Industrial control operation and maintenance instruction real-time risk detection method and system based on double-engine cooperation

Abstract

The invention discloses an industrial control operation and maintenance instruction real-time risk detection method and system based on double-engine cooperation, relates to the technical field of industrial control system security, and aims to solve the problem of low security of industrial control network control. The method comprises the following steps: collecting an operation and maintenance instruction in an industrial control network in real time, and performing protocol analysis on the operation and maintenance instruction to perform semantic reduction to obtain an operation event; analyzing the operation event by utilizing a rule inference engine, and judging whether the operation event violates a predefined rigid rule or not; if yes, outputting the highest risk level and terminating the process; if not, turning to the next step; analyzing the operation event by utilizing a dynamic behavior analysis engine, and calculating an abnormal deviation score of a next operation event of the target equipment corresponding to the operation event; and mapping the abnormal deviation degree score into a risk level, and outputting a final detection result. Rapid compliance judgment and deep behavior analysis of the industrial control operation and maintenance instruction can be realized, and both the detection efficiency and the detection accuracy are considered.

Description

TECHNICAL FIELD

[0002] The present application relates to the technical field of industrial control system security, and in particular to an industrial control operation and maintenance instruction real-time risk detection method and system based on double-engine cooperation. BACKGROUND

[0004] Industrial control system (ICS, Industrial Control System) is the core system supporting power, petrochemical, manufacturing and other key infrastructures, and its security directly affects the national economy and public safety. However, with the complication and remote of operation and maintenance, the risk of operation and maintenance instruction abuse, abnormal operation and malicious instruction injection is increasing.

[0005] The existing industrial control security technology mainly has two types, rule matching type detection: usually relying on static whitelist or fixed threshold rule, quickly judging whether the operation and maintenance instruction is compliant. But this kind of method lacks the perception ability of real-time environment, and is easy to misjudge and miss. For example, in some specific working conditions, the instruction that should be allowed may be mistakenly blocked, or the dangerous instruction is not identified.

[0006] Behavior analysis type detection: based on statistical analysis or machine learning, modeling and detecting abnormal operation and maintenance behavior. But this kind of method often has high computational complexity, and lacks immediate blocking mechanism for obvious violation of high-risk instructions, which is easy to cause safety risk.

[0007] Therefore, the existing technology has the problems of "single detection, insufficient real-time, low context sensitivity", and there is an urgent need for a detection method that can integrate rules and behaviors, and at the same time consider fast response and deep perception. SUMMARY

[0009] Therefore, the present application aims to provide an industrial control operation and maintenance instruction real-time risk detection method based on double-engine cooperation, which can improve the safety of industrial control equipment operation process.

[0010] To achieve the above-mentioned purpose, the present application adopts the following technical scheme: an industrial control operation and maintenance instruction real-time risk detection method based on double-engine cooperation, comprising the following steps:

[0011] Step S1, real-time collection of operation and maintenance instructions in the industrial control network, performing protocol analysis and semantic restoration on the operation and maintenance instructions to obtain operation events;

[0012] Step S2, providing a rule reasoning engine, analyzing the operation events by using the rule reasoning engine, and judging whether the operation events violate the pre-defined rigid rules; if yes, output the highest risk level and terminate the process; if not, go to step S3;

[0013] Step S3, providing a dynamic behavior analysis engine, analyzing the operation event by using the dynamic behavior analysis engine, and calculating an abnormal deviation score of a next operation event of the target device corresponding to the operation event;

[0014] Step S4, mapping the abnormal deviation score to a risk level, and outputting a final detection result.

[0015] In a preferred embodiment, the operation event is represented by the following formula:

[0016] ;

[0017] In the formula, E is a normalized operation event, represents an operation source, represents a target device, represents an operation instruction, represents a timestamp.

[0018] In a preferred embodiment, the analyzing the operation event by using the rule reasoning engine to determine whether the operation event violates a predefined rigid rule specifically includes:

[0019] S21, obtaining multi-dimensional system environment data and industrial control knowledge graph of the target device;

[0020] S22, in a rule set below, the operation event is simultaneously conditionally matched with the environment data and the industrial control knowledge graph to determine whether the rigid rule is violated, which is represented by the following formula:

[0021] ;

[0022] In the formula, represents a determination result, and output 1 indicates that the rule is violated; E is an operation event; is environment data; is an industrial control knowledge graph.

[0023] In a preferred embodiment, the analyzing the operation event by using the dynamic behavior analysis engine to calculate an abnormal deviation score of a next operation event of the target device corresponding to the operation event specifically includes:

[0024] S31, constructing a multi-dimensional context sequence of the target device in a recent time window;

[0025] S32, inputting the multi-dimensional context sequence to a pre-trained normal behavior baseline model;

[0026] S33, the pre-trained normal behavior baseline model predicts the probability distribution of the next expected operation event and system state in a given historical context based on learning from historical sequences, and calculates an abnormal deviation score.

[0027] In a preferred embodiment, the abnormal deviation score is calculated by weighting the operation semantic abnormality score and the state evolution abnormality score, and is represented by the following formula:

[0028] ;

[0029] In the formula, is the abnormal deviation score; is the operation semantic abnormality score, which measures the deviation between the current instruction and the predicted operation; is the state evolution abnormality score, which measures the deviation between the current system state and the predicted system state evolution trend; and are preset weight coefficients, and .

[0030] In a preferred embodiment, the training process of the pre-trained normal behavior baseline model includes:

[0031] Collecting a historical normal operation and maintenance multi-modal time series data set;

[0032] Training the sequence using a multi-modal fusion-based supervised learning method, jointly encoding the historical operation instruction and system state sequence, taking the same historical multi-modal context as input, and cooperatively predicting the operation instruction and system state at the next time, to obtain a cooperative prediction loss;

[0033] Minimizing the cooperative prediction loss to complete model training.

[0034] In a preferred embodiment, the rule reasoning engine and the dynamic behavior analysis engine are decoupled in architecture, and data interaction and process triggering are realized through a standardized API interface.

[0035] The application also provides an industrial control operation and maintenance instruction real-time risk detection system based on double-engine cooperation, comprising:

[0036] A data acquisition module for real-time acquisition of operation and maintenance instruction traffic in an industrial control network, performing protocol analysis and semantic restoration to obtain standardized operation events;

[0037] A rule reasoning engine for receiving operation events from the data acquisition module, combining target device real-time environment data and industrial control knowledge graph for logical reasoning and judgment, and if the event violates the predefined rigid rules, directly outputting the highest risk level and terminating the process, if not, forwarding the operation event to the dynamic behavior analysis engine.

[0038] a dynamic behavior analysis engine configured to receive an operation event from the rule inference engine, extract a multi-dimensional context sequence of the target device corresponding to the operation event in a recent time window from the historical log, and calculate an abnormal deviation score of a next operation event based on a pre-trained normal behavior baseline model; and

[0039] a risk assessment and alarm module configured to map the deviation score output by the dynamic behavior analysis engine into a risk level, output the risk level of the operation event and alarm for a high risk level.

[0040] Compared with the prior art, the present application has the following beneficial effects: compared with the prior art of only analyzing the instruction itself or using static rules, the present application introduces real-time system environment context through a knowledge graph and deeply understands the coupling relationship between “operation-state” through a multi-modal joint prediction model, which significantly reduces the false positive rate and can accurately identify hidden operations that constitute risks only in a specific system state. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 A flow chart of a real-time risk detection method for industrial control operation and maintenance instructions based on double-engine cooperation according to a preferred embodiment of the present application.

[0043] Figure 2 A block diagram of a real-time risk detection system for industrial control operation and maintenance instructions based on double-engine cooperation according to a preferred embodiment of the present application. DETAILED DESCRIPTION

[0045] The present application will be further described below in conjunction with the accompanying drawings and embodiments.

[0046] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise indicated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application pertains.

[0047] It should be noted that the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and furthermore, it should be understood that when the terms “comprise” and / or “include” are used in the present specification, they indicate the presence of a feature, step, operation, device, component and / or combination thereof.

[0048] The application provides a kind of based on double engine collaborative industrial control operation and maintenance instruction real-time risk detection method and system, by knowledge graph introduction real-time system environment context, and by multimodal joint prediction model in-depth understanding of the coupling relationship between " operation-state", significantly reduce the false positive rate, can accurately identify those in specific system state only constitute risk hidden operation;Through rule engine, known high-risk operation is quickly intercepted in advance, greatly reduce the calculation load of rear-end complex model, realize the millisecond level response to explicit threat;Meanwhile, behavior engine carries out depth analysis to unknown and complex threat, and the real-time and accuracy of detection are considered.

[0049] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0050] The embodiments of the present application will be described in further detail below with reference to the drawings of the specification. Please refer to Figure 1 :

[0051] Step S1, real-time collection of operation and maintenance instructions in industrial control network, performing protocol analysis on the operation and maintenance instructions to restore semantics and obtain operation events.

[0052] Among them, the protocol analysis uses a protocol parser to analyze various industrial protocols (such as Modbus, OPC-UA, DNP3, etc.). The standardized event is represented by the following formula:

[0053] : ;

[0054] In the formula, E is a standardized operation event, represents the operation source, represents the target device, represents the operation instruction, represents the timestamp.

[0055] Step S2, providing a rule reasoning engine, analyzing the operation events using the rule reasoning engine to determine whether the operation events violate predefined rigid rules; if yes, output the highest risk level and terminate the process; if not, go to step S3.

[0056] Among them, the operation events are analyzed using the rule reasoning engine to determine whether the operation events violate predefined rigid rules, specifically including:

[0057] S21, acquire multi-dimensional system environment data and industrial control knowledge graph of the target device.

[0058] The multi-dimensional system environment data is real-time data, which can be represented as The multi-dimensional system environment data includes sensor readings, state signals of logically related devices, system operation modes, etc.

[0059] The industrial control knowledge graph includes device operation dependency relationship , process parameter interlocking logic and safety operation permission set , and can be represented as , wherein is a device / parameter entity set, is a set of logical relationships and constraints between entities.

[0060] S22, under the rule set , the operation event is simultaneously matched with the environment data and the industrial control knowledge graph, and it is judged whether the rigid rule is violated, which is represented by the following formula:

[0061] ;

[0062] In the formula, represents the judgment result, and output 1 indicates that the rule is violated; E is the operation event; is the environment data; is the industrial control knowledge graph.

[0063] Step S3, a dynamic behavior analysis engine is provided, and the operation event is analyzed by using the dynamic behavior analysis engine to calculate the abnormal deviation score of the next operation event of the target device corresponding to the operation event.

[0064] The dynamic behavior analysis engine is used to analyze the operation event and calculate the abnormal deviation score of the next operation event of the target device corresponding to the operation event, which specifically includes the following steps:

[0065] S31, a multi-dimensional context sequence of the target device in the recent time window is constructed.

[0066] The target device is taken as a dimension, and the instruction sequence in the recent time window is extracted from the instruction sequence log: , wherein is the last executed operation and maintenance instruction (i.e. the last executed instruction) of the target device at time t; meanwhile, the system environment snapshot data corresponding to each instruction in the sequence is associated and extracted: , wherein, Target device Execute operation and maintenance instructions System environment snapshot data (a multi-dimensional vector containing sensor readings, related device states, running modes, etc.) at the time; thus constructing a multi-modal time sequence sequence that integrates operation semantics and system state: , where each item is a "operation instruction-environment state" pair, serving as the context for current behavior analysis.

[0067] Device instruction sequence logs and their associated system environment snapshot data support target devices Fast acquisition of multi-dimensional context sequences.

[0068] S32, input the multi-dimensional context sequence to the pre-trained normal behavior baseline model.

[0069] Specifically, the operation event instruction to be detected at present and its real-time environment data are input to the pre-trained normal behavior baseline model together with the context multi-modal sequence .

[0070] The pre-trained normal behavior baseline model can be any time series prediction model based on LSTM, Transformer, etc., and its specific training process includes:

[0071] 1) Collect multi-modal time sequence data sets during historical normal operation and maintenance. The multi-modal time sequence data set includes N samples , each sample has w consecutive operation instruction sequences and corresponding system environment state sequences:

[0072] ;

[0073] where i represents a certain sample.

[0074] 2) Use a multi-modal fusion-based supervised learning method to train the sequence, jointly encode the historical operation instruction and system state sequence, and input the same historical multi-modal context to cooperatively predict the operation instruction and system state at the next time , and the objective function is to minimize the weighted sum of operation prediction loss and state prediction loss.

[0075] 3) Minimize the cooperative prediction loss to complete model training, so that the model can learn the implicit coupling relationship and joint evolution mode between operation instructions and system environment states in normal operation and maintenance behavior.

[0076] S33, the pre-trained normal behavior baseline model predicts the probability distribution of the next expected operation event and system state in a given historical context based on learning of historical sequences, and calculates an abnormal deviation degree score.

[0077] wherein the abnormal deviation score is calculated by weighting the operation semantic abnormal score and the state evolution abnormal score, and is represented by the following formula:

[0078] ;

[0079] In the formula, is an abnormal deviation score; is an operation semantic abnormal score, used to measure the deviation between the current instruction and the predicted operation; is a state evolution abnormal score, used to measure the deviation between the current system state and the predicted system state evolution trend; and are preset weight coefficients, and .

[0080] Step S4, mapping the abnormal deviation degree score to a risk level, and outputting a final detection result.

[0081] The abnormal deviation degree score is converted to a risk level by a piecewise function or a Sigmoid mapping function : , is a risk level mapping function.

[0082] The rule reasoning engine and the dynamic behavior analysis engine are decoupled in architecture, and data interaction and process triggering are realized through a standardized API interface.

[0083] The basic idea of the method in the application is to collect operation and maintenance instruction traffic in an industrial control network in real time, perform protocol analysis and semantic restoration to obtain standardized operation events; input the operation events into a rule reasoning engine, perform logical reasoning and judgment in combination with target device real-time environment data and industrial control knowledge graph, if a predefined rigid rule is violated, directly output the highest risk level and terminate the process; if not, forward the operation events to a dynamic behavior analysis engine; the dynamic behavior analysis engine constructs a multi-dimensional context sequence of the target device within a recent time window based on a pre-trained normal behavior baseline model, calculates an abnormal deviation degree score; map the dynamic abnormal deviation degree score to a risk level, and output a final detection result. Through the rule engine, known high-risk operations are first intercepted quickly, greatly reducing the calculation load of the rear-end complex model, and achieving millisecond-level response to explicit threats; at the same time, the behavior engine performs in-depth analysis on unknown and complex threats, taking into account the real-time and accuracy of detection. ​

[0084] Referring to Figure 2 The application further discloses a real-time risk detection system for industrial control operation and maintenance instructions based on double-engine cooperation, comprising a data acquisition module, a rule reasoning engine, a dynamic behavior analysis engine and a risk assessment and alarm module.

[0085] The data acquisition module is configured to acquire operation instruction traffic in an industrial control network in real time, perform protocol analysis and semantic restoration, and obtain standardized operation events.

[0086] The rule reasoning engine is configured to receive operation events from the data acquisition module, perform logical reasoning and judgment in combination with target device real-time environment data and an industrial control knowledge graph, directly output a highest risk level and terminate the process if the events violate predefined rigid rules, or forward the operation events to the dynamic behavior analysis engine if the events do not violate the predefined rigid rules.

[0087] The dynamic behavior analysis engine is configured to receive operation events from the rule reasoning engine, extract a multi-dimensional context sequence of a target device corresponding to the operation events in a recent time window from historical logs, and calculate an abnormal deviation score of a next operation event based on a pre-trained normal behavior baseline model.

[0088] The risk assessment and alarm module is configured to map the deviation score output by the dynamic behavior analysis engine into a risk level, output a risk level of operation and maintenance instructions in the operation events, and alarm a high risk level.

[0089] In the embodiments provided in the present application, it should be understood that the disclosed system and method can be implemented in other manners. For example, the system embodiments described above are only schematic; the division of the modules or units is only a logical function division, and there can be another division manner in actual implementation; for example, a plurality of units or modules can be combined or integrated into another system.

[0090] Although the present application is described herein in conjunction with various embodiments, other variations of the disclosed embodiments can be understood and implemented by those skilled in the art with reference to the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "one" does not exclude a plurality. A single processor or other unit can implement several functions listed in the claims. Measures described in mutually different dependent claims can be combined and produce beneficial results.

[0091] Although the present application has been described in connection with the preferred embodiments thereof with reference to the specific content thereof, it will be apparent to those skilled in the art that various modifications and changes can be made thereto without departing from the spirit and scope of the application. Accordingly, it is intended that the present application cover all such modifications and changes as fall within the scope of the application, along with all equivalents thereof. It will be understood by those within the art that, in general, terms used herein, and especially to the immediately preceding description and claims attached hereto, are intended to be given their broadest interpretation consistent with the specification and the patent statutes.

Claims

1. A method for real-time risk detection of industrial operation and maintenance instructions based on double-engine cooperation, characterized in that, Comprise the following steps: Step S1, real-time collection of operation and maintenance instructions in the industrial control network, performing protocol analysis and semantic restoration on the operation and maintenance instructions to obtain operation events; Step S2, providing a rule reasoning engine, using the rule reasoning engine to analyze the operation events, and determining whether the operation events violate the pre-defined rigid rules; if yes, output the highest risk level and terminate the process; If no, go to step S3; Step S3, providing a dynamic behavior analysis engine, using the dynamic behavior analysis engine to analyze the operation events, and calculating the abnormal deviation score of the next operation event of the target device corresponding to the operation events; Step S4, mapping the abnormal deviation score to a risk level, and outputting the final detection result. 2.The double-engine cooperative-based industrial control operation and maintenance instruction real-time risk detection method according to claim 1, characterized in that, The operation event is represented by the following formula: ; where E is a normalized operation event, represents an operation source, represents a target device, represents an operation instruction, represents a timestamp.

3. The method according to claim 1, wherein, The operation event is analyzed by using the rule reasoning engine to determine whether the operation event violates a predefined rigid rule, specifically comprising: S21, obtaining multi-dimensional system environment data and industrial control knowledge graph of a target device; S22, performing conditional matching of the operation event with the environment data and the industrial control knowledge graph in a rule set Below, the operation event is simultaneously subjected to conditional matching with the environment data and the industrial control knowledge graph to determine whether the rigid rule is violated, which is represented by the following formula: ; in the formula, represents a judgment result, and output 1 indicates that the rule is violated; E is an operation event; is environment data; is an industrial control knowledge graph.

4. The method according to claim 1, wherein, The use of the dynamic behavior analysis engine to analyze the operation events and calculate the abnormal deviation score of the next operation event of the target device corresponding to the operation events specifically includes: S31, constructing a multi-dimensional context sequence of the target device in the recent time window; S32, inputting the multi-dimensional context sequence into a pre-trained normal behavior baseline model; S33, the pre-trained normal behavior baseline model predicts the probability distribution of the next expected operation event and system state based on the learning of historical sequences in a given historical context, and calculates the abnormal deviation score.

5. The method according to claim 4, wherein, The abnormal deviation score is calculated by weighting the operation semantic abnormal score and the state evolution abnormal score, and is represented by the following formula: ; wherein, is the abnormal deviation score; is the operation semantic abnormal score, used to measure the deviation between the current instruction and the predicted operation; is the state evolution abnormal score, used to measure the deviation between the current system state and the predicted system state evolution trend; and is a preset weight coefficient, and .

6. The method according to claim 4, wherein, The training process of the pre-trained normal behavior baseline model includes: collecting a multi-modal time sequence dataset during historical normal operation and maintenance; using a multi-modal fusion-based supervised learning method to train the sequence, jointly encoding the historical operation instructions and system state sequences, taking the same historical multi-modal context as input, and cooperatively predicting the operation instructions and system state at the next time, obtaining a cooperative prediction loss; minimizing the cooperative prediction loss to complete model training.

7. The method according to claim 1, wherein, The rule reasoning engine and the dynamic behavior analysis engine are decoupled in architecture, and data interaction and process triggering are realized through standardized API interfaces.

8. A double-engine cooperative-based industrial control operation and maintenance instruction real-time risk detection system, characterized in that, Comprise: A data acquisition module for real-time acquisition of operation and maintenance instruction traffic in an industrial control network, performing protocol analysis and semantic restoration to obtain standardized operation events; A rule reasoning engine for receiving operation events from the data acquisition module, combining target device real-time environment data and industrial control knowledge graph for logical reasoning and judgment, if the event violates the pre-defined rigid rules, directly output the highest risk level and terminate the process, if not, forward the operation event to the dynamic behavior analysis engine; A dynamic behavior analysis engine for receiving operation events from the rule reasoning engine, extracting the multi-dimensional context sequence of the target device corresponding to the operation events in the recent time window from the historical log, and calculating the abnormal deviation score of the next operation event based on the pre-trained normal behavior baseline model; And A risk assessment and alarm module for mapping the deviation score output by the dynamic behavior analysis engine to a risk level, outputting the risk level of the operation and maintenance instruction in the operation event and alarming for high risk level.

Images