Industrial control protocol deep analysis-oriented adaptive threat blocking method and system

Abstract

The invention discloses a self-adaptive threat blocking method and system oriented to industrial control protocol deep analysis, and the method comprises the steps: constructing an industrial control protocol multi-dimensional analysis model, extracting an operation code semantic rule, a parameter structure constraint and session state hopping features based on protocol reverse engineering, generating a protocol syntax tree, and blocking a threat from the protocol syntax tree. Wherein the operation code semantic rule is matched with the service primitive mapping of an abstract communication service interface in the IEC 61850 standard; based on the protocol syntax tree, semantic-level analysis is carried out on real-time communication flow, dynamic indexes are extracted, the dynamic indexes comprise a process value mutation gradient, an instruction sequence logic conflict degree and a session state abnormal jump rate scale, and a three-dimensional threat feature vector is generated. According to the method, hidden attacks are accurately recognized through industrial control protocol semantic analysis and multi-dimensional dynamic blocking, so that the defense action and the production stability can be collaboratively optimized.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to an adaptive threat blocking method and system for deep analysis of industrial control protocols. Background Technology

[0002] With the rapid development and iteration of information technology, the threat of covert attacks on industrial control protocols has intensified. Traditional solutions lack semantic-level detection capabilities and blocking them can easily lead to control instability. There is an urgent need for a collaborative defense mechanism that integrates deep protocol analysis and stability assurance.

[0003] Traditional methods, such as the Chinese patent with publication number CN117411711A, relate to the field of threat blocking technology, specifically a threat blocking method for an intrusion detection and prevention system. This method includes: acquiring network interface card (NIC) access traffic and performing malicious traffic detection on the access traffic through an intrusion detection and prevention system (IDPS); when the IDPS detects malicious traffic, constructing blocking information based on the attack source of the malicious traffic; the attack source includes external attacks and internal attacks; the blocking information structure includes IP address, port, and protocol type; establishing a bypass blocking structure, and enabling the bypass blocking structure to continuously block malicious traffic based on the blocking information; the bypass blocking structure includes a blocking thread pool. This solution adds a blocking thread pool, enabling real-time blocking of malicious traffic. Since malicious traffic no longer enters the IDPS detection engine, the blocking latency can be reduced to the millisecond level, greatly improving blocking performance. It has minimal impact on business operations and a significant blocking effect.

[0004] However, during the implementation of the relevant technical solutions, at least the following technical problems were discovered:

[0005] 1. The above solutions are based on traditional network layer characteristics (IP / port / protocol type) and five-tuple blocking, which cannot cope with semantic-level attacks (such as opcode tampering, parameter value out-of-bounds and abnormal state machine transitions) under the legitimate protocol structure in industrial control protocols. Such attacks conform to the protocol format specifications, but can destroy the control logic of industrial equipment through malicious semantics.

[0006] 2. The above scheme adopts a static blocking strategy (such as directly sending a RESET packet or loading an eBPF strategy), which does not consider the coupling between the stability of the industrial control system's control loop and the blocking action. For example, abruptly cutting off communication may cause equipment to go out of control (such as a sudden change in excitation voltage causing unit oscillation), and it lacks an adaptive feedback mechanism with defensive effect. Summary of the Invention

[0007] To address the aforementioned problems, embodiments of the present invention provide an adaptive threat blocking method for deep parsing of industrial control protocols, the method comprising:

[0008] A multi-dimensional parsing model of industrial control protocols is constructed. Based on protocol reverse engineering, opcode semantic rules, parameter structure constraints and session state transition features are extracted to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the abstract communication service interface in the IEC 61850 standard.

[0009] Based on the protocol syntax tree, semantic-level parsing is performed on real-time communication traffic to extract dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree and session state abnormal jump rate, and a three-dimensional threat feature vector is generated.

[0010] The three-dimensional threat feature vector is fused and analyzed by a dynamic threat assessment engine, and the threat confidence is calculated using a sliding time window mechanism. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system.

[0011] The tiered blocking strategy is triggered based on the threat confidence level. The tiered blocking strategy includes modifying the protocol message checksum when the confidence level is below the first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off the target device's network communication when the confidence level exceeds the second threshold.

[0012] Based on the closed-loop update protocol syntax tree and threat assessment rules of the defense effect feedback, the trigger threshold of the hierarchical blocking strategy is dynamically adjusted through the control loop stability assessment index.

[0013] Furthermore, the protocol reverse engineering includes:

[0014] The state machine model of the undisclosed protocol was inverted using the opcode-parameter association matrix, and the industrial applicability of the state machine model was verified using the Modbus TCP function code compatibility verification module.

[0015] Furthermore, the method for calculating the gradient of the process value mutation includes:

[0016] The analog data is normalized based on the range of the pressure sensor of the coal-fired boiler, and the gradient rate of change is calculated based on the sampling period of the DCS system of the thermal power plant.

[0017] Furthermore, the dynamic threat assessment engine adopts a hidden Markov model, and its state transition probability matrix is ​​dynamically updated according to the generator set load fluctuation characteristics, with the update cycle synchronized with the AGC command issuance interval.

[0018] Furthermore, the method for modifying the protocol message checksum includes:

[0019] For the OPC UA publish and subscribe mechanism, a response message containing false process values ​​within the range dead zone is injected into the controlled device. The range dead zone is determined according to the range definition module in the DL / T 860 standard.

[0020] Furthermore, the stability evaluation indicators of the control loop include:

[0021] The dynamic correction coefficient is obtained by dynamically correcting the tolerance threshold of the coal mill current fluctuation based on the steam pressure change rate of the turbine speed regulating stage, and adjusting the pH value adjustment delay threshold by combining the SO2 concentration gradient at the desulfurization tower inlet. The dynamic correction coefficient is obtained by calculating the correlation matrix between coal quality and load in the historical operating data of the coal-fired unit.

[0022] Furthermore, the method for dynamically adjusting the trigger threshold includes:

[0023] A PID control algorithm is used to calculate the false blocking rate and the attack miss rate by weighting, and the proportional coefficient is dynamically configured according to the grid connection stability requirements of the power plant units.

[0024] Furthermore, the method for cutting off the target device's network communication includes:

[0025] When abnormal fluctuations in generator excitation voltage are detected, a topology change log containing the current AGC command value and excitation parameters is generated. The log timestamp is then associated with the generator grid connection switch action record via the IEEE 1588 protocol and stored in the safety audit system.

[0026] On the other hand, this application also provides an adaptive threat blocking system for deep analysis of industrial control protocols, the system comprising:

[0027] The protocol reverse modeling module is used to construct a multi-dimensional parsing model of industrial control protocols. Based on protocol reverse engineering, it extracts opcode semantic rules, parameter structure constraints and session state transition features to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the abstract communication service interface in the IEC 61850 standard.

[0028] The threat vector generation module performs semantic-level parsing of real-time communication traffic based on the protocol syntax tree, extracts dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree and session state abnormal jump rate, and generates a three-dimensional threat feature vector.

[0029] The dynamic assessment engine module performs fusion analysis on the three-dimensional threat feature vector through the dynamic threat assessment engine, and calculates the threat confidence using a sliding time window mechanism. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system.

[0030] The tiered blocking strategy module triggers tiered blocking strategies based on threat confidence levels. The tiered blocking strategies include modifying the protocol message checksum when the confidence level is below the first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off network communication of the target device when the confidence level exceeds the second threshold.

[0031] The closed-loop feedback optimization module dynamically adjusts the trigger threshold of the graded blocking strategy based on the defense effect feedback closed-loop update protocol syntax tree and threat assessment rules, using the control loop stability assessment index.

[0032] The technical effects and advantages of the adaptive threat blocking method and system for deep analysis of industrial control protocols provided by this invention are as follows:

[0033] This invention accurately identifies covert attacks through semantic parsing of industrial control protocols and multi-dimensional dynamic blocking, enabling coordinated optimization of defense actions and production stability. By using protocol syntax tree-driven semantic parsing and three-dimensional dynamic threat vector (semantic layer-parameter layer-state layer) modeling, this invention achieves accurate identification of attacks that comply with protocols but exhibit semantic anomalies (such as opcode tampering and parameter out-of-bounds errors), filling the detection blind spot of traditional solutions that rely solely on network layer features. Based on multi-dimensional attack confidence assessment (sliding time window dynamic threshold) and control loop stability indicators (such as current fluctuation rate and pressure change gradient), it implements a tiered blocking strategy (checksum correction → session isolation → communication disconnection), avoiding equipment malfunction caused by brute-force blocking. Attached Figure Description

[0034] Figure 1 This is a flowchart of the adaptive threat blocking method for deep parsing of industrial control protocols in Example 1;

[0035] Figure 2 This is a schematic diagram of the adaptive threat blocking system for deep parsing of industrial control protocols in Example 2. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Example 1:

[0038] Please see Figure 1 As shown, embodiments of the present invention provide an adaptive threat blocking method for deep parsing of industrial control protocols, the method comprising:

[0039] A multi-dimensional parsing model of industrial control protocols is constructed. Based on protocol reverse engineering, opcode semantic rules, parameter structure constraints and session state transition features are extracted to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the Abstract Communication Service Interface (ACSI) in the IEC 61850 standard.

[0040] Semantic-level parsing of real-time communication traffic is performed based on protocol syntax trees to extract dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree, and session state abnormal jump rate, generating a three-dimensional threat feature vector.

[0041] The dynamic threat assessment engine performs fusion analysis on the three-dimensional threat feature vectors and uses a sliding time window mechanism to calculate the threat confidence. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system (ICS).

[0042] The tiered blocking strategy is triggered based on the threat confidence level. The tiered blocking strategy includes modifying the protocol message checksum when the confidence level is below the first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off the target device's network communication when the confidence level exceeds the second threshold.

[0043] Based on the closed-loop update protocol syntax tree and threat assessment rules of the defense effect feedback, the trigger threshold of the hierarchical blocking strategy is dynamically adjusted through the control loop stability assessment index.

[0044] Protocol reverse engineering includes:

[0045] The state machine model of the unpublished protocol was inverted using the opcode-parameter association matrix, and the industrial applicability of the state machine model was verified using the Modbus TCP function code compatibility verification module.

[0046] In adaptive threat blocking targeting industrial control protocols, protocol reverse engineering is the core component of building a multi-dimensional analytical model. Its key lies in reversing the state machine model of undisclosed protocols through communication traffic characteristics. In specific implementation, industrial traffic probes are first deployed to collect the interaction messages between the target device and the control terminal. Based on timestamps and session identifiers, the raw data is cleaned and reassembled to form a set of protocol metadata containing opcode sequences, parameter clusters, and session states.

[0047] During the opcode and parameter association matrix construction phase, each protocol unit is parsed into a (opcode, parameter template) tuple. For example, in the communication traffic of a power monitoring system, it was observed that opcode 0xA1 is always accompanied by a 4-byte floating-point parameter, while opcode 0xB2 is associated with a 2-byte integer device identifier. This fixed pattern is abstracted as a parameter structure constraint and filled into the matrix. Through cluster analysis, the dynamic behavior characteristics of the opcode can be identified. For example, opcode 0xC3 only appears during the system initialization phase, and the parameter length changes with the number of peripheral devices. These characteristics provide a basis for subsequent state transition modeling.

[0048] During the state machine inversion process, temporal association rules are used to mine the causal relationship between opcodes. For example, when it is detected that opcode 0xD4 always appears after opcode 0xE5, and the parameter templates of the two satisfy the constraint of "continuous address range and consistent data type", it is inferred that they constitute a state transition path of "instruction request and data return". Furthermore, the state transition probability is calculated through a hidden Markov model to identify key transition conditions. For example, when a certain parameter value exceeds a preset threshold (such as the temperature parameter exceeding 0x00FF), the state transitions from "running state" to "alarm state". This feature is mapped to the detection logic of abnormal transition rate of session state.

[0049] In the industrial applicability verification stage, the inversion model is tested in three layers using the Modbus TCP compatibility verification module. The three layers of testing include semantic equivalence verification, structural compliance verification, and timing logic adaptation.

[0050] Semantic equivalence verification: The reversed opcode is semantically mapped to the standard function code. For example, if an opcode performs a register write operation in more than 80% of scenarios, it is mapped to Modbus function code 0x06 (preset single register).

[0051] Structural compliance verification: Verify whether the parameter length and encoding format conform to the Modbus Application Data Unit (ADU) specification. For example, identify that a certain 32-bit floating-point parameter needs to be split into two 16-bit register values ​​for storage, and ensure that it is compatible with the register address space of 4xxxx.

[0052] Timing logic adaptation: Evaluate whether the state transition path meets the timing requirements of industrial control. For example, verify the constraint that "equipment start / stop commands must wait for status feedback messages" to prevent control loop oscillations caused by command conflicts.

[0053] The results of protocol reverse engineering are ultimately injected into the protocol syntax tree, which will serve as a dynamic update of the semantic rule base. For example, the reverse-engineered "device diagnostic state" will be mapped to the "information reporting service primitive" of IEC 61850ACSI, realizing closed-loop optimization of deep analysis of industrial control protocols and threat blocking.

[0054] By continuously feeding back false alarm and missed alarm data in actual defense scenarios, the state transition probability threshold can be dynamically adjusted to ensure that the triggering of the blocking strategy is synchronized with the industrial scanning cycle, thus avoiding interference with normal control processes.

[0055] Methods for calculating the gradient of process value mutation include:

[0056] The analog data is normalized based on the range of the pressure sensor of the coal-fired boiler, and the gradient rate of change is calculated based on the sampling period of the DCS system of the thermal power plant.

[0057] In the implementation of threat blocking in the DCS system of thermal power plants, the process value mutation gradient is the core indicator of the three-dimensional threat feature vector. Its calculation needs to be closely combined with the physical characteristics of the industrial site. In specific implementation, taking the pressure sensor of the boiler of a coal-fired unit as a typical object, the range reference is first determined according to the equipment process parameters. For example, if the range of the pressure sensor of a supercritical unit boiler is 0-25MPa, the original analog data is normalized to map the physical value to the standardized range of 0-1, thereby eliminating the influence of the difference in the dimensions of different sensors on mutation detection.

[0058] In the normalization stage, a piecewise linear transformation strategy is adopted, which includes:

[0059] Within the safe operating range (e.g., 12-22 MPa), proportional scaling is used to ensure that minor pressure fluctuations remain identifiable after normalization.

[0060] Data exceeding the range (such as below 0 MPa or above 25 MPa) is truncated and marked with an anomaly flag to prevent extreme values ​​from interfering with gradient calculation.

[0061] The gradient change rate is calculated using the DCS system sampling period as the time reference and employing a sliding difference algorithm. For example, if the DCS sampling period is 500ms, a time window is set to cover 10 consecutive sampling points (i.e., 5 seconds of operating data). The pressure change trend line is fitted using the least squares method. When the slope of the normalized pressure value exceeds the set threshold (e.g., 0.15 / second) within the window period, it is determined to be a process value mutation event. This threshold needs to be dynamically adjusted according to the boiler's thermal inertia characteristics. A higher gradient (e.g., 0.2 / second) is allowed during the unit's load increase phase, while a stricter detection threshold (e.g., 0.1 / second) is used during steady-state operation.

[0062] The process value mutation gradient, the logical conflict degree of the instruction sequence, and the abnormal jump rate of the session state will be vectorized and fused. For example, when the pressure mutation gradient exceeds the limit, if the control instruction simultaneously detects conflicting instructions of "pressurization" and "depressurization" (logical conflict degree ≥ 0.7), and the session state jumps 3 times in a row within 200ms (abnormal jump rate exceeds the threshold), the dynamic threat assessment engine will raise the threat confidence to above the second threshold and trigger the target device communication cut-off operation.

[0063] The dynamic threat assessment engine uses a hidden Markov model (HMM), and its state transition probability matrix is ​​dynamically updated according to the load fluctuation characteristics of the generator set. The update cycle is synchronized with the AGC command issuance interval.

[0064] In the threat blocking scenario of thermal power units, the dynamic threat assessment engine uses a hidden Markov model (HMM) to calculate threat confidence. Its core is to jointly model the physical behavior of the industrial control system with the characteristics of network threats. Taking a 600MW coal-fired unit as an example, the hidden state set of the HMM is defined as {steady-state operation, load increase transition state, load decrease transition state, abnormal state}. The observation sequence is composed of a three-dimensional threat feature vector (process value mutation gradient, command sequence logical conflict degree, session state abnormal jump rate).

[0065] The mechanism for dynamic updating of state transition probabilities is strongly coupled with unit load control, and the coupling methods include:

[0066] The basic transfer matrix is ​​initialized based on historical operating data. For example, during the stable period of AGC (Automatic Generation Control) commands, the probabilities of transitioning from "steady-state operation" to each transition state are 0.05 for load increase, 0.03 for load decrease, and 0.001 for abnormal state.

[0067] When the load fluctuation rate is detected to exceed the threshold (e.g., 15MW / min), the transfer probability is adjusted in real time through an online learning algorithm. For example, during the rapid peak shaving phase, the transfer probability of the load increase transition state is increased to 0.12, while the transfer probability of the abnormal state is simultaneously increased to 0.005, reflecting the enhanced risk sensitivity under highly dynamic operating conditions.

[0068] The update cycle is strictly aligned with the interval between AGC command issuance (typically 4-15 seconds) to ensure that the model and the physics control rhythm are synchronized.

[0069] The dynamic threat assessment engine includes a threat assessment collaboration mechanism, an example of which is shown below:

[0070] When the unit responds to the AGC command to increase from 500MW to 550MW, the gradient of the sudden change in process value reaches 0.18 / second due to the change in main steam pressure (close to the set threshold). At this time, the HMM increases the transition probability weight of the load increase transition state by 40%.

[0071] If a logical conflict (conflict degree ≥ 0.6) is detected simultaneously in the control command sequence between "increase coal feed rate" and "close turbine valve", and the session state changes 5 times within 10 seconds (abnormality rate exceeds limit), the HMM calculates that the probability of abnormal state jumps to 72%, and the threat confidence exceeds the second threshold; the dynamic threat assessment engine immediately triggers a communication cut-off operation and records the event to the defense effect feedback library for subsequent offline optimization of the transition matrix.

[0072] HMM parameters are calibrated in a closed loop using control loop stability indicators. When the unit is in sliding pressure operation mode, the transition state transfer probability threshold is automatically relaxed (e.g., the upper limit of the load increase probability is adjusted from 0.12 to 0.15) to avoid misjudgment caused by control strategy switching.

[0073] Methods for modifying the protocol message checksum include:

[0074] For the OPC UA publish and subscribe mechanism, a response message containing false process values ​​within the range dead zone is injected into the controlled device. The range dead zone is determined according to the range definition module in the DL / T 860 standard.

[0075] In the practice of blocking threats to the OPC UA protocol in thermal power plants, attackers often carry out covert damage by forging process value messages. The defense strategy of this system focuses on identifying and blocking such malicious traffic that tampers with checksums. Its core lies in combining industrial control protocol specifications and physical range characteristics to achieve accurate detection. Taking the main steam temperature control system of a boiler as an example, an attacker attempts to inject false temperature values ​​into the DCS controller. The response message it constructs follows the OPC UA publish / subscribe mechanism, but tampers with the data fields and recalculates the CRC checksum to bypass the basic protocol verification.

[0076] The range dead zone determination is based on the analog quantity range metadata defined in the DL / T 860 standard, as shown in the following example:

[0077] A certain main steam temperature transmitter is calibrated to a range of 0-600℃. According to the "range definition module" in the standard, the dead zone is calculated to be ±1.5℃ (0.25% of the range). An attacker sets a false temperature value to the current true value ±1℃ (e.g., injecting 541℃ or 543℃ when the true value is 542℃), so that the numerical fluctuation is within the normal noise range of the equipment.

[0078] The system extracts the "EngineeringUnits" field from the OPC UA message through protocol reverse engineering, identifies the upper and lower limits of the measurement range and the dead zone parameters of the measurement point, and establishes a dynamic detection baseline.

[0079] The following is an example of multi-dimensional collaborative detection:

[0080] Although the attack message passes the basic CRC check, its parameter cluster structure deviates from the normal pattern. Normal temperature value transmission uses 4-byte floating-point numbers, while the attack message fills the tail part with unconventional zero values ​​(such as 541℃ being encoded as 0x43 0x0A 0x000x00). This anomaly is marked as a parameter structure conflict by the protocol syntax tree.

[0081] Although the false temperature value is within the dead zone of the measurement range, considering the unit load status (HMM model judges that it is currently in steady state operation) and thermodynamic inertia, the gradient of the process value change should be less than 0.02℃ / second. When the temperature value is detected to remain at 541℃ with zero fluctuation (gradient 0.0℃ / second) for three consecutive sampling cycles (1.5 seconds), the steady state anomaly rule is triggered.

[0082] The dynamic threat assessment engine synchronously analyzes session state transitions; to maintain stealth, the attacker repeatedly sends subscription responses 5 times within 2 seconds, resulting in an abnormal session state transition rate of 2.5 times / second (exceeding the threshold of 1.2 times / second).

[0083] The system, through three-dimensional threat feature vector fusion analysis, determined that this communication posed a high risk of "spoofing" (threat confidence level ≥ 85%), and immediately executed the following blocking actions:

[0084] Based on the OPC UA semantic rules generated by reverse engineering the protocol, the DataSetWriterID field of the attack message is rewritten to make it mismatched with the subscriber's expected identifier.

[0085] A correction message is injected into the controller to restore the temperature value to the most recent reliable historical value (e.g., 542.3℃) and recalculate the checksum conforming to the DL / T 860 standard.

[0086] Update the defense effect feedback library and add the attack feature (such as a specific zero-value tail pattern) to the abnormal parameter template library of the protocol syntax tree.

[0087] The stability evaluation indicators for control loops include:

[0088] The dynamic correction coefficient is obtained by dynamically correcting the tolerance threshold of the coal mill current fluctuation based on the steam pressure change rate of the turbine speed regulating stage, and adjusting the pH value adjustment delay threshold by combining the SO2 concentration gradient at the desulfurization tower inlet. The dynamic correction coefficient is obtained by calculating the correlation matrix between coal quality and load in the historical operating data of the coal-fired unit.

[0089] In the assessment of threat blocking effectiveness of thermal power units, the stability index of the control loop serves as a dynamic constraint on defensive actions, deeply coupled with the multivariable control characteristics of the thermal system. Taking a 1000MW ultra-supercritical unit as an example, when performing communication cut-off or message correction operations, it is necessary to ensure that the transient response of key systems such as boiler-turbine-environmental protection island will not induce equipment protection actions.

[0090] The following is an example of how the dynamic threshold collaborative correction mechanism works:

[0091] Coal mill current tolerance adjustment:

[0092] The basic threshold is set at ±5% (e.g., when the rated current of the coal mill is 200A, the fluctuation is allowed to be 190-210A);

[0093] When the steam pressure change rate of the turbine speed regulating stage exceeds 0.8 MPa / s (such as when the main steam pressure rises suddenly due to rapid load reduction of the unit), the system queries the current coal calorific value (such as 18.5 MJ / kg) based on the coal quality and load correlation matrix and sets the correction coefficient of 1.3 accordingly, temporarily relaxing the current fluctuation tolerance to ±6.5%.

[0094] This allows the coal mill to maintain the stability of the pulverizing system by increasing current fluctuations when the coal quality deteriorates (when receiving high-ash coal), thus avoiding coal feeding interruptions caused by excessive restrictions.

[0095] Desulfurization system delay threshold optimization:

[0096] Under normal operating conditions, the pH adjustment delay threshold is 120 seconds (from SO2 concentration change to limestone slurry flow rate response).

[0097] When the SO2 concentration gradient at the inlet of the desulfurization tower reaches 50 mg / (m³) 3 •min)(e.g., a sudden increase in the sulfur content of coal), based on the correlation coefficient of 0.6 for "high sulfur coal - 75% load" in historical operating data, the delay threshold is tightened to 72 seconds.

[0098] If a pH adjustment lag is detected at this time (actually delayed by 85 seconds), even if the threat confidence level meets the standard, the communication blocking will still be delayed to prioritize ensuring that environmental parameters are under control.

[0099] The coal quality and load correlation matrix was constructed by analyzing historical data of the generating units; the matrix dimensions include coal quality indicators (calorific value, sulfur content and ash content) and load rate.

[0100] Methods for dynamically adjusting trigger thresholds include:

[0101] A PID control algorithm is used to calculate the false blocking rate and the attack miss rate by weighting, and the proportional coefficient is dynamically configured according to the grid connection stability requirements of the power plant units.

[0102] In the operation of the thermal power unit safety defense system, the dynamic balance between the false blocking rate and the attack miss rate directly affects the unit control stability. This method introduces a closed-loop regulation mechanism to deeply couple the grid security requirements with the information security strategy. Taking a 600MW unit participating in deep peak shaving as an example, when it undertakes the primary frequency regulation task of the provincial grid, the defense system optimizes the blocking strategy in real time according to the grid connection status:

[0103] The operating principle of PID control mechanism includes the dynamic configuration of control input, target output and proportional coefficient.

[0104] Control inputs: False blocking rate (FP) is taken from false action records in the defense effect feedback library, and attack false negative rate (FN) is calculated from undetected attack events in the post-event audit log.

[0105] Target output: Threat confidence trigger threshold. Its adjustment direction is determined by the power grid frequency deviation. For example, when the frequency fluctuation exceeds ±0.15Hz, the system prioritizes ensuring control continuity and reduces the risk of false interruption.

[0106] Dynamic configuration of proportional coefficient: The stability weight is calculated based on the unit's AGC regulation rate (e.g., 2% Pe / min) and the governor droop characteristics. For example, in a frequency regulation test, the trigger weight coefficient for a frequency drop of 0.2Hz is adjusted from the base value of 0.5 to 0.3 (biased to reduce FP), which increases the first-level blocking threshold from 65% to 72%.

[0107] The following is an example of multi-source data collaboration:

[0108] When the generating unit is in islanded operation mode, the demand for grid connection stability surges:

[0109] The boiler main control pressure change rate was detected to be 0.4 MPa / s through the control loop stability evaluation index.

[0110] The PID algorithm automatically increases the false negative rate weight (coefficient 0.7), lowering the secondary blocking threshold from 85% to 78%.

[0111] At this point, an abnormal jump in the OPC UA session was detected (weight 4). With a threat confidence of 79%, communication was immediately cut off, resulting in a 40% faster response time compared to the normal mode.

[0112] Slow data injection attack occurred during the evening rush hour:

[0113] The attacker tampered with the coal feed instruction at a rate of 0.3% per minute (below the weighted gradient threshold);

[0114] The PID controller calculates based on the current frequency modulation performance index (Kp = 0.8) that a 5% false alarm rate needs to be tolerated to maintain stable combustion.

[0115] The system temporarily relaxes the threshold for process value mutation gradient by 20%, and simultaneously uses a message correction mechanism to gradually counteract the problem, avoiding direct blocking that could cause load fluctuations.

[0116] Methods for cutting off network communication of the target device include:

[0117] When abnormal fluctuations in generator excitation voltage are detected, a topology change log containing the current AGC command value and excitation parameters is generated. The log timestamp is then associated with the generator grid connection switch action record via the IEEE 1588 protocol and stored in the safety audit system.

[0118] When a generator excitation system is subjected to an advanced persistent threat attack, the communication cutoff strategy must ensure the ability to trace the incident and the auditability of the power system operation. For example, in a case study of a 660MW coal-fired unit defense system, an attacker tampered with the excitation regulator setting value through a man-in-the-middle attack, triggering the following coordinated response.

[0119] The topology change log generation mechanism operates as follows:

[0120] When the process value abrupt change gradient detection module identifies an excitation voltage fluctuation exceeding 5% (e.g., a sudden drop of 35V from a rated voltage of 400V), the system performs the following operations:

[0121] Extract the current AGC command value (such as the 4-20mA signal corresponding to a 550MW load) and excitation parameters (PSS gain, AVR setpoint).

[0122] Based on the Modbus / TCP field mapping table established by reverse engineering the protocol, the control code offset in the exception message was captured (function code 0x05 was tampered with to 0x06).

[0123] Generate structured log files containing timestamps, device topology relationships (excitation transformer-regulator-generator terminal connection status), and PID threshold adjustment records.

[0124] The relationship between time synchronization and events is as follows:

[0125] By using the IEEE 1588 precision clock protocol, the log timestamps are aligned with the grid-connected switch action records to the microsecond level (e.g., the circuit breaker tripping time 12:05:27.843216).

[0126] By combining the unit state probabilities output by the HMM model (such as "excitation instability" with a confidence level of 89%), a causal relationship graph of the event sequence is constructed. For example, in a certain attack event, the log shows that the abnormal excitation fluctuation (12:05:27.841) occurred earlier than the 220kV switch trip (12:05:27.859), confirming the attack chain propagation path.

[0127] The defensive coordination is as follows:

[0128] A coastal power plant experienced a periodic disturbance attack on its excitation voltage (fluctuation amplitude ±8%, frequency 2Hz), and the system implemented tiered blocking:

[0129] Primary blocking: The abnormal excitation setting value is rewritten through the message correction mechanism (e.g., the 380V in the attack message is corrected to 402V).

[0130] Advanced blocking: If the corrected voltage still deviates from the threshold by ±3% for 5 seconds, communication is cut off and a log is generated.

[0131] Correlation analysis revealed a temporal correlation between this attack and the aberration pattern of AGC commands (abnormal coal quality and load matrix) in historical logs, triggering a plant-wide defense strategy upgrade.

[0132] Conduct security audits (example of a security audit system):

[0133] Log storage adopts the IEC 61850 event object model, with key fields including:

[0134] Timestamp: The precise time (nanosecond level) of 1588 synchronization.

[0135] Topo_Change: The status of the excitation system equipment (e.g., the #3 excitation transformer changes from "online" to "isolated").

[0136] Control_Context: The associated AGC instruction curve segment (data window from the first 10 seconds to the last 5 seconds).

[0137] In the analysis of a black boot incident, the security audit system, by comparing log timestamps with SCSOE records, located the "false normal" state created by the attacker using a 2.8ms clock deviation, providing clues for vulnerability discovery for protocol reverse engineering.

[0138] Example 2:

[0139] like Figure 2 As shown, based on the same inventive concept as the adaptive threat blocking method for deep parsing of industrial control protocols in the foregoing embodiments, this application provides an adaptive threat blocking system for deep parsing of industrial control protocols. The system and method embodiments in this application are based on the same inventive concept. The system includes:

[0140] The protocol reverse modeling module is used to construct a multi-dimensional analytical model of industrial control protocols. Based on protocol reverse engineering, it extracts opcode semantic rules, parameter structure constraints, and session state transition features to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the abstract communication service interface in the IEC 61850 standard.

[0141] The threat vector generation module performs semantic-level parsing of real-time communication traffic based on the protocol syntax tree, extracts dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree, and session state abnormal jump rate, and generates a three-dimensional threat feature vector.

[0142] The dynamic assessment engine module performs fusion analysis on the three-dimensional threat feature vector through the dynamic threat assessment engine, and calculates the threat confidence using a sliding time window mechanism. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system.

[0143] The tiered blocking strategy module triggers tiered blocking strategies based on threat confidence levels. These strategies include modifying the protocol message checksum when the confidence level is below a first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off network communication of the target device when the confidence level exceeds a second threshold.

[0144] The closed-loop feedback optimization module dynamically adjusts the trigger threshold of the graded blocking strategy based on the defense effect feedback closed-loop update protocol syntax tree and threat assessment rules, using the control loop stability assessment index.

[0145] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0146] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present application, based on the technical solution and concept of the present application, should be covered within the scope of protection of the present application.

Claims

1. An adaptive threat blocking method for deep analysis of industrial control protocols, characterized in that, The methods include: A multi-dimensional parsing model of industrial control protocols is constructed. Based on protocol reverse engineering, opcode semantic rules, parameter structure constraints and session state transition features are extracted to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the abstract communication service interface in the IEC 61850 standard. Based on the protocol syntax tree, semantic-level parsing is performed on real-time communication traffic to extract dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree and session state abnormal jump rate, and a three-dimensional threat feature vector is generated. The three-dimensional threat feature vector is fused and analyzed by a dynamic threat assessment engine, and the threat confidence is calculated using a sliding time window mechanism. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system. The tiered blocking strategy is triggered based on the threat confidence level. The tiered blocking strategy includes modifying the protocol message checksum when the confidence level is below the first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off the target device's network communication when the confidence level exceeds the second threshold. Based on the closed-loop update protocol syntax tree and threat assessment rules of the defense effect feedback, the trigger threshold of the hierarchical blocking strategy is dynamically adjusted through the control loop stability assessment index.

2. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The protocol reverse engineering includes: The state machine model of the undisclosed protocol was inverted using the opcode-parameter association matrix, and the industrial applicability of the state machine model was verified using the Modbus TCP function code compatibility verification module.

3. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The method for calculating the process value mutation gradient includes: The analog data is normalized based on the range of the pressure sensor of the coal-fired boiler, and the gradient rate of change is calculated based on the sampling period of the DCS system of the thermal power plant.

4. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The dynamic threat assessment engine adopts a hidden Markov model, and its state transition probability matrix is ​​dynamically updated according to the load fluctuation characteristics of the generator set. The update cycle is synchronized with the AGC command issuance interval.

5. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The method for modifying the protocol message checksum includes: For the OPC UA publish and subscribe mechanism, a response message containing false process values ​​within the range dead zone is injected into the controlled device. The range dead zone is determined according to the range definition module in the DL / T 860 standard.

6. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The stability evaluation indicators for the control loop include: The dynamic correction coefficient is obtained by dynamically correcting the tolerance threshold of the coal mill current fluctuation based on the steam pressure change rate of the turbine speed regulating stage, and adjusting the pH value adjustment delay threshold by combining the SO2 concentration gradient at the desulfurization tower inlet. The dynamic correction coefficient is obtained by calculating the correlation matrix between coal quality and load in the historical operating data of the coal-fired unit.

7. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The method for dynamically adjusting the trigger threshold includes: A PID control algorithm is used to calculate the false blocking rate and the attack miss rate by weighting, and the proportional coefficient is dynamically configured according to the grid connection stability requirements of the power plant units.

8. The adaptive threat blocking method for deep parsing of industrial control protocols according to claim 1, characterized in that, The method for cutting off the target device's network communication includes: When abnormal fluctuations in generator excitation voltage are detected, a topology change log containing the current AGC command value and excitation parameters is generated. The log timestamp is then associated with the generator grid connection switch action record via the IEEE 1588 protocol and stored in the safety audit system.

9. An adaptive threat blocking system for deep analysis of industrial control protocols, characterized in that, The system includes: The protocol reverse modeling module is used to construct a multi-dimensional parsing model of industrial control protocols. Based on protocol reverse engineering, it extracts opcode semantic rules, parameter structure constraints and session state transition features to generate a protocol syntax tree. The opcode semantic rules are mapped and matched with the service primitives of the abstract communication service interface in the IEC 61850 standard. The threat vector generation module performs semantic-level parsing of real-time communication traffic based on the protocol syntax tree, extracts dynamic indicators, including process value mutation gradient, instruction sequence logical conflict degree and session state abnormal jump rate, and generates a three-dimensional threat feature vector. The dynamic assessment engine module performs fusion analysis on the three-dimensional threat feature vector through the dynamic threat assessment engine, and calculates the threat confidence using a sliding time window mechanism. The time window length of the sliding time window mechanism is dynamically synchronized with the scanning cycle of the industrial control system. The tiered blocking strategy module triggers tiered blocking strategies based on threat confidence levels. The tiered blocking strategies include modifying the protocol message checksum when the confidence level is below the first threshold, isolating abnormal session connections when the confidence level is above the first threshold, and cutting off network communication of the target device when the confidence level exceeds the second threshold. The closed-loop feedback optimization module dynamically adjusts the trigger threshold of the graded blocking strategy based on the defense effect feedback closed-loop update protocol syntax tree and threat assessment rules, using the control loop stability assessment index.

Images