Method and system for detecting and defending abnormal access of industrial control instruction of DCS (Distributed Control System) of thermal power plant

Abstract

The invention provides a thermal power plant DCS system industrial control instruction abnormal access detection and defense method and system. Comprising the following steps: acquiring industrial control instruction data and production real-time data based on a traditional industrial control protocol and a Web / API protocol through acquisition probes deployed in a production control area and a management information area; constructing a state machine for describing a legal execution context of the instruction, parameter compliance and a time sequence frequency model based on an electric power safety production rule; performing dynamic association analysis on the real-time data and the business logic model to detect abnormal access behaviors violating business semantics; once an exception is found, a dynamic defense response including real-time blocking, warning, session termination is triggered. The deep semantic security analysis of the industrial control instruction is realized, so that the abnormal instruction access behavior violating the power production business logic is effectively detected and defended, and the security of the DCS of the thermal power plant is improved.

Description

Technical Field

[0001] This invention relates to the field of industrial control system network security technology, specifically to a method and system for detecting and defending against abnormal access to industrial control commands in a thermal power plant DCS system. Background Technology

[0002] With the deep integration of Industrial Internet technology, the integration level of distributed control systems (DCS) and related information systems in thermal power plants is constantly improving. On the one hand, the industrial control command flow (based on protocols such as OPC and MODBUS) in traditional closed control networks still requires security protection; on the other hand, to achieve data interoperability and remote operation and maintenance, a large number of production control functions are provided externally through Web services, API interfaces, etc., forming new access channels for control commands. This trend has diversified the transmission paths of core industrial control commands, improving operational efficiency while also introducing new cybersecurity risks.

[0003] Currently, there are significant shortcomings in the security protection of industrial control systems. Traditional IT security devices (such as WAFs) cannot parse and understand the unique industrial protocol semantics and control logic of the power industry, making it difficult to effectively protect against attacks targeting industrial control commands. While industrial control firewalls can handle some traditional industrial control protocols, they lack deep detection capabilities for industrial control commands sent by upper-layer applications through API interfaces and encapsulated in common protocols such as HTTP / HTTPS. More importantly, existing solutions generally lack an understanding of the command context, failing to dynamically correlate and analyze the parameters and timing of a command (whether issued through APIs or traditional industrial control protocols) with the current real-time operating status of the target device. Consequently, they cannot identify abnormal operations that appear legitimate but violate production process safety regulations.

[0004] Therefore, this invention aims to overcome the aforementioned limitations by proposing a method and system specifically for detecting and defending against abnormal access to industrial control commands in DCS systems of thermal power plants. Its core lies in constructing a protection system capable of collecting command streams and real-time process data across protocols and multiple interfaces, and deeply understanding the power production business logic for multi-dimensional correlation analysis. This invention focuses on the semantic security and contextual rationality of the commands themselves, thereby achieving a shift from traditional feature- or protocol-based protection to deep intelligent protection based on business semantics, effectively addressing advanced sustainability threats and abnormal operation risks targeting industrial control systems. Summary of the Invention

[0005] The present invention aims to at least solve one of the technical problems existing in the prior art, and provides a method and system for detecting and defending against abnormal access to industrial control commands in a thermal power plant DCS system.

[0006] In a first aspect, embodiments of the present invention provide a system for detecting and preventing abnormal access to industrial control commands in a thermal power plant's DCS system, the system comprising:

[0007] The multi-protocol data acquisition module is used to acquire industrial control command data and real-time production data from traditional industrial control protocol interfaces and API interfaces.

[0008] The business logic modeling module is used to build, update, and store business logic models, which define the legal context for the execution of industrial control instructions.

[0009] The real-time correlation analysis engine is used to receive the data collected by the multi-protocol data acquisition module and call the business logic model to perform dynamic correlation analysis in order to determine whether the current industrial control instruction flow constitutes abnormal access behavior.

[0010] The dynamic response control module is used to trigger a dynamic defense response when the real-time correlation analysis engine determines that an anomaly has occurred.

[0011] The security management center is a human-computer interaction interface that provides users with system configuration, model management, alarm presentation, and audit traceability.

[0012] In some possible embodiments, the multi-protocol data acquisition module includes:

[0013] The first type of acquisition probe is deployed in the production control area to collect and parse command traffic based on at least one of the traditional industrial control protocols, namely OPC, MODBUS, PROFIBUS, and IEC 104.

[0014] The second type of acquisition probe is deployed in the management information area or isolation boundary to collect and parse API instruction call requests based on at least one of the protocols: HTTP, HTTPS, and WebSocket.

[0015] In some possible embodiments, the business logic model includes at least one of a state machine model, a parameter compliance model, and a timing frequency model;

[0016] The state machine model is used to define the interlocking protection conditions and system states that the controlled object must meet when executing specific industrial control instructions;

[0017] The parameter compliance model is used to define the reasonable numerical range and change rate threshold of instruction parameters;

[0018] The timing-frequency model is used to define the reasonable order, period, and frequency baseline of instruction calls.

[0019] In some possible embodiments, when the real-time correlation analysis engine performs dynamic correlation analysis, it is specifically used for:

[0020] Determine whether the industrial control instruction violates the preconditions defined by the state machine model;

[0021] Determine whether the parameter value of the industrial control instruction exceeds the limit or rate of change defined by the parameter compliance model;

[0022] Determine whether the calling sequence or frequency of the industrial control instructions deviates from the normal baseline defined by the timing frequency model;

[0023] Based on the real-time production data, it is determined whether the industrial control command constitutes a dangerous or conflicting operation under the current system operating conditions.

[0024] In some possible embodiments, the dynamic defense response includes at least one of the following actions:

[0025] Issue policies to firewalls, network isolation devices, or industrial security gateways to block abnormal command flows;

[0026] Send alarm information to the monitoring and data acquisition system or operator station;

[0027] Record and report the full context log of security events;

[0028] Forced logout of abnormal commands can initiate a session or disconnect its network connection.

[0029] Secondly, embodiments of the present invention provide a method for detecting and defending against abnormal access to industrial control commands in a thermal power plant's DCS system, the method comprising:

[0030] Acquire industrial control command data and real-time production data from traditional industrial control protocol interfaces and API interfaces;

[0031] Based on a pre-defined business logic model, the real-time acquired industrial control instruction data and the real-time production data are dynamically correlated and analyzed to determine whether the current instruction flow constitutes abnormal access behavior; wherein, the business logic model is used to define the legal context for instruction execution;

[0032] If the access behavior is determined to be abnormal, a dynamic defense response will be triggered.

[0033] In some possible embodiments, the business logic model includes at least one of a state machine model, a parameter compliance model, and a time-series frequency model; the dynamic correlation analysis includes:

[0034] Determine whether the origin, operation type, and parameter content of the industrial control instruction violate the prerequisites defined by the state machine model;

[0035] Determine whether the parameter value of the industrial control instruction exceeds the limit or rate of change defined by the parameter compliance model;

[0036] Determine whether the call sequence, time interval, or frequency of the industrial control instructions deviates from the normal baseline defined by the timing frequency model.

[0037] In some possible embodiments, triggering the dynamic defense response includes:

[0038] Based on the risk level of the abnormal behavior, a tiered response action is executed, which includes one or more of the following: real-time blocking, sending alarms, logging, and terminating the session.

[0039] Thirdly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method as described in any one of the first aspects.

[0040] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described in any one of the first aspects.

[0041] Compared with existing technologies, this invention provides a method and system for detecting and defending against abnormal access to industrial control commands in a thermal power plant's DCS system. It achieves comprehensive perception of heterogeneous industrial control command streams through a multi-protocol data acquisition module; transforms power safety production knowledge into a computable security model through a business logic modeling module; realizes deep understanding and accurate judgment of command semantics and context through a real-time correlation analysis engine; and finally forms a proactive defense closed loop from perception, analysis to decision-making and execution through a dynamic response control module. This system achieves deep security protection across protocols and spaces, based on business semantics, significantly improving the comprehensive defense capabilities of thermal power plant DCS systems against unknown threats, advanced persistent attacks, and internal personnel misoperation / malicious operations, providing a solid security guarantee for the stable operation of critical power infrastructure. Attached Figure Description

[0042] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of the overall architecture of the DCS system for thermal power plants that detects and defends against abnormal access to industrial control commands, provided in an embodiment of the present invention.

[0044] Figure 2A flowchart illustrating the method for detecting and defending against abnormal access to industrial control commands in a thermal power plant DCS system, as provided in this embodiment of the invention.

[0045] Figure 3 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0046] To enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0047] Unless otherwise specifically stated, the technical or scientific terms used in the embodiments of this invention should be understood in their ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "comprising" or "including," as used in the embodiments of this invention, do not limit the shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof mentioned, nor do they exclude the appearance or addition of one or more other different shapes, numbers, steps, actions, operations, components, elements, and / or groups thereof, or the inclusion of these.

[0048] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale, and techniques, methods, and apparatus known to those skilled in the art may not be discussed in detail; however, where appropriate, the illustrated techniques, methods, and apparatus should be considered part of the specification. In all the examples shown and discussed herein, any other specific example may have different values. It should be noted that similar symbols and letters in the following figures denote similar items; therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0049] In the description of the embodiments of the present invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In the embodiments of the present invention, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in the embodiments of the present invention, as well as the features of different embodiments or examples.

[0050] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention; it should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0051] Example 1

[0052] This embodiment provides a detailed implementation process for detecting and preventing abnormal access to industrial control commands in a thermal power plant's DCS system. See also... Figure 2 The method includes the following steps:

[0053] S201: Multi-source heterogeneous data acquisition.

[0054] This step involves acquiring various types of data by deploying data collectors in different locations.

[0055] Industrial Control System (ICS) Command Data Acquisition: Raw network traffic is captured via a bypass sniffing method using a first-type acquisition probe (e.g., a software or hardware probe supporting deep packet inspection) deployed in the production control area network. This probe is capable of parsing various traditional ICS protocols, identifying write commands such as WriteRequest operations in OPC UA packets and Write Single Register (function code 06) in MODBUS / TCP packets, and extracting key metadata, including but not limited to: the source IP address of the command, the target device IP address, the function code, the register address, the written value, and the timestamp.

[0056] Web / API Command Data Acquisition: Using a second type of acquisition probe deployed in the DMZ or near the API gateway / server, all HTTP / HTTPS / WebSocket traffic entering and leaving the DCS-related systems is collected. This probe can decrypt SSL / TLS traffic (by importing the server certificate private key) and parse HTTP requests to extract key information such as: API endpoint (URL), HTTP method (POST / PUT), request parameters, JSON / XML request body content, and authentication information such as API keys or tokens.

[0057] Real-time production data acquisition: Sensor data reflecting the current system status (such as Turbine_Speed, Main_Steam_Pressure), equipment status signals (such as Feedwater_Pump_A_Running), and alarm information (such as Boiler_Trip_Status) are collected at a set frequency (such as once per second) via first-type acquisition probes or dedicated data interfaces deployed next to real-time databases (such as PISystem, iHistorian). This data provides crucial context for subsequent correlation analysis.

[0058] S202: Business logic model construction.

[0059] This step, based on historical data, system design documents, and expert knowledge, builds a behavioral model for the key controlled objects. Taking the "boiler main control setpoint instruction" as an example:

[0060] State machine model: By analyzing the DCS logic diagram and interlocking protection conditions, the state that the system must be in when executing the "Modify boiler main control setpoint" instruction is defined. For example, the valid preconditions for this instruction can be defined as:

[0061] (Boiler_Master_in_AUTO==True), AND,

[0062] (Boiler_Trip_Status==False), AND,

[0063] (Forced_Draft_Fan_A_Running==True,OR,

[0064] Forced_Draft_Fan_B_Running==True).

[0065] Any instruction attempt that does not meet this condition will be considered an exception.

[0066] Parameter compliance model: Based on the boiler's design specifications, define the legal range of setpoints. For example, the legal range of the boiler's load setpoints is [180, 600] (unit: MW). Simultaneously, define that the load change rate must not exceed 15 MW / min to prevent thermal stress shock.

[0067] Timing-frequency model: By analyzing historical normal operation logs, a baseline for command call frequency is established. For example, under normal circumstances, the operator or optimized control system typically issues setpoint commands less than 10 times per minute. A call frequency exceeding 50 times within a short period (e.g., within 10 seconds) is considered a flooding attack.

[0068] S203: Real-time correlation analysis and anomaly detection.

[0069] This step is the core processing stage. The real-time analysis engine receives the real-time data stream from S101 and calls the model built in S202 for comparison.

[0070] Example 1 (Status Anomaly): The analysis engine receives a POST request with the target / api / boiler / master / setpoint and the request body {"value":500}. Simultaneously, the real-time data stream shows Boiler_Trip_Status as True (the boiler has tripped). The engine calls the state machine model for judgment and finds that modifying the master control settings is prohibited in the "boiler tripped" state, thus determining the instruction to be a status anomaly.

[0071] Example 2 (Parameter Anomaly): The analysis engine parses a MODBUS write instruction whose target register address corresponds to the feeder speed setting, and the write value is 120%. The parameter compliance model stipulates that the maximum setting value is 100%, so the engine immediately determines that the instruction is a parameter anomaly.

[0072] Example 3 (Frequency Anomaly): The engine detected that 100 fine-tuning commands were sent to the turbine DEH system from the same IP address (suspected to be an compromised maintenance terminal) within 1 second, which far exceeded the normal baseline defined by the timing frequency model, and was immediately determined to be a frequency anomaly (denial-of-service attack characteristics).

[0073] S204: Dynamic Defense Response.

[0074] The response controller executes a preset response strategy based on the exception level and type output by S203.

[0075] For Example 1 above, the response controller immediately blocks all subsequent command flows from the source IP address to the DCS system by sending an API call to the next-generation firewall or dynamically updating the ACL policy, and sends an audible and visual alarm to the operator console: "Emergency: An illegal attempt to modify the set value was detected during the boiler trip and has been blocked."

[0076] For Example 2 above, the response controller can send alarm information to the DCS engineering station and record the complete operation context for use in security auditing.

[0077] For Example 3 above, the response controller can immediately terminate all network sessions corresponding to that IP address and add it to a temporary blacklist.

[0078] Example 2

[0079] This embodiment provides a system for implementing the method described in Embodiment 1.

[0080] See Figure 1 The system includes:

[0081] Multi-protocol data acquisition module 110: Composed of first-type and second-type acquisition probes deployed in different areas, it is responsible for collecting raw data, performing preliminary analysis and standardization, and sending the data to the analysis engine in a unified manner.

[0082] The first type of acquisition probe is deployed at the core network switching node in the production control area, and uses a bypass mirroring method to capture network traffic without loss. The probe has a built-in deep parsing (DPI) engine for various traditional industrial control protocols (such as OPC UA, MODBUS / TCP, IEC 104, etc.), which can accurately identify and extract key fields such as industrial control instruction opcodes, target addresses, and operands from network packets, and perform standardization (such as converting to a unified JSON format) and timestamp marking.

[0083] The second type of acquisition probe is deployed at the front end of the API gateway or server cluster in the management information area to collect all HTTP / HTTPS / WebSocket traffic. This probe has SSL / TLS decryption capabilities and can fully parse RESTful API calls and WebService requests, extracting URLs, methods, headers, parameters, and message body content, and performing standardized processing accordingly.

[0084] The two probes transmit the formatted data to the central analysis engine in real time via an encrypted channel.

[0085] Business logic modeling module 120: Provides a graphical interface that allows security administrators to import system logic diagrams, configure state transition rules, set parameter thresholds and frequency baselines, thereby building and managing the business logic model.

[0086] Administrators can quickly initialize system topology and variable relationships by importing PID diagrams, DCS logic configuration diagrams, or SCD files.

[0087] Configure the state nodes and transition conditions of the state machine model through the interface (e.g., "The 'Start Coal Mill B' command is only allowed when the 'Feed Pump A is running' signal is TRUE").

[0088] The upper and lower limits, thresholds, and rates of change of the parameter compliance model can be set through the interface (e.g., the "reheat steam temperature" setting range is set to 535℃ to 545℃, and the maximum rate of change is 2℃ / min).

[0089] The system can automatically learn from historical data and generate baseline suggested values ​​for time series frequency models for administrator confirmation and adjustment.

[0090] Real-time correlation analysis engine 130: This is the core processing unit, typically hosted on a high-performance server. Its built-in rule inference engine and machine learning algorithms are responsible for receiving standardized data, calling the business logic model for real-time matching calculations, and outputting anomaly detection results.

[0091] The engine receives a standardized data stream from the acquisition module and matches it against rules in the model library in real time.

[0092] It not only includes a rule-based reasoning fast matcher (for matching known anomalous patterns), but also integrates a machine learning model for detecting unknown, latent anomalous behaviors.

[0093] The engine dynamically correlates real-time command data with real-time status data from the production layer (such as "a valve closing command has been received, but real-time data indicates that the valve is already in the closed position and reports a jamming fault"), performs comprehensive analysis, and generates highly reliable abnormal events.

[0094] Dynamic Response Control Module 140: Receives instructions from the analysis engine and, through predefined interfaces (such as RESTful API, Syslog, SSH), links with existing network security devices (such as firewalls, industrial gateways) and monitoring systems (such as SIS, SOC platforms) to execute defensive actions.

[0095] It integrates with third-party security devices and services through a variety of pre-integrated adapters. For example, it can implement blocking by calling the dynamic policy interface of next-generation firewalls via RESTful API; send standardized alarm events to the SOC / SIEM platform via Syslog or SNMP Trap; and execute command-line operations on network switches via SSH to isolate suspicious terminals.

[0096] The response strategy is configurable and supports tiered responses, such as logging only for low-risk anomalies and immediately blocking and notifying the operator for high-risk attacks.

[0097] Security Management Center 150: Provides a unified management interface for the system, including dashboards, real-time alarm lists, audit log queries, system configuration, and report generation.

[0098] Global Security Dashboard: Displays the overall security posture, anomaly event classification statistics, and top threat source rankings in chart form.

[0099] Real-time alert list: Provides a detailed view of alerts that can be filtered and searched. Each alert comes with complete contextual information (such as the original command, associated real-time data, and details of the triggered rule) to help security personnel make quick decisions.

[0100] Audit and Reporting: Stores all historical operations and security events, and supports querying by conditions and generating compliance reports.

[0101] System Management: Used to manage user permissions, configure data collection probes, and upgrade the feature library, etc.

[0102] This invention provides a method and system for detecting and defending against abnormal access to industrial control commands in a thermal power plant's DCS system. It achieves comprehensive perception of heterogeneous industrial control command streams through a multi-protocol data acquisition module; transforms power safety production knowledge into a computable security model through a business logic modeling module; realizes deep understanding and accurate judgment of command semantics and context through a real-time correlation analysis engine; and finally forms a proactive defense closed loop from perception, analysis to decision-making and execution through a dynamic response control module. This system achieves deep security protection across protocols and spaces, based on business semantics, significantly improving the comprehensive defense capabilities of thermal power plant DCS systems against unknown threats, advanced persistent attacks, and internal personnel misoperation / malicious operations, providing a solid security guarantee for the stable operation of critical power infrastructure.

[0103] Electronic device 300 can be a desktop computer, laptop, handheld computer, cloud server, or other electronic device. Electronic device 300 may include, but is not limited to, processor 301 and memory 302. Those skilled in the art will understand that... Figure 3This is merely an example of electronic device 300 and does not constitute a limitation on electronic device 300. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device may also include input / output devices, network access devices, buses, etc.

[0104] Processor 301 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0105] The memory 302 can be an internal storage unit of the electronic device 300, such as a hard disk or RAM of the electronic device 300. The memory 302 can also be an external storage device of the electronic device 300, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the electronic device 300. Furthermore, the memory 302 can include both internal and external storage units of the electronic device 300. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0106] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this invention. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0107] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0108] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments of the invention herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0109] In the embodiments provided by this invention, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0110] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0111] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0112] If integrated modules / units are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program may include computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. Computer-readable media may include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in a computer-readable medium may be appropriately added to or subtracted according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0113] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A power plant DCS system industrial control instruction abnormal access detection and defense system, characterized in that, The system comprises: a multi-protocol data acquisition module for acquiring industrial control instruction data and production real-time data from traditional industrial control protocol interfaces and API interfaces; a business logic modeling module for constructing, updating and storing a business logic model, which is used to define a legal context of industrial control instruction execution; a real-time correlation analysis engine for receiving data acquired by the multi-protocol data acquisition module and calling the business logic model for dynamic correlation analysis to determine whether the current industrial control instruction flow constitutes abnormal access behavior; a dynamic response control module for triggering a dynamic defense response when the real-time correlation analysis engine determines that it is abnormal; a security management center for providing a man-machine interface for users to configure the system, manage the model, present alarms and trace audits.

2. The power plant DCS system industrial control instruction abnormal access detection and defense system according to claim 1, characterized in that, The multi-protocol data acquisition module comprises: a first type of acquisition probe deployed in a production control area for acquiring and analyzing instruction traffic based on at least one of the following traditional industrial control protocols: OPC, MODBUS, PROFIBUS and IEC104; a second type of acquisition probe deployed in a management information area or an isolation boundary for acquiring and analyzing API instruction call requests based on at least one of the following protocols: HTTP, HTTPS and WebSocket.

3. The power plant DCS system industrial control instruction abnormal access detection and defense system according to claim 1, characterized in that, The business logic model comprises at least one of the following: a state machine model, a parameter compliance model and a timing frequency model; The state machine model is used to define interlock protection conditions and system states that must be met by a controlled object when executing a specific industrial control instruction; The parameter compliance model is used to define reasonable numerical value ranges and change rate thresholds for instruction parameters; The timing frequency model is used to define reasonable sequences, periods and frequency baselines for instruction calls.

4. The power plant DCS system control instruction abnormal access detection and defense system according to any one of claims 1 to 3, characterized in that, When the real-time correlation analysis engine performs dynamic correlation analysis, it is specifically used to: determine whether the industrial control instruction violates the preconditions defined by the state machine model; determine whether the parameter values of the industrial control instruction exceed the limits or change rates defined by the parameter compliance model; determine whether the calling sequence or frequency of the industrial control instruction deviates from the normal baseline defined by the timing frequency model; integrate the production real-time data to determine whether the industrial control instruction constitutes a dangerous or conflicting operation under the current system operating conditions.

5. The power plant DCS system control instruction abnormal access detection and defense system according to any one of claims 1 to 3, characterized in that, The dynamic defense response includes at least one of the following actions: issuing a policy to a firewall, a network lock or an industrial security gateway to block abnormal instruction flow; sending alarm information to a supervisory control and data acquisition system or an operator station; recording a full-context log of a security event and reporting it; forcibly logging out of an abnormal instruction initiation session or cutting off its network connection.

6. A method for detecting and defending against abnormal access of an industrial control instruction of a DCS system of a thermal power plant, characterized in that, The method comprises: acquiring industrial control instruction data and production real-time data from traditional industrial control protocol interfaces and API interfaces; based on a pre-set business logic model, performing dynamic correlation analysis on the real-time acquired industrial control instruction data and production real-time data to determine whether the current instruction flow constitutes abnormal access behavior; wherein the business logic model is used to define a legal context of instruction execution; if it is determined to be abnormal access behavior, triggering a dynamic defense response.

7. The method of claim 6, wherein the method further comprises: detecting the abnormal access of the control instruction by the abnormal user; and preventing the abnormal user from accessing the control instruction. The business logic model comprises at least one of a state machine model, a parameter compliance model and a timing frequency model; the dynamic correlation analysis comprises: ​ determining whether the initiation source, operation type and parameter content of the industrial control instruction violate the prerequisites defined by the state machine model; determining whether the parameter value of the industrial control instruction exceeds the limit value or change rate defined by the parameter compliance model; determining whether the calling sequence, time interval or frequency of the industrial control instruction deviates from the normal baseline defined by the timing frequency model.

8. The method of claim 6 or 7, wherein the method further comprises: The triggered dynamic defense response comprises: performing a gradientized response action according to the risk level of the abnormal behavior, the response action comprising one or more of real-time blocking, sending an alarm, recording a log and terminating a session.

9. An electronic device, comprising: comprise: one or more processors; a storage unit for storing one or more programs, which, when executed by the one or more processors, enable the one or more processors to implement the power plant DCS system industrial control instruction abnormal access detection and defense method according to any one of claims 6 to 8.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by a processor, can implement the power plant DCS system industrial control instruction abnormal access detection and defense method according to any one of claims 6 to 8.

Images