Serial real-time communication protocol attack detection method, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides a serial real-time communication protocol attack detection method, electronic equipment, a storage medium and a program product. The method comprises the following steps: analyzing a message type of a serial real-time communication protocol message; according to the message type, extracting a corresponding preset message feature; performing rule matching detection on the serial real-time communication protocol message based on a predefined abnormal message rule set to obtain a detection result; inputting the preset message features into a trained time sequence analysis model to obtain an abnormal probability of the serial real-time communication protocol message; and if the detection result indicates that the serial real-time communication protocol message is abnormal or the abnormal probability is greater than a preset threshold value, judging that the serial real-time communication protocol message is an abnormal message. Not only can known abnormal message attacks be quickly and accurately identified by utilizing the rule set, but also hidden abnormal and unknown attack modes which are difficult to cover by a traditional rule can be intelligently found through the time sequence analysis model.

Description

Technical Field

[0001] This application relates to the field of information security technology, and more specifically, to a method for detecting attacks on serial real-time communication protocols, an electronic device, a storage medium, and a program product. Background Technology

[0002] The Industrial Internet, a product of the deep integration of next-generation information technology and industrial systems, is reshaping the global manufacturing landscape at an unprecedented pace. Through the integrated application of technologies such as smart devices, networks, big data, and cloud computing, it has achieved comprehensive interconnection of people, machines, and things, driving the transformation of manufacturing towards digitalization, networking, and intelligence. However, with the rapid development of the Industrial Internet, industrial cybersecurity issues are becoming increasingly prominent. Because industrial control systems are directly linked to the operation of production equipment and the transmission of critical data, attacks can not only cause production line shutdowns but also trigger serious safety incidents. Therefore, building a robust industrial cybersecurity system and strengthening security protection and emergency response capabilities have become crucial to ensuring the healthy development of the Industrial Internet.

[0003] However, the open nature of industrial networks exposes them to security threats such as malformed packets and unauthorized data injection, which can affect system stability and reliability. Therefore, a precise detection method for these attacks is urgently needed. Summary of the Invention

[0004] The purpose of this application is to provide a serial real-time communication protocol attack detection method, electronic device, storage medium, and program product to achieve the technical effect of accurately detecting abnormal attacks.

[0005] A first aspect of this application provides a method for detecting attacks on serial real-time communication protocols, the method comprising: Parse the message type of serial real-time communication protocol messages; Based on the message type, extract the corresponding preset message features; Based on a predefined set of rules for malformed messages, rule matching detection is performed on the serial real-time communication protocol messages to obtain the detection results. The preset message features are input into a trained time series analysis model to obtain the anomaly probability of the serial real-time communication protocol message. If the detection result indicates an anomaly or the anomaly probability is greater than a preset threshold, then the serial real-time communication protocol message is determined to be an abnormal message.

[0006] In the above implementation process, it is possible to quickly and accurately identify known malformed message attacks using rule sets, and intelligently discover hidden anomalies and unknown attack patterns that are difficult to cover by traditional rules through time-series analysis models. This achieves comprehensive and accurate anomaly detection of industrial protocol messages, significantly improving the overall protection capability.

[0007] Furthermore, before parsing the message type of the serial real-time communication protocol message, the following steps are also included: Obtain network packets; If the value of the type field of the network message matches the target protocol identifier, then the network message is identified as the serial real-time communication protocol message.

[0008] In the above implementation process, by checking the Ethernet type field as a specific identifier, accurate filtering of protocol messages was achieved, laying the foundation for subsequent targeted deep analysis and detection, avoiding interference from irrelevant messages and improving efficiency.

[0009] Furthermore, the target protocol identifier includes 0x88CD.

[0010] In the above implementation process, by limiting the target protocol identifier to the unique identifier 0x88CD of the SERCOS III protocol, the absolute accuracy of protocol identification is ensured, providing a precise starting point for the implementation of the entire detection method in the SERCOS III industrial protocol scenario.

[0011] Further, the message type includes master station data telegram or slave station response telegram; the step of extracting corresponding preset message features according to the message type includes: If the message type is a master station data telegram, then the master synchronization time is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature. If the message type is a slave response telegram, then the slave status is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature.

[0012] In the above implementation process, by distinguishing between master station data telegrams and slave station response telegrams, and extracting their core features (master synchronization time, slave station status) respectively, high-quality and highly relevant input data are provided for subsequent model analysis, thereby promoting the improvement of detection accuracy.

[0013] Furthermore, the malformed message rule set includes detection rules for master station data telegrams. The detection rules include source address not equal to the preset master station address, destination address exceeding the preset range, message payload length less than the length threshold, or the difference between the master synchronization time of the serial real-time communication protocol message and the master synchronization time of historical serial real-time communication protocol messages exceeding the allowable range.

[0014] In the above implementation process, a set of multi-dimensional, fast-response static rule barriers for master station data telegrams is provided. These rules verify multiple aspects such as message identity (source / destination address), structural integrity (payload length), and timing logic (master synchronization time continuity), and can instantly intercept most known and obvious attack messages with extremely low computational overhead.

[0015] Furthermore, the preset message features are message features that have undergone normalization processing.

[0016] In the above implementation process, normalization can eliminate the differences in the dimensions and magnitudes of different message features, providing a standardized and uniform input for the time series analysis model, thereby ultimately improving the accuracy and reliability of the model in anomaly detection tasks.

[0017] Furthermore, the normalization process includes min-max normalization.

[0018] In the above implementation process, min-max normalization can linearly map features to a fixed interval. The algorithm is simple, has low computational overhead, and is suitable for industrial real-time detection scenarios, providing a guarantee for achieving efficient and accurate feature preprocessing.

[0019] Furthermore, the time-series analysis model is a long short-term memory network model.

[0020] In the above implementation process, the unique gating mechanism and cellular state structure of Long Short-Term Memory (LSTM) networks enable the LSTM network model to excellently capture long-term temporal dependencies and periodic patterns in industrial protocol communication data, thereby accurately identifying subtle abnormal shifts caused by slow, covert attacks and greatly enhancing the ability to detect complex threats.

[0021] Furthermore, the method also includes: Block the transmission of the abnormal message, and / or record the log information of the abnormal message.

[0022] In the above implementation process, security threats are directly eliminated by blocking operations to ensure system operation; and data support is provided for security auditing, attack tracing, and system policy optimization by recording logs.

[0023] A second aspect of this application provides an electronic device, the electronic device comprising: processor; Memory used to store processor-executable instructions; Wherein, when the processor invokes the executable instructions, it implements any of the methods described in the first aspect.

[0024] A third aspect of this application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of any of the methods described in the first aspect.

[0025] A fourth aspect of this application provides a computer program product, the computer program product including a computer program, which, when executed by a processor, implements any of the methods described in the first aspect. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A flowchart illustrating a serial real-time communication protocol attack detection method provided in an embodiment of this application; Figure 2 A schematic diagram of an overall process provided for an embodiment of this application; Figure 3 This is a structural block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0029] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0030] To address any of the problems mentioned above, embodiments of this application provide a method for detecting attacks on serial real-time communication protocols, referring to... Figure 1 , Figure 1 This is a flowchart illustrating a serial real-time communication protocol attack detection method provided in an embodiment of this application.

[0031] In this embodiment, the method includes: Step S10: Parse the message type of the serial real-time communication protocol message; It should be noted that serial real-time communication protocol messages refer to all data frames conforming to the Serial Real-time Communication System (SERCOS) standard, such as SERCOS protocol messages, SERCOS II protocol messages, SERCOS III protocol messages, and other industrial Ethernet protocol messages with similar real-time performance and communication mechanisms. Optionally, the serial real-time communication protocol messages are Ethernet frames carrying SERCOS III protocol data selected from network traffic.

[0032] SERCOS III (Serial Real-Time Communication System III) is a high-performance industrial communication protocol based on Ethernet, designed specifically for motion control and automation. It features ultra-high real-time performance (communication cycle up to 31.25 microseconds), sub-microsecond synchronization, and support for mixed real-time and non-real-time data transmission, making it widely used in servo drives, CNC systems, and robot control. However, the open nature of industrial networks exposes them to security threats such as malformed packets and unauthorized data injection, potentially affecting system stability and reliability. Therefore, an efficient detection and protection method for SERCOS III is urgently needed.

[0033] LSTM (Long Short-Term Memory) is a deep learning model specifically designed to address the long-term dependency problem of traditional Recurrent Neural Networks (RNNs). Its core innovation lies in the introduction of gating mechanisms and cell states, enabling efficient modeling of time-series data through dynamic adjustment of information flow. The gating mechanism dynamically removes noise such as electromagnetic interference while enhancing the temporal characteristics of periodic instructions; the cell states interact according to a low-decay link long-term memory protocol, accurately identifying low-frequency covert attacks. Compared to traditional RNNs, LSTM, through gradient stabilization design, can still capture anomalous shifts in long-term industrial sessions, avoiding the risk of missed detections due to gradient vanishing.

[0034] The relevant technologies primarily target security detection of general industrial protocol messages. First, characteristic detection fields (including destination MAC / IP, protocol port, function code, control parameters, etc.) are determined based on the attributes of the industrial protocol messages, generating an industrial control protocol configuration library. The network protocol messages are then parsed in real time, extracting the aforementioned characteristic fields. For each parameter type, either direct comparison or least squares curve fitting is used to compare the results with standard fields in the configuration library. If discrepancies are found, a protocol alarm is triggered. This security detection method, due to its generalized detection rules and lack of design for the real-time data frames and function types of SERCOS III, results in a high false alarm rate.

[0035] The serial real-time communication protocol attack detection method proposed in this application can be specifically manifested as a SERCOS III industrial protocol attack detection and protection method based on the LSTM algorithm. Addressing the characteristics of the SERCOS III protocol in industrial network communication—high real-time performance, frequent data exchange, and specific formats and cycles—and targeting threats such as malformed packet injection, abnormal data tampering, and unauthorized node communication faced by industrial networks, this method collects incoming and outgoing network packets in real time. It first performs traditional packet identification, header parsing, and feature extraction, then constructs a time-series dataset to train an LSTM model to capture the temporal dependencies of the packets. By fusing traditional rule-based detection with LSTM anomaly detection results, the method improves the accuracy of anomaly packet detection and the ability to discover unknown attack patterns, effectively preventing unauthorized packets from entering the industrial network and ensuring the stable and secure operation of the industrial control system.

[0036] It should be understood that message type refers to the different data telegram types defined in the protocol. Taking SERCOS III as an example, it is mainly divided into Master Data Telegram (MDT) and Acknowledge Telegram (AT). MDT is used by the master station to send instruction data to the slave station, and AT is used by the slave station to send status data back to the master station.

[0037] Optionally, the message type and address information of the serial real-time communication protocol message can be parsed. The address information typically includes the source address and destination address, used to identify the initiator and receiver of the communication. In a SERCOS III network, the master station address is usually fixed (e.g., 0x0001), while the slave station addresses have a specific range.

[0038] Step S20: Extract the corresponding preset message features according to the message type; It should be noted that preset message features refer to key data fields that need to be extracted from messages, as determined in advance according to protocol specifications and attack detection requirements. For example, for SERCOS III MDT messages, one of the key features is the Master Sync Time; for AT messages, one of the key features is the Slave Status.

[0039] Step S30: Based on a predefined set of malformed message rules, perform rule matching detection on the serial real-time communication protocol messages to obtain the detection results; It should be noted that the predefined malformed message rule set refers to a pre-defined set of logical rules used to determine whether a message violates protocol specifications or security policies. The detection result is a binary output (normal or abnormal).

[0040] For example, a predefined set of malformed message rules stipulates that "the source address must be 0x0001". If the source address of the message is not 0x0001, the detection result is indicated as "abnormal".

[0041] Step S40: Input the preset message features into the trained time series analysis model to obtain the anomaly probability of the serial real-time communication protocol message; It should be noted that time series analysis models refer to machine learning or deep learning models that can process time series data and capture the dependencies and patterns of data in the time dimension, such as Long Short-Term Memory Networks (LSTM).

[0042] The anomaly probability is used to characterize the degree to which the current message feature sequence deviates from the normal pattern; the higher the value, the greater the probability of an anomaly. For example, an LSTM model trained on a large amount of normal SERCOS III communication data will output a high anomaly probability of 0.9 for a suddenly appearing message with abnormal time-series features.

[0043] Step S50: If the detection result indicates an anomaly or the anomaly probability is greater than a preset threshold, then the serial real-time communication protocol message is determined to be an anomaly message.

[0044] Understandably, if either the detection result or the anomaly probability is determined to be abnormal, then the message will ultimately be classified as abnormal.

[0045] The preset threshold is a critical value used to measure whether the probability of an anomaly constitutes a real threat. This embodiment does not limit the preset threshold. For example, the preset threshold can be a value such as 0.6, 0.7, or 0.8.

[0046] When the rule-based detection result indicates an anomaly, the current packet will be determined as an anomalous packet regardless of the anomaly probability output by the time-series analysis model. This ensures instantaneous response to all known threat patterns.

[0047] When the anomaly probability output by the time-series analysis model exceeds the preset threshold, the current packet will be classified as an anomalous packet even if it does not trigger any specific malformed packet rule. This enables the system to identify complex, unknown attacks that are difficult to cover with traditional rules.

[0048] In this embodiment, it is possible to quickly and accurately identify known malformed packet attacks using rule sets, and to intelligently discover hidden anomalies and unknown attack patterns that are difficult to cover by traditional rules through time-series analysis models. This achieves comprehensive and accurate anomaly detection of industrial protocol packets, significantly improving the overall protection capability.

[0049] Based on any of the above embodiments, before step S10, the method further includes: Obtain network packets; If the value of the type field of the network message matches the target protocol identifier, then the network message is identified as the serial real-time communication protocol message.

[0050] It should be noted that network packets refer to all Ethernet data frames that flow through the network and are captured through the network interface.

[0051] The type field is a 2-byte field located after the destination MAC address and source MAC address in the Ethernet frame structure. It is used to identify the type of upper-layer protocol encapsulated within the frame.

[0052] The target protocol identifier is a specific numerical value used to uniquely identify a certain upper-layer protocol in an Ethernet frame. This identifier corresponds to the type field in the Ethernet frame header. By checking the value of this field, packets of the target protocol can be quickly filtered out from a massive number of network packets. For example, the serial real-time communication protocol is the SERCOS III protocol, and its corresponding target protocol identifier is 0x88CD. When the type field value of a network packet is detected to be 0x88CD, the packet is identified as a serial real-time communication protocol packet to be detected, specifically a SERCOS III protocol packet.

[0053] In this embodiment, by checking the Ethernet type field, a specific identifier, accurate filtering of protocol packets is achieved, laying the foundation for subsequent targeted deep analysis and detection, avoiding interference from irrelevant packets, and improving efficiency.

[0054] Based on any of the above embodiments, the target protocol identifier includes 0x88CD.

[0055] It should be noted that 0x88CD is the unique identifier of the SERCOS III protocol in Ethernet. This embodiment limits the target protocol identifier to include 0x88CD in order to ensure the accuracy of protocol identification.

[0056] In this embodiment, by limiting the target protocol identifier to the unique identifier 0x88CD of the SERCOS III protocol, the absolute accuracy of protocol identification is ensured, providing a precise starting point for the implementation of the entire detection method in the SERCOS III industrial protocol scenario.

[0057] Based on any of the above embodiments, the message type includes a master station data telegram or a slave station response telegram; the step of extracting corresponding preset message features according to the message type includes: If the message type is a master station data telegram, then the master synchronization time is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature. If the message type is a slave response telegram, then the slave status is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature.

[0058] It should be noted that the preset offset address refers to the fixed starting byte position of a specific characteristic value in the protocol message payload. This embodiment does not impose restrictions on the offset address; it is usually explicitly defined by the protocol standard. Taking SERCOS III as an example: In the MDT message, the Master Sync Time starts 6 bytes off the load and is 2 bytes long. The Master Sync Time is the synchronization clock information published by the master station and is used for synchronization of all slave stations.

[0059] In AT messages, the slave status starts 4 bytes off the load and is 1 byte long. The slave status reflects the slave's working status (such as ready, alarm, etc.).

[0060] It should be understood that in this embodiment, the protocol message is not treated as a whole, but rather its internal communication mechanism is explored, and two different message types with different functions are distinguished to solve the defect of high false alarm rate caused by the lack of design for real-time data frames of SERCOS III in related technologies.

[0061] In this embodiment, by distinguishing between master station data telegrams and slave station response telegrams, and extracting their core features (master synchronization time, slave station status) respectively, high-quality and highly relevant input data is provided for subsequent model analysis, thereby promoting the improvement of detection accuracy.

[0062] Based on any of the above embodiments, the malformed message rule set includes detection rules for master station data telegrams. The detection rules include source address not equal to preset master station address, destination address exceeding preset range, message payload length less than length threshold, or the difference between the master synchronization time of the serial real-time communication protocol message and the master synchronization time of historical serial real-time communication protocol messages exceeding the allowable range.

[0063] It should be noted that SERCOS III is used as an example: The source address is not equal to the default master address: For example, the default master address is 0x0001. If the source address of the MDT message is not this value, it may be an illegal node impersonating the master.

[0064] Target address outside preset range: SERCOS III slave addresses typically have a defined range (e.g., 1-255). If the target address is outside this range, it is considered abnormal. Attackers may send malformed packets to non-existent slave addresses (e.g., 0x00FF) or broadcast addresses to probe network structure or cause network congestion. This rule, "target address outside preset range," directly classifies all MDT packets with target addresses not in the whitelist as abnormal, reducing the attack surface and improving network stability.

[0065] Message payload length is less than the length threshold: Normal MDT messages have a minimum length limit (e.g., 20 bytes). Messages that are too short may be incomplete or malicious.

[0066] The difference between the master synchronization time and the master synchronization time of historical messages exceeds the allowable range: SERCOS III communication has strict periodicity. The master synchronization time of the current message should maintain a stable increment with the master synchronization time of historical serial real-time communication protocol messages (optionally, the historical serial real-time communication protocol message is the frame immediately preceding the current message). If the difference changes abruptly, it is highly likely that synchronization has been disrupted or attacked. This embodiment does not limit the allowable range, which can be preset according to the communication cycle and network jitter.

[0067] In this embodiment, a set of multi-dimensional, fast-response static rule barriers for master station data telegrams is provided. These rules verify multiple aspects such as message identity (source / destination address), structural integrity (payload length), and timing logic (master synchronization time continuity), and can instantly intercept most known and obvious attack messages with extremely low computational overhead.

[0068] Based on any of the above embodiments, the preset message features are message features that have undergone normalization processing.

[0069] It should be noted that the preset message features are normalized in order to eliminate the influence of different feature indicators on the scale, and to uniformly map the extracted feature values ​​of different magnitudes and units (such as master synchronization time, slave status, load length, etc.) into the same numerical range, so as to adapt to the input requirements of deep learning models.

[0070] Optionally, the normalization process can be min-max normalization, Z-Score normalization, or fractional scaling normalization, etc.

[0071] In this embodiment, normalization can eliminate the differences in dimensions and magnitudes of different message features, providing a standardized and uniform input for the time series analysis model, thereby ultimately improving the accuracy and reliability of the model in anomaly detection tasks.

[0072] Based on any of the above embodiments, the normalization process includes minimum-maximum normalization.

[0073] It should be noted that min-max normalization is a standardization process that performs a linear transformation on the original data, mapping its numerical range to a specific interval (usually [0,1]). This process can eliminate the influence of the original feature data's dimensions, making features at different scales comparable during model training.

[0074] Specifically, the minimum-maximum normalization formula is as follows: ; Where X is the original eigenvalue, X min and X max These are the minimum and maximum values ​​of the feature in the dataset, respectively. The feature values ​​are normalized to fit within the range [0,1] to meet the input requirements of the LSTM model.

[0075] In this embodiment, the min-max normalization process can linearly map features to a fixed interval. The algorithm is simple, has low computational overhead, and is suitable for industrial real-time detection scenarios, providing a guarantee for achieving efficient and accurate feature preprocessing.

[0076] Based on any of the above embodiments, the time series analysis model is a long short-term memory network model.

[0077] It should be noted that the Long Short-Term Memory Network model refers to a special type of Recurrent Neural Network (RNN) model that introduces gating mechanisms (including forget gate, input gate, and output gate) and cell states to capture long-term dependencies in time series.

[0078] The method described in this application uses a long short-term memory network model because it possesses the following characteristics that make it suitable for anomaly detection in industrial protocols: The gating mechanism can dynamically adjust the information flow: This mechanism can learn and retain valuable long-term information in the sequence (such as the communication cycle inherent in the protocol), while forgetting unimportant short-term noise (such as transient electromagnetic interference), thereby achieving efficient modeling of the interaction law of industrial protocols. Cellular states construct long-term memory links: this structure transmits key information with an extremely low decay rate, enabling it to remember legitimate protocol interaction patterns for a long time, thereby accurately identifying low-frequency, covert, slow attacks that are difficult to detect by traditional methods because they deviate from normal patterns to a very small extent. Gradient stabilization design ensures the reliability of long sequence analysis: Compared with traditional RNN, LSTM effectively alleviates the gradient vanishing / exploding problem, enabling it to stably capture subtle abnormal shifts when analyzing long-term industrial communication sessions, avoiding the risk of missed reports due to training instability.

[0079] In this embodiment, the unique gating mechanism and cell state structure of the Long Short-Term Memory (LSTM) network enable the LTM network model to effectively capture long-term temporal dependencies and periodic patterns in industrial protocol communication data, thereby accurately identifying subtle abnormal shifts caused by slow, covert attacks and greatly enhancing the ability to detect complex threats.

[0080] Based on any of the above embodiments, the method further includes: Block the transmission of the abnormal message, and / or record the log information of the abnormal message.

[0081] It should be noted that blocking the transmission of the abnormal messages and / or recording the log information of the abnormal messages are to provide timely and traceable proactive protection against detected network attacks, so as to ensure the stable and safe operation of the industrial control system.

[0082] Log information refers to a collection of detailed data recording abnormal events, including but not limited to: timestamps, source and destination addresses of abnormal messages, telegram type (MDT / AT), rule reasons for triggering the abnormality, abnormal probability output by the time series analysis model, and related raw or normalized values ​​of message characteristics.

[0083] Logging abnormal packets is essential for security auditing. Post-incident analysis of these logs allows us to trace the source of attacks, analyze attack patterns, assess system security, and provide data support for optimizing malformed packet rule sets and retraining time-series analysis models.

[0084] As an example, by configuring access control policies on industrial firewalls, packets deemed abnormal can be dropped in real time to block their transmission; and by calling the system log service, structured abnormal information can be written to a local database or uploaded to the central security management platform to record log information of abnormal packets.

[0085] In this embodiment, the security threat is directly eliminated by blocking operations, ensuring system operation; and the logging provides data support for security auditing, attack tracing, and system policy optimization.

[0086] In addition, refer to Figure 2 , Figure 2 This is a schematic diagram of an overall process provided for an embodiment of this application. This application also provides a method for detecting and protecting the SERCOS III protocol based on the LSTM algorithm. The concept of this method is the same as that of the serial real-time communication protocol attack detection method described above. The steps of a method for detecting and protecting the SERCOS III protocol based on the LSTM algorithm include: 1) Message Acquisition and Preliminary Processing: Packet capture: Real-time capture of all Ethernet packets entering and leaving the network.

[0087] Protocol identification: After receiving an Ethernet packet, check the TYPE field. If the field value is 0x88CD, it is determined to be a SERCOS III protocol packet. For example, if a packet 0x00 11 22 33 44 55 66 77 88 99 AA BB 88 CD... is captured, it can be identified as a SERCOS III packet.

[0088] Header parsing and payload calculation: Excluding the 14-byte header and the CRC checksum at the end, calculate the payload length. If the total message length is 50 bytes, then the payload length is 50 - 14 - 4 = 32 bytes. Simultaneously, parse the SERCOS III protocol header to extract key information. If Telegram Type is 0, it represents MDT (Master Data Message), and 1 represents AT (Slave Response Message); the master address is 0x0001, and the slave address is 0x0003. Record the parsing result as a triple in the format: Function Type, Feature Type, Feature Value. For example, (Message Parsing, Telegram Type, 0), (Message Parsing, Source Address, 0x0001), (Message Parsing, Destination Address, 0x0003).

[0089] 2) Feature extraction: MDT Feature Extraction: If the message is of type MDT, take 2 bytes starting from offset 6 bytes as the Master Sync Time. For example, for a message like ... 00 11 22 33 44 55 56 78 ..., the Master Sync Time is 0x5678.

[0090] AT Feature Extraction: If it is an AT message, take 1 byte from the offset 4 bytes as the Slave Status. For example, in the message ... 00 11 22 33 02 ..., the slave status is 0x02.

[0091] Feature normalization: The extracted feature values ​​Master Sync Time, Slave Status, and load length are normalized using the Min-Max normalization method. The normalization formula is as follows: ; In the formula, X is the original eigenvalue, X min and X max These are the minimum and maximum values ​​of the feature in the dataset, respectively. The feature values ​​are normalized to fit within the range [0,1] to meet the input requirements of the LSTM model.

[0092] 3) Dataset construction and partitioning: Dataset Construction: The processed message features are arranged in chronological order to form a time-series dataset. The data at each time step includes normalized feature values ​​and corresponding triplet information.

[0093] Dataset partitioning: The dataset is divided into training, validation, and test sets in a 7:1:2 ratio. The training set is used to train the LSTM model, the validation set is used to tune the model's hyperparameters, and the test set is used to evaluate the model's final performance.

[0094] 4) LSTM model construction and training: Input layer: Receives normalized feature vectors, with the vector dimension determined by the number of extracted features. Five features were extracted: master address, slave address, master sync time (in MDT), slave status (in AT), and load length, resulting in an input dimension of 5.

[0095] LSTM Layer: A certain number of LSTM units are configured. LSTM units can process sequential data and capture temporal dependencies in messages. The forget gate determines how much information from the previous cell state needs to be forgotten, the input gate determines how much information from the current input needs to be added to the cell state, and the output gate determines how much information from the current cell state needs to be output. During long-term communication, message exchanges between the master and slave stations may exhibit periodic patterns, which the LSTM layer can learn.

[0096] Fully connected layer: Performs a linear transformation on the output of the LSTM layer to further extract features. The number of neurons in the fully connected layer can be adjusted according to the actual situation.

[0097] Output layer: Outputs a probability value indicating whether the message is abnormal. The closer the probability value is to 1, the more likely the message is to be abnormal; the closer it is to 0, the more likely it is to be normal.

[0098] Model Training: The LSTM model is trained using the training set, and the difference between the predicted values ​​and the true labels is analyzed. The model weights and biases are adjusted to optimize the model parameters. During training, hyperparameters such as the learning rate and batch size are continuously adjusted to improve the model's performance.

[0099] 5) Malformed message detection and anomaly fusion judgment: MDT Malformed Message Judgment Rules: The source address is not equal to 0x0001; The target address is greater than 255; The payload length is less than 20 bytes; The Master Sync Time difference with the previous frame is abnormal; AT Malformed Message Judgment Rules: The source address is less than 1 or greater than 255; The payload length is less than 10 bytes; Slave Status is outside the legal range.

[0100] LSTM anomaly detection: The feature vector of the current message is input into a trained LSTM model to obtain the anomaly probability. If the anomaly probability is greater than a set threshold, the message is determined to be an anomaly.

[0101] Fusion judgment: Combine the results of malformed message detection and LSTM anomaly detection. If either result is determined to be abnormal, the message is ultimately judged as an abnormal message.

[0102] 6) Security Strategy and Response: Message processing: Based on the final anomaly assessment result, execute the security policy. If the message is determined to be normal, it is allowed to pass; if it is determined to be abnormal, the transmission of the message is blocked to prevent it from harming the industrial network.

[0103] Log recording: For abnormal packets, detailed information is recorded, including source address, destination address, message type, cause of anomaly in traditional detection, and probability of anomaly in LSTM. This log information is stored in a local database or uploaded to the management system. The management system can use these logs for further analysis and auditing to promptly identify potential security threats.

[0104] In practical implementation, the detection and protection method of the SERCOS III protocol based on the LSTM algorithm and the serial real-time communication protocol attack detection method can both be applied to the firewall of CNC machine tools. In the operating environment of CNC machine tools, various components communicate efficiently and stably through the SERCOS III protocol to ensure machining accuracy and production efficiency. Specifically: 1) Message Acquisition and Preliminary Processing: The firewall captured an Ethernet packet with the following content: 00 11 22 33 44 55 66 77 88 99 AA BB 88 CD 00 01 00 05 00 00 12 34...; Checking the TYPE field, we can see from bytes 13 and 14 that it is 0x88CD, confirming that it is a SERCOS III protocol message; Excluding the header 14 bytes and the trailing CRC (assuming the trailing 4 bytes are CRC), calculate the payload length. The total length of this message is 45 bytes, and the payload length is 45 - 14 - 4 = 27 bytes; Parse the header: The Telegram Type is obtained from the 15th byte as 0x00, representing an MDT message; The source address is 0x0001 obtained from bytes 16 and 17, which is the main site address; The Destination Address, as can be seen from bytes 18 and 19, is 0x0005, which is the slave address.

[0105] The record parsing result is a triple: (message parsing, telegram type, 0), (message parsing, master address, 0x0001), (message parsing, slave address, 0x0005).

[0106] 2) Feature extraction and normalization: Feature extraction: Since it is an MDT message, take 2 bytes from the offset 6 bytes as the Master Sync Time, which is 0x1234, and the decimal value is 4660.

[0107] Normalization process: Master Sync Time: Assuming the minimum Master Sync Time value X was previously calculated. min =0x0000, decimal value is 0, maximum value is X max =0xFFFF, which is 65535 in decimal. The normalized value of Master Sync Time is: ; Load length: Assuming minimum value =10, maximum value =50, the message payload length is 27 bytes, and the normalized value is: .

[0108] 3) Malformed message detection and anomaly discovery: Assume the Master Sync Time of the previous MDT message frame was 0x1230, which is 4656 in decimal. Normally, the difference between the Master Sync Time of two adjacent frames is within ±5. The current frame's difference is 4660-4656=4. Suppose that due to network interference or abnormal operation, the actual set normal range becomes ±2. In this case, the difference of 4 exceeds the range, triggering an abnormal alarm for malformed message detection.

[0109] 4) LSTM anomaly detection and fusion judgment: The normalized feature vector [0.071, 0.425] is input into the trained LSTM model. The LSTM model outputs an anomaly probability of 0.8 for this message, which is greater than the set threshold of 0.6, thus determining that the message is abnormal. Combining the results of malformed message detection and LSTM anomaly detection, the message is ultimately determined to be an abnormal message.

[0110] 5) Security policy enforcement and logging: The firewall immediately blocked the transmission of the abnormal MDT message and logged the following information: [Master address: 0x0001, Slave address: 0x0005, Message type: MDT, Master Sync Time: Original value 0x1234 | Normalized value 0.071, Payload length: 27 bytes | Normalized value 0.425, Abnormal cause of malformed message detection: The difference between Master Sync Time and the previous frame exceeds the normal range, LSTM abnormal probability: 0.8].

[0111] In this embodiment, feature values ​​are extracted from the SERCOS III protocol and stored in triplet form. Key features can be extracted and malformation detection performed without relying on network context information. The refined malformation packet detection rules enhance the system's ability to identify potential threats to industrial networks and improve its stability. LSTM is used to process SERCOS III protocol packets, and the extracted packet features are normalized. Anomalies are determined based on sequence characteristics, effectively detecting unknown anomalous attacks such as synchronization time abrupt changes, thus improving the accuracy of anomaly detection. The combination of malformation packet detection and LSTM anomaly detection complements each other, ensuring rapid response to known threats while enhancing the detection capability of unknown anomalies. Independent packet parsing transcends the context dependence of traditional methods, refining malformation packet detection rules and improving detection real-time performance and accuracy. Deep learning of the time-series features of protocol packets using the LSTM algorithm can identify hidden anomalies that are difficult for traditional rules to cover, enhancing system stability. Deep parsing of SERCOS III protocol packets enhances detection accuracy, does not rely on network context information, and improves real-time performance. Malformed message detection rules are designed for both real-time data frames (MDT / AT) and non-real-time data in SERCOS III to improve protection accuracy. Abnormal message alarm and blocking mechanisms are provided to ensure the stability and security of industrial control systems.

[0112] Based on the methods described in any of the above embodiments, this application also provides, as follows: Figure 3 The diagram shows the structure of an electronic device. Figure 3 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the methods described in any of the above embodiments.

[0113] Based on the methods described in any of the above embodiments, this application also provides a computer storage medium storing a computer program, which, when executed by a processor, can be used to perform the methods described in any of the above embodiments.

[0114] Based on the methods described in any of the above embodiments, this application also provides a computer program product, which includes one or more computer programs or instructions. The computer program or instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. When executed by a processor, the computer program implements the methods described in any of the above embodiments.

[0115] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0118] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0119] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0120] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for detecting attacks on serial real-time communication protocols, characterized in that, The method includes: Parse the message type of serial real-time communication protocol messages; Based on the message type, extract the corresponding preset message features; Based on a predefined set of rules for malformed messages, rule matching detection is performed on the serial real-time communication protocol messages to obtain the detection results. The preset message features are input into a trained time series analysis model to obtain the anomaly probability of the serial real-time communication protocol message. If the detection result indicates an anomaly or the anomaly probability is greater than a preset threshold, then the serial real-time communication protocol message is determined to be an abnormal message.

2. The method according to claim 1, characterized in that, Before parsing the message type of the serial real-time communication protocol message, the following is also included: Obtain network packets; If the value of the type field of the network message matches the target protocol identifier, then the network message is identified as the serial real-time communication protocol message.

3. The method according to claim 2, characterized in that, The target protocol identifier includes 0x88CD.

4. The method according to claim 1, characterized in that, The message type includes master station data telegrams or slave station response telegrams; the step of extracting corresponding preset message features based on the message type includes: If the message type is a master station data telegram, then the master synchronization time is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature. If the message type is a slave response telegram, then the slave status is extracted from the preset offset address of the serial real-time communication protocol message as the preset message feature.

5. The method according to claim 4, characterized in that, The malformed message rule set includes detection rules for master station data telegrams. The detection rules include source address not equal to the preset master station address, destination address exceeding the preset range, message payload length less than the length threshold, or the difference between the master synchronization time of the serial real-time communication protocol message and the master synchronization time of historical serial real-time communication protocol messages exceeding the allowable range.

6. The method according to claim 1, characterized in that, The preset message features are message features that have undergone normalization processing.

7. The method according to claim 6, characterized in that, The normalization process includes min-max normalization.

8. The method according to claim 1, characterized in that, The time series analysis model is a long short-term memory network model.

9. The method according to claim 1, characterized in that, The method further includes: Block the transmission of the abnormal message, and / or record the log information of the abnormal message.

10. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; Wherein, when the processor invokes the executable instructions, it implements the method according to any one of claims 1-9.

11. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of any of the methods described in claims 1-9.

12. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-9.

Images