New energy power plant network security industrial gateway with layered interface protection

Abstract

The invention relates to the technical field of photovoltaic power plant combiner box data acquisition, and discloses a new energy power plant network security industrial gateway with layered interface protection. The gateway divides an internal network domain and an external network domain by constructing a virtual protection space with a physical interface as a boundary. The operation process comprises the following steps of: capturing and analyzing message characteristics and session context of boundary communication data in real time; performing intelligent tagging on the communication behaviors by utilizing a behavior intention recognition engine; querying a security policy library based on the intention label to generate a preliminary disposal instruction; activating a traffic shaping and protocol filtering function to perform deep content inspection; and dynamically updating the threat index and triggering a strategy adjustment mechanism in the checking process. According to the method, the passive response of the existing dynamic gateway is overcome, the overall study and judgment and active defense of a complex attack chain are realized by constructing a full-process collaborative intelligent framework of data perception, intention understanding and strategy generation and execution, and the network security level of a new energy power plant monitoring system is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of data acquisition technology for combiner boxes in photovoltaic power plants, specifically to a layered interface protection industrial gateway for network security in new energy power plants. Background Technology

[0002] With the rapid development of new energy power generation technologies (such as wind power and photovoltaics) and their increasing penetration rate in the power grid, the cybersecurity of new energy power plants has become a critical link in the stable operation of the power system. As the core hub connecting the internal monitoring network and the external dispatch network of the power plant, the security protection capability of industrial gateways is of paramount importance.

[0003] Current so-called dynamic gateways on the market often exhibit dynamism in response to individual data streams or isolated security events. For example, when an abnormal request frequency from an IP address is detected, it may be temporarily blocked dynamically; this dynamism is localized and passive. Its core deficiency lies in the lack of a unified, collaborative intelligent framework that spans the entire process of data perception, intent understanding, policy generation, and execution. Individual security components (such as intrusion detection systems and firewall modules) may operate independently, making judgments based on their own limited information, easily forming "information silos" and leading to inaccurate analysis of complex attack chains. For instance, in the process of protocol conversion, the Modbus / TCP interface of an industrial gateway used for data acquisition in photovoltaic combiner boxes often becomes an attack entry point due to protocol vulnerabilities, making it susceptible to malicious command injection that could tamper with monitoring data. Simultaneously, the built-in firewall and intrusion detection module lack coordination; when the firewall allows compliant but abnormal data packets, the intrusion detection system struggles to promptly perform deep packet analysis and response, resulting in the inability to effectively block abnormal start / stop commands targeting the power generation unit. Summary of the Invention

[0004] The purpose of this invention is to provide a layered interface protection industrial gateway for network security in new energy power plants, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a layered interface protection industrial gateway for network security in new energy power plants, the gateway comprising: Construct a virtual protection space with physical interfaces as the boundary. This virtual protection space is used to divide the internal network domain from the external network domain. All communication data flowing through the boundary of the virtual protected space is captured in real time, and the message characteristics and session context information of the communication data are extracted. The message features and the session context information are input into the behavior intent recognition engine, and the behavior intent recognition engine outputs the behavior intent label of the communication data; Based on the behavioral intent tag, a preset security policy library is queried to generate preliminary processing instructions for the communication data; According to the initial processing instructions, the gateway's traffic shaper and protocol filter are activated to perform deep content inspection on the communication data; During in-depth content inspection, if protocol anomalies or content violations are identified, the threat index of the communication data is updated, and a dynamic protection strategy adjustment mechanism is triggered.

[0006] Preferably, the process of constructing a virtual protective space bounded by a physical interface further includes: Based on the physical interface configuration information of the gateway, multiple logical isolation zones are defined; Each logical isolation zone is assigned an independent address range and access control list; Virtual detection points are deployed between the logical isolation zones, and these virtual detection points are used to monitor the data flow between the zones. Establish a mapping relationship between the logical isolation zone and the internal network domain and the external network domain.

[0007] Preferably, the process of capturing all communication data flowing through the boundary of the virtual protected space in real time further includes: A data probe is deployed at the virtual detection point, and the data probe listens to network traffic in a bypass manner. The data probe parses the original data frame and restores the complete application layer protocol content; Record the source address, destination address, port number, and timestamp information of the application layer protocol content; The restored protocol content is combined with the recorded network information to form the session context information.

[0008] Preferably, the operation of the behavioral intent recognition engine further includes: A behavioral sequence model of the data stream is constructed using the message characteristics; The behavior sequence model is matched with a predefined behavior pattern library for similarity. Based on the matching results, an initial behavioral intent label is assigned to the data stream; By combining the historical behavior records in the session context information, the initial behavior intent label is modified to generate the final behavior intent label.

[0009] Preferably, the process of querying a preset security policy library based on the behavioral intent tag and generating a preliminary processing instruction for the communication data further includes: The security policy library contains multiple policy rules, each policy rule is associated with a behavioral intent tag and a handling action; Using the final behavioral intent tag as an index, retrieve matching policy rules from the security policy library; Extract the action parameters defined in the matched policy rules; A preliminary handling instruction containing execution conditions and operation type is generated based on the handling action parameters.

[0010] Preferably, the process of performing deep content inspection on the communication data further includes: The flow shaper adjusts the transmission queue priority of the communication data according to the operation type in the preliminary processing instruction; The protocol filter checks the protocol fields of the communication data for compliance according to the protocol specifications defined in the preliminary processing instruction; If a protocol field is found to deviate from the protocol specification, the communication data is marked as suspicious data. Perform content feature scanning on communication data marked as suspicious to identify whether predefined malicious code patterns exist.

[0011] Preferably, the process of updating the threat index of the communication data further includes: Initialize a base threat value for the communication data; When a protocol anomaly is identified, the base threat value is adjusted upwards based on the anomaly level. When a content violation is identified, the base threat value is adjusted upwards again based on the severity of the violation. The adjusted final value will be used as the updated threat index for the communication data.

[0012] Preferably, the process of triggering the dynamic protection strategy adjustment mechanism further includes: The updated threat index is compared with multiple preset threshold ranges to determine the current threat level; Based on the determined threat level, select the corresponding enhanced protection strategy template from the strategy template library; Instantiate the enhanced protection strategy template to generate a specific set of protection rules; The generated set of protection rules is sent to the traffic shaper and protocol filter in real time to replace or supplement the original control rules.

[0013] Preferably, the gateway further includes a session lifecycle management process: To establish a session trace based on the examined communication data, the session trace includes a lifetime timer; During the lifecycle, the behavioral changes of the communication data are continuously monitored; If a threat index update is detected again during the lifecycle, the security of the session will be reassessed. When the lifecycle timer times out or the session terminates normally, clear the corresponding session trace records.

[0014] Preferably, the gateway further includes a protection log auditing process: Record all events from the capture of communication data to its final disposal, forming an audit log; The audit logs are categorized and stored in the security event database and the operation log database, respectively. Periodically extract features from the records in the security event database, generate new behavior patterns, and update the behavior pattern database. Based on the statistical information in the runtime log library, optimize the policy rule parameters in the security policy library.

[0015] Compared with the prior art, the beneficial effects of the present invention are: This invention fundamentally changes the traditional dynamic gateway model, which only responds locally and passively to isolated events, by constructing a collaborative intelligent framework that spans data perception, intent understanding, policy generation, and execution. Based on a deep understanding of the overall intent of communication behavior, the gateway can proactively generate and execute collaborative protection strategies, achieving global defense against complex, multi-stage network attack chains and significantly improving the security resilience of new energy power plants against advanced persistent threats (APTs).

[0016] By using a unified behavioral intent recognition engine to collaboratively analyze the entire network's data flow, this invention deeply integrates and correlates information that was originally scattered across various independent security modules (such as intrusion detection and firewalls). This effectively avoids inaccurate judgments caused by fragmented information, enabling more precise identification of covert attack behaviors disguised in normal traffic and significantly reducing the risk of false positives and false negatives. This invention employs a layered protection architecture, forming multiple tightly connected lines of defense from virtual protection space construction and behavioral intent recognition to deep content inspection. More importantly, this system possesses dynamic closed-loop optimization capabilities; that is, after anomalies are detected during the deep content inspection phase, the threat index is updated in real time, triggering a policy adjustment mechanism. This allows security policies to adaptively evolve with changes in the network threat landscape, achieving truly intelligent dynamic protection. Attached Figure Description

[0017] Figure 1 This is a schematic diagram illustrating the working principle of the layered interface protection industrial gateway for new energy power plant network security as described in this invention. Figure 2 A flowchart for constructing a virtual protected space; Figure 3 A flowchart illustrating the operation of the behavioral intent recognition engine; Figure 4 The correlation distribution between industrial gateway protocol anomaly levels and threat index adjustment values; Figure 5 The frequency distribution of various security incidents occurring at industrial gateways in new energy power plants. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] Please see Figure 1 This invention provides a layered interface protection industrial gateway for cybersecurity in new energy power plants. The gateway includes: constructing a virtual protection space with physical interfaces as boundaries, which divides the network into an internal network domain and an external network domain, forming a logically isolated protection boundary. The gateway captures all communication data flowing through the boundary of this virtual protection space in real time and extracts packet features and session context information including session state and historical behavior. The extracted packet features and session context information are sent to a behavior intent recognition engine for processing. This engine analyzes the behavior patterns of the data flow and outputs corresponding behavior intent tags. Based on these tags, the gateway queries a preset security policy library to generate preliminary handling instructions for the current communication data. According to these instructions, the gateway activates a built-in traffic shaper and protocol filter to perform deep content inspection on the data flow. The inspection process includes protocol field analysis and content feature scanning. If protocol anomalies or content violations are identified during the deep inspection, the threat index of the communication data is dynamically updated, and a dynamic protection policy adjustment mechanism is triggered to adjust the protection policy in real time to address potential threats.

[0020] Example 1: See Figure 2In practical implementation, the hardware platform of a network security industrial gateway is typically equipped with multiple physical network interfaces. These interfaces connect to different business networks within the new energy power plant and external networks. The definition of logical isolation zones directly maps to the connection relationships of the physical interfaces. Each logical interface or group of interfaces is divided into an independent logical isolation zone. Logical isolation zones are isolated at the software level through virtual LAN technology or independent virtual routing instances. Each logical isolation zone is allocated an independent address range and access control list. In practice, the allocation of address ranges follows the network planning scheme of the new energy power plant. For example, a continuous private IP address range is allocated to the logical isolation zone connecting to the wind turbine monitoring system, while another non-overlapping private IP address range is allocated to the logical isolation zone connecting to the photovoltaic inverter group. Access control list rules are configured based on the principle of least privilege, explicitly allowing or denying communication of specific protocols and port numbers between logical isolation zones or with external networks. Virtual detection points are deployed between logical isolation zones. These virtual detection points are embedded in the data plane of the network security industrial gateway as software modules. They are not independent physical devices but rather interception hook functions running in the gateway's operating system kernel. These functions are triggered to execute monitoring functions when data packets cross the boundaries of logical isolation zones. A mapping relationship is established between logical isolation zones and internal and external network domains. In specific implementations, the internal network domain includes the power plant's production process control layer network and station control layer network, while the external network domain includes the scheduling data network and remote operation and maintenance network. The mapping relationship is implemented through a configuration table, which records the security domain category and security level of each logical isolation zone. For example, the mapping relationship indicates that the logical isolation zone connecting to the station control layer server belongs to the core internal network domain with a high security level, while the logical isolation zone connecting to the remote maintenance dial-up server belongs to the external network domain with a low security level.

[0021] The process of capturing all communication data flowing through the virtual protection space boundary in real time is completed at the virtual detection point. In practice, after the virtual detection point is activated, a replica node is created on the packet processing path. A data probe is deployed at the virtual detection point. The data probe is a software component responsible for deep packet inspection. The data probe listens to network traffic in a bypass mode, meaning that the data probe receives a replica of the network traffic, while the original packets are still forwarded along the normal path. This method avoids delays in real-time communication. The data probe parses the original data frames to reconstruct the complete application layer protocol content. The parsing process starts from the data link layer, peeling off the Ethernet frame header, IP packet header, and transport layer TCP or UDP header layer by layer, ultimately extracting the complete application layer payload. The application layer protocol content may include Modbus / TCP protocol data units, IEC104 protocol ASDU data units, or other industrial control protocol messages. The system records the source address, destination address, port number, and timestamp information of the application layer protocol content. In specific implementations, the source and destination addresses record the complete IP address version 4 or version 6, the port number records the 16-bit source and destination port values ​​of the transport layer, and the timestamp records the system time accurate to milliseconds when the data packet was captured. The reconstructed protocol content is combined with the recorded network information to form session context information. The combination process creates a structured session context information object, which contains a fixed field storing the five-tuple information and the timestamp, and a variable-length field storing a complete copy of the application layer protocol content. The session context information object is assigned a unique session identifier for subsequent process correlation and tracking.

[0022] In some embodiments, the number of logical isolation zones can be flexibly configured based on the number of physical interfaces of the network security industrial gateway. The access control lists (ACLs) of the logical isolation zones support state-based detection, meaning the ACLs can understand the state of a communication session, for example, allowing only connection traffic originating from an internal network domain to an external network domain to pass through. It is understood that the data probe's parsing capabilities support extensible protocol plugins. The data probe supports multiple industrial control protocols by loading different protocol parsing plugins, which contain the syntax and semantic rules of specific protocols.

[0023] In practical implementation, the boundary defense strength of the virtual protection space can be dynamically adjusted by modifying access control policies between logical isolation zones. When the network security industrial gateway detects an escalation in network threat levels, it can automatically tighten access control list rules, such as temporarily blocking communication on certain high-risk ports. The deployment locations of virtual detection points are carefully designed to cover all possible cross-regional data flows. Virtual detection points ensure that any data packet must undergo security policy checks when routed from one logical isolation zone to another. It is understood that the richness of session context information directly affects the accuracy of subsequent behavior analysis; therefore, the recorded network metadata strives for comprehensiveness. In addition to the basic five-tuple, some embodiments also record information such as the packet's time-to-live (TTL) value and protocol flags.

[0024] Optionally, the address range planning of logical isolation zones can be coordinated with the address allocation of physical network devices to avoid conflicts with the address ranges of other network devices within the plant. Data probe deployment can employ a multi-threaded parallel processing mode to handle high network throughput scenarios. Each data probe thread is responsible for processing traffic from one or more logical isolation zones, thereby improving overall data capture performance. In some embodiments, the session context information object is additionally associated with a security context flag. The security context flag is initially empty and is populated by the security module with threat assessment results in subsequent processing.

[0025] In practice, the construction of the virtual protection space is an ongoing process. During operation, the network security industrial gateway allows authorized administrators to dynamically add, delete, or modify the configuration parameters of logical isolation zones through the management interface. The reliability of real-time captured communication data is ensured through the data probe process's guardian mechanism and anomaly recovery mechanism. If the data probe process terminates unexpectedly, the watchdog process will immediately restart it and restore it to its state before termination. Understandably, the accuracy of application layer protocol content restoration is crucial for deep content inspection; therefore, the data probe's protocol parser must strictly adhere to the official standard documents of relevant industrial control protocols to ensure the completeness and accuracy of the restored application layer messages.

[0026] Example 2: See Figure 3The behavioral intent recognition engine first constructs a behavioral sequence model of the data flow using extracted message features. In practice, message features are a series of quantifiable attributes extracted from network data packets. These attributes include, but are not limited to, the length of a single data packet, the time interval between data packets, the byte value at a specific position in the packet payload, the command code sequence formed by consecutive data packets, and the transmission direction of the data flow. The behavioral sequence model organizes these discrete message features into an ordered sequence in chronological order, representing the behavioral trajectory of the network connection over a period of time. The behavioral sequence model is then matched against a predefined behavioral pattern library. This predefined behavioral pattern library is a collection stored in the local database of the network security industrial gateway. Each behavioral pattern template in the library describes a characteristic sequence of a typical network behavior, including normal operation templates, known attack templates, and suspicious behavior templates. The similarity matching process is achieved by calculating the difference between the behavioral sequence model and each behavioral pattern template. The matching algorithm can employ dynamic time warping, the longest common subsequence algorithm, or other sequence similarity measurement methods. For example, for a newly established behavior sequence model, the dynamic time warping algorithm calculates its path distance to the "normal periodic reading" template in the behavior pattern library, and also calculates its path distance to the "register brute-force enumeration" template. Based on the matching results, an initial behavior intent label is assigned to the data stream. The initial behavior intent label is a preliminary classification result, and its value is directly derived from the intent category associated with the behavior pattern template with the highest similarity. If the behavior sequence model has the highest similarity to the "normal periodic reading" template, the initial behavior intent label "normal data acquisition" is assigned; if it has the highest similarity to the "register brute-force enumeration" template, the initial behavior intent label "suspicious enumeration attack" is assigned.

[0027] By combining historical behavior records from the session context information, the initial behavioral intent label is revised to generate the final behavioral intent label. The historical behavior records in the session context information contain long-term behavioral statistics related to the current data flow. These records may include the number of connections initiated by the source IP address over a past period, the type of target service accessed, the history of behavioral intent labels from previous sessions, and whether any security alerts have been triggered. The revision process is a rule-based or probability-based reasoning process that considers the consistency between the current behavioral sequence model and historical behavioral patterns. For example, even if the current behavioral sequence model has a high similarity to the "suspicious enumeration attack" template, if the historical behavior records in the session context information show that this source IP address is a long-term trusted maintenance terminal, and its current behavior is the first occurrence within an authorized maintenance time window, then the revision process may downgrade the initial behavioral intent label from "suspicious enumeration attack" to "authorized configuration operation" or "further observation required." Conversely, if a source IP address has multiple minor violations in its historical behavior records, then even if the similarity between the current behavioral sequence model and the attack template is only moderate, the revision process may upgrade the threat level. The final behavioral intent label is the output after context calibration, and it will be used for subsequent security policy decisions.

[0028] In some embodiments, the construction of the behavior sequence model can employ a sliding window mechanism to handle long-duration communication sessions. The behavior sequence model retains only the feature sequences of the most recent data packets or a few recent packets to focus on the most recent behavior. It is understood that the behavior pattern library needs to be updated regularly to address new threats. Updates can be achieved by administrators manually importing new attack feature sequences or by the gateway's log audit module automatically learning new normal behavior patterns. In specific implementations, the computational efficiency of similarity matching is crucial; therefore, feature dimensionality reduction or indexing techniques may be used to accelerate the search process of a large-scale behavior pattern library. The initial assignment of behavioral intent labels may include a confidence score, reflecting the reliability of the match. Matches with low confidence scores will be given greater adjustment space during the correction phase. It is understood that the weight of historical behavior records can be dynamically adjusted in the correction algorithm. For newly added devices, the weight of historical behavior records may be lower, relying more on the current behavior sequence model; for devices with long-term stable behavior, the weight of historical behavior records is higher.

[0029] Optionally, the correction process can utilize a simple weighted scoring model that comprehensively considers both the current sequence matching score and historical behavior scores. The model formula can be expressed as:

[0030] in: This is the final score. It is the weight of the current behavior sequence matching score. It is the similarity score between the current behavior sequence and the best matching template. It is the weight of the historical behavior score. It is a reputation score calculated based on historical behavioral records. The final behavioral intent label is based on... The score range in which the target score falls determines the target score. In some embodiments, the behavioral intent recognition engine can support multimodal learning. The behavioral intent recognition engine not only analyzes sequence features but also combines statistical features such as connection frequency and data volume for comprehensive judgment.

[0031] Example 3: The process of generating preliminary handling instructions based on querying the security policy library using behavioral intent tags involves the retrieval and parameterization of policy rules. The security policy library is stored in the local storage device of the network security industrial gateway in the form of a relational database table. The security policy library contains multiple policy rules, each of which is a complete record item. The main fields of the record item include a unique rule identifier, rule activation conditions, matching behavioral intent tags, associated handling action type, and a list of specific parameters for the action. Using the final behavioral intent tag output by the behavioral intent recognition engine as the index key, an exact match query or a fuzzy match query is performed on the "behavioral intent tag" field of the security policy library. The retrieval process is executed by a dedicated policy retrieval module. The policy retrieval module receives the behavioral intent tag string as input, generates the corresponding database query statement, and executes it. The handling action parameters defined in the matching policy rule record are extracted. The handling action parameters are specific values ​​or configuration fragments that control how subsequent security components operate. The handling action parameters may include the bandwidth limit that the traffic shaper needs to set, the path of the specific protocol specification file that the protocol filter needs to load, the depth level flag of the content scan, and the on / off option for whether logging is required. Based on the extracted action parameters, a preliminary handling instruction is generated, which includes execution conditions and operation types. The preliminary handling instruction is a structured data object containing an instruction header and an instruction body. The instruction header specifies the data flow five-tuple information to which the instruction applies and the policy rule identifier that triggers the instruction. The instruction body describes in detail the sequence of operations to be performed and the parameters required for each operation. For example, a preliminary handling instruction may specify "For traffic from port C from IP address A to B, perform the following operations: set the traffic priority to low, enable IEC104 protocol full field check, and perform deep content scan".

[0032] The process of performing deep content inspection on communication data is jointly completed by a traffic shaper and a protocol filter activated by the preliminary handling instruction. The traffic shaper, a software component in the network security industrial gateway responsible for managing packet transmission queues and rates, adjusts the priority position of the target communication data stream in the egress queue or allocates its available bandwidth resources according to the operation type field in the preliminary handling instruction. For example, when the operation type is "rate limiting," the traffic shaper reduces the transmission token bucket capacity of the data stream, thereby reducing its effective transmission rate. The protocol filter, a software component in the network security industrial gateway responsible for parsing and verifying the compliance of application layer protocols, checks the protocol fields of the communication data byte-by-byte according to the protocol specification file defined in the preliminary handling instruction. The protocol specification file, in XML or JSON format, defines the message structure, legal function code range, data unit length constraints, valid address field values, and other rules for specific industrial protocols. If the protocol filter finds that a protocol field deviates from the definition in the protocol specification file during the inspection process—for example, the value of the type identifier field in an IEC104 message is not listed as a valid value in the specification file, or the length field in a ModbusTCP message does not match the actual length of the subsequent data—the protocol filter will mark this communication data as suspicious. For communication data marked as suspicious, the protocol filter will further trigger a deep content inspection process. This process calls a signature-based scanning engine, which loads a predefined malicious code pattern library. This library contains characteristic strings or byte sequences of known attack payloads targeting industrial control systems. The scanning engine performs a multi-pattern matching algorithm on the application layer message payload to identify whether there is content that matches the features in the pattern library.

[0033] In practical implementation, rules in the security policy library may have overlapping priorities. When the behavioral intent tag of a data stream matches multiple policy rules simultaneously, the policy retrieval module will sort them according to the preset priority field in the rules and execute only the rule with the highest priority. The process of extracting action parameters may need to handle parameter dependencies. For example, when the action type is "association check," the parameter list may contain the identifier of another protocol filtering rule that needs to be referenced simultaneously. It is understandable that the generation of the initial action instruction needs to be atomic; the process of generating the initial action instruction must be executed completely. If an error occurs midway, an error log will be generated and the default action instruction will be used.

[0034] In some embodiments, the traffic shaper can operate with greater fine-grained precision, not only adjusting priorities but also delaying packet transmission or introducing jitter to counter certain time-series analysis attacks. The protocol filter specification file supports hot updates, allowing administrators to upload new versions without restarting the network security industrial gateway service to address newly discovered protocol vulnerabilities or support new protocol variants.

[0035] Optionally, deep content inspection may employ a weighted scoring mechanism to reduce false positives. This mechanism assigns different weights to matching results for different features. The formula for calculating the weighted scoring mechanism can be expressed as:

[0036] in: This represents the final risk score for this content review. The total number of feature patterns enabled in the representation pattern library. Representing the The weighting coefficients for each feature pattern are set based on the historical accuracy and threat level of that feature pattern. It is a binary indicator; if the current packet load matches the first... Each feature pattern The final risk score is 1 if it is 1, otherwise it is 0. If a certain preset threshold is exceeded, the content is confirmed to be in violation. It's understandable that the original copy of communication data marked as suspicious is usually recorded in its entirety and stored in a security incident database. The recorded data packet copies can be used by security analysts for post-incident forensic analysis.

[0037] In practice, the order of protocol field checks may follow the protocol hierarchy, proceeding from the header to the body. If a fatal error (such as an invalid checksum) is found in a higher-level protocol header check, the protocol filter may skip subsequent, more time-consuming content scans to save computational resources. Traffic shaper policies need to ensure that they do not cause unacceptable delays to critical control instructions. Therefore, for high-priority critical business data flows, even if their behavioral intent labels trigger traffic shaping, they are typically only monitored rather than strictly rate-limited. In some embodiments, preliminary handling instructions may include an expiration field, automatically expiring after a certain period to prevent erroneous blocking of traffic resuming normal behavior due to outdated policies.

[0038] Example 4: Updating the threat index of communication data is a dynamic, multi-stage evaluation process. Each piece of communication data, after being captured and analyzed for the first time by the network security industrial gateway, is assigned a basic threat value. The basic threat value is set based on various factors, such as the source IP address's reputation score in the reputation database, the sensitivity level of the service corresponding to the destination port, and the historical security record of the protocol family to which the communication data belongs. For example, communication data from a known malicious IP address list will have a significantly higher basic threat value than communication data from an internal trusted network. When protocol anomalies are identified during deep content inspection, the basic threat value is adjusted upwards based on the detected anomaly level. The protocol anomaly level is determined by the protocol filter based on the degree of deviation from protocol specifications and the potential impact. Protocol anomaly levels can be defined as low-level, medium-level, and high-level anomalies. For example, a transaction identifier in a Modbus TCP packet that does not conform to the expected incrementing sequence may be considered a low-level anomaly, while a function code field containing a reserved undefined value may be considered a high-level anomaly. The adjustment operation typically adds a fixed penalty value corresponding to the anomaly level or a proportionally increased penalty value to the basic threat value. When further content violations are identified during deep content inspection—that is, when the signature-based scanning engine confirms a malicious code pattern match in the packet payload—the current threat value is adjusted upwards based on the severity of the violation. The severity of the content violation is determined by predefined danger levels in the malicious code pattern library. For example, matching a known denial-of-service attack payload is considered a severe violation, while matching an information probing payload is considered a moderate violation. After adjustments based on the combined effects of protocol anomalies and content violations, the final value is updated as the current threat index for the communication data. The threat index is a quantified risk indicator, and its level directly determines the intensity of subsequent dynamic protection strategy adjustments.

[0039] The process of triggering the dynamic protection policy adjustment mechanism begins by comparing the updated threat index with multiple preset threshold ranges. These preset threshold ranges are explicitly defined in the network security industrial gateway's configuration file. The threshold ranges divide the threat index values ​​into different threat levels; for example, a threat index of 0-30 is classified as "low threat," 31-70 as "medium threat," and 71-100 as "high threat." The comparison operation is performed by the policy decision module, which queries the threshold range to which the threat index belongs and determines the threat level corresponding to the current communication data. Based on the determined threat level, a corresponding enhanced protection policy template is selected from a preset policy template library. This library is a collection of various predefined response policies. An enhanced protection policy template is a set of action rules designed for a specific threat level; for example, an enhanced protection policy template for a "high threat" level might include actions such as immediately blocking the connection, recording detailed logs, and sending an alert to the administrator. The selected enhanced protection strategy template is instantiated to generate a specific set of protection rules. The instantiation process involves replacing placeholder variables in the template with specific parameters for the current session. For example, the "source IP address" variable is replaced with the actual source IP address that triggered the alert, and the "blocking duration" variable is replaced with a specific time value dynamically calculated based on the threat index. The newly generated set of protection rules is then distributed in real-time to the traffic shaper and protocol filter. This distributed set replaces or supplements the existing control rules currently being executed by these components, immediately changing the processing method for the current communication data stream and even other data streams from the same source, thus achieving dynamic and adaptive adjustment of the protection strategy.

[0040] In practice, the initial base threat value of the threat index can be determined using a lookup table. The lookup table's index is a combination of source address type, destination service type, and protocol type. Protocol anomaly levels can be categorized based on an anomaly scorecard, with different scores assigned to different protocol field errors. It's understandable that adjusting the severity of content violations may not be a simple addition, but rather a multiplicative factor, to allow for a more drastic response to high-threat content.

[0041] In some embodiments, the threat index update may take into account a time decay factor; if no anomalies are found in subsequent checks of a communication data, its threat index may slowly decrease over time. The selection of enhanced protection strategy templates may not be one-to-one; for threat indices near threshold boundaries, templates at two adjacent levels may be activated simultaneously for overlay control.

[0042] Optionally, the threat index can be calculated using a weighted formula that integrates various indicators. The formula can be designed as follows:

[0043] in: This represents the final threat index calculated. Represents the base threat value. This represents the number of protocol anomaly types detected. Representing the The severity coefficient of the protocol anomaly. Representing the The weight of the protocol anomaly This represents the number of content violation types detected. Representing the The severity coefficient of this type of content violation. Representing the The weight of each type of content violation. The weight and coefficient value are determined by analyzing historical attack data.

[0044] As can be understood (referring to Table 1), the effectiveness of the dynamic protection strategy adjustment mechanism depends on the rationality of the threshold range setting. Inappropriate thresholds may lead to excessive false alarms or missed alarms. The distribution of protection rule sets needs to ensure transactionality; the loading of new rule sets should not cause inconsistent states in traffic shapers or protocol filters when processing ongoing communications.

[0045] Table 1: Correspondence between Protocol Anomaly Levels and Adjustment Values Protocol exception level Description Threat index adjustment value Low level exception Transaction identifier slight discontinuity +10 Medium level exception Function code out of common range but not defined +25 High level exception Length field gross error or checksum invalid +50 In practice, enhanced protection policy templates in the policy template library are typically stored in Extensible Markup Language (EXPLAIN) or JSON format for easy parsing and modification. The instantiated protection rule sets need to be compiled into a low-level instruction format that traffic shapers and protocol filters can directly execute. Real-time delivery mechanisms may employ high-speed inter-process communication methods such as message queues or shared memory to ensure low latency policy implementation. For some complex attack scenarios, dynamic protection policy adjustment mechanisms may trigger a series of coordinated response actions, rather than just rule changes on a single device.

[0046] See Figure 4 This chart is a dual-axis correlation graph: the blue bars represent the frequency of protocol anomalies at different levels, and the red line represents the threat index adjustment value for the corresponding level. This chart is a visual representation of the threat index update mechanism, clearly demonstrating the quantitative rule that the higher the anomaly level, the greater the threat adjustment. It not only intuitively reflects the risk gradient of protocol anomalies but also provides a core basis for dynamic protection strategy adjustments. The high threat adjustment value triggered by advanced anomalies directly drives the gateway to enable stricter traffic shaping and protocol filtering rules, making it a key data support chart for industrial gateways to achieve adaptive security protection.

[0047] Example 5: The session lifecycle management process of the network security industrial gateway establishes an independent session trace record for each communication session that passes the initial security check. In specific implementations, communication sessions are typically uniquely identified by standard five-tuple information. The session trace record is a data structure stored in the gateway's memory. The session trace record contains fields such as session identifier, creation timestamp, last activity timestamp, session state enumeration value, and a crucial lifetime timer. The lifetime timer starts when the session trace record is created and counts down according to a preset timeout threshold. For example, for a newly established TCP connection, after completing the three-way handshake and passing the initial security check, the network security industrial gateway creates a session trace record and sets the lifetime timer to, for example, an idle timeout value of 1800 seconds. Throughout the session's lifetime, the network security industrial gateway continuously monitors the behavioral changes of all subsequent communication data related to the session. Monitoring these behavioral changes includes analyzing whether there are abnormal fluctuations in the arrival interval of data packets, whether the amount of transmitted data suddenly increases or decreases, whether the application layer protocol command sequence deviates from historical patterns, and whether the session's threat index is updated due to subsequent data packets triggering new detection rules. If, during the session's lifecycle, a subsequent data packet triggers a new threat detection, causing the session's threat index to be updated, the session lifecycle management module will reassess the overall security of the session. This reassessment will consider the magnitude and frequency of the threat index update, as well as the session's current state. For example, if an IEC104 session initially marked as normal experiences a sudden surge in function code errors, causing its threat index to jump from low to high, the session lifecycle management module may determine that the session has been hijacked or abused. When the session's lifecycle timer expires or the session terminates through a normal termination process, the management system automatically cleans up the corresponding tracking records. A lifecycle timer expiration means that no data packet transmissions were detected within the set time window. Normal session termination for TCP means the connection is correctly closed via a four-way handshake; for connectionless protocols, it means a complete transaction interaction sequence has been completed. The cleanup operation includes releasing the memory space occupied by the session tracking records and related processing context.

[0048] The protection log auditing process of the network security industrial gateway records all key events from the initial capture of communication data to its final handling. Key events include packet arrival time, analysis results of the behavioral intent recognition engine, query hit status of the security policy library, execution actions of the traffic shaper and protocol filter, the trajectory of threat index changes, and the final handling decision. These events are arranged in chronological order to form an audit pipeline with a complete causal relationship. The generated audit pipeline is automatically classified according to event type and severity. The classification rules are based on a predefined event classification dictionary, which maps different event IDs to categories. For example, events such as "protocol field error detected" and "malicious code pattern identified" are classified as security events and stored in the security event library, while events such as "traffic statistics" and "system resource utilization" are classified as operational status information and stored in the operational log library. Periodically perform batch feature extraction on historical records in the security event database. The feature extraction process uses data mining algorithms to identify frequent patterns, association rules, and anomalies in the event records. For example, by analyzing security events marked as "port scanning" over a period of time, features such as the scanning intervals and target port sequences commonly used by attack sources can be extracted, generating new behavioral pattern templates. Based on long-term statistical information accumulated in the operation log database, optimize the policy rule parameters in the security policy database. The optimization process is a data-driven feedback loop. For example, if statistics from the operation log database show that a certain policy rule is causing a large number of false positives to normal business traffic due to overly strict conditions, the optimization algorithm will automatically adjust the trigger threshold of the rule or modify its matching conditions to achieve a better balance between security and availability.

[0049] In practice, the timeout value of the session tracking log's lifetime timer can be dynamically set according to the protocol type. For short-connection protocols such as HTTP, the timeout value may be set shorter, while for long-connection protocols such as industrial control protocols, the timeout value may be set longer. Reassessing session security may trigger a series of actions, including sending alerts to administrators, forcibly resetting the current connection, or simply escalating the monitoring log level. Understandably, audit log records need to ensure their integrity and tamper resistance; audit logs are typically stored in read-only mode or protected using digital signature technology.

[0050] Optionally, the feature extraction process can employ a clustering algorithm to automatically discover new attack patterns. This algorithm groups event records in the security event database based on various feature vectors. Isolated groups of a certain size that cannot be categorized into any known attack type may represent new threats. The clustering algorithm can use distance metrics of the following form for similarity determination:

[0051] in: This represents two security incident records. and The weighted Euclidean distance between them This represents the total number of event features used for clustering. Features can include source port number, number of hours since the attack occurred, and the triggered rule ID, etc. It is the first The weighting coefficients for each feature are used to adjust the importance of different features in distance calculation. and These are events and events In the The standardized values ​​for each feature. Events that are closer in distance are considered more similar and more likely to belong to the same behavioral pattern. It's understandable that optimizing security policies from runtime log libraries is a continuous and gradual process; policy parameters are typically adjusted in small steps to avoid network instability caused by large single adjustments.

[0052] In practice, the generation of audit logs needs to maintain high performance to avoid becoming a bottleneck for network processing; therefore, asynchronous writes and non-blocking I / O operations may be employed. Security event libraries and runtime log libraries are typically built on relational databases or dedicated log management platforms to support complex query and analysis operations. The generation of new behavior pattern templates requires administrator review and confirmation before being officially updated to the behavior pattern library to prevent accidental noise or normal business changes from being misjudged as new attack patterns. The statistical information in the runtime log library is not only used to optimize security policies, but also to generate system health reports and capacity planning references.

[0053] See Figure 5 This horizontal bar chart presents the frequency of occurrence of five core security events in the industrial gateway's protection logs. As a visualization of the protection log audit results, it not only intuitively presents the distribution characteristics of security threats to the industrial gateway but also provides targeted guidance for subsequent security strategy optimization. For high-frequency protocol anomalies, the standard verification rules of the protocol filter can be strengthened. It also reflects the current gateway's relatively good protection against high-risk events such as session hijacking, making it a key reference chart for assessing the security protection status of industrial gateways.

[0054] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A layered interface protection industrial gateway for network security in new energy power plants, characterized in that, The operation of the gateway includes the following steps: Construct a virtual protection space with physical interfaces as the boundary. This virtual protection space is used to divide the internal network domain from the external network domain. All communication data flowing through the boundary of the virtual protected space is captured in real time, and the message characteristics and session context information of the communication data are extracted. The message features and the session context information are input into the behavior intent recognition engine, and the behavior intent recognition engine outputs the behavior intent label of the communication data; Based on the behavioral intent tag, a preset security policy library is queried to generate preliminary processing instructions for the communication data; According to the initial processing instructions, the gateway's traffic shaper and protocol filter are activated to perform deep content inspection on the communication data; During in-depth content inspection, if protocol anomalies or content violations are identified, the threat index of the communication data is updated, and a dynamic protection strategy adjustment mechanism is triggered.

2. The layered interface protection industrial gateway for new energy power plant network security according to claim 1, characterized in that, The process of constructing a virtual protected space with physical interfaces as its boundaries further includes: Based on the physical interface configuration information of the gateway, multiple logical isolation zones are defined; Each logical isolation zone is assigned an independent address range and access control list; Virtual detection points are deployed between the logical isolation zones, and these virtual detection points are used to monitor the data flow between the zones. Establish a mapping relationship between the logical isolation zone and the internal network domain and the external network domain.

3. The layered interface protection industrial gateway for new energy power plant network security according to claim 2, characterized in that, The process of capturing all communication data flowing through the boundary of the virtual protected space in real time further includes: A data probe is deployed at the virtual detection point, and the data probe listens to network traffic in a bypass manner. The data probe parses the original data frame and restores the complete application layer protocol content; Record the source address, destination address, port number, and timestamp information of the application layer protocol content; The restored protocol content is combined with the recorded network information to form the session context information.

4. The layered interface protection industrial gateway for new energy power plant network security according to claim 3, characterized in that, The operation of the behavioral intent recognition engine further includes: A behavioral sequence model of the data stream is constructed using the message characteristics; The behavior sequence model is matched with a predefined behavior pattern library for similarity. Based on the matching results, an initial behavioral intent label is assigned to the data stream; By combining the historical behavior records in the session context information, the initial behavior intent label is modified to generate the final behavior intent label.

5. A layered interface protection industrial gateway for new energy power plant network security according to claim 4, characterized in that, The process of querying a preset security policy library based on the behavioral intent tag and generating a preliminary processing instruction for the communication data further includes: The security policy library contains multiple policy rules, each policy rule is associated with a behavioral intent tag and a handling action; Using the final behavioral intent tag as an index, retrieve matching policy rules from the security policy library; Extract the action parameters defined in the matched policy rules; A preliminary handling instruction containing execution conditions and operation type is generated based on the handling action parameters.

6. A layered interface protection industrial gateway for new energy power plant network security according to claim 5, characterized in that, The process of performing deep content inspection on the communication data further includes: The flow shaper adjusts the transmission queue priority of the communication data according to the operation type in the preliminary processing instruction; The protocol filter checks the protocol fields of the communication data for compliance according to the protocol specifications defined in the preliminary processing instruction; If a protocol field is found to deviate from the protocol specification, the communication data is marked as suspicious data. Perform content feature scanning on communication data marked as suspicious to identify whether there are predefined malicious code patterns.

7. A layered interface protection industrial gateway for new energy power plant network security according to claim 6, characterized in that, The process of updating the threat index of the communication data further includes: Initialize a base threat value for the communication data; When a protocol anomaly is identified, the base threat value is adjusted upwards based on the anomaly level. When a content violation is identified, the base threat value is adjusted upwards again based on the severity of the violation. The adjusted final value will be used as the updated threat index for the communication data.

8. A layered interface protection industrial gateway for new energy power plant network security according to claim 7, characterized in that, The process of triggering the dynamic protection strategy adjustment mechanism further includes: The updated threat index is compared with multiple preset threshold ranges to determine the current threat level; Based on the determined threat level, select the corresponding enhanced protection strategy template from the strategy template library; Instantiate the enhanced protection strategy template to generate a specific set of protection rules; The generated set of protection rules is sent to the traffic shaper and protocol filter in real time to replace or supplement the original control rules.

9. A layered interface protection industrial gateway for new energy power plant network security according to claim 1, characterized in that, The gateway also includes a session lifecycle management process: To establish a session trace based on the examined communication data, the session trace includes a lifetime timer; During the lifecycle, the behavioral changes of the communication data are continuously monitored; If a threat index update is detected again during the lifecycle, the security of the session will be reassessed. When the lifecycle timer times out or the session terminates normally, clear the corresponding session trace records.

10. A layered interface protection industrial gateway for new energy power plant network security according to claim 1, characterized in that, The gateway also includes a protection log auditing process: Record all events from the capture of communication data to its final disposal, forming an audit log; The audit logs are categorized and stored in the security event database and the operation log database, respectively. Periodically extract features from the records in the security event database, generate new behavior patterns, and update the behavior pattern database. Based on the statistical information in the runtime log library, optimize the policy rule parameters in the security policy library.

Images