Network intrusion detection method and system based on industrial control security

Abstract

This application relates to the field of network security and discloses a network intrusion detection method and system based on industrial control system (ICS) security. The method includes: acquiring network traffic data and system logs; extracting statistical and frequency domain features from the network traffic data and concatenating them to form a time-series feature vector; performing binary conversion on the system logs to obtain a grayscale image, retaining the time-series information in the grayscale image to obtain a grayscale image feature matrix; analyzing the quintuple and session lifetime, and identifying multiple devices in the ICS network environment; analyzing the communication link relationships between multiple devices; constructing an ICS network topology map; enhancing the features of multiple nodes to obtain enhanced features of multiple nodes; and identifying whether multiple devices have been subjected to network intrusion. This invention significantly improves the accuracy, robustness, and interpretability of detection through the collaborative design of multimodal data fusion, image-based log processing, dynamic topology modeling, and attention enhancement mechanisms.

Description

Technical Field

[0001] This invention relates to the field of network security, and more specifically, to a network intrusion detection method and system based on industrial control system security. Background Technology

[0002] With the deep integration of industrial automation and information technology, Industrial Control Systems (ICS) have been widely used in critical infrastructure sectors such as energy, power, manufacturing, and transportation. However, the increasingly open network architecture of ICS exposes them to a growing number of cybersecurity threats. In recent years, cyberattacks targeting ICS, such as WannaCry and TRITON, have occurred frequently. Building an efficient and accurate cybersecurity protection system for ICS, especially a network intrusion detection mechanism with real-time performance and high accuracy, has become a key research focus and urgent need in the field of industrial information security.

[0003] Traditional general-purpose network intrusion detection technologies are mainly based on signature matching or anomaly behavior analysis. Systems such as Snort and Suricata are widely used in enterprise IT networks. However, relying solely on signature matching or anomaly behavior analysis limits the accuracy and interpretability of general-purpose network intrusion detection. Therefore, there is an urgent need to propose a new intrusion detection method to improve the ability to detect complex and covert attacks and enhance the overall defense level. Summary of the Invention

[0004] To address the aforementioned technical issues, this application is proposed to provide a network intrusion detection method and system based on industrial control system security, thereby enhancing the ability to detect complex and covert attacks and improving the overall defense level.

[0005] In a first aspect, the present invention provides a network intrusion detection method based on industrial control system (ICS) security, comprising: acquiring network traffic data and system logs in an ICS network environment; extracting statistical features and frequency domain features from the network traffic data, and concatenating them to form a time-series feature vector; performing binary conversion on the system logs to obtain a grayscale image, and retaining the time-series information in the grayscale image to obtain a grayscale image feature matrix; analyzing the quintuples and session lifetimes of the ICS network environment based on the time-series feature vector, and identifying multiple devices in the ICS network environment; analyzing the communication link relationships between the multiple devices based on the grayscale image feature matrix; and determining the communication link relationships between the multiple devices and... The communication link relationships between the multiple devices are used to construct an industrial control network topology graph. The multiple devices are set as multiple nodes in the industrial control network topology graph. The features of the multiple nodes are set according to the time-series feature vector. The weights of the edges of the industrial control network topology graph are set according to the degree of hub role of the multiple devices in the industrial control network topology graph. The attention relationship between each of the multiple nodes and its neighboring nodes is calculated. The features of the multiple nodes are enhanced according to the attention relationship corresponding to the multiple nodes to obtain the enhanced features of the multiple nodes. The enhanced features of the multiple nodes are input into a preset model to identify whether the multiple devices are subjected to network intrusion.

[0006] Optionally, the aforementioned network intrusion detection method based on industrial control system security, which converts the system logs into a grayscale image through binary conversion, includes: detecting protocols contained in the system logs; when the system logs contain security protocols, calculating the standard deviation of the most recent log entries in the system logs; setting Gaussian filtering parameters based on the standard deviations of the log entries; performing Gaussian filtering on the grayscale image based on the Gaussian filtering parameters; detecting the structural similarity index of the grayscale image after Gaussian filtering; and performing Gaussian filtering again when the structural similarity index of the grayscale image is lower than a preset first threshold, until the structural similarity index of the grayscale image is higher than the first threshold.

[0007] Optionally, the aforementioned network intrusion detection method based on industrial control security, which retains the temporal information in the grayscale image to obtain a grayscale image feature matrix, includes: calculating the temporal complexity of the grayscale image; when the temporal complexity of the grayscale image is higher than a preset second threshold, selecting MobileViT as a feature extractor, wherein the MobileViT embeds ASPP for processing the output of the Transformer encoder in the MobileViT; when the temporal complexity of the grayscale image is lower than the second threshold, selecting ResNet-18 as the feature extractor; and using the feature extractor to extract the temporal information in the grayscale image.

[0008] Optionally, the aforementioned network intrusion detection method based on industrial control security, based on the grayscale image feature matrix, analyzes the communication link relationship between the multiple devices, including: extracting abnormal pixel regions in the grayscale image; determining the occurrence time of abnormal events in the industrial control network environment according to the position of the abnormal pixel regions in the grayscale image; extracting log fragments from the system log according to the occurrence time of the abnormal events; parsing message information of multiple pairs of devices from the log fragments; analyzing the communication strength between each pair of devices according to the message information of the multiple pairs of devices; and determining one or more pairs of devices with a communication link relationship according to the communication strength of the multiple pairs of devices.

[0009] Optionally, before setting the weights of the edges in the industrial control network topology graph based on the hub function of the multiple devices, the aforementioned network intrusion detection method based on industrial control network security further includes: taking any one of the multiple devices as device A; and calculating the betweenness centrality of device A. Where s and t represent two other devices besides device A among the plurality of devices. This represents the total number of shortest paths from device s to device t. This represents the number of paths passing through device A in the shortest path from device s to device t; the multiple devices are divided into multiple communities, and the size of the community where device A is located is calculated. ; Calculate the degree of hub function of device A in the industrial control network topology diagram. , among which, among which, among which This indicates dot product.

[0010] Optionally, the aforementioned network intrusion detection method based on industrial control system security, before setting the weights of the edges in the industrial control network topology graph according to the hub role of the multiple devices in the industrial control network topology graph, includes: identifying the traffic data of device A from network traffic data; analyzing the proportion of each type of data in the traffic data of device A, wherein the proportion of the i-th type of data is... ; Calculate the flow entropy of device A. The degree of hub function of device A in the industrial control network topology is corrected, and the degree of hub function of device A in the industrial control network topology is corrected. ,in The preset weighting factors, The flow entropy of device A Historical data variance The flow entropy of device A The standard deviation of historical data.

[0011] Optionally, the aforementioned network intrusion detection method based on industrial control system security further includes: when any of the plurality of devices is found to be under network intrusion, acquiring intrusion traffic data; reconstructing the intrusion traffic data using an ASN.1 syntax tree to extract the function code, register address, and data length of the intrusion traffic data; constructing intrusion legitimacy verification rules based on the function code, register address, and data length of the intrusion traffic data; adding the intrusion legitimacy verification rules to the device under network intrusion, and filtering data that matches the intrusion legitimacy verification rules from the data received by the device under network intrusion.

[0012] Secondly, this invention provides a network intrusion detection system based on industrial control network security, comprising: a data acquisition module for acquiring network traffic data and system logs in an industrial control network environment; a vector splicing module for extracting statistical features and frequency domain features from the network traffic data and splicing them to form a time-series feature vector; a matrix forming module for performing binary conversion on the system logs to obtain a grayscale image, and retaining the time-series information in the grayscale image to obtain a grayscale image feature matrix; a device analysis module for analyzing the quintuples and session lifetimes of the industrial control network environment based on the time-series feature vector, and identifying multiple devices in the industrial control network environment; and a link analysis module for analyzing the communication link relationships between the multiple devices based on the grayscale image feature matrix; and a network... The topology module constructs an industrial control network topology graph based on the multiple devices and the communication link relationships between them. It sets the multiple devices as nodes in the topology graph, sets the features of the nodes based on the time-series feature vector, and sets the edge weights of the topology graph based on the hub role of the multiple devices. The relationship calculation module calculates the attention relationship between each node and its neighboring nodes, and enhances the features of the nodes based on these attention relationships to obtain enhanced features. The intrusion detection module inputs the enhanced features of the nodes into a preset model to identify whether the multiple devices have been subjected to network intrusion.

[0013] The above-described technical solutions of the present invention have at least one or more of the following beneficial effects:

[0014] According to the technical solution of the present invention, an intelligent intrusion detection system for industrial control environments is constructed through the collaborative design of multimodal data fusion, image-based log processing, dynamic topology modeling and attention enhancement mechanism. This system significantly improves the accuracy, robustness and interpretability of detection, and provides efficient and reliable technical support for the security protection of critical information infrastructure. Attached Figure Description

[0015] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0016] Figure 1 This is a flowchart of a network intrusion detection method based on industrial control system security according to an embodiment of this application;

[0017] Figure 2 This is a partial flowchart of a network intrusion detection method based on industrial control system security according to an embodiment of this application;

[0018] Figure 3 This is another layout flowchart of a network intrusion detection method based on industrial control security according to an embodiment of this application;

[0019] Figure 4 This is another partial flowchart of a network intrusion detection method based on industrial control security according to an embodiment of this application;

[0020] Figure 5 This is a block diagram of a network intrusion detection system based on industrial control security according to an embodiment of this application. Detailed Implementation

[0021] Some embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0022] like Figure 1 As shown, one embodiment of the present invention provides a network intrusion detection method based on industrial control system security, comprising:

[0023] Step S110: Obtain network traffic data and system logs in the industrial control network environment.

[0024] In this embodiment, network traffic data and system logs in the industrial control network are collected simultaneously, breaking through the limitation of traditional methods that rely on only a single data source.

[0025] Step S120: Extract statistical features and frequency domain features from network traffic data and concatenate them to form a time-series feature vector.

[0026] Step S130: Convert the system log to binary to obtain a grayscale image, and retain the temporal information in the grayscale image to obtain the grayscale image feature matrix.

[0027] In this embodiment, by extracting the time-series feature vector of traffic data and the grayscale image feature matrix of log data respectively, joint modeling of network behavior and system operation behavior is realized, which significantly enhances the ability to detect covert attacks (such as low-speed scanning, privilege escalation, command injection, etc.) and effectively reduces the false alarm rate and false negative rate.

[0028] In this embodiment, the unstructured text logs are converted into a computable two-dimensional matrix by binary encoding and conversion into grayscale images, while preserving their time-series structure, thus forming a grayscale image feature matrix. This method not only facilitates the extraction of local and global behavioral patterns using image processing techniques but also effectively captures the behavioral evolution characteristics of devices during long-term operation, providing high-dimensional semantic information support for subsequent communication link analysis.

[0029] Step S140: Based on the time-series feature vector, analyze the quintuple and session lifetime of the industrial control network environment, and identify multiple devices in the industrial control network environment.

[0030] Step S150: Analyze the communication link relationship between multiple devices based on the grayscale image feature matrix.

[0031] Step S160: Based on the multiple devices and the communication link relationships between the multiple devices, construct an industrial control network topology graph, set the multiple devices as multiple nodes in the industrial control network topology graph, set the features of the multiple nodes according to the time series feature vector, and set the weights of the edges in the industrial control network topology graph according to the degree of hub role of the multiple devices in the industrial control network topology graph.

[0032] In this embodiment, based on the five-tuple, session lifetime, and log communication behavior, device entities and their communication link relationships in the industrial control network are jointly identified, and an industrial control network topology map with clear physical meaning is constructed accordingly. This topology map not only reflects the connection relationships between devices, but also endows nodes with dynamic behavioral attributes by using time-series feature vectors as node features, enabling the topology structure to have time-varying perception capabilities and more closely reflect the actual operating state of the industrial control system.

[0033] In this embodiment, when constructing the topology graph, the weights of edges are dynamically set according to the hub role of devices in the communication network, giving higher weight to connections between key control nodes (such as engineering workstations and PLC main control units). This mechanism highlights the communication importance of core paths, helps identify targeted attacks and lateral movement behaviors against key devices, and improves the targeting and interpretability of detection.

[0034] Step S170: Calculate the attention relationship between each node and its neighboring nodes, and enhance the features of the multiple nodes based on the attention relationships between the multiple nodes to obtain the enhanced features of the multiple nodes.

[0035] In this embodiment, by calculating the attention relationship between each node and its neighboring nodes, neighborhood information is adaptively weighted and aggregated to enhance node features. This mechanism can effectively identify the most influential communication node in the current context, suppress interference from noisy connections, thereby highlighting abnormal interaction behavior and significantly improving the ability to identify distributed cooperative attacks and covert command channels.

[0036] Step S180: Input the enhanced features of multiple nodes into a preset model to identify whether multiple devices have been subjected to network intrusion.

[0037] In this embodiment, attention-enhanced node features are input into a preset model (such as a neural network or classifier), enabling accurate judgment of whether a device has been subjected to network intrusion. Because the model input integrates multi-layered information such as traffic dynamics, log semantics, topology, and node importance, it possesses strong generalization capabilities and is suitable for industrial control network environments of different sizes and protocol types, especially showing good detection potential against zero-day attacks and advanced persistent threats (APTs).

[0038] According to the technical solution of this embodiment, an intelligent intrusion detection system for industrial control environments is constructed through the collaborative design of multimodal data fusion, image log processing, dynamic topology modeling and attention enhancement mechanism. This significantly improves the accuracy, robustness and interpretability of detection, and provides efficient and reliable technical support for the security protection of critical information infrastructure.

[0039] like Figure 2 As shown, one embodiment of the present invention provides a network intrusion detection method based on industrial control system security. Compared with the previous embodiments, the network intrusion detection method based on industrial control system security in this embodiment includes step S130 as follows:

[0040] Step S210: Detect the protocols contained in the system log.

[0041] Step S220: When the system log contains a security protocol, calculate the standard deviation of the most recent log entries in the system log.

[0042] Step S230: Set the Gaussian filter parameters based on the standard deviation of multiple logs.

[0043] Step S240: Perform Gaussian filtering on the grayscale image according to the Gaussian filtering parameters.

[0044] Step S250: Detect the structural similarity index of the grayscale image after Gaussian filtering.

[0045] In step S260, when the structural similarity index of the grayscale image is lower than the preset first threshold, Gaussian filtering is performed again until the structural similarity index of the grayscale image is higher than the first threshold.

[0046] In this embodiment, after initial Gaussian filtering, a structural similarity index (SSIM) is further introduced to quantitatively evaluate the filtering effect. By detecting the SSIM value between the filtered image and the original image, and iteratively performing Gaussian filtering when the value falls below a preset first threshold, sufficient structural clarity is maintained while denoising the image. This closed-loop feedback mechanism effectively prevents image blurring or loss of edge information caused by multiple filtering processes, ensuring the integrity of the time-series pattern and communication cycle structure in the log grayscale image.

[0047] According to the technical solution of this embodiment, the system log is first checked for the presence of security protocols (such as TLS / SSL, IPsec, etc.) to determine the security and encryption characteristics of the communication behavior. The presence of a security protocol indicates that the log may record frequent handshakes, authentication, or key exchange processes, with significant fluctuations in time intervals and message patterns. In this case, the standard deviation of the most recent log entries is calculated to quantify the degree of fluctuation in log behavior, and the Gaussian filter parameters are dynamically set accordingly, achieving adaptive adjustment of the filter strength. This mechanism avoids the problems of over-smoothing or insufficient noise reduction caused by fixed-parameter filtering, effectively preserving key behavioral mutation characteristics while suppressing random noise interference.

[0048] like Figure 3 As shown, one embodiment of the present invention provides a network intrusion detection method based on industrial control system security. Compared with the previous embodiments, the network intrusion detection method based on industrial control system security in this embodiment includes step S130 as follows:

[0049] Step S310: Calculate the temporal complexity of the grayscale image.

[0050] Step S320: When the temporal complexity of the grayscale image is higher than the preset second threshold, MobileViT is selected as the feature extractor. ASPP is embedded in MobileViT to process the output of the Transformer encoder in MobileViT.

[0051] In this embodiment, for highly complex log images, the lightweight visual Transformer architecture MobileViT is employed. This architecture effectively captures long-distance dependencies across time steps in the image, overcoming the limitations of the local receptive field in traditional CNNs and more accurately identifying collaborative anomalies among distributed devices. Furthermore, a Spatial Pyramid Pooling (ASPP) module is embedded at the output of the Transformer encoder. This allows for the parallel extraction of multi-scale contextual information at multiple expansion rates, enhancing the model's ability to perceive behavioral patterns at different time granularities (such as second-level heartbeats and minute-level task scheduling). This significantly improves the detection sensitivity against covert and progressive attacks (such as APTs and data leakage).

[0052] Step S330: When the temporal complexity of the grayscale image is lower than the second threshold, ResNet-18 is selected as the feature extractor.

[0053] Step S340: Use a feature extractor to extract temporal information from the grayscale image.

[0054] According to the technical solution of this embodiment, adaptive selection of feature extraction models is achieved, balancing accuracy and efficiency. By calculating the temporal complexity of the grayscale image, the complexity of the behavioral patterns contained in the log image is quantified. When the complexity is higher than a preset second threshold, it indicates that there are complex communication behaviors in the log, such as multi-period, nonlinear, and long-distance dependencies (e.g., multi-device collaborative operation, abnormal state transitions). In this case, MobileViT combined with the ASPP module is selected as the feature extractor. When the complexity is low, it indicates that the system is running stably and the log pattern is simple. The lightweight ResNet-18 can efficiently capture the main features.

[0055] like Figure 4 As shown, one embodiment of the present invention provides a network intrusion detection method based on industrial control system security. Compared with the previous embodiments, the network intrusion detection method based on industrial control system security in this embodiment includes step S150 as follows:

[0056] Step S410: Extract abnormal pixel regions from the grayscale image.

[0057] Step S420: Determine the time of occurrence of the abnormal event in the industrial control network environment based on the location of the abnormal pixel region in the grayscale image.

[0058] In this embodiment, abnormal pixel regions are extracted from grayscale images, and image analysis techniques are used to identify time periods and device behaviors that deviate from normal patterns. By combining the mapping relationship between pixel positions and timestamps in the image, the occurrence time of abnormal events can be accurately determined, achieving high-resolution spatiotemporal localization of potential attack behaviors. This mechanism overcomes the limitations of traditional coarse-grained detection based on statistical thresholds or sliding windows, significantly improving the ability to detect covert threats such as short-term pulse attacks and intermittent communication anomalies.

[0059] Step S430: Extract log fragments from the system log according to the time of occurrence of the abnormal event.

[0060] In this embodiment, after locating the abnormal time period, log segments corresponding to the time window are actively extracted from the original system logs to form an analytical closed loop of "finding the cause from the image and interpreting the meaning from the text". The unstructured log data is spatiotemporally aligned with the abnormal area of ​​the structured image, which not only verifies the authenticity of the image anomaly, but also restores the specific semantics of the abnormal behavior (such as device restart, permission change, protocol anomaly) through the log content, greatly enhancing the interpretability and evidence support capability of the intrusion detection results.

[0061] Step S440: Parse the message information of multiple pairs of devices from the log fragments.

[0062] Step S450: Analyze the communication strength between each pair of devices based on the message information of the multiple pairs of devices.

[0063] Step S460: Based on the communication strength of multiple pairs of devices, determine one or more pairs of devices that have a communication link relationship.

[0064] According to the technical solution of this embodiment, this embodiment constructs a communication strength index by analyzing the message frequency, data volume, and interaction duration of each pair of devices during abnormal periods, and determines whether there is a real and close communication link relationship based on this. It can distinguish different types of interactions such as master-slave, periodic heartbeat, and occasional query, and supports dynamic evaluation of the dependency relationship between devices, providing a key basis for the subsequent construction of an industrial control network topology with attack context awareness capabilities.

[0065] One embodiment of the present invention provides a network intrusion detection method based on industrial control system security. Compared with the previous embodiments, the network intrusion detection method based on industrial control system security in this embodiment further includes the following step before step S160:

[0066] (1) Select any one of the multiple devices as device A.

[0067] (2) Betweenness centrality of computing device A Where s and t represent two other devices besides device A among a plurality of devices. This represents the total number of shortest paths from device s to device t. This represents the number of paths that pass through device A in the shortest path from device s to device t.

[0068] (3) Divide the multiple devices into multiple communities and calculate the size of the community where device A is located. .

[0069] (4) Degree of hub function of computing device A in the industrial control network topology diagram ,in This indicates dot product.

[0070] In this embodiment, a novel hub function is proposed, which combines the betweenness centrality of device A with the size of its community, fully considering the bridging role of the device between the local community and the global network. This design can more accurately identify core control nodes (such as SCADA servers and central controllers) that are both on critical communication paths and connected to large-scale device clusters, significantly improving the rationality and physical interpretability of critical device identification.

[0071] (5) Identify the traffic data of device A from the network traffic data.

[0072] (6) Analyze the proportion of each type of data in the flow data of device A, where the proportion of the i-th type of data is: .

[0073] (7) Calculate the flow entropy of device A .

[0074] (8) Correct the degree of hub function of device A in the industrial control network topology diagram. The corrected degree of hub function of device A in the industrial control network topology diagram ,in The preset weighting factors, The flow entropy of device A Historical data variance The flow entropy of device A The standard deviation of historical data.

[0075] In this embodiment, traffic entropy is further introduced as a dynamic behavior indicator to quantify the uncertainty of the distribution of different types of data packets (such as read commands, write commands, heartbeat packets, alarm messages, etc.) of device A within a unit of time. Normal industrial control equipment usually has a highly regular data interaction pattern and low traffic entropy; however, when a device is attacked or used as a jump server, its communication content tends to be randomized, leading to an abnormal increase in traffic entropy. By constructing a modified hub effect, dynamic weighted adjustment of device criticality is achieved. This mechanism enables the system to automatically increase the "influence weight" of abnormally active devices during an attack, which helps to capture potential lateral movement and command and control behaviors.

[0076] In this embodiment, the edge weights are set based on the modified hub effect, ensuring that the importance of a communication link depends not only on the static topological positions of the connected parties but also on the degree of anomalousness in its current behavior. For example, communication between two devices with high modified hub values ​​will be assigned a higher weight, indicating potential unexpected interactions between core devices. This design enables the constructed industrial control network topology graph to possess attack context awareness, providing a more discriminative input structure for subsequent attention calculations and anomaly identification based on graph neural networks.

[0077] According to the technical solution of this embodiment, by constructing a three-in-one hub role evaluation model of "topological centrality + community structure + dynamic traffic entropy correction", a leap from "static importance" to "dynamic influence" is achieved. This technology not only improves the accuracy and semantic richness of industrial control network topology modeling, but also provides high-quality contextual information support for subsequent attention enhancement and intrusion detection, significantly enhancing the system's ability to detect complex, covert, and dynamic attacks, and has important theoretical value and engineering application prospects.

[0078] One embodiment of the present invention provides a network intrusion detection method based on industrial control system security. Compared with the previous embodiments, the network intrusion detection method based on industrial control system security in this embodiment further includes, in step:

[0079] (1) When any of the multiple devices is found to be under network intrusion, obtain intrusion traffic data.

[0080] (2) Reconstruct the ASN.1 syntax tree of the intrusion traffic data and extract the function code, register address and data length of the intrusion traffic data.

[0081] In this embodiment, by reconstructing the detected intrusion traffic data using the ASN.1 (Abstract Syntax Notation One) syntax tree, the method can accurately parse the nested structured fields in industrial control protocols (such as Modbus, DNP3, IEC 60870-5-104, etc.) and automatically extract key semantic elements of the attack behavior, including function codes, register addresses, and data lengths. This method overcomes the limitations of traditional shallow analysis based on IP / port or simple payload matching, delving into the protocol semantic layer and ensuring that the extracted features are highly accurate and operable.

[0082] (3) Construct intrusion legality verification rules based on the function code, register address and data length of the intrusion traffic data.

[0083] In this embodiment, based on the extracted function code, register address, and data length combination, intrusion legitimacy verification rules are automatically generated (such as "prohibit function code 0x06 from being written to addresses 40001-40010" or "limit the data length of function code 0x10 to no more than 10 bytes"). These rules directly correspond to the operational intent of the attack, are highly targeted, and can effectively prevent the recurrence of similar attacks while avoiding false interception of normal business traffic, significantly improving the accuracy and business compatibility of the protection strategy.

[0084] (4) Add intrusion legitimacy verification rules to the device that has been compromised by the network, and filter the data that matches the intrusion legitimacy verification rules in the data received by the device that has been compromised by the network.

[0085] According to the technical solution of this embodiment, by introducing dynamic rule generation and local filtering mechanisms based on semantic parsing, an integrated security closed loop of "detection-response-protection" is constructed, significantly improving the self-repair and continuous protection capabilities of industrial control systems after being attacked. This technology not only enhances the system's proactive defense level but also provides an innovative solution for realizing an intelligent, resilient, and reliable industrial network security system.

[0086] like Figure 5 As shown, one embodiment of the present invention provides a network intrusion detection system based on industrial control system security, comprising:

[0087] The data acquisition module 510 acquires network traffic data and system logs in the industrial control network environment.

[0088] In this embodiment, network traffic data and system logs in the industrial control network are collected simultaneously, breaking through the limitation of traditional methods that rely on only a single data source.

[0089] The vector splicing module 520 extracts statistical and frequency domain features from network traffic data and splices them to form a time-series feature vector.

[0090] The matrix forming module 530 performs binary conversion on the system log to obtain a grayscale image, and retains the temporal information in the grayscale image to obtain the grayscale image feature matrix.

[0091] In this embodiment, by extracting the time-series feature vector of traffic data and the grayscale image feature matrix of log data respectively, joint modeling of network behavior and system operation behavior is realized, which significantly enhances the ability to detect covert attacks (such as low-speed scanning, privilege escalation, command injection, etc.) and effectively reduces the false alarm rate and false negative rate.

[0092] In this embodiment, the unstructured text logs are converted into a computable two-dimensional matrix by binary encoding and conversion into grayscale images, while preserving their time-series structure, thus forming a grayscale image feature matrix. This method not only facilitates the extraction of local and global behavioral patterns using image processing techniques but also effectively captures the behavioral evolution characteristics of devices during long-term operation, providing high-dimensional semantic information support for subsequent communication link analysis.

[0093] The device analysis module 540 analyzes the five-tuple and session lifetime of the industrial control network environment based on time-series feature vectors, and identifies multiple devices in the industrial control network environment.

[0094] The link analysis module 550 analyzes the communication link relationships between multiple devices based on the grayscale image feature matrix.

[0095] The network topology module 560 constructs an industrial control network topology graph based on multiple devices and the communication link relationships between them. It sets multiple devices as nodes in the industrial control network topology graph, sets the characteristics of multiple nodes based on time-series feature vectors, and sets the weights of the edges in the industrial control network topology graph based on the degree of hub role of multiple devices in the industrial control network topology graph.

[0096] In this embodiment, based on the five-tuple, session lifetime, and log communication behavior, device entities and their communication link relationships in the industrial control network are jointly identified, and an industrial control network topology map with clear physical meaning is constructed accordingly. This topology map not only reflects the connection relationships between devices, but also endows nodes with dynamic behavioral attributes by using time-series feature vectors as node features, enabling the topology structure to have time-varying perception capabilities and more closely reflect the actual operating state of the industrial control system.

[0097] In this embodiment, when constructing the topology graph, the weights of edges are dynamically set according to the hub role of devices in the communication network, giving higher weight to connections between key control nodes (such as engineering workstations and PLC main control units). This mechanism highlights the communication importance of core paths, helps identify targeted attacks and lateral movement behaviors against key devices, and improves the targeting and interpretability of detection.

[0098] The relationship calculation module 570 calculates the attention relationship between each node and its neighboring nodes among multiple nodes, and enhances the features of multiple nodes based on the attention relationships corresponding to the multiple nodes to obtain the enhanced features of multiple nodes.

[0099] In this embodiment, by calculating the attention relationship between each node and its neighboring nodes, neighborhood information is adaptively weighted and aggregated to enhance node features. This mechanism can effectively identify the most influential communication node in the current context, suppress interference from noisy connections, thereby highlighting abnormal interaction behavior and significantly improving the ability to identify distributed cooperative attacks and covert command channels.

[0100] The intrusion detection module 580 inputs the enhanced features of multiple nodes into a preset model to identify whether multiple devices have been subjected to network intrusion.

[0101] In this embodiment, attention-enhanced node features are input into a preset model (such as a neural network or classifier), enabling accurate judgment of whether a device has been subjected to network intrusion. Because the model input integrates multi-layered information such as traffic dynamics, log semantics, topology, and node importance, it possesses strong generalization capabilities and is suitable for industrial control network environments of different sizes and protocol types, especially showing good detection potential against zero-day attacks and advanced persistent threats (APTs).

[0102] According to the technical solution of this embodiment, an intelligent intrusion detection system for industrial control environments is constructed through the collaborative design of multimodal data fusion, image log processing, dynamic topology modeling and attention enhancement mechanism. This significantly improves the accuracy, robustness and interpretability of detection, and provides efficient and reliable technical support for the security protection of critical information infrastructure.

[0103] The basic principles of this application have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this application are merely examples and not limitations, and should not be considered as essential features of each embodiment of this application. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the application to the necessity of employing the aforementioned specific details for implementation.

[0104] The block diagrams of devices, apparatuses, devices, and systems involved in this application are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0105] It should also be noted that in the apparatus, equipment, and methods of this application, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions of this application.

[0106] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this application. Therefore, this application is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0107] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A network intrusion detection method based on industrial control system security, comprising: Acquire network traffic data and system logs in the industrial control network environment; Extract statistical and frequency domain features from the network traffic data and concatenate them to form a time-series feature vector; The system log is converted to binary to obtain a grayscale image, and the temporal information in the grayscale image is retained to obtain a grayscale image feature matrix; Based on the time-series feature vector, the five-tuple and session lifetime of the industrial control network environment are analyzed, and multiple devices in the industrial control network environment are identified. Based on the grayscale image feature matrix, the communication link relationship between the multiple devices is analyzed; Based on the multiple devices and the communication link relationships between the multiple devices, an industrial control network topology is constructed, the multiple devices are set as multiple nodes in the industrial control network topology, the features of the multiple nodes are set according to the time-series feature vector, and the weights of the edges of the industrial control network topology are set according to the degree of hub role of the multiple devices in the industrial control network topology. Calculate the attention relationship between each of the plurality of nodes and its neighboring nodes, and enhance the features of the plurality of nodes based on the attention relationships between the plurality of nodes to obtain the enhanced features of the plurality of nodes; The enhanced features of the multiple nodes are input into a preset model to identify whether the multiple devices have been subjected to network intrusion. The analysis of communication link relationships between the multiple devices based on the grayscale image feature matrix includes: Extract abnormal pixel regions from the grayscale image; The time of occurrence of the abnormal event in the industrial control network environment is determined based on the position of the abnormal pixel region in the grayscale image. Log fragments are extracted from the system log according to the time of occurrence of the abnormal event; Multiple pairs of device message information were parsed from the log fragments; Based on the message information of the multiple pairs of devices, analyze the communication strength between each pair of devices in the multiple pairs of devices; Based on the communication strength of the multiple pairs of devices, determine one or more pairs of devices that have a communication link relationship.

2. The network intrusion detection method based on industrial control system security according to claim 1, wherein, The system log is converted from binary to grayscale to obtain a grayscale image, including: Detect the protocols contained in the system logs; When the system log contains a security protocol, calculate the standard deviation of the most recent log entries in the system log. Based on the standard deviation of the multiple log entries, set the Gaussian filter parameters; The grayscale image is subjected to Gaussian filtering processing according to the Gaussian filtering parameters; Detect the structural similarity index of the grayscale image after Gaussian filtering; When the structural similarity index of the grayscale image is lower than a preset first threshold, Gaussian filtering is performed again until the structural similarity index of the grayscale image is higher than the first threshold.

3. The network intrusion detection method based on industrial control system security according to claim 1, wherein, The grayscale image feature matrix is ​​obtained by preserving the temporal information in the grayscale image, including: Calculate the temporal complexity of the grayscale image; When the temporal complexity of the grayscale image is higher than a preset second threshold, MobileViT is selected as the feature extractor. The MobileViT embeds a hollow spatial pyramid pooling (ASPP) to process the output of the Transformer encoder in the MobileViT. When the temporal complexity of the grayscale image is lower than the second threshold, ResNet-18 is selected as the feature extractor. The feature extractor is used to extract temporal information from the grayscale image.

4. The network intrusion detection method based on industrial control system security according to claim 1, wherein, Before setting the weights of the edges in the industrial control network topology graph based on the hub function of the multiple devices in the graph, the network intrusion detection method based on industrial control security further includes: Choose any one of the plurality of devices as device A; Calculate the betweenness centrality of device A. Where s and t represent two other devices besides device A among the plurality of devices. This represents the total number of shortest paths from device s to device t. This represents the number of paths that pass through device A in the shortest path from device s to device t; Divide the multiple devices into multiple communities, and calculate the size of the community where device A is located. ; Calculate the degree of hub function of device A in the industrial control network topology diagram. ,in This indicates dot product.

5. The network intrusion detection method based on industrial control system security according to claim 4, wherein, Before setting the weights of the edges in the industrial control network topology graph based on the hub function of the multiple devices in the graph, the network intrusion detection method based on industrial control security further includes: Identify the traffic data of device A from network traffic data; Analyze the proportion of each type of data in the traffic data of device A, where the proportion of the i-th type of data is: ; Calculate the flow entropy of device A. ; The hub function of device A in the industrial control network topology is corrected, and the corrected hub function of device A in the industrial control network topology is... ,in The preset weighting factors, The flow entropy of device A Historical data variance The flow entropy of device A The standard deviation of historical data.

6. The network intrusion detection method based on industrial control system security according to claim 1 further includes: When any of the plurality of devices is found to be subjected to network intrusion, intrusion traffic data is acquired; The intrusion traffic data is reconstructed using an ASN.1 syntax tree to extract the function code, register address, and data length of the intrusion traffic data. Based on the function code, register address, and data length of the intrusion traffic data, construct intrusion legality verification rules; Add the intrusion legitimacy verification rule to the device that has been compromised by the network, and filter the data received by the compromised device that matches the intrusion legitimacy verification rule.

7. A network intrusion detection system based on industrial control system security, comprising: The data acquisition module acquires network traffic data and system logs in the industrial control network environment; The vector concatenation module extracts statistical and frequency domain features from the network traffic data and concatenates them to form a time-series feature vector. The matrix forming module performs binary conversion on the system log to obtain a grayscale image, and retains the temporal information in the grayscale image to obtain a grayscale image feature matrix; The device analysis module analyzes the five-tuple and session lifetime of the industrial control network environment based on the time-series feature vector, and identifies multiple devices in the industrial control network environment. The link analysis module analyzes the communication link relationships between the multiple devices based on the grayscale image feature matrix. The network topology module constructs an industrial control network topology graph based on the multiple devices and the communication link relationships between the multiple devices, sets the multiple devices as multiple nodes in the industrial control network topology graph, sets the features of the multiple nodes based on the time-series feature vector, and sets the weights of the edges in the industrial control network topology graph based on the degree of hub role of the multiple devices in the industrial control network topology graph. The relationship calculation module calculates the attention relationship between each of the multiple nodes and its neighboring nodes, and enhances the features of the multiple nodes based on the attention relationships corresponding to the multiple nodes to obtain the enhanced features of the multiple nodes. The intrusion detection module inputs the enhanced features of the multiple nodes into a preset model to identify whether the multiple devices have been subjected to network intrusion. The analysis of communication link relationships between the multiple devices based on the grayscale image feature matrix includes: Extract abnormal pixel regions from the grayscale image; The time of occurrence of the abnormal event in the industrial control network environment is determined based on the position of the abnormal pixel region in the grayscale image. Log fragments are extracted from the system log according to the time of occurrence of the abnormal event; Multiple pairs of device message information were parsed from the log fragments; Based on the message information of the multiple pairs of devices, analyze the communication strength between each pair of devices in the multiple pairs of devices; Based on the communication strength of the multiple pairs of devices, determine one or more pairs of devices that have a communication link relationship.

Images