a loop path is identified in the state transition directed graph, the loop length and loop frequency of the loop path are calculated, the loop path is divided into multiple loop pattern groups, and the core features of the loop pattern are extracted to determine the stage loop features. The state transition sequence corresponding to the current observed transition probability distribution is analyzed, and the state transition sequence is pattern matched with the phase cycle features of each attack phase. The ratio of the number of matched state nodes to the total number of nodes in the state transition sequence is calculated to determine the cycle matching degree. Calculate the probability distribution divergence between the current observed transition probability distribution and the standard transition probability distribution of each attack stage. Then, weight and fuse the probability distribution divergence with the cyclic matching degree of the corresponding attack stage to obtain the stage matching degree. Select the attack stage with the highest stage matching degree as the current attack stage. Based on the current attack phase, determine the delay time parameters and response template to generate response data, and control the simulation service instance to return response data; Isolate network access requests based on the current stage of the attack.

2. The method according to claim 1, characterized in that, Extract multiple interaction operations from the simulation service instance, map these operations to nodes in a multi-layered directed graph, and establish directed edges carrying transition weights. Based on these transition weights, calculate the weighted connectivity of each node and compute the branch entropy value, including: The network data packets of each interaction operation received by the simulation service instance are analyzed, and the timestamp, operation type identifier and protocol layer identifier of each interaction operation are extracted. The interaction operations are sorted according to the timestamp, and the interaction operations are divided into application layer operations and transport layer operations based on the protocol layer identifier. The sorted interaction operations are mapped to nodes in a multi-layer directed graph. Traverse each node in the multi-level directed graph. When the timestamp of the previous node is earlier than that of the subsequent node, extract the operation type identifier combination of the previous node and the subsequent node, query the preset operation transfer constraint table to determine whether the operation type identifier combination constitutes a valid transfer path. When it constitutes a valid transfer path, establish a directed edge carrying the transfer weight between the previous node and the subsequent node. Taking each node in the multi-layer directed graph as the target node, the number of directed edges pointing to the target node is counted to determine the number of predecessor nodes, and the number of directed edges pointed to by the target node is counted to determine the number of successor nodes. Based on the corresponding transition weights, the number of predecessor nodes and the number of successor nodes are weighted and accumulated to obtain the weighted connectivity of each node. The probability distribution of each node is determined by the ratio of the weighted connectivity of each node to the sum of the weighted connectivity of all nodes. The information entropy is then calculated based on the probability distribution to determine the branch entropy value of the operation sequence.

3. The method according to claim 1, characterized in that, The process involves parsing control commands in interactive operations and extracting parameter fields. These parameter fields are then compared with predefined data types and value ranges to construct a parameter dependency graph and trace the influence propagation path. Semantic deviation is calculated, and the branch entropy value and semantic deviation are combined into a feature vector, including: Parse the control commands in each interactive operation, extract the command operation code and parameter fields, query the corresponding parameter definition rules from the industrial control protocol specification library, and obtain the predefined data types, predefined value ranges and constraint relationships between parameters; The actual data type of the parameter field is matched with the predefined data type. When the actual data type is inconsistent with the predefined data type, it is marked as a data type deviation. The actual value of the parameter field is compared with the predefined value range. When the actual value exceeds the predefined value range, it is marked as a value range deviation. The total number of data type deviations and value range deviations determines the number of parameter deviations. A parameter dependency graph is constructed based on the constraint relationship between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path. The basic deviation rate is calculated based on the number of parameter deviations and the total number of parameter fields. The diffusion deviation rate is calculated based on the influence diffusion degree of each parameter deviation field and the total number of parameter nodes in the parameter dependency graph. The semantic deviation rate is obtained by fusing the basic deviation rate and the diffusion deviation rate. The feature vector is constructed by combining the branch entropy value and semantic deviation of the operation sequence after normalization.

4. The method according to claim 3, characterized in that, A parameter dependency graph is constructed based on the constraints between parameters. Propagation simulation is performed along the parameter dependency graph starting from the source node to determine the influence propagation path. The influence diffusion degree is calculated based on the influence propagation path, including: The constraints between parameters are analyzed, and the numerical association constraints and temporal sequence constraints between parameter fields are extracted. Each parameter field is used as a parameter node. When there is a numerical association constraint between the first parameter field and the second parameter field, an association edge is established in the direction from the first parameter field to the second parameter field and the constraint conditions are marked. When there is a temporal sequence constraint between the first parameter field and the second parameter field, a temporal sequence edge is established and the temporal interval is marked. A parameter dependency graph containing association edges and temporal sequence edges is constructed. In the parameter dependency graph, the parameter fields where the data type or value range deviates are located to determine the deviation source node. Starting from each deviation source node, a propagation simulation is performed along the associated edges and time-series edges. During the propagation process, the constraint conditions marked on each edge are extracted, and it is determined whether the downstream parameter node triggers a constraint violation when the current deviation source node deviates. When the downstream parameter node triggers a constraint violation, the downstream parameter node is marked as an affected node and the propagation continues downstream. When the downstream parameter node does not trigger a constraint violation, the propagation branch is terminated, and the propagation link formed from the deviation source node to each affected node is recorded to determine the impact propagation path. The number of affected nodes corresponding to each deviation from the source node is counted, and the number of edges traversed in each influence propagation path is extracted as the propagation depth. The influence diffusion degree of each deviation from the source node is calculated based on the number of affected nodes and the propagation depth.

5. The method according to claim 1, characterized in that, In the directed graph of state transition, cyclic paths are identified, the cycle length and frequency of the cyclic path are calculated, the cyclic path is divided into multiple cyclic pattern groups, and the core features of the cyclic patterns are extracted to determine the stage cyclic features, including: In the directed graph of state transition, the depth-first traversal algorithm is used to identify the loop path that starts from the starting state node, passes through multiple intermediate state nodes, and returns to the starting state node. The state node sequence and state transition edge sequence in the loop path are extracted, the number of state nodes in the loop path is calculated to determine the loop length, and the frequency of the loop path in the historical interaction sequence samples is calculated to determine the loop frequency. Calculate the difference in cycle length and the difference in cycle frequency between each cycle path. When the difference in cycle length is less than a preset length threshold and the difference in cycle frequency is less than a preset frequency threshold, the cycle path is divided into the same cycle pattern group. Extract the common state node subsequence and common state transition edge subsequence of the cycle path in each cycle pattern group to determine the core features of the cycle pattern. Combine the core features of the cycle pattern with the corresponding cycle length range and cycle frequency range to determine the stage cycle features.

6. The method according to claim 1, characterized in that, Based on the current attack phase, determine the delay time parameters and response template to generate response data, and control the simulation service instance to return response data including: Based on the current attack phase, extract the corresponding attack phase delay time parameters and response templates from the preset strategy library; The adjustment field in the response template is parsed to obtain the data type and value constraint range of the adjustment field. Based on the attack characteristics of the current attack stage, the induction direction of the adjustment field is determined. Boundary values ​​are selected as induction values ​​along the induction direction within the value constraint range. Replace the initial value of the adjustment field with the induced value, keep the initial value of the non-adjustment field in the response template unchanged, generate response data containing the induced value, and calculate the response sending time based on the current time and the delay time parameter; The control simulation service instance returns the response data to the attack source at the time the response is sent.

7. An industrial control system security deception detection system based on container technology, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to obtain access requests from the industrial control system. When the preset abnormal behavior judgment conditions are met, the access request is directed to the simulation service instance in the container environment. The second unit is used to extract multiple interactive operations of simulation service instances, map the interactive operations to nodes in a multi-layer directed graph and establish directed edges carrying transition weights, calculate the weighted connectivity of each node based on the transition weights, and calculate the branch entropy value. The third unit is used to parse control commands in interactive operations and extract parameter fields, compare parameter fields with predefined data types and value ranges, construct parameter dependency graphs and track influence propagation paths, calculate semantic deviation, and synthesize branch entropy values ​​and semantic deviation into feature vectors. The fourth unit is used to input the feature vector into the state transition matrix to calculate the transition probability value, extract the stage cycle features and standard transition probability distribution of each attack stage from the preset attack behavior knowledge base, and determine the current attack stage based on the weighted fusion of cycle matching degree and probability distribution divergence. The fifth unit is used to determine the delay time parameters and response template based on the current attack phase, generate response data, and control the simulation service instance to return response data; Unit 6 is used to isolate network access requests based on the current stage of the attack.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images