PLC closed-loop trusted operation method and system based on state awareness and dynamic strategy

Abstract

The application discloses a PLC closed-loop trusted operation method and system based on state awareness and dynamic strategy, and comprises the following steps: based on a hardware trust root, the integrity of Bootloader, an operating system and a PLC runtime is verified level by level to control the power-on of the PLC and start the operating system and the PLC runtime; a dynamic measurement module is used to periodically measure the user service logic of the PLC operation, and a state awareness module is used to collect the internal state and external context of the control system in real time; a historical time sequence window data is constructed, a plurality of dynamic parameters of the current moment are generated after time sequence feature extraction by using an LSTM; a nonlinear scoring model is constructed, the internal state score, the external context score and the service logic score of the dynamic change are calculated in real time by combining the plurality of dynamic parameters, and the total trusted score is obtained; and a response strategy is dynamically selected based on the total trusted score. The application can ensure the safety and trustworthiness of the system, maximize the availability and functional safety of the control system, and realize the consideration of safety and efficiency.

Description

Technical Field

[0001] This invention belongs to the field of information security of industrial control systems, and in particular relates to a PLC closed-loop reliable operation method and system based on state perception and dynamic strategy. Background Technology

[0002] Information security in industrial control systems covers critical infrastructure sectors such as transportation, energy, and manufacturing. As a core component of industrial control systems, PLCs (Programmable Logic Controllers) undertake critical tasks such as equipment control, data acquisition, and logic operations. The safe and stable operation of PLCs is directly related to production continuity and functional safety in industrial settings.

[0003] However, with the popularization of the Industrial Internet, the connection between PLC systems and external networks is becoming increasingly close, and the cybersecurity threats they face are becoming more and more severe. Cyber ​​attackers may use methods such as PLC industrial protocol message attacks, DoS / DDOS attacks, and buffer overflows to interfere with or disrupt the normal operation of industrial control systems, leading to production interruptions, equipment damage, or even safety accidents. At the same time, PLC systems also face internal risks such as default configuration vulnerabilities and malicious code injection, as well as complex security challenges brought about by supply chain security and the introduction of new functions. Against this backdrop, a secure and reliable industrial control system is particularly important.

[0004] The existing protection approaches and methods for PLC startup and operation phases, namely "static startup verification" and "fixed runtime strategy protection," lack sufficient adaptability, leading to the following deficiencies in safe production:

[0005] (1) Risk of chain trust breakdown:

[0006] After the PLC is started, the existing trust chain technology cannot cope with the normal changes caused by the dynamic adjustment of business control logic and the fine-tuning of legitimate configurations after the PLC system is running. This can easily lead to the system "misjudging" that there is a fault in the safety detection system, forcing the system to shut down the safety detection, causing a substantial break in the trust chain, and thus leading to the risk of safety production accidents.

[0007] (2) The separation between protection and control:

[0008] Dynamic measurement technologies during operation typically take rigid measures such as interruption and stop upon detecting tampering, lacking the real-time, continuous, and safety considerations required in PLC control. This neglects the functional safety and continuous production requirements of industrial control systems, and safety protection actions may directly lead to production accidents.

[0009] (3) Lack of intelligent response capability:

[0010] Due to the complexity of industrial control systems (ICS), their real-time changing operational status, and the variety of external attack methods, existing anomaly handling strategies have significant limitations. Many of these strategies are preset and fixed (such as stopping operation or triggering alarms), failing to provide dynamic and tiered responses based on the criticality level of the compromised object, the system's real-time operational status, and the potential impact of the attack. This can easily lead to over-protection affecting production, or insufficient protection allowing threats to spread further, posing a significant threat to the safe and stable operation of industrial control systems.

[0011] Therefore, there is an urgent need in this field for a closed-loop trusted solution that can deeply integrate trusted protection with the normal operation of the control system and has dynamic perception and intelligent decision-making capabilities. Summary of the Invention

[0012] This invention provides a PLC closed-loop reliable operation method and system based on state awareness and dynamic strategy, which can ensure the safety and reliability of the system while maximizing the availability and functional safety of the control system, thus achieving a balance between safety and efficiency.

[0013] A PLC closed-loop reliable operation method based on state awareness and dynamic strategy includes:

[0014] (1) Based on the hardware root of trust, verify the integrity of the Bootloader, operating system and PLC runtime step by step to control the PLC to power on and start the operating system and PLC runtime;

[0015] (2) After the operating system and PLC start running, the dynamic measurement module periodically measures the user business logic running the PLC, and the status perception module collects the internal status and external context of the control system in real time.

[0016] Among them, the indicators included in user business logic are status monitoring degree and user logic integrity; the indicators included in internal status are CPU load, memory usage, and task scheduling cycle stability; and the indicators included in external context are the legality of the host computer's instruction sequence, abnormal network communication patterns, and the rationality of sensor readings.

[0017] (3) Construct historical time series window data. The vector at each time point contains the normalized values ​​of 8 indicators. After extracting time series features using LSTM, multiple dynamic parameters for the current time are generated.

[0018] (4) Construct a nonlinear scoring model, receive 8 indicators at the current time, combine them with the corresponding multiple dynamic parameters, calculate the dynamically changing internal state score, external context score and business logic score in real time, and further obtain the total credibility score;

[0019] (5) Dynamically select response strategies based on total credibility score.

[0020] The specific process of step (1) is as follows:

[0021] Based on the hardware root of trust, the integrity of the bootloader is verified. If the verification is successful, the PLC is powered on and the bootloader is started simultaneously. If the verification fails, the startup is terminated.

[0022] After the PLC is powered on, the bootloader loads the operating system and PLC runtime. During the loading process, the integrity of the operating system and PLC runtime is verified. If the verification passes, the operating system and PLC runtime are started. If the verification fails, the startup of the operating system and PLC runtime is terminated.

[0023] In step (3), after extracting temporal features using LSTM, multiple dynamic parameters for the current time are generated, specifically:

[0024] LSTM is used to process historical time-series window data and output a hidden state vector. and cell state ; implied state Multiple dynamic parameters for the current time step are generated through several parallel fully connected layers, including sensitivity coefficients. Instruction exception penalty coefficient Network anomaly penalty coefficient Sensor anomaly penalty coefficient and smoothing factor .

[0025] In step (4), the formula for calculating the internal state fraction is:

[0026] ;

[0027] ;

[0028] ;

[0029] ;

[0030] ;

[0031] In the formula, Linear fundamental components representing internal states, Represents the sensitivity coefficient. Indicates the base offset. , , These are the weighting coefficients. ; CPU load score The score represents memory usage. The task cycle stability score; This represents the CPU load value. CPU load threshold; This is the memory usage value. This is the memory usage threshold; The standard deviation of the most recent multiple task cycles, This is the stable attenuation coefficient.

[0032] In step (4), the formula for calculating the external context score is:

[0033] ;

[0034] ;

[0035] ;

[0036] ;

[0037] In the formula, This is the penalty coefficient for instruction exceptions. This represents the network anomaly penalty coefficient. This is the penalty coefficient for sensor anomalies; For sequence anomaly degree, For network communication anomaly degree, The degree of sensor reading anomaly; This refers to the number of abnormal access commands from the host computer within a specified time period T. The total number of host computer access commands within a specified time period T; The number of abnormal network packets received by the PLC within a specified time period T. The total number of network messages received by the PLC within a specified time period T; For the number of sensors, Indicates the first One sensor, This is a sensor normality status indicator. If the sensor reading is normal, then... ,otherwise .

[0038] In step (4), the formula for calculating the business logic score is:

[0039] ;

[0040] ;

[0041] ;

[0042] In the formula, It is a smoothing factor; is the status monitoring degree, representing the proportion of all monitored key business variables that are within the expected range. is the status of the th key business variable. If it is in the normal state, it is 1; if it is in the abnormal state, it is 0. represents the number of key business variables. is the user logical integrity.

[0043] In step (4), the calculation formula for the total trust score is:

[0044] ;

[0045] In the formula, is the internal status score, is the external context score, is the business logic score.

[0046] In step (5), the response strategy is dynamically selected based on the total trust score. Specifically:

[0047] When the total trust score S > 0.85, the status is trusted and no operation is performed.

[0048] When the total trust score 0.6 < S < 0.85, the status is attention, and a mild alarm is sent to the host computer.

[0049] When the total trust score S < 0.6, the status is dangerous, and an emergency strategy is executed, switching to the redundant PLC and stopping the execution of non-critical or high-real-time tasks.

[0050] A PLC closed-loop trusted operation system based on state awareness and dynamic policies, including:

[0051] A hardware trust root module, which is used to verify the integrity of the Bootloader, the operating system, and the PLC runtime, and control the power-on of the PLC and start the operating system and the PLC runtime.

[0052] A dynamic measurement module, which is used to perform periodic dynamic measurements on the user business logic running on the PLC.

[0053] A state awareness module, which is used to collect the internal state and external context of the control system in real time.

[0054] A dynamic policy module, which is used to receive the inputs from the dynamic measurement module and the state awareness module, and use the LSTM and non-linear scoring models to calculate the dynamically changing internal state score, external context score, business logic score, and total trust score in real time, and dynamically select the response strategy based on the total trust score.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1. Achieving a balance between security and availability: Based on the user business logic obtained by the dynamic measurement module and the internal state and external context obtained by the state awareness module, the present invention dynamically selects response strategies, avoiding the disruption of the production process caused by "one-size-fits-all" security interruptions, and ensuring the continuous operation of the system's core functions while resisting attacks.

[0057] 2. Improved intelligence and accuracy of protection: This invention calculates the dynamically changing total credibility score in real time through LSTM and nonlinear scoring models. By integrating internal state, external context and business logic for decision-making, it significantly reduces the false alarm rate and can more accurately assess the actual impact of security incidents and take the most appropriate countermeasures.

[0058] 3. A true endogenous trusted closed loop has been constructed: In this invention, the dynamic strategy module works in concert with the dynamic measurement module and the state awareness module to upgrade security from an "external" detection and response to an endogenous capability that is deeply coupled with the control system and continuously evolves, thus realizing the transformation from "passive protection" to "active immunity". Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart illustrating the workflow of the hardware trust root module in an embodiment of the present invention.

[0061] Figure 2 This is a flowchart illustrating the workflow of the dynamic measurement module, state awareness module, and dynamic strategy module in this embodiment of the invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0064] This invention provides a PLC closed-loop reliable operation system based on state awareness and dynamic strategies, comprising:

[0065] The hardware root of trust module is used to verify the integrity of the bootloader, operating system, and PLC runtime, and to control the PLC to power on and start the operating system and PLC runtime.

[0066] The dynamic measurement module is used to periodically and dynamically measure the user business logic running on the PLC.

[0067] The state awareness module is used to collect the internal state and external context of the control system in real time.

[0068] The dynamic strategy module receives input from the dynamic measurement module and the state awareness module. The LSTM and nonlinear scoring model calculate the dynamically changing internal state score, external context score, business logic score and total credibility score in real time, and dynamically selects the response strategy based on the total credibility score.

[0069] like Figure 1 As shown, the workflow of the hardware trust root module is as follows:

[0070] Based on a hardware root of trust, the bootloader, operating system, and PLC runtime are verified step by step to build an initial trusted environment. The hardware root of trust module verifies the bootloader; if the verification passes, it controls the PLC to power on and simultaneously starts the bootloader. The bootloader loads the operating system and PLC runtime and verifies them. If the verification passes, it starts the operating system and PLC runtime. Therefore, the hardware root of trust, as a trusted starting point, plays a crucial role.

[0071] like Figure 2 As shown, the dynamic measurement module periodically measures the user business logic running on the PLC, while the state awareness module collects the internal state and external context of the control system in real time. The results are then used as multi-dimensional inputs to the dynamic strategy module for strategy adjustment and judgment. The system's human-machine interface allows for secondary configuration of the strategy decision matrix based on changes in the actual industrial environment, providing flexibility and robustness.

[0072] A PLC closed-loop reliable operation method based on state awareness and dynamic strategy includes:

[0073] S1, based on the hardware root of trust, verifies the integrity of the Bootloader, operating system, and PLC runtime step by step to control the PLC power-on and start the operating system and PLC runtime.

[0074] S2, after the operating system and PLC start up, uses the dynamic measurement module to periodically measure the user business logic running on the PLC, and uses the state perception module to collect the internal state and external context of the control system in real time.

[0075] The metrics included in user business logic are status monitoring degree and user logic integrity. The metrics included in internal status are CPU load, memory usage, and task scheduling cycle stability. The metrics included in external context are the legality of the host computer's instruction sequence, abnormal network communication patterns, and the rationality of sensor readings.

[0076] S3: Construct historical time-series window data. The vector at each time point contains normalized values ​​of eight indicators. After extracting time-series features using LSTM, five dynamic parameters for the current time point are generated, including the sensitivity coefficient. Instruction exception penalty coefficient Network anomaly penalty coefficient Sensor anomaly penalty coefficient and smoothing factor .

[0077] S4 constructs a non-linear scoring model, receives 8 indicators at the current moment, combines them with multiple corresponding dynamic parameters, calculates the dynamically changing internal state score, external context score, and business logic score in real time, and further obtains the total credibility score.

[0078] Internal state score The calculation formula is:

[0079] ;

[0080] In the formula, Linear fundamental scores representing internal states; sensitivity coefficient , is a real number greater than 0, which controls the steepness of the Sigmoid function; The larger the value, the more drastic the function changes near the inflection point, and the more severe the system's response to resource overruns. Base offset This defines the "passing grade" for the internal state score. This value can be adjusted according to the performance of different PLCs.

[0081] Linear basic score The formula is as follows:

[0082] ;

[0083] in, , , These are the weighting coefficients. The weights can be adjusted according to the actual operation of the PLC.

[0084] CPU load percentage :

[0085] ;

[0086] in, This represents the CPU load value. This is the CPU load threshold; CPU load threshold: set to 0.9. When the load exceeds the threshold, the contribution of this indicator drops directly to 0.

[0087] Memory usage score :

[0088] ;

[0089] in, This is the memory usage value. The memory usage threshold is set to 0.85.

[0090] Task cycle stability score :

[0091] ;

[0092] in, This represents the standard deviation of the most recent task cycles (such as scan cycles). The larger the standard deviation, the more unstable the cycle is. To stabilize the attenuation coefficient, it determines the severity of the effect of periodic fluctuations on the fraction. For example, it can be set to... .

[0093] External context score assesses the safety risks during the interaction between the PLC and the external environment. The calculation formula is:

[0094] ;

[0095] In the formula, This is the penalty coefficient for instruction exceptions. This represents the network anomaly penalty coefficient. This is the penalty coefficient for sensor anomalies; For sequence anomaly degree, For network communication anomaly degree, This refers to the anomaly rate of sensor readings.

[0096] Instruction sequence anomaly :

[0097] ;

[0098] In the formula, This refers to the number of abnormal access commands from the host computer within a specified time period T. The total number of host computer access commands within a specified time period T.

[0099] Network communication anomaly :

[0100] ;

[0101] The number of abnormal network packets received by the PLC within a specified time period T. This represents the total number of network messages received by the PLC within a specified time period T.

[0102] Sensor reading anomaly :

[0103] ;

[0104] For the number of sensors, Indicates the first One sensor, This is a sensor normality status indicator. If the sensor reading is normal, then... ,otherwise .

[0105] External context score It is a compound exponential decay function. Any increase in the penalty term will cause the score to decrease exponentially. For example, when the proportion of abnormal network traffic... When the score increases from 0.05 to 0.10, the decrease is much greater than when it increases from 0.50 to 0.55. This model emphasizes "prevention is better than cure," meaning that even initial, minor anomalies should raise a high level of alert in the system.

[0106] The business logic score directly evaluates whether the user-written control program executes as expected. It uses a minimum smooth gate function to determine whether critical functions are functioning correctly. (Business Logic Score) The calculation formula is:

[0107] ;

[0108] In the formula, Let be the smoothing factor, and be a real number in the interval (0, 1); when When the minimum value is strictly taken, the absence of any item will cause a drastic change in the score. For example This will smoothly amplify the minimum value, preventing the score from fluctuating drastically due to a single momentary failure, thus improving the system's robustness.

[0109] is the status monitoring degree, indicating the proportion of all monitored key business variables in the expected range. The formula is:

[0110] ;

[0111] is the status of the th key business variable. If it is in the normal state, it is 1; if it is in the abnormal state, it is 0. represents the number of key business variables.

[0112] is the user logical integrity, which is measured by the dynamic measurement module. This variable plays a decisive role in the trust score:

[0113] ;

[0114] The total trust score has the following calculation formula:

[0115] ;

[0116] In the formula, is the internal status score, is the external context score, is the business logic score.

[0117] This invention uses the geometric mean to fuse the sub-scores of the three dimensions. The geometric mean is extremely sensitive to low scores. As long as one dimension has a very low score, the total score will be significantly reduced, which conforms to the design concept of the industrial safety system. The system security does not depend on the strongest link, but on the weakest link.

[0118] S5. Dynamically select the response strategy based on the total trust score.

[0119] When the total trust score S > 0.85, the status is trusted and no operation is performed;

[0120] When the total trust score 0.6 < S < 0.85, the status is attention, and a mild alarm is sent to the host computer;

[0121] When the total trust score S < 0.6, the status is dangerous, an emergency strategy is executed, switched to the redundant PLC, and non-critical or high-real-time tasks are stopped.

[0122] The specific working process of LSTM is further described as follows:

[0123] 1. Input: Historical time series window data of a fixed length L.

[0124] ;

[0125] Wherein, the vector at each time point It contains the normalized values ​​of all 8 original indicators.

[0126] 2. LSTM temporal feature extraction:

[0127] ;

[0128] The LSTM network processes this time window and ultimately outputs a hidden state vector. and cell state This vector The system's dynamic behavior patterns over a past period of time are encoded.

[0129] 3. Dynamic parameter generation:

[0130] Hidden states of LSTM Key parameters in the nonlinear scoring model are generated through several parallel fully connected layers.

[0131] Dynamic sensitivity coefficient:

[0132] ;

[0133] Dynamic penalty coefficient:

[0134] ;

[0135] ;

[0136] ;

[0137] Dynamic smoothing factor:

[0138] ;

[0139] The dynamic smoothing factor is in (0,1).

[0140] 4. Real-time nonlinear scoring:

[0141] Current moment original coordinates The dynamic parameters generated by LSTM are substituted into the corresponding calculation formula to calculate the final confidence score. .

[0142] here, The reliability score of the PLC system at the current moment. This is the nonlinear scoring model of the present invention. The data consists of 8 dimensions collected at the current moment. It is a dynamic parameter mapping function implemented by a fully connected layer. This is the set of key parameters in the nonlinear scoring model F.

[0143] The training and inference process is as follows:

[0144] 1. Data preparation: Collect a large amount of historical time series data containing normal and various abnormal operating conditions, and calculate the true confidence score for each time point t according to the formulas in 1.1 to 1.4.

[0145] 2. Teacher-Student Model: The entire "LSTM + dynamic parameters + nonlinear scoring" system serves as the student model. A well-validated "expert system" can serve as the teacher model, especially producing more reliable results. As a learning objective.

[0146] 3. Loss Function: Using Mean Squared Error (MSE) Loss:

[0147] ;

[0148] By using backpropagation and gradient descent, the LSTM and its subsequent fully connected layers are trained simultaneously, so that the score output by the student model is as close as possible to the score (or the true score) of the teacher model.

[0149] Compared with existing technologies, this invention has the following technical advantages: 1. Comprehensiveness: Covering three dimensions: internal state, external context, and business logic; 2. Intelligence: Achieving temporal pattern recognition through LSTM; 3. Foresight: Possessing fault prediction and early warning capabilities; 4. Adaptability: Model parameters are dynamically adjusted according to the operating environment; 5. Lightweight: Can run on resource-constrained edge devices.

[0150] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A PLC closed-loop reliable operation method based on state awareness and dynamic strategy, characterized in that, including: (1) Based on the hardware root of trust, verify the integrity of the Bootloader, operating system, and PLC runtime system step by step to control the power-up of the PLC and start the operating system and PLC runtime system; (2) After the operating system and PLC runtime system are started, use the dynamic measurement module to periodically measure the user business logic running on the PLC, and use the state perception module to collect the internal state and external context of the control system in real time; Among them, the metrics included in the user business logic are state monitoring degree and user logic integrity, the metrics included in the internal state are CPU load, memory occupancy, and task scheduling cycle stability, and the metrics included in the external context are the legality of the instruction sequence of the upper computer, the abnormal mode of network communication, and the rationality of sensor readings; (3) Construct historical time-series window data, where the vector at each time point contains the normalized values of 8 metrics. After using LSTM for time-series feature extraction, generate multiple dynamic parameters at the current moment; (4) Construct a non-linear scoring model, receive the 8 metrics at the current moment, combine the corresponding multiple dynamic parameters, and calculate the dynamically changing internal state score, external context score, and business logic score in real time, and further obtain the total trust score; (5) Dynamically select response strategies based on the total trust score.

2. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 1, characterized in that, The specific process of step (1) is as follows: Based on the hardware root of trust, verify the integrity of the Bootloader. If the verification passes, control the power-up of the PLC and start the Bootloader at the same time. If the verification fails, terminate the startup; After the PLC is powered on, the Bootloader loads the operating system and PLC runtime system. During the loading process, verify the integrity of the operating system and PLC runtime system. If the verification passes, start the operating system and PLC runtime system. If the verification fails, terminate the startup of the operating system and PLC runtime system.

3. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 1, characterized in that, In step (3), after using LSTM for time-series feature extraction, generate multiple dynamic parameters at the current moment, specifically: LSTM is used to process historical time-series window data and output a hidden state vector. and cell state ; implied state Multiple dynamic parameters for the current time step are generated through several parallel fully connected layers, including sensitivity coefficients. Instruction exception penalty coefficient Network anomaly penalty coefficient Sensor anomaly penalty coefficient and smoothing factor .

4. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 3, characterized in that, In step (4), the calculation formula for the internal state score is: ； ； ； ； ； In the formula, Linear fundamental components representing internal states, Represents the sensitivity coefficient. Indicates the base offset. , , These are the weighting coefficients. ; CPU load score The score represents memory usage. The task cycle stability score; This represents the CPU load value. CPU load threshold; This is the memory usage value. This is the memory usage threshold; The standard deviation of the most recent multiple task cycles, This is the stable attenuation coefficient.

5. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 4, characterized in that, In step (4), the calculation formula for the external context score is: ； ； ； ； In the formula, This is the penalty coefficient for instruction exceptions. This represents the network anomaly penalty coefficient. This is the penalty coefficient for sensor anomalies; For sequence anomaly degree, For network communication anomaly degree, The degree of sensor reading anomaly; This refers to the number of abnormal access commands from the host computer within a specified time period T. The total number of host computer access commands within a specified time period T; The number of abnormal network packets received by the PLC within a specified time period T. The total number of network messages received by the PLC within a specified time period T; For the number of sensors, Indicates the first One sensor, This is a sensor normality status indicator. If the sensor reading is normal, then... ,otherwise .

6. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 5, characterized in that, In step (4), the calculation formula for the business logic score is: ； ； ； In the formula, It is a smoothing factor; Status monitoring level represents the proportion of all monitored key business variables that are within the expected range. For the first The status of key business variables A value of 1 indicates a normal state, while a value of 0 indicates an abnormal state. Indicates the number of key business variables; For the sake of user logic integrity.

7. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 1, characterized in that, In step (4), the calculation formula for the total trust score is: ； In the formula, The internal state score. For external context scores, The score is for business logic.

8. The PLC closed-loop reliable operation method based on state awareness and dynamic strategy according to claim 1, characterized in that, In step (5), dynamically select response strategies based on the total trust score, specifically: When the total trust score S > 0.85, the state is trusted and no operation is performed; When the total trust score 0.6 < S < 0.85, the state is attention, and a mild alarm is sent to the upper computer; When the total trust score S < 0.6, the state is dangerous, execute the emergency strategy, switch to the redundant PLC, and stop executing non-critical or high-real-time tasks.

9. A PLC closed-loop reliable operation system based on state awareness and dynamic strategy, characterized in that, including: The hardware root of trust module is used to verify the integrity of the Bootloader, operating system, and PLC runtime system, and control the power-up of the PLC and start the operating system and PLC runtime system; The dynamic measurement module is used to perform periodic dynamic measurement on the user business logic running on the PLC; among them, the metrics included in the user business logic are state monitoring degree and user logic integrity; The state awareness module is used to collect the internal state and external context of the control system in real time. The internal state includes indicators such as CPU load, memory usage, and task scheduling cycle stability, while the external context includes indicators such as the legality of the host computer's instruction sequence, abnormal network communication patterns, and the rationality of sensor readings. The dynamic strategy module is used to: construct historical time-series window data, where the vector at each time point contains normalized values ​​of 8 indicators; extract time-series features using LSTM to generate multiple dynamic parameters for the current time; construct a nonlinear scoring model, which receives the 8 indicators at the current time, combines them with the corresponding multiple dynamic parameters, and calculates the dynamically changing internal state score, external context score, and business logic score in real time, and further obtains the total credibility score; and dynamically select a response strategy based on the total credibility score.

Images