Method and system for realizing industrial honeypot network based on multi-core electric power IED (Intelligent Electronic Device)

Abstract

The invention relates to the technical field of network security, and discloses a method and system for realizing an industrial honeypot network based on multi-core electric power IED equipment, and the method comprises the steps: carrying out the preprocessing of traffic, and redirecting and forwarding the traffic to a processor core of the electric power IED equipment; generating multi-dimensional vectors of a plurality of distribution nodes and mimicry data, and determining the distribution nodes and the mimicry data according to the probability of the distribution nodes; based on a honeypot network kernel, forwarding the attack data to an associated electric power IED device in combination with the distribution node and the mimicry data, and generating mimicry data corresponding to the attack data by using a dense network client associated with the electric power IED device; and mimicry data returned by the secret network client is integrated, and a final attack response is generated and sent to the attack source. According to the method, one-step generation of trapping data and distribution nodes on the premise of local data security can be realized, real-time analysis, quick response and effective cheating of attack traffic are realized, and the overall security protection level of an industrial control system is fundamentally improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a method and system for implementing an industrial honeypot network based on a multi-core power IED device. BACKGROUND

[0002] Honeypot technology is a network security technology that actively attracts and captures attack behavior by deploying simulated or virtual systems. Through the capture and analysis of attack traffic, honeypot technology can identify the behavior patterns and intentions of attackers, providing key data support for network protection and effectively improving network security response capabilities and threat prediction capabilities. The current network security situation of industrial control systems (ICS) is increasingly severe, especially in the field of power industrial control, where network attack incidents occur frequently and are becoming increasingly complex and concealed. Traditional network security protection measures such as intrusion detection systems (IDS), firewalls, and access control lists (ACL) mainly rely on matching detection of known attack features, and have limited ability to prevent unknown attacks or advanced persistent threats (APTs).

[0003] Existing industrial control devices (such as intelligent electronic devices IED) widely adopt multi-core processor technology, but the core resource utilization rate is not high in actual application, and there are cases of long-term idle cores. At the same time, local IED devices have low computing power, making it difficult to deploy complex data processing algorithms. Complex algorithms are usually deployed independently on online clients, requiring local devices to upload data traffic data for analysis. Encrypted data transmission significantly increases device cost and computing power cost, while unencrypted data poses a risk of data leakage. Existing AI-based encryption algorithms cannot simultaneously generate and distribute nodes and quasi-state data, making it difficult to balance encryption and efficiency, and unable to meet the high real-time and high interactivity requirements of industrial control system environments.

[0004] In view of the problems in the related art, no effective solution has been proposed so far. SUMMARY

[0005] In view of the problems in the related art, the present application proposes a method for implementing an industrial honeypot network based on a multi-core power IED device to overcome the above technical problems existing in the prior art.

[0006] To this end, the specific technical solutions adopted by the present application are as follows:

[0007] According to one aspect of the present application, a method for implementing an industrial honeypot network based on a multi-core power IED device is provided, comprising the following steps:

[0008] S1, using the FPGA device of the power IED device to preprocess the traffic, and redirecting and forwarding the suspicious traffic after preprocessing to the processor core of the power IED device;

[0009] S2. Based on the one-step two-stage dense network data distribution algorithm, generate a multi-dimensional vector of several distribution nodes and mimicry data, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0010] S3. The honeypot network kernel based on the processor of the power IED device combines the distribution node and the mimicry data to forward the attack data to the associated power IED device, and uses the honeypot client of the associated power IED device to generate mimicry data corresponding to the attack data.

[0011] S4. Utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source to achieve a deceptive response to the attacker.

[0012] The process of generating multi-dimensional vectors of several distribution nodes and mimicry data based on a one-step two-stage dense network data distribution algorithm, and determining the distribution nodes and mimicry data according to the probability of the distribution nodes, includes the following steps:

[0013] S21. Using the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device, the vector encoding of the input sequence is mapped to a feature vector that meets the length of the two-stage generator, and then uploaded to the honeypot client.

[0014] S22. Using a two-stage generator deployed on the encrypted network client, output a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0015] Furthermore, the process of preprocessing traffic using the FPGA device of the power IED equipment and redirecting the preprocessed suspicious traffic to the processor core of the power IED equipment includes the following steps:

[0016] S11. Receive data uploaded using a preset protocol using a power IED device, and filter the uploaded data using a preset access control whitelist;

[0017] S12. Based on traffic determination and redirection technology, traffic identification is performed on the filtered data, and the traffic is forwarded to the corresponding kernel of the power IED device processor according to the identification result.

[0018] Furthermore, based on traffic determination and redirection technology, the filtered data is subjected to traffic identification, and suspicious traffic is redirected and forwarded to the corresponding kernel of the power IED device processor according to the identification results, including the following steps:

[0019] S121. Use a pre-built logistic regression model to identify abnormal traffic in the filtered data, obtain the probability that the data is abnormal traffic, and identify abnormal traffic based on the comparison result between the probability of abnormal traffic and the preset probability threshold.

[0020] S122. Normal traffic is forwarded to the functional component kernel of the power IED device processor through redirection technology, and the normal traffic after network storm suppression and DDoS protection is processed for business purposes; abnormal traffic is forwarded to the honeypot network kernel of the power IED device processor.

[0021] Furthermore, utilizing the one-stage generator deployed in the honeypot network kernel of the power IED device processor, the vector encoding of the input sequence is mapped to a feature vector conforming to the length of the two-stage generator, and then uploaded to the honeypot client, including the following steps:

[0022] S211. Utilize the vector encoding function of the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device to convert the serialized traffic and node information into encoded vectors.

[0023] Among them, traffic and node information includes the network topology information of adjacent power IED devices, the static device information of its own power IED device nodes, the actual traffic sequence received by its own power IED device and the simulated data traffic sequence sent from adjacent power IED devices.

[0024] S212. The converted encoded vectors are concatenated, and the multilayer perceptron in the first-stage generator is used to map the concatenated encoded vectors into feature vectors that conform to the length of the second-stage generator. The mapped feature vectors are then uploaded to the encrypted network client.

[0025] Furthermore, using a two-stage generator deployed on the encrypted network client, a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector is output. The determination of distribution nodes and mimicry data based on the probability of the distribution nodes includes the following steps:

[0026] S221. Using the pre-trained model in the two-stage generator deployed on the encrypted network client, positional information is added to the feature vector, and global temporal features of the feature vector are extracted.

[0027] S222. Using the generation task module in the two-stage generator deployed on the encrypted network client, the temporal dependency of the feature vector is processed and the feature vector is converted into the target output format to obtain a multi-dimensional vector matrix.

[0028] S223. Based on the multidimensional vector matrix, determine the multidimensional vectors of several distribution nodes and mimicry data, and determine the final distribution nodes and mimicry data according to the preset probability threshold of the distribution nodes.

[0029] Furthermore, by utilizing the pre-trained model in the two-stage generator deployed on the encrypted network client, positional information is added to the feature vectors, and global temporal features of the feature vectors are extracted, including the following steps:

[0030] S2211. Use sine and cosine functions to generate a fixed-position encoding vector, and superimpose the fixed-position encoding vector with the input feature vector to obtain a feature vector containing position information.

[0031] The expression for the fixed-position encoding vector is:

[0032]

[0033] In the formula, This represents the vector encoding at even-numbered positions, where pos represents the word's position in the sequence, and i represents the dimension index. P represents the dimension of the word vector. This represents the vector encoding at odd positions;

[0034] S2212. Input the feature vector containing location information into the multi-layer Transformer module, and use the multi-head self-attention and feedforward neural network in each layer of the Transformer module to extract global temporal features step by step to obtain a feature vector containing global temporal features.

[0035] Furthermore, by utilizing the generation task module in the two-stage generator deployed on the encrypted network client, the temporal dependencies of the feature vectors are processed and the feature vectors are transformed into the target output format to obtain a multidimensional vector matrix, including the following steps:

[0036] S2221. Utilize the modeling capability of long short-term memory networks for time-series data to learn the mapping relationship between feature vectors containing global time-series features and distribution nodes and pseudo-data, and generate initial multi-dimensional output vectors.

[0037] S2222: Flatten the initial multidimensional output vector, transform its dimension size, and convert it into the preset target output format after calculation by the Softmax function to obtain a multidimensional vector matrix;

[0038] The expression for the multidimensional vector matrix is:

[0039]

[0040] In the formula, Represents a multidimensional vector matrix. This indicates that the output is a real number. The output vector matrix represents the size of a single set, m represents the length of the output control flow data, s represents the encoding length of word vector encoding for letters and symbols, n represents the number of output dimension matrix sequences, k represents the size of the output sequence hidden vectors, and b represents the batch size.

[0041] Furthermore, based on the multidimensional vector matrix, determining several distribution nodes and multidimensional vectors of mimicry data, and determining the final distribution nodes and mimicry data according to the preset probability threshold of the distribution nodes includes the following steps:

[0042] S2231. Based on the preset distribution node probability threshold, filter out data rows in the multidimensional vector matrix whose number of probability columns is less than the distribution node probability threshold. When the probability column values ​​of all data rows are less than the distribution node probability threshold, there is no need to forward them.

[0043] S2232. In the data rows that have been filtered out and retained, the data rows with the largest probability columns in the hidden dimensions are selected sequentially, and the data rows whose hidden dimensions have been discarded are skipped; all the selected data rows with the largest probability columns are used as the final distribution nodes and mimicry data. Furthermore, this method also includes using a discriminator to update the parameters of the first-stage generator, the second-stage generator, and the multilayer perceptron in the vector encoding during the training phase;

[0044] The loss function during the training phase consists of the generator loss and the discriminator loss.

[0045] The expression for generator loss is:

[0046]

[0047]

[0048]

[0049]

[0050] The discriminator loss is expressed as follows:

[0051]

[0052]

[0053] In the formula, Indicates generator loss. Indicates the resistance loss coefficient. Indicating resistance to loss, Represents the node loss coefficient. Indicates node loss. This represents the loss coefficient of the generated data. The loss during data generation is represented by M, the total number of samples in the batch is represented by D(*), the probability that the discriminator network predicts whether the input is real traffic data is represented by D(*), and the number of node categories is represented by K. This represents the one-hot encoding of the actual node label. L represents the probability that the generator predicts for this node. rec The loss represents the sum of the labels and the generated nodes, where T represents the sequence length. This represents the actual value of the traffic data for the i-th sample at time step t. This represents the generated traffic data value of the i-th sample at time step t. Indicates discriminator loss. This indicates whether the loss is true or false.

[0054] According to another aspect of the present invention, a system for implementing an industrial honeypot network based on a multi-core power IED device is provided, including a traffic preprocessing module, a honeypot data distribution module, an attack data forwarding module, and an attack response module;

[0055] Among them, the traffic preprocessing module is used to preprocess the traffic using the FPGA device of the power IED equipment, and redirect the preprocessed suspicious traffic to the processor core of the power IED equipment;

[0056] The dense network data distribution module is used to generate a multi-dimensional vector of several distribution nodes and mimicry data based on a one-step two-stage dense network data distribution algorithm, and to determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0057] The attack data forwarding module is used to forward attack data to associated power IED devices by combining the distribution node and mimicry data with the honeypot network kernel of the power IED device processor, and to generate mimicry data corresponding to the attack data using the honeypot client of the associated power IED device.

[0058] The attack response module is used to utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source, thereby achieving a deceptive response to the attacker.

[0059] The beneficial effects of this invention are as follows:

[0060] 1) This invention can fully utilize the multi-core processor computing power of IED devices and combine them with a secure network client server to build a distributed, high-computing-power industrial honeypot defense system without affecting the operation of existing industrial control systems. This enables the one-step generation of captured data and distribution nodes under the premise of local data security, and realizes real-time analysis, rapid response and effective deception of attack traffic, thereby fundamentally improving the overall security protection level of industrial control systems.

[0061] 2) This invention designs a one-step, two-stage honeypot data distribution algorithm, integrating a pre-trained model and an LSTM model to achieve distribution node prediction, one-step generation of distributed data, and two-stage distributed deployment. In the deployment phase, the algorithm generator is decomposed into two parts. The first part, the one-stage generator, is deployed on the local IED device, where four data formats are vectorized and encoded before being uploaded to the honeypot client to prevent data leakage during transmission. The second part, the two-stage generator, is deployed on the cloud-based honeypot client. It includes position embedding of the output vectors from the first-stage generator and a generation model for generating mimicry data and predicting forwarding nodes. The generated mimicry data can be forwarded to associated IED devices according to the forwarding nodes, forming a honeypot network. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Fig. 1 This is a schematic diagram illustrating the principle of a method for implementing an industrial honeypot network based on a multi-core power IED device according to an embodiment of the present invention;

[0064] Fig. 2 This is a schematic diagram illustrating the principle of a single-stage, two-phase honeypot network data distribution algorithm in a method for implementing an industrial honeypot network based on a multi-core power IED device according to an embodiment of the present invention.

[0065] Fig. 3 This is a schematic diagram of the honeypot structure deployed on the idle core of the power industrial control IED device in a method for realizing an industrial honeypot network based on multi-core power IED devices according to an embodiment of the present invention. Detailed Implementation

[0066] To further illustrate the various embodiments, the present invention provides accompanying drawings, which are part of the disclosure of the present invention. These drawings are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementation methods and the advantages of the present invention. The components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0067] According to an embodiment of the present invention, a method for implementing an industrial honeypot network based on a multi-core power IED device is provided.

[0068] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments, such as... Figs. 1-3 As shown, according to an embodiment of the present invention, a method for implementing an industrial honeypot network based on multi-core power IED devices is provided, comprising the following steps:

[0069] S1. Use the FPGA device of the power IED equipment to preprocess the traffic, and redirect the preprocessed suspicious traffic to the processor core of the power IED equipment;

[0070] The process of preprocessing traffic using the FPGA device of the power IED equipment and redirecting suspicious traffic to the processor core of the power IED equipment includes the following steps:

[0071] S11. Receive data uploaded using a preset protocol using a power IED device, and filter the uploaded data using a preset access control whitelist;

[0072] S12. Based on traffic determination and redirection technology, traffic identification is performed on the filtered data, and suspicious traffic is redirected and forwarded to the corresponding kernel of the power IED device processor according to the identification results.

[0073] Specifically, based on traffic determination and redirection technology, the filtered data is identified, and suspicious traffic is redirected and forwarded to the corresponding kernel of the power IED device processor according to the identification results, including the following steps:

[0074] S121. Use a pre-built logistic regression model to identify abnormal traffic in the filtered data, obtain the probability that the data is abnormal traffic, and identify abnormal traffic based on the comparison result between the probability of abnormal traffic and the preset probability threshold.

[0075] S122. Normal traffic is forwarded to the functional component kernel of the power IED device processor through redirection technology, and the normal traffic after network storm suppression and DDoS protection is processed for business purposes; abnormal traffic is forwarded to the honeypot network kernel of the power IED device processor.

[0076] In this embodiment, the preprocessing includes access control, discrimination and redirection, network storm suppression, DDoS protection, and traffic forwarding. Normal data traffic after preprocessing is forwarded to processor cores 0 and 1. Cores 0 and 1 constitute functional business components, while idle cores 2 and 3 constitute a honeypot system. Core 0 provides tasks such as data collection, logging, processing, and communication for business data; core 1 deploys human-computer interaction programs to execute normal business services.

[0077] On the FPGA device, traffic is identified and redirected. Traffic deemed abnormal is redirected and forwarded to core 2 of the honeypot on the IED device. The honeypot is deployed on the communication board of the power IED device. A background data processing module runs on core 2, performing data acquisition and deploying a one-step, two-stage encrypted network data distribution algorithm. Core 3 runs a real-time interaction module, which marks (e.g., whether it's encrypted network client data), encapsulates, and communicates with adjacent IED devices. Core 3 also deploys a real-time interaction module for marking, encapsulating, and interacting with encrypted network data.

[0078] Specifically, when an IED device receives data transmitted over protocols such as TCP / IP and UDP, it first filters the data using an access control whitelist, and then identifies malicious traffic (i.e., abnormal traffic). If the traffic is normal, it passes through modules such as network storm suppression and DDoS protection before entering the functional modules for business processing. If the traffic is malicious, it is forwarded to the background data processing module of the honeypot system on the local host. These modules are responsible for handling network attacks, thereby ensuring the stable operation of the IED device under high load conditions.

[0079] Traffic identification and redirection: This section has the ability to distinguish between normal and abnormal attack traffic. When a large amount of suspicious traffic from an abnormal IP address is detected, a logistic regression model can be used to accurately identify the attack traffic. (Using vectors...) This represents the characteristics of a single traffic record or data packet in the network. Each of these... These can all represent an attribute of a network data packet. Examples include packet length, packet interval, and protocol type. A binary classifier can be built using a logistic regression model. , Indicates the bias term. Indicates the weighting coefficient. This is represented as an eigenvector. Assume... If this happens, the data packet will be identified as malicious traffic.

[0080] After data packets are processed by the logistic regression model, if malicious traffic is detected, the data acquisition module redirects the flow to the honeypot system, which then forwards it to the backend data processing module on core 2. The backend data processing module performs in-depth behavioral analysis on this abnormal data. If the traffic is determined to be normal, it proceeds to subsequent network traffic protection modules such as network storm suppression and DDoS protection. Network storm suppression can detect multiple indicators such as traffic bursts, abnormal increases in connection numbers, and session duration, suppressing network congestion or device performance anomalies caused by short-term, high-frequency access, ensuring stable transmission of business traffic. DDoS attack protection can adjust protection measures in real time based on protocol characteristics, origin, and other features to filter abnormal sources or threatening access, preventing malicious traffic from reaching business function modules through normal channels.

[0081] S2. Based on the one-step two-stage dense network data distribution algorithm, generate a multi-dimensional vector of several distribution nodes and mimicry data, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0082] In this embodiment, the one-step two-stage dense network data distribution algorithm has the following characteristics: the algorithm model generator is divided into two stages, deployed on different devices respectively; the algorithm simultaneously generates distribution nodes and the mimicry data to be distributed in one step. Specifically, the first-stage generator is deployed on a low-computing-power local IED device, mapping the data into fixed-length vectors through vector encoding and a multilayer perceptron (MLP), and then uploading it to the dense network client. The second-stage generator is deployed on a high-computing-power dense network client. The fixed-length feature vector input data uploaded by the first-stage generator can directly output the distribution nodes and corresponding mimicry data through the second-stage generator.

[0083] Specifically, based on the one-step two-stage dense network data distribution algorithm, a multi-dimensional vector of several distribution nodes and mimicry data is generated, and the distribution nodes and mimicry data are determined according to the probability of the distribution nodes, including the following steps:

[0084] S21. Using the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device, the vector encoding of the input sequence is mapped to a feature vector that meets the length of the two-stage generator, and then uploaded to the honeypot client.

[0085] In this embodiment, firstly, the four types of input sequences pass through a one-stage generator, which includes a vector encoding module to convert the sequences into vectorized representations. Each character in the sequence has the same vector encoding length, and the length of each type of input sequence is the sum of the vector encoding lengths of each character. Then, the encoded vectors converted from the four types of sequences are concatenated and passed through a multilayer perceptron (MLP) to convert the sequences into fixed-length sequences. The MLP output vector is mapped to a vector representation X=(t1,t2,...t) that conforms to the input length of the two-stage generator. n ), t i ∈N,t i This represents the vector encoding of each character, and N represents the vector encoding of all characters. Finally, the vector is uploaded to the secure network client.

[0086] Specifically, the process involves using a one-stage generator deployed in the honeypot network kernel of the power IED device processor to map the vector encoding of the input sequence into a feature vector that conforms to the length of the two-stage generator, and then uploading it to the honeypot client. This includes the following steps:

[0087] S211. Utilize the vector encoding function of the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device to convert the serialized traffic and node information into encoded vectors.

[0088] The traffic and node information includes the network topology information of adjacent power IED devices (T). net Static device information of its own power IED device node node The actual flow sequence S received by the IED device itself self and the simulated data traffic sequence S sent from adjacent power IED devices adj ;

[0089] The node attributes of adjacent IED device network topology information may include device ID, functional role, communication protocol type (such as IEC 60870-5-104, IEC 61850), etc., while edge attributes may include bandwidth, latency, link status (normal / congested / out of service), etc. Example as follows:

[0090] { "nodes": [{"id": "dev_001", "type": "RTU", "protocol": "IEC104"},{"id": "dev_002", "type": "IED", "protocol": "IEC61850"} ], "edges": [{"src":"dev_001", "dst": "dev_002", "latency": 12, "bandwidth": 100},{"src": "dev_002", "dst": "dev_001", "latency": 10, "bandwidth": 95} ]}.

[0091] The static device information attributes of a power IED device node include device manufacturer, model identifier, software version number, protocol stack characteristics, port and interface configuration, and port security policy. See the example below:

[0092] { "manufacturer": "Siemens", "model": "SIPROTEC 5","firmware_version": "V7.80", protocols":["IEC104","IEC61850"],"protocol_stack":{ "iec104_version":"2.1","iec61850_security": true}, "ports": [{"type": "ethernet", "speed": 100, "duplex": "full", "role": "control"},{"type": "ethernet", "speed": 1000, "duplex": "full", "role": "data"}],"security": { "auth": ["certificate", "password"], "remote_mgmt": ["SSH"]}}.

[0093] The attributes of the actual traffic sequence received by the power IED device itself include key information for each traffic packet / frame received by the device, recorded in time series. Typical fields include timestamp, source IP, source port, destination IP, destination port, protocol type, frame size, and content digest (such as CRC or hash). If it is IEC104, it also includes protocol fields such as ASDU type and information object address. Example as follows:

[0094] [{"time": "2025-08-11T14:20:00.100Z", "src": "192.168.1.10", "dst": "192.168.1.20", protocol": "IEC104", "size": 256, "asdu_type": 3, "IEC104": 6814 00 00 00 00 03 01 03 00 01 00 01 00 00 01 64 14 0E 0B 08 65 0A}].

[0095] A sequence of mimicry data traffic sent from a neighboring device, the sequence having a similarity to S self Same data format.

[0096] S212. The converted encoded vectors are concatenated, and the multilayer perceptron in the first-stage generator is used to map the concatenated encoded vectors into feature vectors that conform to the length of the second-stage generator. The mapped feature vectors are then uploaded to the encrypted network client.

[0097] S22. Using a two-stage generator deployed on the encrypted network client, output a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0098] In this embodiment, the encrypted network client deploys a two-stage generator. The two-stage generator receives feature vector input from the perceptron and generates simulated traffic sequence data, the identified distribution node, and the probability (i.e., the credibility) of identifying that distribution node.

[0099] The two-stage generator mainly consists of a pre-trained model G. pre and the task generation module G task Composition. The pre-trained model consists of location embeddings and multi-layer Transformer modules. Each Transformer module contains multiple Attention modules and a feedforward neural network (FNN). The feedforward neural network then transforms the output vector of the pre-trained model into a size that satisfies the input of the generation task module. The generation task module consists of multi-layer LSTM modules, and the output vector undergoes flattening, reshaping, and softmax operations.

[0100] Specifically, using a two-stage generator deployed on the encrypted network client, a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector is output. The determination of distribution nodes and mimicry data based on the probability of distribution nodes includes the following steps:

[0101] S221. Using the pre-trained model in the two-stage generator deployed on the encrypted network client, positional information is added to the feature vector, and global temporal features of the feature vector are extracted.

[0102] Specifically, the process of adding positional information to feature vectors and extracting global temporal features of feature vectors using a pre-trained model deployed in a two-stage generator on a secure network client includes the following steps:

[0103] S2211. Generate a fixed-position encoding vector using sine and cosine functions, and superimpose the fixed-position encoding vector with the input feature vector to obtain a feature vector X containing positional information. pos =X+PE(pos), where X represents the input before vector encoding, and PE(pos) represents the vector encoding for odd and even positions;

[0104] The expression for the fixed-position encoding vector is:

[0105]

[0106] In the formula, This represents the vector encoding at even-numbered positions, where pos represents the word's position in the sequence, and i represents the dimension index. Representing the dimension of word vectors, Use sin(*) for even numbers and cos(*) for odd numbers. This represents the vector encoding at odd positions;

[0107] S2212. Input the feature vector containing location information into a multi-layer Transformer module, and use the multi-head self-attention and feedforward neural network in each Transformer module to extract global temporal features step by step to obtain a feature vector X containing global temporal features. trans .

[0108] S222. Using the generation task module in the two-stage generator deployed on the encrypted network client, the temporal dependency of the feature vector is processed and the feature vector is converted into the target output format to obtain a multi-dimensional vector matrix.

[0109] Specifically, by utilizing the generation task module in the two-stage generator deployed on the encrypted network client, the temporal dependencies of feature vectors are processed and the feature vectors are transformed into the target output format to obtain a multidimensional vector matrix, including the following steps:

[0110] S2221. Utilize the modeling capability of long short-term memory networks for time-series data to learn the mapping relationship between feature vectors containing global time-series features and distribution nodes and pseudo-data, and generate initial multi-dimensional output vectors.

[0111] S2222: Flatten the initial multidimensional output vector, transform its dimension size, and convert it into the preset target output format after calculation by the Softmax function to obtain a multidimensional vector matrix;

[0112] The expression for the multidimensional vector matrix is:

[0113]

[0114] In the formula, Represents a multidimensional vector matrix. This indicates that the output is a real number. The output vector matrix represents the size of a single set, m represents the length of the output control flow data, s represents the encoding length of word vector encoding for letters and symbols, n represents the number of output dimension matrix sequences, i.e., hidden dimensions, k represents the size of the hidden vectors in the output sequence, and b represents the batch size.

[0115] S223. Based on the multidimensional vector matrix, determine the multidimensional vectors of several distribution nodes and mimicry data, and determine the final distribution nodes and mimicry data according to the preset probability threshold of the distribution nodes.

[0116] Specifically, determining the multidimensional vectors of several distribution nodes and mimicry data based on a multidimensional vector matrix, and determining the final distribution nodes and mimicry data according to a preset probability threshold for the distribution nodes includes the following steps:

[0117] S2231. Based on the preset distribution node probability threshold, filter out data rows in the multidimensional vector matrix whose number of probability columns is less than the distribution node probability threshold. When the probability column values ​​of all data rows are less than the distribution node probability threshold, there is no need to forward them.

[0118] S2232. Among the data rows that have been filtered out and retained, select the data rows with the largest probability column in the hidden dimension in turn, and skip the data rows that have been discarded in the hidden dimension; take all the selected data rows with the largest probability column as the final distribution nodes and pseudo data.

[0119] Specifically, the preset distribution node probability threshold hyperparameter Discard the output vector matrix For rows with probability column values ​​below a threshold, discard the entire row. At this point, the number of remaining data rows is k. Then, among the remaining data rows, in the order of 1, 2, 3...k, the data rows with the largest probability column in the hidden n dimensions are selected sequentially in dimension k, and the data rows discarded in the hidden n dimensions are skipped. The selected data rows with the largest probability columns are the final distributed data associated with the IED device nodes and data. If the probability column values ​​of all data rows are lower than the preset threshold, no forwarding is required.

[0120] The associated IED device receives the distributed data and analyzes whether the requested data exists on the local device. If it exists, the associated IED device adds noise perturbation to the local data and returns it to the attacked device; if it does not exist, it returns empty data. After the attack traffic finishes requesting data, data forwarding is terminated.

[0121] Specifically, the pre-trained model G pre It is a fixed-parameter deep learning network with a multi-layer Transformer structure, pre-trained on a general dataset and used for feature extraction in generative tasks. Each Transformer layer contains multi-head attention and a feedforward neural network (FNN). The input X to the Lth layer is... (L-1) =X pos (L-1) =(X pos,1 (L-1) ,X pos, 2 (L-1) ,...,X pos, n (L-1)After passing through one Transformer module, the Lth layer outputs X. (L) =FNN(Multi-Head(X (L-1) In this context, Multi-Head(*) represents multi-head self-attention, where the parameters are fixed. The pre-trained model extracts feature vectors from the input vectorized data to construct positional associations. The output of the pre-trained model is X. trans =X (L) =FNN(MultiHead(X (L-1) The output is used as the generation task module G. task Input.

[0122] Generate task module G task Composed of multiple LSTM modules, this architecture is reconstructed specifically for the characteristics and output format of this dataset, used to learn and construct the mapping between input and output vectors. The LSTM module output undergoes Flatten, Reshape, and softmax operations to transform the output into a probability distribution. The output is... Where b is the batch size, k is the size of the hidden vector of the output sequence, and n is the number of n-dimensional sequences in the output. Let be the size of a single output vector, and s be the encoding length for word vector encoding of letters, symbols, etc. id1, id2, ..., id n The node representing the data output, each output node has an ID. n Size is S nm This represents each output mimicry data point, and each output mimicry data point S... 1,1 ,S 1,2 ,...,S (N-1),(M-1) S n,m Size is .

[0123] After the above operations, the output is Size matrix, This represents the node vector representation of the n output distribution nodes. The returned values ​​are n control flow data of length m bits, with each control flow bit having a length of s.

[0124] Furthermore, this invention also includes using a discriminator to determine the authenticity of the generated mimicry data. The discriminator is deployed only during the training phase and is used to update the parameters of the generator network and the MLP in the vector encoding. The discriminator module is not deployed during the actual training phase.

[0125] The loss function during the training phase consists of the generator loss and the discriminator loss.

[0126] The expression for generator loss is:

[0127]

[0128]

[0129]

[0130]

[0131] The discriminator loss is expressed as follows:

[0132]

[0133]

[0134] In the formula, Indicates generator loss. Indicates the resistance loss coefficient. Indicating resistance to loss, Represents the node loss coefficient. Indicates node loss. This represents the loss coefficient of the generated data. The loss during data generation is represented by M, the total number of samples in the batch is represented by D(*), the probability that the discriminator network predicts whether the input is real traffic data is represented by D(*), and the number of node categories is represented by K. This represents the one-hot encoding of the actual node label. L represents the probability that the generator predicts for this node. rec The loss represents the sum of the labels and the generated nodes, where T represents the sequence length. This represents the actual value of the traffic data for the i-th sample at time step t. This represents the generated traffic data value of the i-th sample at time step t. Indicates discriminator loss. This indicates whether the loss is true or false.

[0135] S3. The honeypot network kernel based on the processor of the power IED device combines the distribution node and mimicry data to forward the attack data (the attack data includes information such as the external attack host and the attacked host, request content, etc.) to the associated power IED device, and uses the honeypot client of the associated power IED device to generate mimicry data corresponding to the attack data.

[0136] Specifically, firstly, the honeypot network kernel based on the power IED device processor distributes data to associated IED devices according to the honeypot mimicry data sent by the honeypot client and the distribution nodes. Then, the associated IED device receives the distributed data and analyzes whether its local device can provide the requested data. If it can, the associated IED device adds noise perturbation to the local data and returns it to the attacked device; if not, it returns empty data. Data forwarding terminates after the attack traffic's data request ends.

[0137] S4. Utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source to achieve a deceptive response to the attacker.

[0138] This invention proposes a honeycomb data distribution method and designs a one-step, two-stage honeycomb data distribution algorithm. The generator network is divided into a first-stage generator and a second-stage generator, trained together during model training but deployed separately during deployment. The low-computation-requirement first-stage generator is deployed on the local IED device, vectorizing the local data and uploading it to the honeycomb client, serving both sequence encoding and information encryption purposes. The high-computation-requirement second-stage generator is deployed on the honeycomb client, handling both first-stage vector decryption and model output. The honeycomb data distribution algorithm simultaneously generates honeycomb data distribution nodes and distributes pseudo-data. Loss functions are constructed for paired and unpaired data and summarized as the generator device loss, addressing the issues of dimensional alignment and mapping difficulty in multi-source data. The second-stage generator uses a pre-trained model based on a multi-layer Transformer structure and an LSTM network, improving feature extraction capabilities while reducing the difficulty of loss function convergence. The algorithm does not significantly increase the cost of local device modification, and the network topology of each honeypot host is consistent with the network topology of the real IED device, thus the honeypot network has higher deceptiveness.

[0139] According to another embodiment of the present invention, a system for implementing an industrial honeypot network based on a multi-core power IED device is provided, including a traffic preprocessing module, a honeypot data distribution module, an attack data forwarding module, and an attack response module;

[0140] Among them, the traffic preprocessing module is used to preprocess the traffic using the FPGA device of the power IED equipment, and redirect the preprocessed suspicious traffic to the processor core of the power IED equipment;

[0141] The dense network data distribution module is used to generate a multi-dimensional vector of several distribution nodes and mimicry data based on a one-step two-stage dense network data distribution algorithm, and to determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

[0142] The attack data forwarding module is used to forward attack data to associated power IED devices by combining the distribution node and mimicry data with the honeypot network kernel of the power IED device processor, and to generate mimicry data corresponding to the attack data using the honeypot client of the associated power IED device.

[0143] The attack response module is used to utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source, thereby achieving a deceptive response to the attacker.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for implementing an industrial honeypot network based on multi-core power IED devices, characterized in that, Includes the following steps: S1. Use the FPGA device of the power IED equipment to preprocess the traffic, and redirect the preprocessed suspicious traffic to the processor core of the power IED equipment; S2. Based on the one-step two-stage dense network data distribution algorithm, generate a multi-dimensional vector of several distribution nodes and mimicry data, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes. S3. The honeypot network kernel based on the processor of the power IED device combines the distribution node and the mimicry data to forward the attack data to the associated power IED device, and uses the honeypot client of the associated power IED device to generate mimicry data corresponding to the attack data. S4. Utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source to achieve a deceptive response to the attacker. The step of generating a multi-dimensional vector of several distribution nodes and mimicry data based on a one-step two-stage dense network data distribution algorithm, and determining the distribution nodes and mimicry data according to the probability of the distribution nodes, includes the following steps: S21. Using the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device, the vector encoding of the input sequence is mapped to a feature vector that meets the length of the two-stage generator, and then uploaded to the honeypot client. S22. Using a two-stage generator deployed on the encrypted network client, output a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector, and determine the distribution nodes and mimicry data according to the probability of the distribution nodes.

2. The method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 1, characterized in that, The process of preprocessing traffic using the FPGA device of the power IED equipment and redirecting suspicious traffic to the processor core of the power IED equipment includes the following steps: S11. Receive data uploaded using a preset protocol using a power IED device, and filter the uploaded data using a preset access control whitelist; S12. Based on traffic determination and redirection technology, traffic identification is performed on the filtered data, and suspicious traffic is redirected and forwarded to the corresponding kernel of the power IED device processor according to the identification results.

3. The method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 2, characterized in that, The process of identifying traffic in the filtered data based on traffic determination and redirection technology, and redirecting suspicious traffic to the corresponding kernel of the power IED device processor according to the identification results, includes the following steps: S121. Use a pre-built logistic regression model to identify abnormal traffic in the filtered data, obtain the probability that the data is abnormal traffic, and identify abnormal traffic based on the comparison result between the probability of abnormal traffic and the preset probability threshold. S122. Normal traffic is forwarded to the functional component kernel of the power IED device processor through redirection technology, and the normal traffic after network storm suppression and DDoS protection is processed for business purposes; abnormal traffic is forwarded to the honeypot network kernel of the power IED device processor.

4. The method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 1, characterized in that, The process of using a one-stage generator deployed in the honeypot network kernel of the power IED device processor to map the vector encoding of the input sequence into a feature vector conforming to the length of the two-stage generator and uploading it to the honeypot client includes the following steps: S211. Utilize the vector encoding function of the one-stage generator in the honeypot network kernel deployed in the processor of the power IED device to convert the serialized traffic and node information into encoded vectors. The traffic and node information includes the network topology information of adjacent power IED devices, the static device information of the power IED device nodes, the actual traffic sequence received by the power IED device itself, and the simulated data traffic sequence sent from adjacent power IED devices. S212. The converted encoded vectors are concatenated, and the multilayer perceptron in the first-stage generator is used to map the concatenated encoded vectors into feature vectors that conform to the length of the second-stage generator. The mapped feature vectors are then uploaded to the encrypted network client.

5. The method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 1, characterized in that, The process of using a two-stage generator deployed on a secure network client to output a multi-dimensional vector of several distribution nodes and mimicry data corresponding to the feature vector, and determining the distribution nodes and mimicry data based on the probability of the distribution nodes, includes the following steps: S221. Using the pre-trained model in the two-stage generator deployed on the encrypted network client, positional information is added to the feature vector, and global temporal features of the feature vector are extracted. S222. Using the generation task module in the two-stage generator deployed on the encrypted network client, the temporal dependency of the feature vector is processed and the feature vector is converted into the target output format to obtain a multi-dimensional vector matrix. S223. Based on the multidimensional vector matrix, determine the multidimensional vectors of several distribution nodes and mimicry data, and determine the final distribution nodes and mimicry data according to the preset probability threshold of the distribution nodes.

6. A method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 5, characterized in that, The process of adding positional information to feature vectors and extracting global temporal features of feature vectors using a pre-trained model deployed in a two-stage generator on a secure network client includes the following steps: S2211. Use sine and cosine functions to generate a fixed-position encoding vector, and superimpose the fixed-position encoding vector with the input feature vector to obtain a feature vector containing position information. The expression for the fixed-position encoding vector is: ； In the formula, This represents the vector encoding at even-numbered positions, where pos represents the word's position in the sequence, and i represents the dimension index. P represents the dimension of the word vector. This represents the vector encoding at odd positions; S2212. Input the feature vector containing location information into the multi-layer Transformer module, and use the multi-head self-attention and feedforward neural network in each layer of the Transformer module to extract global temporal features step by step to obtain a feature vector containing global temporal features.

7. A method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 6, characterized in that, The process of utilizing the generation task module in the two-stage generator deployed on the encrypted network client to process the temporal dependency of feature vectors and transform the feature vectors into the target output format to obtain a multidimensional vector matrix includes the following steps: S2221. Utilize the modeling capability of long short-term memory networks for time-series data to learn the mapping relationship between feature vectors containing global time-series features and distribution nodes and pseudo-data, and generate initial multi-dimensional output vectors. S2222: Flatten the initial multidimensional output vector, transform its dimension size, and convert it into the preset target output format after calculation by the Softmax function to obtain a multidimensional vector matrix; The expression for the multidimensional vector matrix is: ； In the formula, Represents a multidimensional vector matrix. This indicates that the output is a real number. The output vector matrix represents the size of a single set, m represents the length of the output control flow data, s represents the encoding length of the word vector encoding for the letter symbols, n represents the number of output dimension matrix sequences, k represents the size of the output sequence hidden vectors, and b represents the batch size.

8. A method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 5, characterized in that, The process of determining a number of distribution nodes and mimicry data based on a multidimensional vector matrix, and determining the final distribution nodes and mimicry data according to a preset probability threshold for the distribution nodes, includes the following steps: S2231. Based on the preset distribution node probability threshold, filter out data rows in the multidimensional vector matrix whose number of probability columns is less than the distribution node probability threshold. When the probability column values ​​of all data rows are less than the distribution node probability threshold, there is no need to forward them. S2232. Among the data rows that have been filtered out and retained, select the data rows with the largest probability column in the hidden dimension in turn, and skip the data rows that have been discarded in the hidden dimension; take all the selected data rows with the largest probability column as the final distribution nodes and pseudo data.

9. A method for implementing an industrial honeypot network based on multi-core power IED devices according to claim 1, characterized in that, The method also includes using a discriminator to update the parameters of the one-stage generator, the two-stage generator, and the multilayer perceptron in the vector encoding during the training phase; The loss function during the training phase consists of the generator loss and the discriminator loss. The expression for generator loss is: ； ； ； ； The discriminator loss is expressed as follows: ； ； In the formula, Indicates generator loss. Indicates the resistance loss coefficient. Indicating resistance to loss, Represents the node loss coefficient. Indicates node loss. This represents the loss coefficient of the generated data. The loss during data generation is represented by M, the total number of samples in the batch is represented by D(*), the probability that the discriminator network predicts whether the input is real traffic data is represented by D(*), and the number of node categories is represented by K. This represents the one-hot encoding of the actual node label. L represents the probability that the generator predicts for this node. rec The loss represents the sum of the labels and the generated nodes, where T represents the sequence length. This represents the actual value of the traffic data for the i-th sample at time step t. This represents the generated traffic data value of the i-th sample at time step t. Indicates discriminator loss. This indicates whether the loss is true or false.

10. A system for realizing an industrial honeypot network based on multi-core power IED devices, characterized in that, It includes a traffic preprocessing module, a secure network data distribution module, an attack data forwarding module, and an attack response module; The traffic preprocessing module is used to preprocess the traffic using the FPGA device of the power IED device, and redirect the preprocessed suspicious traffic to the processor core of the power IED device. The dense network data distribution module is used to generate a multi-dimensional vector of several distribution nodes and mimicry data based on a one-step two-stage dense network data distribution algorithm, and to determine the distribution nodes and mimicry data according to the probability of the distribution nodes. The attack data forwarding module is used to forward attack data to associated power IED devices based on the honeypot network kernel of the power IED device processor, combined with distribution nodes and mimicry data, and to generate mimicry data corresponding to the attack data using the honeypot client of the associated power IED device. The attack response module is used to utilize the honeypot network kernel of the processor of the attacked power IED device, integrate the mimicry data returned by the honeypot client, generate the final attack response and send it to the attack source, thereby achieving a deceptive response to the attacker.

Images