A method, system, device, medium and product for detecting encrypted malicious traffic of an industrial control system

Abstract

This application discloses a method, system, device, medium, and product for detecting encrypted malicious traffic in industrial control systems, relating to the field of industrial control. First, encrypted traffic from communications between various levels of the industrial control system (including the management / MES layer, process monitoring layer, and control layer) is collected and preprocessed to extract key traffic data packets. These key traffic data packets are then input into a trained feature extraction network to extract encrypted traffic features. The encrypted traffic features are matched against pre-stored encrypted malicious traffic features. If a match is successful, the traffic is identified as encrypted malicious and blocked. If no match is found, the encrypted traffic features are input into a trained deep detection network, which outputs the encrypted traffic classification result. This application can effectively detect and block network and data security attacks initiated from external and internal sources in industrial control systems, improving the detection capability and security protection capability against encrypted malicious traffic.

Description

Technical Field

[0001] This application relates to the field of industrial control technology, and in particular to a method, system, device, medium and product for detecting encrypted malicious traffic in an industrial control system. Background Technology

[0002] Currently, with the continuous empowerment of technologies such as the Industrial Internet, big data, and artificial intelligence, the intelligence level, network complexity, and the types and quantities of equipment in Industrial Control Systems (ICS) are constantly increasing, leading to a rapid growth trend in network traffic. While these new technologies empower industrial production, they also expose industrial networks to serious data security threats. Therefore, data encryption technology has been widely applied in the industrial field. With the increasing demand for ICS data security, the application of lightweight encryption algorithms has increased the proportion of encrypted traffic in ICS. Although data encryption technology effectively protects ICS data security, it also provides opportunities for attackers. Attackers can still launch effective attacks on ICS using encrypted malicious traffic. Existing Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are not very effective in detecting encrypted malicious traffic, and still have shortcomings in areas such as encrypted traffic feature extraction, noise sensitivity, and model generalization ability. Therefore, to ensure data security in control networks, it is necessary to improve the detection capability of ICS for encrypted malicious traffic and ensure the safe, reliable, stable, and fast operation of ICS. Summary of the Invention

[0003] The purpose of this application is to provide a method, system, device, medium, and product for detecting encrypted malicious traffic in industrial control systems. This method can effectively detect and block network and data security attacks initiated from external and internal sources in industrial control systems, thereby improving the detection capability and security protection capability of encrypted malicious traffic.

[0004] To achieve the above objectives, this application provides the following solution.

[0005] Firstly, this application provides a method for detecting encrypted malicious traffic in an industrial control system, including:

[0006] Encrypted traffic from communications between different levels of the industrial control system is collected; the levels of the industrial control system include the management layer, the MES (Manufacturing Execution System) layer, the process monitoring layer, and the control layer.

[0007] Preprocess the encrypted traffic to extract key traffic data packets;

[0008] The key traffic data packets are input into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features include global features, local features, and fused features.

[0009] The encrypted traffic characteristics are matched with the pre-stored encrypted malicious traffic characteristics. If the match is successful, the current encrypted traffic is identified as encrypted malicious traffic and blocked.

[0010] If no match is found, the encrypted traffic features are input into the trained deep detection network, and the encrypted traffic classification result is output; the encrypted traffic classification result is encrypted malicious traffic or non-malicious traffic.

[0011] Block encrypted malicious traffic and store the corresponding encrypted traffic characteristics as encrypted malicious traffic characteristics.

[0012] Optionally, the preprocessing operation on the encrypted traffic to extract key traffic data packets specifically includes:

[0013] The encrypted traffic packets are segmented and cleaned to extract the set of valid information. ;in Indicates the source and destination ports of the communication; Indicates the communication protocol; Indicates the length of the data packet; For the extracted key traffic data packets; among which Effective encrypted traffic after removing redundant and useless information; This refers to tagged encrypted traffic; among which For top traffic, For load flow, For encrypted traffic on the Internet, the extracted tag information includes the Internet communication protocol and the corresponding common port; for encrypted traffic in the industrial control network, the extracted tag information includes the dedicated industrial control protocol, the corresponding common port, and the device profile information.

[0014] Key traffic data packets The length of the data packets is standardized to the optimal byte length, and the critical traffic data packets are... The bytes in the code are converted to integers between 0 and 255.

[0015] Optionally, the feature extraction network includes a global feature extraction module, a local feature extraction module, and a feature fusion module;

[0016] The global feature extraction module includes a grayscale image conversion unit and a CNN-Inception network; the grayscale image conversion unit is used to convert key traffic data packets... The pcap format file is converted to Npy format and normalized before being converted into a grayscale image, which is then used as input to the CNN-Inception network. The CNN-Inception network is used to extract global features from the input grayscale image. ;

[0017] The local feature extraction module is used to extract features from labeled encrypted traffic. Extracting local features ;

[0018] The feature fusion module is used to integrate global features. With local features Perform fusion and stitching processing to output fused features. .

[0019] Optionally, the CNN-Inception network includes convolutional layers, pooling layers, adaptive Inception components, and feature fusion transformation units connected in sequence.

[0020] The input grayscale image is passed through a certain number of convolutional and pooling layers of different sizes to initially learn and extract features from the encrypted traffic that has been converted into a grayscale image, thus extracting a preliminary feature map.

[0021] The initial feature map is input into the adaptive Inception component, which captures features of different scales of encrypted traffic through parallel convolutional layers and pooling layers, and outputs a multi-scale feature map.

[0022] Multi-scale feature maps are input into a feature fusion transformation unit for fusion, and then converted into a one-dimensional feature vector using a reshape function, which serves as the extracted global feature. .

[0023] Optionally, the local feature extraction module includes a byte sequence conversion unit, a data embedding unit, a position encoding unit, a similarity calculation unit, an encoding unit, and a normalization unit;

[0024] The byte sequence conversion unit is used to convert tagged encrypted traffic. Convert to a byte sequence vector ;in Indicates the first 1 byte; This refers to the number of bytes in the header traffic. This represents the total number of bytes for both header and payload traffic. Indicates the first One tag; Number of tags;

[0025] The data embedding unit is used to embed each byte and each tag Embedded separately into two joint embedding spaces, the bytes Mapping to byte embedding vector , label Mapping to label embedding vector The byte embedding vector includes a header vector and a payload vector.

[0026] The position encoding unit performs position encoding on the header vector and payload vector respectively, embedding the bytes into the vector. Update to encoded vector ;

[0027] The similarity calculation unit is used to calculate the encoded vector. With label embedding vector Cosine similarity between This constitutes a byte tag similarity matrix. ;

[0028] The encoding unit includes a byte attention encoder and a label attention encoder; the byte attention encoder is based on a byte label similarity matrix. Generate header byte feature representation and payload byte feature representation The label attention encoder is based on a byte label similarity matrix. Generate header label feature representation and load label feature representation ;

[0029] The normalization unit is used to represent the four features. , , and After splicing and normalization, local features are formed. .

[0030] Optionally, the deep detection network includes a serialization unit, a Transformer module, a fully connected layer, and a Softmax classifier;

[0031] The serialization unit is used to serialize the fused features and input them into the Transformer module;

[0032] The Transformer module is used to perform depth detection on serialized features and extract depth features;

[0033] The fully connected layer is used to weight and fuse deep features and map them to the target dimension, serving as a key scoring vector for classification;

[0034] The Softmax classifier is used to convert the key score vector into class probabilities between 0 and 1, and output the encrypted traffic classification result based on the class probabilities.

[0035] Secondly, this application provides an encrypted malicious traffic detection system for industrial control systems, comprising:

[0036] An encrypted traffic acquisition module is used to acquire encrypted traffic between different layers of an industrial control system; the layers of the industrial control system include a management layer, a MES layer, a process monitoring layer, and a control layer.

[0037] The data preprocessing module is used to preprocess encrypted traffic and extract key traffic data packets;

[0038] The encrypted traffic feature extraction module is used to input key traffic data packets into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features include global features, local features, and fused features.

[0039] The encrypted traffic feature matching module is used to match encrypted traffic features with pre-stored encrypted malicious traffic features. If the match is successful, the current encrypted traffic is determined to be encrypted malicious traffic and blocked.

[0040] An encrypted traffic classification module is used to input encrypted traffic features into a trained deep detection network and output encrypted traffic classification results if no match is found; the encrypted traffic classification results are classified as encrypted malicious traffic or non-malicious traffic.

[0041] The encrypted malicious traffic handling module is used to block encrypted malicious traffic and store the corresponding encrypted traffic characteristics as encrypted malicious traffic characteristics.

[0042] Thirdly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the encrypted malicious traffic detection method of the industrial control system.

[0043] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the encrypted malicious traffic detection method of the industrial control system.

[0044] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements an encrypted malicious traffic detection method for the industrial control system.

[0045] Based on the specific embodiments provided in this application, the following technical effects are disclosed.

[0046] This application provides a method, system, device, medium, and product for detecting encrypted malicious traffic in industrial control systems. First, it collects encrypted traffic from communication between various layers of the industrial control system (including the management / MES layer, process monitoring layer, and control layer) and performs preprocessing operations to extract key traffic data packets. The key traffic data packets are then input into a trained feature extraction network to extract encrypted traffic features (including global features, local features, and fused features). These encrypted traffic features are then matched with pre-stored encrypted malicious traffic features. If a match is successful, the traffic is identified as encrypted malicious and blocked. If no match is found, the encrypted traffic features are input into a trained deep detection network, which outputs a classification result indicating whether the current encrypted traffic is encrypted malicious. This application can effectively detect and block network and data security attacks initiated from external and internal sources in industrial control systems, improving the detection capability and security protection capability against encrypted malicious traffic. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a flowchart illustrating an encrypted malicious traffic detection method for an industrial control system according to this application.

[0049] Figure 2 A schematic diagram illustrating the hierarchical relationship of an industrial control system and the deployment location of an encrypted malicious traffic detection system;

[0050] Figure 3 Network architecture diagrams for feature extraction network and deep detection network;

[0051] Figure 4 A schematic diagram illustrating the matching process of encrypted traffic characteristics for industrial control networks;

[0052] Figure 5 A schematic diagram illustrating the matching process for encrypted internet traffic features;

[0053] Figure 6 A schematic diagram illustrating the working process of an encrypted malicious traffic detection system. Detailed Implementation

[0054] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0055] This application proposes a method, system, device, medium, and product for detecting encrypted malicious traffic in industrial control systems. It can effectively detect and block network and data security attacks initiated from external and internal sources in industrial control systems, thereby improving the detection capability and security protection capability of encrypted malicious traffic.

[0056] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] In one exemplary embodiment, such as Figure 1 As shown, an encrypted malicious traffic detection method for an industrial control system is provided, including the following steps 1 to 6.

[0058] Step 1: Collect encrypted traffic of communication between different levels of the industrial control system.

[0059] See Figure 2 Industrial control systems typically consist of three layers: a management / MES layer, a process monitoring layer, and a control layer. The management / MES layer is usually the enterprise management layer and / or production management layer. The process monitoring layer is typically implemented using Supervisory Control and Data Acquisition (SCADA) systems. The control layer typically includes Programmable Logic Controllers (PLCs), Distributed Control Systems (DCS), and Safety Instrumented Systems (SIS). PLCs are commonly used for discrete control, such as sequential control of mechanical equipment. DCS is suitable for continuous process control, such as in the chemical and power industries. SIS focuses on safety functions, used to safely shut down operations or trigger protective measures in abnormal situations.

[0060] This application targets both encrypted malicious traffic detection in internet information domains (including communication between enterprise management, production management, and process monitoring layers) and encrypted malicious traffic detection in industrial control network (ICS) control domains, such as communication between the process monitoring layer and the control layer, and between the management / MES layer and the control layer. Therefore, the encrypted traffic collected in this application includes communication data traffic from both the internet (information domain) and the ICS (control domain).

[0061] Communication between information devices at different layers of the information domain is interactive. Encrypted malicious traffic can be transmitted through communication between information systems, thereby affecting every device or system in the information domain. Attacks against industrial field control equipment typically originate directly from the SCADA / MES layer, following a north-to-south direction. Therefore, this application's detection of encrypted malicious traffic in the information domain requires the collection, analysis, and interception of encrypted data in both north-south directions to ensure security between layers. However, due to the characteristics of network attacks and the strict latency requirements in the control domain, only encrypted traffic from north to south is collected for targeted detection.

[0062] In other words, in the internet, attackers can originate from any terminal device, and encrypted communication can occur between these devices. Therefore, it is necessary to monitor and collect bidirectional communication traffic between key nodes at each layer of the information domain to prevent arbitrary devices from being attacked. However, in the industrial control network of the control domain, it is only necessary to focus on monitoring the unidirectional communication traffic data between the management layer / MES layer / process monitoring layer and the control layer. Currently, communication data from the process monitoring layer to the control layer is often in plaintext or uses lightweight encryption algorithms for bidirectional encrypted communication. But from an attack perspective, network attacks targeting industrial field equipment typically originate from communication data at the process monitoring layer or the management layer / MES layer; therefore, it is sufficient to collect and monitor unidirectional encrypted data.

[0063] Step 2: Preprocess the encrypted traffic to extract key traffic data packets.

[0064] Although this application collects encrypted traffic, the traffic data packets are also divided into unencrypted and encrypted portions. Generally, the encrypted portion is the payload carrying important control command information, while the unencrypted portion contains basic communication information such as source port, destination port, IP address, and length. The core objective of this application is to identify and block malicious encrypted traffic from a large amount of encrypted traffic. Different types of communication protocols generally flow through different ports to various devices; therefore, protocols and ports can serve as traffic tags. Furthermore, devices in the industrial control layer, due to proprietary protocols or unique communication modes, carry unique character information in their communication traffic, which can serve as the identity information of industrial control devices. Tagging this traffic creates the tagging characteristics of encrypted traffic in the industrial control network.

[0065] After collecting encrypted traffic data between different levels in ICS, preprocessing operations are required for the encrypted traffic, including traffic extraction, traffic segmentation, traffic cleaning, and standardization of length.

[0066] First, the encrypted traffic packets (usually in pcap format) from the Internet or industrial control network are segmented and cleaned to extract the set of valid information. .in Indicates the source and destination ports of the communication; Indicates the communication protocol; Indicates the length of the data packet; These are the key traffic data packets extracted. To obtain valid encrypted traffic after removing redundant and useless information, such as anonymizing or padding MAC addresses, DNS fields, IP addresses, checksums, etc., while retaining some important port information such as 80, 8080, 443, 502, etc., the resulting valid information is obtained. This refers to tagged encrypted traffic; among which For top traffic, For load flow, This refers to tag information. For encrypted traffic in the Internet (information domain), the extracted tag information... This mainly includes internet communication protocols (HTTP, SSSH, SSL, etc.) and their corresponding common ports (80, 8080, 443, 502, etc.). For encrypted traffic in industrial control networks (control domains), the extracted tag information... This includes, but is not limited to, dedicated industrial control protocols (such as OPC, Modbus, S7, etc.), corresponding common ports (502, 443, 4840, 102, etc.), and device profile information. Device profile information typically refers to a unique string that can represent device information.

[0067] Then, in order to improve the identification efficiency of detection and analysis, key traffic data packets were... The length of the data packets is standardized to the optimal byte length, and the critical traffic data packets are... The bytes in the code are converted to integers between 0 and 255.

[0068] The so-called "optimal" refers to, from the perspective of preserving key information in encrypted traffic, analyzing key traffic data packets. The maximum packet length in the dataset is used as the optimal byte length. Research shows that most data packets are less than 1500 bytes long and have headers smaller than 50 bytes; therefore, the optimal byte length is determined by the maximum packet length. The lengths of the header and payload portions have been uniformly adjusted to 50 bytes and 1450 bytes, respectively. Specifically, the header and payload portions are truncated; bytes exceeding the limit are deleted from the tail, and bytes insufficient are padded with 0s.

[0069] Key traffic data packets The purpose of converting bytes to integers is that traffic packets are essentially sequences of hexadecimal numbers. To ensure that the subsequent network model can process and learn the relevant byte distribution, they need to be converted to integers for subsequent normalization and other operations. The purpose of converting them to integers between 0 and 255 is that the minimum and maximum values ​​of the bytes correspond to 0x00 and 0xFF, respectively, which correspond to the integers 0 and 255.

[0070] Step 3: Input the key traffic data packets into the trained feature extraction network to extract the encrypted traffic features.

[0071] The feature extraction network constructed in this application includes (3.1) a global feature extraction module, (3.2) a local feature extraction module and (3.3) a feature fusion module. The extracted encrypted traffic features include global features, local features and fused features.

[0072] This application's feature extraction network primarily targets two network scenarios: encrypted traffic feature extraction and analysis in information domain and control domain networks. Both types of encrypted traffic employ... Figure 3 The network structure shown is used for detection. By constructing a dual-channel approach, it accurately learns, extracts, detects, and classifies encrypted traffic in the information and control domains from the perspectives of global and local feature extraction. This allows for the detection of malicious encrypted traffic based on these features, improving the accuracy of malicious encrypted traffic identification. The network structure and module functions of the feature extraction network are described in detail below.

[0073] (3.1) Global Feature Extraction Module

[0074] See Figure 3 The global feature extraction module primarily employs a CNN network architecture with adaptive Inception components. Specifically, the global feature extraction module includes (3.1.1) a grayscale image conversion unit and (3.1.2) a CNN-Inception network. The grayscale image conversion unit is used to convert key traffic data packets... The pcap format file is converted to Npy format and normalized before being converted into a grayscale image, which is then used as input to the CNN-Inception network. The CNN-Inception network is used to extract global features from the input grayscale image. The following section provides a detailed introduction to the network structure and functions of the global feature extraction module.

[0075] (3.1.1) Grayscale image conversion unit

[0076] The grayscale conversion unit is used to convert key traffic data packets. The pcap format file is converted to Npy format and normalized before being converted into a grayscale image, which is then used as input to the CNN-Inception network for global feature extraction.

[0077] Specifically, you can use Python's built-in NumPy module to convert key traffic packets into integers. Save the data as Npy format. Since the data consists of fixed-length sequences, it's equivalent to stacking one-dimensional arrays. Use the Image function from Python's PIL library to convert each sequence in the Npy file into a grayscale image. Essentially, this involves folding the image at both ends according to a specified length. The image size is 64×64, where each pixel value corresponds one-to-one with the data packet byte value. The number of pixels in the image is greater than the length of the data packet, and any excess is replaced with 0.

[0078] (3.1.2) CNN-Inception Network

[0079] See Figure 3 The CNN-Inception network includes convolutional layers, pooling layers, adaptive Inception components, and feature fusion transformation units connected in sequence.

[0080] The input grayscale image is first passed through a certain number of convolutional and pooling layers of varying sizes to initially learn and extract features from the encrypted traffic converted to grayscale, thus extracting a preliminary feature map. In an exemplary embodiment, a 5-layer 3×3 convolution is constructed, i.e., 5 3×3 convolutions are performed.

[0081] Then, the preliminary feature map after initial feature extraction is input into the adaptive Inception component. Through parallel convolutional layers and pooling layers, features of different scales of encrypted traffic are captured in network layers of the same depth, and multi-scale feature maps are output to improve the accuracy and robustness of the network model.

[0082] Based on previous research experience, the adaptive Inception component mainly uses 1×1, 3×3, and 5×5 convolutional kernel sizes. 1×1 reduces the dimensionality of the output features, lowering complexity; 3×3 is a common size that maintains a good balance; and 5×5 better captures the feature space. The Inception component introduced in this application is a three-channel parallel network with adaptive adjustment capabilities. Its upper limit is three columns. The first column remains unchanged, consisting of a max-pooling layer and a 1×1 convolutional layer. The second and third columns use a random combination of 1×1, 3×3, and 5×5 convolutional layers. The Inception component selects the optimal kernel size based on feature learning performance and fine-tunes the structure accordingly.

[0083] For the input feature map and convolution kernel The formula for calculating convolution is:

[0084] (1);

[0085] in, Represents pixel position coordinates, This represents the output feature map; and These represent the values ​​of the input feature map and the convolution kernel at their respective positions; and These represent half the size of the convolution kernel, rounded down.

[0086] A 1×1 convolution operation performs a linear transformation on the multi-channel vector at each pixel location. The calculation formula is as follows:

[0087] (2);

[0088] in, This represents the number of channels in the input feature map, where any channel... ; Indicates position In the Values ​​on each channel; Indicates the convolution kernel at the th... Weights on each channel.

[0089] Max pooling layers are used to reduce the spatial dimensionality of feature maps, and the formula is:

[0090] (3);

[0091] in, Indicates a pooled window. Indicates the corresponding position within the window. This indicates taking the maximum value.

[0092] The adaptive Inception component performs convolutions on the pooled results with different kernel sizes. The purpose is to use convolution kernels of different scales to increase the receptive field, allowing the model to better learn the dependencies between bytes at different intervals.

[0093] Finally, the multi-scale feature maps extracted by the adaptive Inception component are input into the feature fusion transformation unit for fusion, and then converted into one-dimensional feature vectors using Python's built-in Reshape function, which serve as the extracted global features. .

[0094] The global feature extraction module of this application will extract key traffic data packets. Using grayscale images as input representation, this method fully leverages deep convolutional networks to globally learn the correlations between bytes and pixels in the grayscale images of traffic samples. This enhances the separability between heterogeneous traffic samples in a high-dimensional space, making subsequent classification more stable and mitigating the influence of local noise to some extent. Simultaneously, the Inception component of the CNN network utilizes different convolutional kernels to achieve feature learning at different scales. If the network layers are too shallow, deep features cannot be extracted; if they are too deep, overfitting can occur. Therefore, by using receptive fields of different sizes, the correlation and necessary connections between some bytes and others in the encrypted traffic are explored to varying degrees, further enhancing the effectiveness of global feature extraction from encrypted traffic.

[0095] (3.2) Local Feature Extraction Module

[0096] The local feature extraction module is used to extract features from labeled encrypted traffic. Extracting local features The local feature extraction module includes (3.2.1) a byte sequence conversion unit, (3.2.2) a data embedding unit, (3.2.3) a position encoding unit, (3.2.4) a similarity calculation unit, (3.2.5) an encoding unit, and (3.2.6) a normalization unit, which are described in detail below.

[0097] (3.2.1) Byte sequence conversion unit

[0098] The byte sequence conversion unit is used to convert tagged encrypted traffic. Convert to a byte sequence vector .in Indicates the first bytes, The number of bytes in the header traffic. This refers to the number of bytes of payload traffic. In other words, , Head flow plus load flow total 1 byte. Indicates the first A tag, The number of tags, i.e. .

[0099] (3.2.2) Data embedding unit

[0100] The data embedding unit is used to embed each byte and each tag They are embedded into two joint embedding spaces (i.e., the header-tag joint embedding space and the payload-tag joint embedding space), each containing two parallel layers: a byte embedding layer and a tag embedding layer, used to embed the bytes... Mapping to byte embedding vector , label Mapping to label embedding vector The byte embedding vector includes a header vector. and load vector In other words, the byte embedding layer in the header-tag joint embedding space is used to embed bytes... The byte embedding vector mapped to the header (or simply the header vector). Tag embedding layer is used to... Corresponding tags Mapping to label embedding vector The byte embedding layer in the payload-tag joint embedding space is used to embed bytes... The byte embedding vector mapped to the payload portion (or simply payload vector). Tag embedding layer is used to... Corresponding tags Mapping to label embedding vector .

[0101] Through the byte embedding layer Mapping to obtain byte embedding vector The embedding dimension is 256, aiming to map discrete data like bytes into continuous variables so that the model can capture the semantic or feature information of the original data. This is a feature vector containing semantic information representing bytes. Similarly, it is embedded through a label embedding layer. Mapping yields the label embedding vector The embedding dimension is 256. It is a feature vector that contains semantic information representing the label.

[0102] (3.2.3) Position coding unit

[0103] The position encoding unit performs position encoding on the header vector and payload vector respectively, embedding the bytes into the vector. (Head vector) or load vector Update to the encoded vector .

[0104] Since different bytes in different positions generally represent different semantics, and this type of information is crucial for classification, positional encoding of these bytes is necessary. Definition For the first The positional embedding of each byte is specifically achieved by constructing a positional encoding layer for these two vectors using the following formula. , Perform the corresponding transformation:

[0105] (4);

[0106] in pos Indicates location, d Representing dimension, and That is, position 2 d and 2 d The position code at +1. This specifies the embedding dimension, which defaults to 256. Each dimension of the positional encoding corresponds to a sine / cosine wave function. Therefore, for any positional encoding dimension... For each byte, the corresponding positional encoding vector can be calculated. ( and (a general term), and then through and Add to update the byte embedding. .

[0107] Positional encoding of byte embedding vectors ensures that the model learns not only semantic information but also the positional dependencies between bytes, making the model's learning of distributions more accurate.

[0108] (3.2.4) Similarity Calculation Unit

[0109] The similarity calculation unit is used to calculate the encoded vector. With label embedding vector Cosine similarity between This constitutes a byte tag similarity matrix. .

[0110] The following formula is used to calculate the first... The first byte and the first Cosine similarity between tags:

[0111] (5);

[0112] in Represents the encoded vector With label embedding vector Cosine similarity between them; Corresponding to , The encoded vector, Number of tags. As the matrix Line number The column elements constitute the byte tag similarity matrix. The matrix will be used subsequently. The attention encoder, which is input into the encoding unit, is used to generate its own attention score.

[0113] (3.2.5) Encoding Unit

[0114] The encoding unit uses a one-dimensional convolutional neural network to learn the byte tag similarity matrix. The attention score for each byte is calculated, and the byte portion is represented as a weighted sum of bytes. The encoding unit specifically includes a byte attention encoder and a label attention encoder. The byte attention encoder is further divided into a head attention encoder and a payload attention encoder. They have the same structure but different parameters; both include structures such as one-dimensional convolution, batch normalization (BN), max pooling, and softmax, but the weight parameters for the linear transformation differ. The head attention encoder and payload attention encoder are based on the byte label similarity matrix, respectively. ( Generate header byte feature representation and payload byte feature representation The label attention encoder is based on a byte label similarity matrix. ( Generate header label feature representation and load label feature representation The encoding methods of head attention encoders, payload attention encoders, and label attention encoders are similar; the following explanation will use the head attention encoder as an example.

[0115] Since individual bytes in a data packet typically lack semantic independence, subsequent processing in this application will employ a continuous... Each byte is used as the basic unit of processing (called a byte unit) rather than a single byte. Therefore, it contains A sequence of bytes will be divided into Each byte unit is specifically divided as follows: for units containing A sequence of bytes ,by A window of size 1 byte is used to slide the slider with a step size of 1. Byte unit, here Each byte unit can be viewed as a byte vector, through which this is processed in each window. By averaging the byte vectors, we can obtain... The region's byte-unit vector. Then, using... K Kernel convolution combined with a nonlinear activation function, for The region's byte unit vector is processed to generate a value for each byte unit vector. K Each attention score is used as a candidate result.

[0116] Specifically, for each byte unit vector , No. The attention scores for each candidate are:

[0117] (6);

[0118] in, It is the non-linear activation function ReLU. BN It is a batch normalization function used to standardize all candidate scores in a batch. Indicates the use of the first Convolution operations with multiple convolution kernels. Indicates the similarity of tags in different byte regions, with the index ranging from 1 to 2. Calculations are performed here. Its function is to calculate the unit vector for each byte. The scores are then analyzed, and max pooling is used to select the candidate value with the largest score in each byte unit vector. :

[0119] (7);

[0120] The weight normalization function sofmax is used to... After normalization, the byte attention vector is obtained. .

[0121] Finally, summing all byte unit vectors weighted by the byte attention vector yields the feature representation of the header bytes in the packet representation. ,Right now:

[0122] (8).

[0123] For the payload portion of bytes, its characteristic representation The generation method and Similar, the difference lies in the object being processed. The byte tag similarity matrix used The range of values ​​is .

[0124] Similarly, using a calculation method similar to that of the byte attention encoder, we can obtain information about the label dimension. The attention vector. Here, it starts from the label dimension, and the magnitude of the summation is relative to... Dimensions are added together. Through learning... The label attention vector in the data packet representation, and based on the label portion in the data packet representation. The head label feature representation can be obtained by generating a weighted sum of the label and the label attention vector. and load label feature representation .

[0125] (3.2.6) Normalized unit

[0126] The normalization unit is used to represent the four features learned by the attention encoder. , , and After concatenation and normalization, a complete latent space representation (in the form of feature vectors) is formed, which yields the local features. :

[0127] (9);

[0128] in This indicates a dimension concatenation operation.

[0129] Considering the differences between industrial encrypted traffic and traditional network traffic, it is crucial to focus on the physical meaning of the encrypted traffic header and payload. This application decomposes encrypted traffic into header and payload information from a local perspective, thereby further enhancing the granularity of traffic feature extraction and overcoming the problems of poor adaptability to complex data, high training costs, and weak noise resistance associated with global feature extraction. Local feature extraction is based on a local joint attention feature extraction framework using data labels and header-payload. It captures the implicit correlation between the bytes of the current category of encrypted traffic and the category label from a local perspective, forming an attention feature scoring vector to characterize the detailed differences of encrypted traffic at the local granularity. This enables fine-grained representation of the header and payload at the level of byte feature importance.

[0130] (3.3) Feature Fusion Module

[0131] The feature fusion module is used to integrate the extracted global features. With local features Perform fusion and stitching processing to output fused features. :

[0132] (10).

[0133] The feature fusion module achieves fusion processing through dimensional concatenation, resulting in fused features. This is a high-dimensional Python array. Feature fusion, by summing global and local features under a fixed dimension, enriches the feature space representation of the extracted encrypted traffic, enhances the separability of heterogeneous encrypted traffic in a high-dimensional space, solves the problem of insufficient single-modal feature extraction, and thus ensures the learnability of the encrypted traffic byte distribution of subsequent deep detection networks. This improves the accuracy and reliability of encrypted malicious traffic detection and identification, and increases the execution efficiency of malicious behavior detection.

[0134] During the model training phase, the feature extraction network is trained and tested using a large amount of encrypted traffic and encrypted malicious traffic. Its network parameters are adjusted, and the trained feature extraction network can be directly used to extract encrypted traffic features from real-time network traffic. It is important to note that in the local feature extraction phase of the control domain, while extracting features from encrypted traffic, control device profile information is also constructed based on traffic and tag information for rapid matching of subsequent encrypted malicious traffic features.

[0135] Step 4: Match the encrypted traffic characteristics with the pre-stored encrypted malicious traffic characteristics. If the match is successful, determine that the current encrypted traffic is encrypted malicious traffic and block it.

[0136] This application pre-establishes an encrypted malicious traffic (also referred to as malicious traffic) signature database, primarily used to store abnormal traffic (encrypted malicious traffic) and encrypted malicious traffic signature data. It can be divided into an Internet (information threshold) encrypted malicious traffic signature database and an industrial control network (control domain) encrypted malicious traffic signature database. Malicious traffic signatures in the Internet (information threshold) encrypted malicious traffic signature database all carry corresponding protocol and port signature tags. Malicious traffic signatures in the industrial control network (control domain) encrypted malicious traffic signature database, in addition to protocol and port signature tags, also carry control device profile information tags, and are matched against the corresponding industrial control device profile information database based on the device profile information.

[0137] The fused features have learned the communication protocol type and corresponding port (or further include device profile information) of encrypted traffic through local feature extraction. Based on this information, it can be matched with malicious traffic features in the encrypted malicious traffic feature library to determine whether it is encrypted malicious traffic. If the feature match is successful, the encrypted malicious traffic is intercepted to prevent further transmission; if it does not match the features in the feature library, it is temporarily left unprocessed, and the fused features are input into the subsequent deep detection network for deep detection processing to classify the encrypted traffic. If it is malicious traffic, it is intercepted, and the extracted features are stored in the feature library; if it is non-malicious traffic, it is left unprocessed.

[0138] For industrial control network (control domain) devices, an industrial control device profile database has also been established. Industrial control devices (hereinafter referred to as devices) generally use proprietary protocols for communication, employing fixed ports during communication. Simultaneously, the communication data contains unique device tag information (device profile information). The device profile database is primarily built for new control devices accessing the network. During local feature extraction, the communication protocol, port information, and unique tag information (device profile information) of the control devices are extracted to establish the industrial control device profile database. The encrypted malicious traffic feature database stores a set of malicious traffic features, each with tag information. Malicious features with the same tag information can be considered a virtual encrypted malicious traffic feature sub-database, facilitating feature matching. The encrypted malicious traffic features in the industrial control network (control domain) encrypted malicious traffic feature database also carry device profile information tags. Each piece of information in the device profile database establishes a dynamic soft link relationship (one-to-many) with the malicious traffic features in the industrial control network encrypted malicious traffic feature database. Based on the device profile information, the specific control device attacked by encrypted malicious traffic can be quickly located, facilitating further verification and defense work.

[0139] After model training is complete, during real-time detection of encrypted malicious traffic, the encrypted traffic features are first extracted from the encrypted traffic to be detected, and then feature matching is performed. The matching process for encrypted traffic features in industrial control networks is as follows: Figure 4 As shown, it mainly includes:

[0140] 1) First, determine the extracted local features. If the device profile information contained therein is in the device profile information database, then the encrypted malicious traffic characteristics can be quickly located through a soft link. If the malicious traffic characteristics are matched, the encrypted malicious traffic will be immediately blocked. If the match is unsuccessful, proceed to step 2).

[0141] 2) If the device profile information extracted from local features is not in the device profile feature library, further encrypted traffic features will be extracted. The encrypted malicious traffic is matched against the encrypted malicious traffic feature library through a traversal method. If the match is successful, the malicious traffic is intercepted, the device profile information is stored in the device profile information library, and a soft link is established. If the match is unsuccessful, the encrypted traffic needs to be further detected by a subsequent deep detection network. If it is finally identified as encrypted malicious traffic, the extracted encrypted malicious traffic features are stored in the encrypted malicious traffic feature library, and a soft link is established with the device profile information.

[0142] The matching process of encrypted internet traffic characteristics is as follows: Figure 5 As shown, it mainly includes: fusing features The system matches the tag information (protocol and port) against encrypted malicious traffic features in the encrypted malicious traffic feature database. If a match is found, the traffic is considered malicious and is intercepted to prevent further transmission, and detection is stopped. If no match is found, the fused features are input into a subsequent deep detection network for classification, and the malicious traffic classification result is output. If the traffic is non-malicious, normal communication continues; if it is malicious, it is intercepted and blocked, and the new encrypted malicious traffic features are stored in the encrypted malicious traffic feature database.

[0143] Among them, the encrypted traffic features extracted from the industrial control network (control domain) are tagged with device profile information. During feature matching, the extracted encrypted traffic features and the constructed device profile information are quickly compared. The encrypted traffic feature tags extracted from the Internet (information domain) are mainly protocols and ports. During feature matching, the tag information extracted from the network is quickly compared with the encrypted malicious traffic features, which improves the comparison efficiency to a certain extent.

[0144] When features in an encrypted malicious traffic signature database lack labels, the fused features are often matched one-to-one with the features in the database through a traversal approach, which is inefficient. However, if the features in the database contain labels, and the network model can recognize these labels, the labels can be used to quickly locate and match the features, thus improving efficiency.

[0145] Step 5: If no match is found, input the encrypted traffic features into the trained deep detection network and output the encrypted traffic classification result; the encrypted traffic classification result is encrypted malicious traffic or non-malicious traffic.

[0146] After global and local feature extraction and fusion, the encrypted traffic features are compared with features in the Internet encrypted malicious traffic feature database. The locally extracted features include tags for Internet protocol type and corresponding port information, used for rapid malicious traffic feature matching.

[0147] If the device profile information is not in the device profile feature library, and the encrypted traffic features fail to match the pre-stored encrypted malicious traffic features, then the currently extracted encrypted traffic features need to be input into the trained deep detection network to identify whether it is malicious or non-malicious traffic.

[0148] See Figure 3 The deep detection network includes a serialization unit, a Transformer module (also known as a Transformer encoder), a fully connected layer, and a Softmax classifier.

[0149] The serialization unit is used to fuse features. After serialization, it is input into the Transformer module; serialization refers to... It is converted into a 1D sequence and used for the training and detection process of the subsequent Transformer module.

[0150] The Transformer module is used for depth detection of serialized features to extract deep features. Its depth detection process can be summarized as follows: segmenting serialized features into tokens → performing 1D (one-dimensional) learnable positional encoding → stacking 3 layers of "Sparse-Win-Transformer blocks" → the final layer CLS token is the extracted deep feature. In the Transformer encoder, a token refers to the basic unit of the input sequence. The CLS token, short for Classification Token, is a special token added at the beginning of the input sequence. It does not participate in the segmentation of the original data but acts as a "summator" or "global feature representation." After multiple Transformer layers, the vector representation of the CLS token in the last layer is used as the global or deep feature of the entire input sequence.

[0151] The fully connected layer is used to weight and fuse deep features and map them to the target dimension, serving as a key scoring vector for classification.

[0152] The Softmax classifier is used to convert the key score vector into class probabilities between 0 and 1, and outputs the encrypted traffic classification result based on the class probabilities. A class probability close to 0 is considered normal, while a probability close to 1 is considered abnormal, typically with 0.5 as the dividing line. If the class probability is less than 0.5, the final classification result is benign (non-malicious traffic), and the output value is represented by 0; if the class probability is greater than or equal to 0.5, the final classification result is malicious (encrypted malicious traffic), and the output value is represented by 1.

[0153] Step 6: Block the encrypted malicious traffic and store the corresponding encrypted traffic characteristics as encrypted malicious traffic characteristics.

[0154] The method proposed in this application can effectively detect and block encrypted malicious traffic from key layers outside or inside the ICS, preventing further attacks and penetration of the ICS system.

[0155] The method proposed in this application can extract features from encrypted traffic from both global and local perspectives, and then fuse these extracted features to achieve encrypted malicious traffic detection. For global feature extraction, an adaptive Inception component is introduced into the CNN network. By performing multiple convolution calculations and feature extractions on the input traffic grayscale data, the problem of insufficient learning ability of a single CNN for feature extraction is solved, enabling it to capture multi-scale features more flexibly. For local feature extraction, a local joint attention feature extraction framework based on data labels and header-payload is adopted to capture the implicit correlation between bytes and labels from a local perspective, thereby extracting the representation of encrypted malicious traffic data packets more accurately. Finally, feature fusion can enhance the representation characteristics of encrypted malicious traffic. Furthermore, when feature matching fails, a Transformer module is used for deep detection, improving the detection and identification efficiency of encrypted malicious traffic. This application enhances the feature extraction effect of encrypted traffic, reduces noise, improves the model's generalization ability, and improves the detection and security protection capabilities of encrypted malicious traffic in the industrial field.

[0156] This application incorporates byte data tags into the input for local feature extraction of encrypted malicious traffic. These tags carry features such as network protocols and communication ports. By calculating the similarity between these tag features and the input encrypted malicious traffic data, the application can more effectively identify the characteristic information of encrypted malicious traffic, improving the accuracy of feature recognition. Simultaneously, the output of local feature extraction synchronously outputs information such as network protocols, port tags, and industrial control equipment-specific tags for rapid matching of encrypted malicious traffic features. Particularly for encrypted malicious traffic in the control domain, local feature learning can construct a profile of the control device based on the data tags and encrypted malicious traffic features, facilitating feature matching of encrypted malicious traffic and precise location of attack targets.

[0157] The control domain encrypted traffic feature detection and identification method of this application fully considers the characteristic that malicious traffic is usually from north to south. Therefore, it only identifies and analyzes one-way encrypted traffic, which can reduce system overhead and ensure the control system latency requirements. The method proposed in this application provides a new approach for the security protection of ICS systems that adopt lightweight encryption technology in the future.

[0158] In one exemplary embodiment, this application also provides an encrypted malicious traffic detection system for an industrial control system, comprising: an encrypted traffic acquisition module for acquiring encrypted traffic communicating between different layers of the industrial control system; the layers of the industrial control system include a management layer / MES layer, a process monitoring layer, and a control layer; a data preprocessing module for preprocessing the encrypted traffic to extract key traffic data packets; an encrypted traffic feature extraction module for inputting the key traffic data packets into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features include global features, local features, and fused features; an encrypted traffic feature matching module for matching the encrypted traffic features with pre-stored encrypted malicious traffic features; if the match is successful, the current encrypted traffic is determined to be encrypted malicious traffic and blocked; an encrypted traffic classification module for inputting the encrypted traffic features into a trained deep detection network and outputting an encrypted traffic classification result if the match is unsuccessful; the encrypted traffic classification result is encrypted malicious traffic or non-malicious traffic; and an encrypted malicious traffic handling module for blocking the encrypted malicious traffic and storing the corresponding encrypted traffic features as encrypted malicious traffic features.

[0159] Based on the deployment location and the type of encrypted traffic collected, the encrypted malicious traffic detection system for industrial control systems can be further divided into encrypted malicious traffic detection subsystem 1 and encrypted malicious traffic detection subsystem 2. (See also...) Figure 2 The encrypted malicious traffic detection subsystem 1 is designed for detecting encrypted malicious traffic between internet information domains. The encrypted malicious traffic detection subsystem 2 is designed for detecting encrypted malicious traffic within the industrial control network (ICS) control domain. These subsystems are deployed serially within the ICS at the core nodes of data exchange between network layers to effectively detect network and data security attacks originating from external or internal sources within the industrial control system.

[0160] Based on this, the encrypted malicious traffic detection system of the industrial control system may also include a management and configuration module, which is mainly used to realize the general configuration management of the system, such as regular updates of the malicious traffic feature library, configuration of detection modes and detection protocol types of each subsystem, regular model training, user management, etc.

[0161] Building upon this, the encrypted malicious traffic detection system for the industrial control system may further include a visualization module, primarily responsible for the statistical calculation and visual display of the encrypted malicious traffic detection and analysis status of each subsystem. Specifically, it analyzes and displays data generated at each stage of the encrypted malicious traffic feature extraction and detection process, such as the number of protocols detected, the number of ports and IP addresses involved, the number of features extracted, the specific device types associated, the scale of communication traffic, the health status of the model, the amount of encrypted and unencrypted malicious traffic identified, newly extracted device profile information, and updates to the malicious traffic feature database.

[0162] In an exemplary embodiment, the operation of the encrypted malicious traffic detection system of the industrial control system is as follows: Figure 6 As shown, it specifically includes the following S1 to S5.

[0163] S1: Subsystem 1 and Subsystem 2 respectively collect encrypted traffic between the management layer / MES layer and the process monitoring layer, and between the process monitoring layer and the control layer.

[0164] S2: Each subsystem preprocesses the collected encrypted traffic by segmenting, cleaning, and standardizing its length to meet the data input requirements of the feature extraction network of each subsystem.

[0165] S3: The critical traffic data packets are input into a parallel feature extraction module for global and local feature extraction. The traffic is converted into a grayscale image and input into the global feature extraction channel. A CNN network with an adaptive Inception component is used for deep malicious feature extraction. The labeled encrypted traffic is divided into header data packets and payload data packets, which are vectorized separately and embedded into two joint embedding spaces. Feature extraction is then performed through a joint attention network. Finally, the globally and locally extracted features are fused.

[0166] S4: The merged features are matched with encrypted malicious traffic features in the encrypted malicious traffic feature library using tag information / device profile information. If it is malicious traffic, the malicious traffic is intercepted to prevent further transmission of encrypted malicious traffic and the detection is stopped.

[0167] S5: If a match is not found, the fused feature serialization is input into the Transformer module for deep detection, followed by classification using a Softmax classifier to output the malicious traffic classification result. If the traffic is non-malicious, normal communication continues; if the traffic is malicious, it is intercepted and blocked, and the new encrypted malicious traffic features are stored in the encrypted malicious traffic feature library.

[0168] This application addresses the network and data security issues of industrial control systems by proposing a method and system for detecting encrypted malicious traffic in industrial control systems. This method / system is mainly aimed at encrypted malicious traffic from the Internet and encrypted malicious traffic from industrial field control networks in industrial control systems. It can identify and intercept encrypted malicious traffic originating from various key levels within the industrial control system.

[0169] The encrypted malicious traffic detection method / system proposed in this application can extract features from encrypted malicious traffic from both global and local perspectives, and then fuse the extracted features to achieve encrypted malicious traffic detection. For global feature extraction, an adaptive Inception component is introduced into the CNN network. By performing multiple convolution calculations and feature extractions on the input grayscale traffic data, the problem of insufficient learning ability of a single CNN feature extraction method is solved, enabling it to capture multi-scale features more flexibly. For local feature extraction, a local joint attention feature extraction framework based on data labels and header-payload is adopted to capture the implicit correlation between bytes and labels from a local perspective, thereby extracting the characteristics of encrypted malicious data packets more accurately. Finally, feature fusion can enhance the representation characteristics of encrypted malicious traffic and improve the system's detection and identification efficiency for encrypted malicious traffic. This application enhances the feature extraction effect of encrypted traffic, reduces noise, and improves the model's generalization ability, thereby improving the detection and security protection capabilities of encrypted malicious traffic in the industrial field.

[0170] The Inception component introduced in this application is a three-channel parallel network with adaptive adjustment capabilities. It has an upper limit of three columns. The first column consists of a max-pooling layer and a 1×1 convolutional layer, which remain unchanged. The second and third columns use a random combination of 3×3 and 5×5 convolutional layers. The Inception component selects the optimal structure based on the feature learning performance and fine-tunes the structure accordingly.

[0171] This application incorporates byte data tags into the input for local feature extraction of encrypted malicious traffic. These tags carry features such as network protocols and communication ports. By calculating the similarity between these tag features and the input encrypted malicious traffic data, the application can more effectively identify the characteristic information of encrypted malicious traffic, improving the accuracy of feature recognition. Simultaneously, the output of local feature extraction uses synchronously output information such as network protocols, port tags, and industrial control equipment-specific tags for rapid matching of encrypted malicious traffic features. Particularly for encrypted malicious traffic in the control domain, local feature learning can construct a profile of the control device based on the data tags and encrypted malicious traffic features, facilitating feature matching of encrypted malicious traffic and precise location of attack targets.

[0172] The control domain encrypted traffic feature detection and identification process in this application fully considers the characteristic that malicious traffic usually flows from north to south, and only identifies and analyzes unidirectional encrypted traffic, which can reduce system overhead and ensure the latency requirements of the control system. The method / system proposed in this application provides a new approach for security detection of lightweight encryption algorithms used extensively in industrial control systems in the future, and has broad application prospects.

[0173] In one exemplary embodiment, this application also provides a computer device, which may be a server or a terminal. The computer device includes a processor, a memory, an input / output interface, and a communication interface. The processor, memory, and input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the encrypted malicious traffic detection method of the industrial control system described above.

[0174] In one exemplary embodiment, this application also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the encrypted malicious traffic detection method for the industrial control system described above.

[0175] In one exemplary embodiment, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the encrypted malicious traffic detection method for the industrial control system described above.

[0176] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by hardware related to computer program instructions. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any reference to memory or other media in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0177] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0178] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0179] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting encrypted malicious traffic of an industrial control system, characterized in that, The method comprises the following steps: Collecting encrypted traffic between layers of an industrial control system; the layers of the industrial control system comprise a management layer, an MES layer, a process monitoring layer and a control layer; wherein MES represents a manufacturing execution system; Preprocessing the encrypted traffic to extract key traffic data packets; Inputting the key traffic data packets into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features comprise global features, local features and fusion features; Matching the encrypted traffic features with pre-stored encrypted malicious traffic features; if the matching is successful, it is determined that the current encrypted traffic is encrypted malicious traffic and is blocked; The feature extraction network includes a global feature extraction module, a local feature extraction module, and a feature fusion module; the global feature extraction module includes a grayscale image conversion unit and a CNN-Inception network; the grayscale image conversion unit is used to convert key traffic data packets... The pcap format file is converted to Npy format and normalized before being converted into a grayscale image, which is then used as input to the CNN-Inception network. The CNN-Inception network is used to extract global features from the input grayscale image. The local feature extraction module is used to extract features from labeled encrypted traffic. Extracting local features The feature fusion module is used to integrate global features. With local features Perform fusion and stitching processing to output fused features. ; If the matching is not successful, inputting the encrypted traffic features into a trained deep detection network to output an encrypted traffic classification result; the encrypted traffic classification result is encrypted malicious traffic or non-malicious traffic; Blocking the encrypted malicious traffic and storing the corresponding encrypted traffic features as encrypted malicious traffic features. The preprocessing of the encrypted traffic to extract key traffic data packets comprises the following steps:

2. The method of claim 1, wherein the malicious encrypted traffic detection method of an industrial control system is characterized by, The CNN-Inception network comprises a convolution layer, a pooling layer, an adaptive Inception component and a feature fusion conversion unit connected in sequence: Splitting and cleaning the data packets of encrypted traffic to extract a set of valid information ; wherein represents the source port and the destination port of the communication; represents the communication protocol; represents the data packet length; is the extracted key traffic data packet; wherein is the valid encrypted traffic after removing the redundancy and useless information; is the labeled encrypted traffic; wherein is the header traffic, is the payload traffic, is the label information; for the encrypted traffic in the Internet, the extracted label information is the Internet communication protocol and the corresponding common port; for the encrypted traffic in the industrial control network, the extracted label information is the dedicated industrial control protocol, the corresponding common port and the device portrait information; The length of the key traffic data packet is unified to the optimal byte length, and the byte in the key traffic data packet is converted to an integer between 0 and 255.

3. The method of claim 1, wherein the malicious encrypted traffic detection of the industrial control system is characterized by, The input grayscale image is subjected to a certain number of convolution layers and pooling layers of different sizes to preliminarily learn and extract features of the encrypted traffic converted into a grayscale image, and a preliminary feature map is extracted; The preliminary feature map is input into the adaptive Inception component to capture different scale features of the encrypted traffic through parallel convolution layers and pooling layers, and a multi-scale feature map is output; The local feature extraction module comprises a byte sequence conversion unit, a data embedding unit, a position encoding unit, a similarity calculation unit, an encoding unit and a normalization unit; The multi-scale feature maps are input to a feature fusion conversion unit for fusion, and a reshape function is used to convert the multi-scale feature maps into one-dimensional feature vectors as the extracted global features .

4. The method of claim 1, wherein the malicious encrypted traffic detection method of an industrial control system is characterized by, The encoding unit comprises a byte attention encoder and a label attention encoder; The byte sequence conversion unit is configured to convert the labeled encrypted traffic into a byte sequence vector ; wherein denotes the th byte; is the number of bytes of the header traffic; is the total number of bytes of the header traffic and the payload traffic; denotes the th label; is the number of labels; The data embedding unit is configured to embed each byte and each label into two joint embedding spaces respectively, map the byte to a byte embedding vector , and map the label to a label embedding vector ; the byte embedding vector includes a head vector and a payload vector. The position encoding unit respectively position encodes the head vector and the payload vector to embed the byte into the vector updating to an encoded vector ; The similarity calculating unit is configured to calculate a cosine similarity between the encoded vector and the label embedding vector The similarity calculating unit is configured to calculate a cosine similarity between the encoded vector and the label embedding vector The similarity calculating unit is configured to calculate a cosine similarity between the encoded vector and the label embedding vector The similarity calculating unit is configured to calculate a cosine similarity between the encoded vector and the label embedding vector The similarity calculating unit is configured to calculate a cosine similarity between the encoded vector and the label embedding vector The deep detection network comprises a serialization unit, a Transformer module, a fully connected layer and a Softmax classifier; The byte attention encoder is based on a byte label similarity matrix generating a header byte feature representation and a payload byte feature representation The label attention encoder is based on a byte label similarity matrix generating a header label feature representation and a payload label feature representation ; The normalization unit is used to splice and normalize four feature representations , , and After the splicing and normalization, local features are formed.

5. The method of claim 1, wherein the malicious encrypted traffic detection of the industrial control system is characterized by, The serialization unit is used to serialize the fusion features and input them into the Transformer module; The Transformer module is used to perform deep detection on the serialized features to extract deep features; The fully connected layer is used to weight and fuse the deep features and map them to a target dimension as a key score vector for classification; The Softmax classifier is used to convert the key score vector into a class probability between 0 and 1, and output an encrypted traffic classification result according to the class probability. The method comprises the following steps:

6. An encrypted malicious traffic detection system of an industrial control system, characterized by, An encrypted traffic collection module is configured to collect encrypted traffic between layers of an industrial control system; The layers of the industrial control system comprise a management layer, an MES layer, a process monitoring layer and a control layer; wherein MES represents a manufacturing execution system; A data preprocessing module is configured to preprocess the encrypted traffic to extract key traffic data packets; An encrypted traffic feature extraction module is configured to input the key traffic data packets into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features comprise global features, local features and fusion features; An encrypted traffic feature extraction module is configured to input the key traffic data packets into a trained feature extraction network to extract encrypted traffic features; the encrypted traffic features comprise global features, local features and fusion features; The feature extraction network includes a global feature extraction module, a local feature extraction module, and a feature fusion module; the global feature extraction module includes a grayscale image conversion unit and a CNN-Inception network; the grayscale image conversion unit is used to convert key traffic data packets... The pcap format file is converted to Npy format and normalized before being converted into a grayscale image, which is then used as input to the CNN-Inception network. The CNN-Inception network is used to extract global features from the input grayscale image. The local feature extraction module is used to extract features from labeled encrypted traffic. Extracting local features ; The feature fusion module is configured to perform fusion splicing processing on the global feature and the local feature , and output fused features ; The encrypted traffic feature matching module is configured to match the encrypted traffic feature with the pre-stored encrypted malicious traffic feature, and if the matching is successful, determine that the current encrypted traffic is encrypted malicious traffic and block the encrypted malicious traffic. The encrypted traffic classification module is configured to input the encrypted traffic feature into the trained deep detection network if the matching is not successful, and output an encrypted traffic classification result; the encrypted traffic classification result is encrypted malicious traffic or non-malicious traffic. The encrypted malicious traffic processing module is configured to block the encrypted malicious traffic and store the corresponding encrypted traffic feature as an encrypted malicious traffic feature.

7. A computer device comprising: The memory, the processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the encrypted malicious traffic detection method of the industrial control system in any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the encrypted malicious traffic detection method of the industrial control system in any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the encrypted malicious traffic detection method of the industrial control system in any one of claims 1 to 5.

Images