Industrial network flow anomaly detection and tracing method, device and equipment and storage medium

Abstract

The invention discloses an industrial network traffic anomaly detection and source tracing method, device and equipment and a storage medium, and relates to the technical field of artificial intelligence, and the method comprises the steps: converting a traffic data package of an industrial network into a process characteristic analysis software package, extracting a plurality of dimension statistical features from the process characteristic analysis software package, and storing the extracted statistical features in a database; converting the statistical characteristics of each dimension into table data; performing classification coding processing on connection behavior features in the table data to obtain a target coding result, normalizing statistical features to obtain a normalization result, converting time features to obtain a conversion result, obtaining a mixed feature vector, constructing a DAGMM model comprising a self-codec and a Gaussian mixture model by using an unsupervised mode, and obtaining a mixed feature vector; performing anomaly detection on the mixed feature vector to obtain an anomaly detection result; and if the traffic is abnormal, performing reverse decoding on the mixed feature vector by using a tracing algorithm to obtain a tracing result, thereby improving the efficiency of performing anomaly detection and tracing on the industrial network traffic.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and storage medium for anomaly detection and source tracing of industrial network traffic. Background Technology

[0002] Currently, critical infrastructure such as energy, refining, and transportation are the nerve centers of national stable operation and are of paramount importance to my country's cybersecurity. With the advancement of automation, interconnection, and intelligent construction of large-scale national infrastructure equipment (intelligent substations, intelligent process industrial systems, and industrial distributed control systems), cybersecurity issues are becoming increasingly prominent. In recent years, a series of cyberattacks targeting national critical infrastructure have caused enormous economic losses and irreversible damage to society. These top hackers frequently infiltrate the communication networks of key substations, process industrial systems, and even nuclear power plants using more covert, efficient, and destructive intrusion methods. Currently, the defense and hardening of national critical infrastructure network systems has risen to the national strategic level, and industrial network communication traffic analysis is widely recognized as the most promising solution to industrial system security problems. Intelligent communication traffic analysis is an interdisciplinary solution that organically combines traditional internet security solutions with the characteristics of modern power communication networks and industrial control systems.

[0003] According to relevant reports and literature, all attacks targeting industrial systems manifest on communication networks. Most attacks on industrial networks result in damage to the related communication networks, with different attack types causing varying degrees and locations of damage. Attacks spearheaded by "Blackenergy," employing combined attacks and a series of malicious code injections, can paralyze communication networks, block critical channels, manipulate data acquisition and monitoring systems, and cause delayed recovery and state blinding of control systems. Because data traffic in industrial networks exhibits different traffic patterns and characteristics similar to internet traffic, statistical features of industrial network traffic can be extracted and mathematical models generated for analysis, allowing for the development and understanding of the characteristics of industrial network traffic data. Currently, industrial network traffic analysis techniques widely employ statistical, deep packet inspection, rule-based, supervised learning, and unsupervised learning-based traffic analysis methods. Traffic analysis techniques extract abnormal network events in the operation of industrial control systems and issue alerts for detected threats. However, current anomaly detection in industrial network traffic predominantly relies on supervised learning methods. Supervised learning methods largely depend on datasets of positive samples (data under normal flow) and negative samples (abnormal data). Due to the scarcity of anomaly datasets related to industrial networks, and the significant differences between industrial networks across various industries (with substantial variations in topology, protocols, and included devices), the training effectiveness of supervised learning models needs improvement. Furthermore, the unique characteristics of industrial network traffic data mean that attack traffic targeting different types of industrial networks often differs considerably. Therefore, open-source industrial network traffic data from different industries is not readily applicable and cannot be directly used as training data for models.

[0004] As can be seen from the above, improving the efficiency of anomaly detection and source tracing in industrial network traffic is an urgent problem to be solved. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for anomaly detection and source tracing of industrial network traffic, which can improve the efficiency of anomaly detection and source tracing in the process of industrial network traffic anomaly detection and source tracing. The specific solution is as follows:

[0006] Firstly, this application provides a method for anomaly detection and source tracing in industrial network traffic, including:

[0007] Traffic data packets from an industrial network are collected using the mirror port of a pre-set industrial switch, and the traffic data packets are converted into a process characteristic analysis software package. Then, a traffic analysis tool is used to extract several statistical features from the process characteristic analysis software package, and each of the statistical features is converted into tabular data in tabular format. The tabular data includes connection behavior features, time features, and statistical features.

[0008] The connection behavior features in the table data are classified and encoded to obtain the target encoding result. The statistical features are then normalized using normalization technology to obtain the normalization result. The time features are then transformed based on a preset period to obtain the transformation result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time.

[0009] The target encoding result, the normalization result, and the transformation result are concatenated to obtain a mixed feature vector. A DAGMM model including a self-encoder and a Gaussian mixture model is constructed using an unsupervised method. Then, the DAGMM model is used to perform anomaly detection on the mixed feature vector based on a preset threshold to obtain anomaly detection results.

[0010] If the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain the source tracing result corresponding to the hybrid feature vector, which includes the traffic source IP and traffic source port information.

[0011] Optionally, the step of collecting traffic data packets from the industrial network using the mirror port of a preset industrial switch, converting the traffic data packets into a process characteristic analysis software package, then using a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and converting each dimension of statistical features into tabular data in tabular format, includes:

[0012] In an industrial network environment, the corresponding device in the industrial network is determined based on the device type identifier, and the communication source address and destination address corresponding to the industrial network traffic are retrieved based on the device type identifier, so as to determine the communication link between each device based on the communication source address and the destination address.

[0013] The industrial network traffic packets between the devices are collected using a traffic acquisition plugin and through the mirror port of the industrial switch and the communication link, and the industrial network traffic packets are saved as a process characteristic analysis software package in process characteristic analysis software package format;

[0014] The process characteristic analysis software package is subjected to multidimensional statistical feature extraction using a flow feature extraction tool to obtain several dimensions of statistical features. Each dimension of statistical features is saved as a comma-separated value file and then converted into tabular data in tabular data format.

[0015] The dimensional statistical features include general traffic features, features related to data table packet size, packet and byte rate features, packet arrival interval features, features related to packet header, features related to packet payload, and traffic status features.

[0016] The general characteristics include the duration of the traffic, the total number of forward messages, the total number of backward messages, the total number of bytes sent, and the total number of bytes received; the characteristics related to packet size include the minimum, maximum, average, standard deviation, and variance of the packet size, the minimum, maximum, average, and standard deviation of the forward packet size, the minimum, maximum, average, and standard deviation of the backward packet size, and the byte ratio of the backward messages to the forward messages; the forward messages are messages sent from the initiating device to the responding device, and the backward messages are messages sent from the responding device to the initiating device;

[0017] The data packet and byte rate characteristics include byte rate, packet rate, forward packet rate, and backward packet rate; the data packet arrival interval characteristics include the minimum, maximum, average, and standard deviation of the data packet arrival interval, the minimum, maximum, average, and standard deviation of the backward data packet arrival interval, the minimum, maximum, average, and standard deviation of the forward data packet arrival interval, and the sum of all backward and forward arrival intervals;

[0018] The header-related features include the number of push and emergency flags in the forward transmission control protocol, the number of push and emergency flags in the backward transmission control protocol, the total number of packets in the transmission control protocol messages containing end flag, synchronization flag, reset flag, acknowledgment flag, and congestion window reduction flag, and the number of explicit congestion notification packets.

[0019] The characteristics related to packet payload include the average payload size of all traffic packets, the average payload size of forward packets, the average payload size of backward packets, the average number of packets and the average number of bytes in bursts of consecutive forward packets, the average number of packets and the average number of bytes in bursts of consecutive backward packets, the number of bytes in the initial burst of forward packets, the number of bytes in the initial burst of backward packets, the number of backward packets with payloads, and the minimum payload size of backward packets.

[0020] The state characteristics of the flow include the minimum, maximum, average, and standard deviation of the flow activity time, as well as the minimum, maximum, average, and standard deviation of the idle time.

[0021] Optionally, the step of classifying and encoding the connection behavior features in the table data to obtain the target encoding result, and then normalizing the statistical features using normalization techniques to obtain the normalization result, and finally transforming the time features based on a preset period to obtain the transformation result, includes:

[0022] In the industrial network, the connection behavior characteristics of the table data are extracted through the communication link, the corresponding connection port, the protocol used, and the connection time to obtain the connection behavior characteristics.

[0023] Determine whether the transmission of the industrial network traffic uses a preset public port. If the transmission of the industrial network traffic uses a preset public port, then use binary one-hot encoding technology to encode the connection behavior characteristics using the preset public port to obtain the first initial encoding result.

[0024] The virtual variable transformation is performed on the connection behavior characteristics of other connections that do not use the preset public port using the one-hot encoding technique to obtain the virtual variable transformation result;

[0025] The first initial encoding result is classified and encoded based on the protocol type in the connection behavior characteristics to obtain a second initial encoding result, and the target encoding result is determined based on the first initial encoding result and the second initial encoding result.

[0026] The normalization technique is used to limit the numerical values ​​of each element corresponding to the statistical feature to a preset range to obtain the normalization result. Then, the timestamp corresponding to the time feature is converted into a preset time period format to obtain the conversion result.

[0027] Optionally, the step of concatenating the target encoding result, the normalization result, and the transformation result to obtain a mixed feature vector, and constructing a DAGMM model including a self-encoder and a Gaussian mixture model using an unsupervised approach, includes:

[0028] The target encoding result, the normalization result, and the transformation result are concatenated to obtain the corresponding hybrid feature vector. Then, the autoencoder in the compression network is used to map the hybrid feature vector to a preset space that meets the preset low-dimensional conditions to obtain the mapping result.

[0029] The mapping result is reconstructed using the self-decoder in the compression network to obtain a reconstruction result, and the reconstruction error between the reconstruction result and the traffic data packet is determined. The mapping result and the reconstruction error are then combined to obtain a combined result.

[0030] The combined result is input into the estimation network to determine the membership degree of each Gaussian mixture component of the combined result using the Gaussian mixture model in the estimation network, thereby obtaining the corresponding membership degree. Based on each membership degree, the Gaussian mixture model parameters corresponding to the Gaussian mixture model, including the mixing probability, mean vector, and covariance matrix parameters, are determined. Then, the energy function value corresponding to the traffic data packet is determined based on the Gaussian mixture model parameters.

[0031] Determine the reconstruction loss term corresponding to the reconstruction error, the likelihood term corresponding to the energy function value, and the regularization term corresponding to the covariance matrix parameter, and construct a minimization objective function based on the reconstruction loss term, the likelihood term, and the regularization term;

[0032] The compressed network and the estimated network are optimized using the minimization objective function to obtain the optimized compressed network and the estimated network. A DAGMM model including the optimized compressed network and the estimated network is then constructed using an unsupervised approach.

[0033] The autoencoder and the autodecoder each include several fully connected layers, and the corresponding activation functions include hyperbolic tangent function and no activation function.

[0034] Optionally, the step of constructing a DAGMM model including a self-encoded decoder and a Gaussian mixture model in an unsupervised manner, and then using the DAGMM model and based on a preset threshold to perform anomaly detection on the mixed feature vector to obtain anomaly detection results includes:

[0035] Historical industrial network traffic data is acquired to train the DAGMM model in an unsupervised manner during the offline training phase, thereby obtaining the trained DAGMM model. The model file corresponding to the trained DAGMM model is then saved as an offline file in a preset markup language format or an extensible markup language format. Each piece of historical industrial network traffic data is network traffic data that meets preset normal conditions.

[0036] During the online detection phase, industrial network traffic is collected in real time, and features are extracted from the hybrid feature vector using a preset traffic analysis tool. Based on the obtained feature extraction results, a hybrid feature vector is constructed. Then, the offline file is loaded to perform real-time anomaly detection on the hybrid feature vector using the Gaussian mixture model and based on a preset threshold, thereby obtaining real-time anomaly detection results.

[0037] Optionally, the step of using the DAGMM model and performing anomaly detection on the hybrid feature vector based on a preset threshold to obtain anomaly detection results includes:

[0038] The energy function value corresponding to the traffic data packet is determined by using a preset energy function formula, and anomaly analysis is performed on the energy function value sequence of historical samples based on the over-threshold peak method in extreme value theory to obtain anomaly analysis results. The threshold with the largest value among the thresholds in the anomaly analysis results is set as the initial threshold, and all over-threshold samples exceeding the initial threshold are extracted from the mixed feature vector based on the initial threshold.

[0039] The generalized Pareto distribution is used to fit each of the overthreshold samples to obtain the corresponding scale parameters and shape parameters. The initial threshold is then optimized using the quantile function based on the scale parameters, the shape parameters, the preset tail probability, the total number of samples in the preset calibration set, and the number of overthreshold samples to obtain the preset threshold.

[0040] The energy function value is compared with the preset threshold to obtain a comparison result. If the comparison result indicates that the energy function value is greater than the preset threshold, the traffic data packet is determined to be abnormal.

[0041] Optionally, if the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain a source tracing result corresponding to the hybrid feature vector, including the traffic source IP and traffic source port information, including:

[0042] If the anomaly detection result indicates an anomaly, then the traffic data packet is inversely transformed using one-hot coding technology to obtain the source address index information and destination address index information corresponding to the traffic data packet;

[0043] The source address index information and the destination address index information are matched with a preset address list to obtain a matching result corresponding to the traffic data packet, including the source address and the destination address. Then, a preset one-hot encoding technique is used to determine whether the source port corresponding to the source address and the destination port corresponding to the destination address are common ports, and a judgment result is obtained.

[0044] The protocol type corresponding to the traffic data packet is determined, and the source address, destination address, source port, destination port, protocol type and judgment result are combined to obtain the five-tuple feature corresponding to the traffic data packet. The five-tuple feature is used to perform fine-grained tracing and positioning of the traffic data packet to obtain the source tracing result.

[0045] Secondly, this application provides an anomaly detection and tracing device for industrial network traffic, comprising:

[0046] The traffic data packet acquisition module is used to collect traffic data packets of the industrial network using the mirror port of a preset industrial switch, convert the traffic data packets into a process characteristic analysis software package, and then use a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and convert each dimension of statistical features into tabular data in tabular data format; the tabular data includes connection behavior features, time features, and statistical features;

[0047] The conversion result determination module is used to classify and encode the connection behavior features in the table data to obtain the target encoding result, and to normalize the statistical features using normalization technology to obtain the normalization result. Then, the time features are converted based on a preset period to obtain the conversion result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time.

[0048] An anomaly detection result determination module is used to concatenate the target encoding result, the normalization result, and the transformation result to obtain a mixed feature vector, and to construct a DAGMM model including a self-encoder and a Gaussian mixture model in an unsupervised manner. Then, anomaly detection is performed on the mixed feature vector using the DAGMM model and based on a preset threshold to obtain an anomaly detection result.

[0049] The source tracing result determination module is used to perform reverse decoding on the hybrid feature vector using a source tracing algorithm if the anomaly detection result indicates an anomaly, to obtain a source tracing result corresponding to the hybrid feature vector, including traffic source IP and traffic source port information.

[0050] Thirdly, this application provides an electronic device, comprising:

[0051] Memory, used to store computer programs;

[0052] A processor is used to execute the computer program to implement the aforementioned method for anomaly detection and tracing of industrial network traffic.

[0053] Fourthly, this application provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned method for anomaly detection and tracing of industrial network traffic.

[0054] As can be seen from the above, before performing anomaly detection and source tracing of industrial network traffic, this application needs to collect traffic data packets of the industrial network using the mirror port of a preset industrial switch, convert the traffic data packets into a process characteristic analysis software package, and then use a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and convert each dimension of statistical features into tabular data in tabular format; classify and encode the connection behavior features in the tabular data to obtain the target encoding result, and use normalization technology to normalize the statistical features to obtain the normalization result, and then transform the time features based on a preset period to obtain the transformation result; concatenate the target encoding result, the normalization result and the transformation result to obtain a mixed feature vector, and use an unsupervised method to construct a DAGMM model including a self-encoded decoder and a Gaussian mixture model, and then use the DAGMM model and a preset threshold to perform anomaly detection on the mixed feature vector to obtain the anomaly detection result; if the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the mixed feature vector to obtain the source tracing result corresponding to the mixed feature vector, including the traffic source IP and traffic source port information.

[0055] Therefore, this application first needs to collect traffic data packets from the industrial network using the mirror port of a pre-set industrial switch, and convert the traffic data packets into a process characteristic analysis software package. Then, it uses a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and converts each dimension of statistical features into tabular data in tabular format. Second, it performs classification and encoding processing on the connection behavior features in the tabular data to obtain the target encoding result, and uses normalization technology to normalize the statistical features to obtain the normalization result. Then, it transforms the time features based on a pre-set period to obtain the transformation result. Then, it concatenates the target encoding result, the normalization result, and the transformation result to obtain a mixed feature vector, and uses an unsupervised method to construct a DAGMM model including a self-coded decoder and a Gaussian mixture model. Then, it uses the DAGMM model and a pre-set threshold to perform anomaly detection on the mixed feature vector to obtain the anomaly detection result. Finally, if the anomaly detection result indicates an anomaly, it uses a source tracing algorithm to perform reverse decoding on the mixed feature vector to obtain the source tracing result corresponding to the mixed feature vector, including the traffic source IP and traffic source port information. This improves the efficiency of anomaly detection and tracing in industrial network traffic, thereby enhancing the user experience. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0057] Figure 1 This is a flowchart of an anomaly detection and source tracing method for industrial network traffic disclosed in this application;

[0058] Figure 2 This is a flowchart illustrating a specific feature engineering process disclosed in this application;

[0059] Figure 3 This is a schematic diagram of the structure of a specific DAGMM model disclosed in this application;

[0060] Figure 4 This is a schematic diagram of the overall structure of a specific abnormal behavior detection method disclosed in this application;

[0061] Figure 5 This is a schematic diagram illustrating the data compression effect of a compression network in a DAGMM disclosed in this application on two datasets; wherein, Figure 5 (a) is a schematic diagram of the data compression effect of the compression network in DAGMM on the mixed feature dataset; Figure 5 (b) is a schematic diagram of the data compression effect of the compression network in DAGMM on the CICIDS2017 dataset;

[0062] Figure 6 This is a schematic diagram of the structure of an industrial network traffic anomaly detection and tracing device disclosed in this application;

[0063] Figure 7 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] Currently, critical infrastructures such as energy, refining, and transportation are the nerve center for the stable operation of the nation and are of paramount importance to my country's cybersecurity. At present, industrial network traffic analysis technologies widely employ statistical, deep packet inspection, rule-based, supervised learning, and unsupervised learning-based traffic analysis methods. However, current anomaly detection in industrial network traffic predominantly relies on supervised learning. Supervised learning largely depends on data from normal traffic flow and anomalous datasets. Due to the scarcity of anomaly datasets related to industrial networks, and the significant differences between industrial networks across different industries—with substantial variations in topology, protocols, and included devices—the training effectiveness of supervised learning models needs improvement. Furthermore, due to the unique characteristics of industrial network traffic data, attack traffic targeting different types of industrial networks often differs significantly. Therefore, open-source industrial network traffic data from different industries is not readily applicable and cannot be directly used as model training data. To address this, this application provides a method for anomaly detection and source tracing in industrial network traffic, which can improve the efficiency of anomaly detection and source tracing in the process.

[0066] See Figure 1 As shown in the figure, this invention discloses a method for anomaly detection and source tracing of industrial network traffic, including:

[0067] Step S11: Collect traffic data packets of the industrial network using the mirror port of the preset industrial switch, convert the traffic data packets into a process characteristic analysis software package, and then use the traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and convert each dimension of statistical features into tabular data in tabular data format; the tabular data includes connection behavior features, time features and statistical features.

[0068] In this embodiment, the first step is to collect multi-dimensional industrial network traffic. It's worth noting that because industrial network environments are stable and their communication topologies rarely change, devices within their Ethernet networks can discover assets via IP (Internet Protocol) or MAC (Media Access Control Address), making it relatively easy to observe the devices they contain. These devices' IP or MAC addresses can be identified as unique TypeIDs (i.e., the serial numbers identifying the devices). Subsequently, by retrieving the communication source and destination addresses using predefined TypeIDs, the communication link between two devices can be obtained, thereby enabling fine-grained tracking of industrial network behavior.

[0069] Furthermore, in this embodiment, a Process Characterization Analysis Package (PCAP) for industrial network traffic can be customized and saved using the "T-shark" plugin via the mirror port of an industrial switch, and then further converted into statistical features. The CICFlowMeter tool (Canadian Institute for Cybersecurity FlowMeter, an open-source network traffic analysis tool) can be used to extract multidimensional statistical features (typically 80 dimensions) of network traffic and save them as a .csv file. It generally has offline or online modes. The online mode can monitor network traffic in real time and generate multidimensional features, saving them locally as a .csv file after monitoring ends. The offline mode can directly use a .pcap file (network card traffic data can be obtained using Wireshark or the traffic sniff function, in .pcap format) as input to convert it into multidimensional statistical features.

[0070] Subsequently, based on the acquisition of the aforementioned multi-dimensional industrial network traffic characteristics, this embodiment of the application can summarize the reduced 70-dimensional data output by the CICFlowMeter tool. Each flow has an initiator and a responder. Forward packets refer to packets sent from the initiator to the responder, while backward packets refer to packets sent from the responder to the initiator. The 70-dimensional characteristics of network traffic for each connection link within a certain time period are summarized.

[0071] The statistical characteristics include:

[0072] (1) General characteristics of a stream (5): the duration of the entire stream, i.e. the interval between the first and last packets, the total number of forward / backward messages, and the total number of bytes sent / received;

[0073] (2) Characteristics related to packet size (14): minimum, maximum, average, standard deviation and variance of packet size; minimum, maximum, average and standard deviation of forward / backward packet size; and byte ratio of backward message to forward message.

[0074] (3) Data packets and byte rate (4): byte rate, calculated as the total number of bytes divided by the duration; packet rate, i.e., the total number of packets divided by the duration; forwarding packet rate; and lagging packet rate.

[0075] (4) Data packet arrival interval (14): minimum, maximum, average and standard deviation of data packet arrival interval, minimum, maximum, average and standard deviation of backward / forward data packet arrival interval, and the sum of all backward / forward arrival intervals;

[0076] (5) Features related to the packet header (14): the number of PSH / URG flags in the forward / backward TCP packets, the total number of packets in the TCP packets containing FIN / SYN / RST / ACK / CWR flags respectively, and the number of ECE packets;

[0077] (6) Characteristics related to packet payload (11): average payload size of all flow packets, average payload size of forward / backward messages, average number of packets and average number of bytes in burst traffic in nearly consecutive forward / backward packets, number of bytes in the initial burst traffic of forward / backward packets, number of backward packets with payload, and minimum payload size of backward packets.

[0078] (7) Status characteristics of flow (8): minimum, maximum, average and standard deviation of active and idle time.

[0079] Specifically, the process involves collecting industrial network traffic data packets using the mirror port of a pre-defined industrial switch, converting these packets into a process characteristic analysis software package, and then using a traffic analysis tool to extract several statistical features from the package. These features are then converted into tabular data. This process may include: identifying the corresponding devices in the industrial network based on device type identifiers, retrieving the communication source and destination addresses corresponding to the industrial network traffic based on these identifiers, and determining the communication links between devices based on these addresses; collecting industrial network traffic packets between devices using a traffic acquisition plugin and through the mirror port of the industrial switch and the communication links, and saving the traffic packets as a process characteristic analysis software package in process characteristic analysis software package format; using a traffic feature extraction tool to perform multi-dimensional statistical feature extraction on the process characteristic analysis software package, obtaining several statistical features, saving each feature as a comma-separated value file, and then converting these features into tabular data.

[0080] In one specific implementation, the dimensional statistical features include general traffic characteristics, features related to data table packet size, packet and byte rate characteristics, packet arrival interval characteristics, header-related features, packet payload-related features, and traffic state characteristics; general features include traffic duration, total number of forward messages, total number of backward messages, total number of bytes sent, and total number of bytes received; packet size-related features include the minimum, maximum, average, standard deviation, and variance of packet sizes, the minimum, maximum, average, and standard deviation of forward packet sizes, the minimum, maximum, average, and standard deviation of backward packet sizes, and the byte ratio of backward messages to forward messages; forward messages are messages sent from the initiating device to the responding device, and backward messages are messages sent from the responding device to the initiating device; packet and byte rate characteristics include byte rate, packet rate, forward packet rate, and backward packet rate; packet arrival interval characteristics include the minimum, maximum, average, and standard deviation of packet arrival intervals, the minimum, maximum, average, and standard deviation of backward packet arrival intervals, and the minimum, maximum, average, and standard deviation of forward packet arrival intervals. The characteristics related to the packet header include the mean and standard deviation, as well as the sum of all arrival intervals for both forward and backward traffic; header-related characteristics include the number of Transmission Control Protocol (TCP) push and emergency flags in forward messages, the number of TCP push and emergency flags in backward messages, the total number of packets containing end flag, synchronization flag, reset flag, acknowledgment flag, and congestion window reduction flag in TCP messages, and the number of explicit congestion notification packets; packet payload-related characteristics include the average payload size of all traffic packets, the average payload size of forward messages, the average payload size of backward messages, the average number of packets and bytes in bursts of consecutive forward packets, the average number of packets and bytes in bursts of consecutive backward packets, the number of bytes in the initial burst of forward packets, the number of bytes in the initial burst of backward packets, the number of backward packets with payloads, and the minimum payload size of backward packets; traffic status characteristics include the minimum, maximum, average, and standard deviation of traffic activity time, and the minimum, maximum, average, and standard deviation of idle time.

[0081] Step S12: Classify and encode the connection behavior features in the table data to obtain the target encoding result, and normalize the statistical features using normalization technology to obtain the normalization result. Then, transform the time features based on a preset period to obtain the transformation result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time.

[0082] In this embodiment, the feature engineering process is as follows: Figure 2As shown in the figure. Connection behavior characteristics can be represented by connection links, connection ports, the protocol used, and connection time. These characteristics contain available information about normal network behavior. Because industrial network environments are relatively fixed, the most frequently used ports and the most likely connection durations generally do not change. One-hot encoding can be used to classify and encode connection behavior characteristics, ensuring the integrity of the output vector. The common port used in the control system can be used as the "whether a common port is used" parameter in binary one-hot encoding to characterize connection behavior characteristics. The mixed characteristic case is shown in the figure. Figure 2 As shown (Y represents yes, N represents no). Other connection behavior characteristics can be directly converted into dummy variables using one-hot encoding, and the resulting labels can be saved for subsequent data analysis. Protocols can be classified using specific labels, such as UDP (number 6), TCP (number 17), ICMP (number 55), etc. Furthermore, this embodiment uses a time-division method to convert start_time into categorized data with a 24-hour cycle (using the hour digit). For example, timestamp 10:30:10 can be labeled as 10 / 24, and timestamp 21:51:19 can be labeled as 21 / 24.

[0083] Specifically, the connection behavior features in the tabular data are classified and encoded to obtain the target encoding result. Then, the statistical features are normalized using normalization techniques to obtain the normalized result. Finally, the time features are transformed based on a preset period to obtain the transformation result. This process may include: extracting connection behavior features from the tabular data in the industrial network through communication links, corresponding connection ports, protocols, and connection times to obtain connection behavior features; determining whether the industrial network traffic transmission uses a preset public port; if so, encoding the connection behavior features using the preset public port using binary one-hot encoding techniques to obtain the first initial encoding result; using one-hot encoding techniques to perform dummy variable transformation on the remaining connection behavior features that do not use the preset public port to obtain the dummy variable transformation result; classifying and encoding the first initial encoding result based on the protocol type in the connection behavior features to obtain the second initial encoding result; determining the target encoding result based on the first and second initial encoding results; using normalization techniques to limit the numerical values ​​of each element corresponding to the statistical features to a preset range to obtain the normalized result; and then converting the timestamps corresponding to the time features into a preset time period format to obtain the transformation result.

[0084] Step S13: Concatenate the target encoding result, the normalization result, and the transformation result to obtain a hybrid feature vector, and construct a DAGMM model including a self-encoded decoder and a Gaussian mixture model using an unsupervised method. Then, use the DAGMM model and a preset threshold to perform anomaly detection on the hybrid feature vector to obtain anomaly detection results.

[0085] In this embodiment, the concatenation algorithm used in feature engineering is as follows: the binary features of the common port, the one-hot encoding of the protocol, the one-hot encoding of other discrete features, and the time features are concatenated to obtain the final feature vector of the i-th connection. :

[0086] ;

[0087] in, As a public port feature, As a protocol feature, For connection features, As a time feature, This indicates vector concatenation (joining).

[0088] Subsequently, embodiments of this application can consider the connection behavior features generated by one-hot encoding, the periodic time features of traffic, and the standardized statistical features based on a mixture of features including connection behavior features, time features, and statistical features. The statistical features extracted from CICFlowMeter can be normalized using the "min-max" method, which further restricts the value of each element of the entire mixture vector (i.e., the combination of connection behavior features and statistical features) to the range [0, 1]. Therefore, using the mixture features as input to DAGMM satisfies the modeling prerequisite of a positive definite matrix. Furthermore, the mixture features (more than 70 dimensions) can reflect the more granular communication status of industrial networks and perform corresponding identification and anomaly detection through the DAGMM model, the algorithm of which is shown below:

[0089] ;

[0090] or: ;

[0091] in, , , This indicates element-wise division, and 1 represents a vector of all 1s of the same dimension.

[0092] In one specific implementation, the DAGMM model includes SOM-DAGMM (Self-Organizing Map-assisted DAGMM, an improved unsupervised intrusion detection model), and then addresses the shortcomings of the original DAGMM model in preserving the topology of the input space by incorporating the topology-preserving capability of self-organizing maps (SOM). Specifically, SOM-DAGMM introduces an SOM loss term, which acts as a powerful regularizer to optimize the reconstruction error and topological structure corresponding to the low-dimensional features learned by the DAGMM model. The complete objective function of SOM-DAGMM can be written as:

[0093] ;

[0094] in, , This is the prototype vector corresponding to BMU in SOM.

[0095] In this embodiment, the multidimensional flow model based on DAGMM is a combination of a compression network and an estimation network, and the model overview is as follows: Figure 3 As shown: The compression network reduces the dimensionality of the input samples using a deep autoencoder (AE), and its low-dimensional representation consists of the reduced dimensionality space and reconstruction error. The subsequent estimation network receives these low-dimensional representations and identifies anomalies by predicting their likelihood / energy. An offline model is generated by inputting a multi-dimensional mixed feature vector of industrial network traffic over a period of time; and an online predictive analysis is performed on the traffic samples to be analyzed, outputting the energy function value of the samples to determine whether the samples are anomalies.

[0096] Among them, the low-dimensional representation provided by the compressed network It contains two feature sources: (1) Input Low-dimensional representation (2) Reconstruction error Given a multi-feature sample Its low-dimensional representation can be obtained through an encoder. To learn the low-dimensional spatial features of the original data:

[0097] ;

[0098] in, The equation representing the encoder, These are the encoder parameters. Reconstruction error. The decoder output can be calculated. and the original input sequence The reconstruction error between them is obtained as follows:

[0099] ;

[0100] in, The equation representing the decoder, These are the parameters for the decoder. This represents the equation for calculating the reconstruction error. Specifically, multiple distance metrics can be considered to measure multidimensional features. Examples include absolute Euclidean distance, relative Euclidean distance, and cosine similarity.

[0101] Among them, low-dimensional representation yes Low-dimensional representation and reconstruction error The combination, and The formula for determining it is as follows:

[0102] ;

[0103] It is worth mentioning that, in this embodiment, relative Euclidean distance and cosine similarity are selected as indicators to measure the reconstruction error features. Subsequently, given input samples... Low-dimensional representation The network is estimated, and density estimation is performed within the framework of a Gaussian Mixture Model (GMM). This is done without any information about the distribution of the GMM mixture components. Mixed mean and mixed covariance During the training process of prior knowledge, the estimation network estimates the input samples. GMM parameters and evaluation of samples The likelihood or energy value. The estimation network uses a multi-layer neural network to predict the mixed membership degree of each sample, given an integer. As the number of GMM mixture components, and the low-dimensional representation previously derived from the compressed network. The formula for estimating the predicted membership degree of a network is shown below:

[0104] ;

[0105] in, It is a multilayer neural network (its parameters are) The output of ) To predict the membership of mixed components using the softmax function A dimensional vector. The GMM parameters can be estimated in one step using a batch of samples and their predicted membership values. ):

[0106] ;

[0107] in, For low-dimensional representation The Membership predictions for each GMM mixed component. , , They are the first The probability, mean, and covariance of each GMM mixture component.

[0108] In this embodiment, after obtaining the above GMM parameters, the energy function of the sample can be estimated:

[0109] ;

[0110] in, This is the determinant of the matrix. During the testing phase, high-energy samples are identified using a pre-selected threshold percentage. The value is used to identify whether there are any anomalies in the sample to be analyzed.

[0111] It is worth mentioning that the DAGMM training phase combines the AE model and the GMM model, and its training objective can be constructed as a dataset. Objective function:

[0112] ;

[0113] in, Let represent the objective function, and the objective function consists of three parts: It describes the input of the encoder in the compression network. and decoder output The loss function is the reconstruction error between the input and output data. Key information from the input data can be extracted in the compressed network and converted into a low-dimensional representation. Ultimately, as the loss function value decreases, the decoder's output... Approximation encoder input .use The paradigm describes the distance between elements, and the formula is: ; This represents the probability that the mixed features can be reproduced for the i-th input data. This is achieved by minimizing the sample energy. This yields the optimal parameter combination for the compressed and estimated networks, maximizing the reproduction of the input samples. Specifically, This is the first meta-parameter in the DAGMM; The aim is to punish the phenomenon of small values ​​on the diagonal of the matrix caused by the singularity problem in DAGMM, that is, to trigger a trivial solution when the diagonal terms in the covariance matrix degenerate to 0. This is the second meta-parameter in DAGMM. It can be by The calculation yielded the following result. Low-dimensional representation The dimension of.

[0114] Specifically, the target encoding result, normalization result, and transformation result are concatenated to obtain a mixed feature vector. An unsupervised DAGMM model, including a self-encoder and a Gaussian mixture model, is then constructed. This process includes: concatenating the target encoding result, normalization result, and transformation result to obtain the corresponding mixed feature vector; mapping the mixed feature vector to a preset space satisfying preset low-dimensional conditions using an autoencoder in a compression network to obtain a mapping result; reconstructing the mapping result using a self-decoder in the compression network to obtain a reconstruction result, determining the reconstruction error between the reconstruction result and the traffic data packet, and combining the mapping result and the reconstruction error to obtain a combined result; inputting the combined result into an estimation network to determine the membership degree of each Gaussian mixture component of the combined result using the Gaussian mixture model in the estimation network, thus obtaining a... The membership degrees are determined to identify the Gaussian mixture model parameters, including the mixture probability, mean vector, and covariance matrix parameters. Then, the energy function value corresponding to the traffic data packet is determined based on these Gaussian mixture model parameters. The reconstruction loss term corresponding to the reconstruction error, the likelihood term corresponding to the energy function value, and the regularization term corresponding to the covariance matrix parameters are determined. A minimization objective function is constructed based on these terms. The compression network and estimation network are optimized using the minimization objective function to obtain the optimized compression network and estimation network. A DAGMM model including the optimized compression network and estimation network is constructed using an unsupervised approach. Both the autoencoder and autodecoder include several fully connected layers, and the corresponding activation functions include the hyperbolic tangent function and no activation function.

[0115] In this embodiment, when the model training is complete and the unsupervised learning model is built, i.e., the objective function is... Training stops when the value is close to 0. At this point, a test vector is analyzed. ,if This indicates that the current test vector is abnormal. Extreme value theory (EVT, POT-GPD) is used to analyze the abnormality of a series of test vectors, evaluate the appropriate threshold, and optimize the threshold by fitting a generalized Pareto distribution, thereby improving the detection accuracy for extreme samples and further reducing noise from redundant alarms.

[0116] In this embodiment, a high threshold is selected. (e.g., 95th percentile), determine the portion exceeding the threshold:

[0117] ;

[0118] Subsequently, a generalized Pareto distribution was fitted. Based on target tail probability (e.g., 0.01) Determine the threshold:

[0119] ;

[0120] in, To calibrate the sample size in the set, This represents the number of samples exceeding the threshold.

[0121] It is worth mentioning that, taking The limit of time, , That is, when... At that time, the current sample is abnormal.

[0122] Specifically, a DAGMM model, including a self-encoded decoder and a Gaussian mixture model, is constructed using an unsupervised method. Then, the DAGMM model is used to perform anomaly detection on the mixed feature vectors based on a preset threshold to obtain anomaly detection results. This process can include: acquiring historical industrial network traffic data to train the DAGMM model offline using an unsupervised method based on each historical industrial network traffic data point, obtaining the trained DAGMM model, and saving the model file corresponding to the trained DAGMM model as an offline file in a preset markup language format or an extensible markup language format; wherein each historical industrial network traffic data point is network traffic data that meets preset normal conditions; in the online detection phase, industrial network traffic is collected in real time, and features are extracted from the mixed feature vectors using a preset traffic analysis tool. Based on the obtained feature extraction results, a mixed feature vector is constructed, and then the offline file is loaded to perform real-time anomaly detection on the mixed feature vectors using a Gaussian mixture model based on a preset threshold to obtain real-time anomaly detection results.

[0123] It is worth mentioning that the anomaly detection results obtained by using the DAGMM model and based on a preset threshold to perform anomaly detection on the mixed feature vector can include: determining the energy function value corresponding to the traffic data packet using a preset energy function formula, and performing anomaly analysis on the energy function value sequence of historical samples based on the over-threshold peak method in extreme value theory to obtain anomaly analysis results; setting the threshold with the largest value among the thresholds in the anomaly analysis results as the initial threshold, and extracting all over-threshold samples that exceed the initial threshold from the mixed feature vector based on the initial threshold; fitting each over-threshold sample with a generalized Pareto distribution to obtain the corresponding scale parameter and shape parameter; optimizing the initial threshold using a quantile function based on the scale parameter, shape parameter, preset tail probability, preset calibration set sample total number, and number of over-threshold samples to obtain the preset threshold; comparing the energy function value with the preset threshold to obtain the comparison result, and determining the traffic data packet as anomaly if the energy function value is greater than the preset threshold in the comparison result.

[0124] Step S14: If the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain the source tracing result corresponding to the hybrid feature vector, including the traffic source IP and traffic source port information.

[0125] In this embodiment, based on the results of anomaly detection and analysis, the source IP, destination IP, and corresponding protocol of the abnormal traffic can be deduced. From the aforementioned multi-dimensional unsupervised anomaly detection scheme, the set of anomaly vectors is obtained as follows: ,in The first representative analysis An anomaly, Represents the total analysis 3D feature vectors.

[0126] It is worth mentioning that, according to the source tracing algorithm, the feature vector converted from the aforementioned "one-hot" encoding can be transformed into a connection feature with practical significance. The previously defined order of src_ip remains unchanged, when... Then it exists:

[0127] ;

[0128] in, This is the index of the source IP address corresponding to the exception. Similarly, if the previously defined order of `dst_ip` remains unchanged, the total number of entries in the `src_ip` list is... ,when Existence:

[0129] ;

[0130] in, The index of the destination IP address corresponding to the anomaly.

[0131] Furthermore, whether to use common source and destination ports can be further determined through one-hot encoding. Similarly, the total number of entries in the dst_ip list is defined as follows: The algorithm for determining whether the port number of the corresponding source IP is a common port number is as follows:

[0132] ;

[0133] Here, 1 represents a common port number, and a list of common industrial network protocol ports can be found. Similarly, the algorithm for determining whether the port number of the corresponding destination IP is a common port number is as follows:

[0134] ;

[0135] Here, 1 represents a common port number, and the list of port numbers can be viewed to see the general industrial network protocol port list.

[0136] In this embodiment, the communication transmission protocol used can generally be identified by the feature code fed back from the traffic data, corresponding to the specific protocol type. For example, the TCP protocol corresponds to number 17. Based on multi-dimensional features, the transmission protocol corresponding to abnormal traffic can also be traced in a more granular way using this method, defining the adopted protocol number as... Specifically:

[0137] ;

[0138] in, The specific protocols corresponding to abnormal behavior in industrial networks.

[0139] In summary, the five-tuple characteristics of anomalies obtained from the embodiments of this application are as follows:

[0140] ;

[0141] Specifically, if the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain the source tracing result corresponding to the hybrid feature vector, including the traffic source IP and traffic source port information. This can include: if the anomaly detection result indicates an anomaly, using one-hot encoding technology to perform an inverse transformation on the traffic data packet to obtain the source address index information and destination address index information corresponding to the traffic data packet; matching the source address index information and destination address index information with a preset address list to obtain the matching result corresponding to the traffic data packet, including the source address and destination address; then using the preset one-hot encoding technology to determine whether the source port corresponding to the source address and the destination port corresponding to the destination address are common ports, obtaining the judgment result; determining the protocol type corresponding to the traffic data packet, and combining the source address, destination address, source port, destination port, protocol type, and judgment result to obtain the five-tuple feature corresponding to the traffic data packet, so as to use the five-tuple feature to perform fine-grained tracing and positioning of the traffic data packet, and obtain the source tracing result.

[0142] It is worth mentioning that the overall framework of this application embodiment is as follows: First, industrial network traffic is classified according to network connection links, and then unsupervised machine learning is used to model the multi-dimensional features. Logically, DAGMM is divided into an offline training model and an online detection model. DAGMM uses a large amount of normal industrial network traffic as training samples to represent the patterns of normal traffic, and is supplemented with a small number of abnormal samples as a validation set to provide feedback and adjust the model. It is also worth noting that DAGMM can adopt an end-to-end training method to adjust the dimensionality reduction components and improve the quality of cluster estimation. It can be stored using Predictive Model Markup Language (PMML) and saved as an offline file using Extensible Markup Language (XML). The XML format offline file is easy to save and read, and can be used for real-time identification of subsequent unknown abnormal operating behaviors of industrial networks. The overall structure of the abnormal behavior detection method is as follows: Figure 4As shown: In this embodiment, two datasets were used for analysis: ICS-CPS network traffic records and the CICIDS2017 dataset. The ICS-CPS network traffic training / validation hybrid set includes a large number of normal network traffic records (533,493 records) from normal operation, and a small number of abnormal network traffic records (20,829 records) from network attacks or malicious operations, with an anomaly rate of 3%. The CICIDS2017 data training / validation set includes network traffic labeled "benign" (2,273,098 records) and network traffic labeled "abnormal" (i.e., "DoS Slowloris", "Slowhttptest", "DoS Hulk", "DoS GoldenEye", and "DDoS LOIC-HTTP") (380,688 records), with an anomaly rate of 16%.

[0143] Secondly, the training phase of the DAGMM model is entirely based on network traffic under normal operating conditions. In the experiment, this embodiment only uses normal data samples for offline DAGMM model training; 50% of the normal samples in the training / validation set are randomly selected for training, and the remaining 50% are used for testing. Finally, a small amount of abnormal sample data is used for validation feedback and parameter adjustment.

[0144] Subsequently, for the proposed testbed hybrid feature dataset, its compressed network provides a 3-dimensional input to the estimation network, one of which is a low-dimensional representation. The other two come from reconstruction errors. Only reliable data transmission between two devices in the communication topology is considered (ignoring non-functional communications such as broadcast, multicast messages, ARP, and routing protocols). The eigenvector dimension is calculated to be 391 dimensions (i.e., 320+1+70). The estimated network considers a GMM with four mixed components. The compressed network structure is FC(391, 360, tanh)-FC(360, 120, tanh)-FC(120, 60, tanh)-FC(60, 30, tanh)-FC(30, 10, tanh)-FC(10, 1, none)-FC(1, 10, tanh)-FC(10, 30, tanh)-FC(30, 60, tanh)-FC(60, 120, none)-FC(120, 360, tanh)-FC(360, 391, tanh), and the estimated network structure is FC(3, 10, tanh)-Drop(0.5)-FC(10, 4, softmax). Here, FC(a,b, f) represents a network with... input neurons and A fully connected layer with n output neurons, where f is the activation function (none indicates that no activation function is used). Let the training maintain probability be... The dropout layer.

[0145] For the CICIDS2017 dataset, the feature vectors have a dimension of 80. The estimation network considers a GMM with four mixture components. The structure of the compressed network is FC(80, 60, tanh)-(60, 30, tanh)-FC(30, 10, tanh)-FC(10, 1, none)-FC(1, 10, tanh)-FC(10, 30, tanh)-FC(30, 60, tanh)-FC(60, 120, ReLU), and the structure of the estimation network is FC(3, 10, tanh)-Drop(0.4)-FC(10, 4, softmax). Table 1 shows the DAGMM model training parameters for the mixture feature data of the ICS-CPS testbed, and Table 2 shows the DAGMM model training parameters for the CICIDS2017 dataset.

[0146] Table 1. Schematic diagram of DAGMM training parameters for mixed feature data on the test bench.

[0147]

[0148] Table 2. DAGMM training parameters for the CICIDS2017 dataset.

[0149]

[0150] In this embodiment, Figure 5 The compression effect of the compression network in DAGMM on two datasets is shown. Figure 5 (a) shows the data compression effect of the compression network in DAGMM on the mixed feature dataset; Figure 5 (b) shows the data compression effect of the compression network in DAGMM on the CICIDS2017 dataset. Subsequently, a subset of samples was selected for verification to calculate their three-dimensional low-dimensional representation. The Encoded dimension is the input. Low-dimensional representation The Euclidean and Cosine dimensions are derived from the reconstruction error, respectively. The Euclidean distance and cosine similarity in the network are discussed. It's worth noting that the low-dimensional representation of the network output is compressed. It can effectively capture the differences between normal and abnormal samples, thus enabling the subsequent classification of data samples using a GMM model.

[0151] In this embodiment, Table 3 illustrates the performance of different unsupervised machine learning techniques—namely, One-class Support Vector Machine (OC-SVM), Deep Structure Energy Based Model (DSEBM), Random Forest (RF), K-Means model, and the proposed DAGMM model—on processing two network traffic datasets. In the DAGMM model, the threshold... (i.e., Energy_threshold in Tables 2 and 3) can mark samples with the highest energy values ​​as anomalies. Typically, the threshold... It can be set to the same value as the anomaly rate of the dataset to be analyzed. For example, when analyzing the proposed mixed feature dataset, the threshold can be... Set as This means the baseline threshold is consistent with the anomaly rate. The threshold can be fine-tuned according to different practical requirements. This alters the detection sensitivity and achieves the desired detection effect. Specifically, the DAGMM-b settings... DAGMM-b / 2 is set as the baseline threshold. It is half of the baseline threshold (taken as 0.015); the same applies to DAGMM-2b.

[0152] Table 3: Detection performance of different unsupervised models on two datasets

[0153]

[0154] Among them, the accuracy rate is The recall rate was The error omission rate is ,coefficient .

[0155] It is worth mentioning that, as shown in Table 3, DAGMM outperforms other unsupervised models in detecting both datasets. The embodiments in this application can select different energy thresholds for DAGMM based on different detection priorities (i.e., whether a low false negative rate or high accuracy in detecting positive examples is desired). .

[0156] For industrial network environments, the embodiments of this application should pay attention to the error omission rate (FOR), because covert network attacks or malicious behaviors can bypass traditional IDS. Thus far, DAGMM can achieve good detection results on both datasets; however, for the proposed hybrid feature set, its anomaly detection can not only detect anomalous samples, but also extract anomalous behaviors from connection behavior features and temporal features.

[0157] In one specific implementation, this application embodiment selects a typical industrial system, namely a power generation, transmission and distribution system, to verify the detection effect of the hybrid anomaly detection model under various abnormal operating conditions. The prediction period of each sliding window is used as a reference time slot (i.e., one time slot state every 20 seconds). For example, when a D-DoS attack is launched from 12:00:00 to 12:10:00, the total number of time slots is... (That is, under a D-DoS attack, one time slot is analyzed every 20 seconds, for a total of 30 time slots).

[0158] Table 4 shows the various ICS exception event types and the total number of test slots corresponding to each event. The proposed hybrid anomaly detection model's ability to correctly identify negative samples (TN) is analyzed and verified by actually testing ICS anomaly events caused by network attacks, malicious operations, and network anomalies in a pre-set test range power transmission and distribution system.

[0159] Table 4. Illustrated Table of ICS Abnormal Event Types

[0160]

[0161] Subsequently, this embodiment of the application uses the .pcap packets of abnormal traffic (including network attacks and malicious operations) used in the above experiments as online analysis samples to verify and analyze the proposed model. Based on the established DAGMM offline model, an online detection framework is used to detect malicious samples, and the results show that: the detection effect for network attacks is good; tracing back to the abnormal mixed characteristics reveals a sudden increase in IP communication volume of the attack injection platform (previously there was almost no communication from the attack injection platform IP), indicating a change in its internal network communication environment, leading to changes in communication links, thus enabling the model to detect abnormal behavior. The detection effect for malicious operations is also good because the regular traffic pattern of the fixed communication link is broken, and the statistical characteristics of its 70-dimensional CICFlowMeter change significantly; tracing back to the abnormal mixed characteristics reveals changes in the duration, frequency, triggering time, and statistical characteristics of TCP traffic with other flag bits in the communication connection.

[0162] Furthermore, by using anomaly tracing algorithms to decompose and calculate the analyzed multidimensional anomaly feature vectors, the specific anomalous behaviors corresponding to the anomaly events can be obtained. Taking one anomaly event as an example, the calculated energy density far exceeds 97%, reaching 99.3%, surpassing the energy density calculated by the denoising algorithm. The threshold indicates that the anomaly can be separated relatively well. Furthermore, the calculated number of data points exceeding the threshold was 50, which is close to the true anomaly rate of 3% out of 1600 data points. The threshold satisfies the anomaly rate calculation of the original data being 0.03, which is lower than the actual anomaly rate. Therefore, it can detect anomalies more accurately, thereby achieving the effect of noise reduction.

[0163] Therefore, it was determined to be a suspicious anomaly in the industrial network. Taking one of the anomalous behavior quintuples obtained from the analysis as an example, such as... This indicates that the source IP corresponding to the abnormal event is located at the 9th position of the src_ip list, and the destination IP is located at the 3rd position of the dst_ip list. Common source and destination ports are not used; the TCP protocol is employed instead. Due to the increased detail available for model reference, this model outperforms traditional supervised learning-based industrial network traffic anomaly detection techniques when detecting malicious operations.

[0164] As can be seen from the above, the embodiments of this application first need to collect traffic data packets of the industrial network using the mirror port of a preset industrial switch, and convert the traffic data packets into a process characteristic analysis software package. Then, the traffic analysis tool extracts several dimensions of statistical features from the process characteristic analysis software package, and converts each dimension of statistical features into tabular data in tabular format. Next, the connection behavior features in the tabular data are classified and encoded to obtain the target encoding result, and the statistical features are normalized using normalization technology to obtain the normalization result. Then, the time features are transformed based on a preset period to obtain the transformation result. Then, the target encoding result, the normalization result and the transformation result are concatenated to obtain a mixed feature vector, and a DAGMM model including a self-encoded decoder and a Gaussian mixture model is constructed using an unsupervised method. Then, the DAGMM model is used to perform anomaly detection on the mixed feature vector based on a preset threshold to obtain the anomaly detection result. Finally, if the anomaly detection result indicates an anomaly, the mixed feature vector is decoded in reverse using a source tracing algorithm to obtain the source tracing result corresponding to the mixed feature vector, including the traffic source IP and traffic source port information. This improves the efficiency of anomaly detection and tracing in industrial network traffic, thereby enhancing the user experience.

[0165] Accordingly, see Figure 6 As shown, this application also provides an anomaly detection and tracing device for industrial network traffic, including:

[0166] The traffic data packet acquisition module 11 is used to acquire traffic data packets of the industrial network using the mirror port of a preset industrial switch, convert the traffic data packets into a process characteristic analysis software package, and then use a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and convert each dimension of statistical features into tabular data in tabular data format; the tabular data includes connection behavior features, time features, and statistical features;

[0167] The conversion result determination module 12 is used to classify and encode the connection behavior features in the table data to obtain the target encoding result, and to normalize the statistical features using normalization technology to obtain the normalization result. Then, the time features are converted based on a preset period to obtain the conversion result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time.

[0168] The anomaly detection result determination module 13 is used to concatenate the target encoding result, the normalization result and the transformation result to obtain a mixed feature vector, and to construct a DAGMM model including a self-encoder and a Gaussian mixture model in an unsupervised manner. Then, the DAGMM model is used to perform anomaly detection on the mixed feature vector based on a preset threshold to obtain anomaly detection results.

[0169] The source tracing result determination module 14 is used to perform reverse decoding on the mixed feature vector using a source tracing algorithm if the anomaly detection result indicates an anomaly, so as to obtain a source tracing result corresponding to the mixed feature vector, including traffic source IP and traffic source port information.

[0170] In some specific embodiments, the traffic data packet acquisition module 11 may specifically include:

[0171] A communication link construction unit is used to determine the corresponding device in the industrial network based on the device type identifier in the industrial network environment, and to retrieve the communication source address and destination address corresponding to the industrial network traffic based on the device type identifier, so as to determine the communication link between each device based on the communication source address and the destination address.

[0172] The process characteristic analysis software package determination unit is used to collect industrial network traffic packets between the devices through the traffic acquisition plug-in and the communication link via the mirror port of the industrial switch, and save the industrial network traffic packets as a process characteristic analysis software package in process characteristic analysis software package format;

[0173] The tabular data determination unit is used to perform multi-dimensional statistical feature extraction on the process characteristic analysis software package using a traffic feature extraction tool to obtain several dimensions of statistical features. Each dimension of statistical features is saved as a comma-separated value file, and then converted into tabular data in tabular data format. The dimension of statistical features includes general traffic characteristics, features related to data packet size, data packet and byte rate characteristics, data packet arrival interval characteristics, header-related features, data packet payload-related features, and traffic status characteristics. The general features include traffic duration, total number of forward packets, total number of backward packets, etc. The total number of bytes sent and received; the data packet size-related features include the minimum, maximum, average, standard deviation, and variance of the data packet size; the minimum, maximum, average, and standard deviation of the forward data packet size; the minimum, maximum, average, and standard deviation of the backward data packet size; and the byte ratio of the backward message to the forward message; the forward message is the message sent from the initiating device to the responding device, and the backward message is the message sent from the responding device to the initiating device; the data packet and byte rate features include byte rate, packet rate, forward packet rate, and backward packet rate; the data packet arrival interval features include the minimum, maximum, and standard deviation of the data packet arrival interval. The features related to the packet header include: the minimum and maximum values ​​of the backward packet arrival interval, the minimum and maximum values ​​of the forward packet arrival interval, the sum of all backward and forward arrival intervals; the number of packets in the forward packet containing push and urgent flags in the Transmission Control Protocol (TCP); the number of packets in the backward packet containing push and urgent flags in the TCP; the total number of packets in the TCP containing end flags, synchronization flags, reset flags, acknowledgment flags, and congestion window reduction flags; and the number of explicit congestion notification packets; the features related to the packet payload. The characteristics include the average payload size of all traffic packets, the average payload size of forward packets, the average payload size of backward packets, the average number of packets and bytes in bursts of consecutive forward packets, the average number of packets and bytes in bursts of consecutive backward packets, the number of bytes in the initial burst of forward packets, the number of bytes in the initial burst of backward packets, the number of backward packets with payloads, and the minimum payload size of backward packets; the state characteristics of the traffic include the minimum, maximum, average, and standard deviation of traffic activity time and the minimum, maximum, average, and standard deviation of idle time.

[0174] In some specific embodiments, the conversion result determination module 12 may specifically include:

[0175] A connection behavior feature determination unit is used to extract connection behavior features from the table data in the industrial network through the communication link, the corresponding connection port, the protocol used, and the connection time, so as to obtain connection behavior features.

[0176] The first encoding result determination unit is used to determine whether the transmission of the industrial network traffic uses a preset public port. If the transmission of the industrial network traffic uses a preset public port, the connection behavior characteristics using the preset public port are encoded using binary one-hot encoding technology to obtain the first initial encoding result.

[0177] The virtual variable conversion unit is used to perform virtual variable conversion on the connection behavior characteristics of other connections that do not use the preset public port using the one-hot encoding technology, and obtain the virtual variable conversion result.

[0178] The second encoding result determination unit is used to classify and encode the first initial encoding result based on the protocol type in the connection behavior characteristics to obtain a second initial encoding result, so as to determine the target encoding result based on the first initial encoding result and the second initial encoding result;

[0179] The conversion result determination unit is used to limit the numerical values ​​of each element corresponding to the statistical feature to a preset range using normalization technology to obtain a normalization result, and then convert the timestamp corresponding to the time feature into a preset time period format to obtain a conversion result.

[0180] In some specific embodiments, the anomaly detection result determination module 13 may specifically include:

[0181] The mapping result determination unit is used to concatenate the target encoding result, the normalization result and the transformation result to obtain the corresponding hybrid feature vector, and then use the autoencoder in the compression network to map the hybrid feature vector to a preset space that meets the preset low-dimensional conditions to obtain the mapping result;

[0182] The combined result generation unit is used to reconstruct the mapping result using the self-decoder in the compression network to obtain the reconstruction result, determine the reconstruction error between the reconstruction result and the traffic data packet, and combine the mapping result and the reconstruction error to obtain the combined result.

[0183] An energy function value determination unit is used to input the combination result into an estimation network, and use the Gaussian mixture model in the estimation network to determine the membership degree of each Gaussian mixture component of the combination result, thereby obtaining the corresponding membership degree. Based on each membership degree, the unit determines the Gaussian mixture model parameters corresponding to the Gaussian mixture model, including the mixing probability, mean vector, and covariance matrix parameters. Then, based on the Gaussian mixture model parameters, the unit determines the energy function value corresponding to the traffic data packet.

[0184] The objective function minimization unit is used to determine the reconstruction loss term corresponding to the reconstruction error, the likelihood term corresponding to the energy function value, and the regularization term corresponding to the covariance matrix parameter, so as to construct a minimization objective function based on the reconstruction loss term, the likelihood term, and the regularization term.

[0185] The model building unit is used to optimize the compressed network and the estimated network using the minimization objective function to obtain the optimized compressed network and the estimated network, and to construct a DAGMM model including the optimized compressed network and the estimated network using an unsupervised method; wherein, the autoencoder and the autodecoder both include several fully connected layers, and the corresponding activation functions include the hyperbolic tangent function and no activation function.

[0186] In some specific embodiments, the anomaly detection result determination module 13 may specifically include:

[0187] The model training unit is used to acquire historical industrial network traffic data, and to train the DAGMM model in the offline training stage using an unsupervised method based on the historical industrial network traffic data, so as to obtain the trained DAGMM model, and save the model file corresponding to the trained DAGMM model as an offline file in a preset markup language format or an extensible markup language format; wherein, each of the historical industrial network traffic data is network traffic data that meets preset normal conditions.

[0188] The feature extraction unit is used to collect industrial network traffic in real time during the online detection phase, extract features from the hybrid feature vector using a preset traffic analysis tool, construct a hybrid feature vector based on the obtained feature extraction results, and then load the offline file to perform real-time anomaly detection on the hybrid feature vector using the Gaussian mixture model and based on a preset threshold, thereby obtaining real-time anomaly detection results.

[0189] In some specific embodiments, the anomaly detection result determination module 13 may specifically include:

[0190] An anomaly analysis result determination unit is used to determine the energy function value corresponding to the traffic data packet using a preset energy function formula, and to perform anomaly analysis on the energy function value sequence of historical samples based on the over-threshold peak method in extreme value theory to obtain anomaly analysis results. The threshold with the largest value among the thresholds in the anomaly analysis results is set as the initial threshold, and all over-threshold samples exceeding the initial threshold are extracted from the mixed feature vector based on the initial threshold.

[0191] The preset threshold determination unit is used to fit each of the over-threshold samples using a generalized Pareto distribution to obtain the corresponding scale parameters and shape parameters, and to optimize the initial threshold using a quantile function based on the scale parameters, the shape parameters, the preset tail probability, the total number of samples in the preset calibration set, and the number of over-threshold samples to obtain the preset threshold.

[0192] The comparison result generation unit is used to compare the energy function value with the preset threshold to obtain a comparison result, and if the comparison result indicates that the energy function value is greater than the preset threshold, then the traffic data packet is determined to be abnormal.

[0193] In some specific embodiments, the source tracing result determination module 14 may specifically include:

[0194] The data packet inverse transformation unit is used to perform an inverse transformation on the traffic data packet using one-hot coding technology if the anomaly detection result indicates an anomaly, to obtain the source address index information and destination address index information corresponding to the traffic data packet;

[0195] The judgment result generation unit is used to match the source address index information and the destination address index information with a preset address list respectively to obtain a matching result corresponding to the traffic data packet, including the source address and the destination address. Then, it uses a preset one-hot encoding technology to determine whether the source port corresponding to the source address and the destination port corresponding to the destination address are common ports to obtain a judgment result.

[0196] The source tracing result determination subunit is used to determine the protocol type corresponding to the traffic data packet, and combine the source address, the destination address, the source port, the destination port, the protocol type and the judgment result to obtain the five-tuple feature corresponding to the traffic data packet, so as to use the five-tuple feature to perform fine-grained tracing and positioning of the traffic data packet to obtain the source tracing result.

[0197] Furthermore, embodiments of this application also disclose an electronic device, Figure 7This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the industrial network traffic anomaly detection and tracing method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0198] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0199] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0200] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the industrial network traffic anomaly detection and tracing method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include computer programs capable of performing other specific tasks.

[0201] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned method for anomaly detection and tracing of industrial network traffic. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0202] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0203] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0204] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0205] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0206] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for anomaly detection and source tracing in industrial network traffic, characterized in that, include: Traffic data packets from an industrial network are collected using the mirror port of a pre-set industrial switch, and the traffic data packets are converted into a process characteristic analysis software package. Then, a traffic analysis tool is used to extract several statistical features from the process characteristic analysis software package, and each of the statistical features is converted into tabular data in tabular format. The tabular data includes connection behavior features, time features, and statistical features. The connection behavior features in the table data are classified and encoded to obtain the target encoding result. The statistical features are then normalized using normalization technology to obtain the normalization result. The time features are then transformed based on a preset period to obtain the transformation result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time. The target encoding result, the normalization result, and the transformation result are concatenated to obtain a mixed feature vector. A DAGMM model including a self-encoder and a Gaussian mixture model is constructed using an unsupervised method. Then, the DAGMM model is used to perform anomaly detection on the mixed feature vector based on a preset threshold to obtain anomaly detection results. If the anomaly detection result indicates an anomaly, the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain the source tracing result corresponding to the hybrid feature vector, which includes the traffic source IP and traffic source port information.

2. The method for anomaly detection and source tracing of industrial network traffic according to claim 1, characterized in that, The process involves collecting traffic data packets from the industrial network using a pre-set industrial switch's mirror port, converting the traffic data packets into a process characteristic analysis software package, then using a traffic analysis tool to extract several statistical features from the process characteristic analysis software package, and converting each of the statistical features into tabular data in a tabular format. In an industrial network environment, the corresponding device in the industrial network is determined based on the device type identifier, and the communication source address and destination address corresponding to the industrial network traffic are retrieved based on the device type identifier, so as to determine the communication link between each device based on the communication source address and the destination address. The industrial network traffic packets between the devices are collected using a traffic acquisition plugin and through the mirror port of the industrial switch and the communication link, and the industrial network traffic packets are saved as a process characteristic analysis software package in process characteristic analysis software package format; The process characteristic analysis software package is subjected to multidimensional statistical feature extraction using a flow feature extraction tool to obtain several dimensions of statistical features. Each dimension of statistical features is saved as a comma-separated value file and then converted into tabular data in tabular data format. The dimensional statistical features include general traffic features, features related to data table packet size, packet and byte rate features, packet arrival interval features, features related to packet header, features related to packet payload, and traffic status features. The general characteristics include the duration of the traffic, the total number of forward messages, the total number of backward messages, the total number of bytes sent, and the total number of bytes received; the characteristics related to packet size include the minimum, maximum, average, standard deviation, and variance of the packet size, the minimum, maximum, average, and standard deviation of the forward packet size, the minimum, maximum, average, and standard deviation of the backward packet size, and the byte ratio of the backward messages to the forward messages; the forward messages are messages sent from the initiating device to the responding device, and the backward messages are messages sent from the responding device to the initiating device; The data packet and byte rate characteristics include byte rate, packet rate, forward packet rate, and backward packet rate; the data packet arrival interval characteristics include the minimum, maximum, average, and standard deviation of the data packet arrival interval, the minimum, maximum, average, and standard deviation of the backward data packet arrival interval, the minimum, maximum, average, and standard deviation of the forward data packet arrival interval, and the sum of all backward and forward arrival intervals; The header-related features include the number of push and emergency flags in the forward transmission control protocol, the number of push and emergency flags in the backward transmission control protocol, the total number of packets in the transmission control protocol messages containing end flag, synchronization flag, reset flag, acknowledgment flag, and congestion window reduction flag, and the number of explicit congestion notification packets. The characteristics related to packet payload include the average payload size of all traffic packets, the average payload size of forward packets, the average payload size of backward packets, the average number of packets and the average number of bytes in bursts of consecutive forward packets, the average number of packets and the average number of bytes in bursts of consecutive backward packets, the number of bytes in the initial burst of forward packets, the number of bytes in the initial burst of backward packets, the number of backward packets with payloads, and the minimum payload size of backward packets. The state characteristics of the flow include the minimum, maximum, average, and standard deviation of the flow activity time, as well as the minimum, maximum, average, and standard deviation of the idle time.

3. The method for anomaly detection and source tracing of industrial network traffic according to claim 2, characterized in that, The process involves classifying and encoding the connection behavior features in the table data to obtain a target encoding result, normalizing the statistical features using normalization techniques to obtain a normalized result, and then transforming the time features based on a preset period to obtain a transformation result, including: In the industrial network, the connection behavior characteristics of the table data are extracted through the communication link, the corresponding connection port, the protocol used, and the connection time to obtain the connection behavior characteristics. Determine whether the transmission of the industrial network traffic uses a preset public port. If the transmission of the industrial network traffic uses a preset public port, then use binary one-hot encoding technology to encode the connection behavior characteristics using the preset public port to obtain the first initial encoding result. The virtual variable transformation is performed on the connection behavior characteristics of other connections that do not use the preset public port using the one-hot encoding technique to obtain the virtual variable transformation result; The first initial encoding result is classified and encoded based on the protocol type in the connection behavior characteristics to obtain a second initial encoding result, and the target encoding result is determined based on the first initial encoding result and the second initial encoding result. The normalization technique is used to limit the numerical values ​​of each element corresponding to the statistical feature to a preset range to obtain the normalization result. Then, the timestamp corresponding to the time feature is converted into a preset time period format to obtain the conversion result.

4. The method for anomaly detection and source tracing of industrial network traffic according to claim 1, characterized in that, The process involves concatenating the target encoding result, the normalization result, and the transformation result to obtain a mixed feature vector, and then constructing a DAGMM model that includes a self-encoded decoder and a Gaussian mixture model using an unsupervised approach, including: The target encoding result, the normalization result, and the transformation result are concatenated to obtain the corresponding hybrid feature vector. Then, the autoencoder in the compression network is used to map the hybrid feature vector to a preset space that meets the preset low-dimensional conditions to obtain the mapping result. The mapping result is reconstructed using the self-decoder in the compression network to obtain a reconstruction result, and the reconstruction error between the reconstruction result and the traffic data packet is determined. The mapping result and the reconstruction error are then combined to obtain a combined result. The combined result is input into the estimation network to determine the membership degree of each Gaussian mixture component of the combined result using the Gaussian mixture model in the estimation network, thereby obtaining the corresponding membership degree. Based on each membership degree, the Gaussian mixture model parameters corresponding to the Gaussian mixture model, including the mixing probability, mean vector, and covariance matrix parameters, are determined. Then, the energy function value corresponding to the traffic data packet is determined based on the Gaussian mixture model parameters. Determine the reconstruction loss term corresponding to the reconstruction error, the likelihood term corresponding to the energy function value, and the regularization term corresponding to the covariance matrix parameter, and construct a minimization objective function based on the reconstruction loss term, the likelihood term, and the regularization term; The compressed network and the estimated network are optimized using the minimization objective function to obtain the optimized compressed network and the estimated network. A DAGMM model including the optimized compressed network and the estimated network is then constructed using an unsupervised approach. The autoencoder and the autodecoder each include several fully connected layers, and the corresponding activation functions include hyperbolic tangent function and no activation function.

5. The method for anomaly detection and source tracing of industrial network traffic according to claim 4, characterized in that, The method involves constructing a DAGMM model, including a self-written decoder and a Gaussian mixture model, using an unsupervised approach. Then, anomaly detection is performed on the mixed feature vector using the DAGMM model and based on a preset threshold to obtain anomaly detection results, including: Historical industrial network traffic data is acquired to train the DAGMM model in an unsupervised manner during the offline training phase, thereby obtaining the trained DAGMM model. The model file corresponding to the trained DAGMM model is then saved as an offline file in a preset markup language format or an extensible markup language format. Each piece of historical industrial network traffic data is network traffic data that meets preset normal conditions. During the online detection phase, industrial network traffic is collected in real time, and features are extracted from the hybrid feature vector using a preset traffic analysis tool. Based on the obtained feature extraction results, a hybrid feature vector is constructed. Then, the offline file is loaded to perform real-time anomaly detection on the hybrid feature vector using the Gaussian mixture model and based on a preset threshold, thereby obtaining real-time anomaly detection results.

6. The method for anomaly detection and source tracing of industrial network traffic according to claim 5, characterized in that, The step of using the DAGMM model and performing anomaly detection on the hybrid feature vector based on a preset threshold to obtain anomaly detection results includes: The energy function value corresponding to the traffic data packet is determined by using a preset energy function formula, and anomaly analysis is performed on the energy function value sequence of historical samples based on the over-threshold peak method in extreme value theory to obtain anomaly analysis results. The threshold with the largest value among the thresholds in the anomaly analysis results is set as the initial threshold, and all over-threshold samples exceeding the initial threshold are extracted from the mixed feature vector based on the initial threshold. The generalized Pareto distribution is used to fit each of the overthreshold samples to obtain the corresponding scale parameters and shape parameters. The initial threshold is then optimized using the quantile function based on the scale parameters, the shape parameters, the preset tail probability, the total number of samples in the preset calibration set, and the number of overthreshold samples to obtain the preset threshold. The energy function value is compared with the preset threshold to obtain a comparison result. If the comparison result indicates that the energy function value is greater than the preset threshold, the traffic data packet is determined to be abnormal.

7. The method for anomaly detection and source tracing of industrial network traffic according to any one of claims 1 to 6, characterized in that, If the anomaly detection result indicates an anomaly, then the source tracing algorithm is used to reverse decode the hybrid feature vector to obtain the source tracing result corresponding to the hybrid feature vector, including the traffic source IP and traffic source port information, including: If the anomaly detection result indicates an anomaly, then the traffic data packet is inversely transformed using one-hot coding technology to obtain the source address index information and destination address index information corresponding to the traffic data packet; The source address index information and the destination address index information are matched with a preset address list to obtain a matching result corresponding to the traffic data packet, including the source address and the destination address. Then, a preset one-hot encoding technique is used to determine whether the source port corresponding to the source address and the destination port corresponding to the destination address are common ports, and a judgment result is obtained. The protocol type corresponding to the traffic data packet is determined, and the source address, destination address, source port, destination port, protocol type and judgment result are combined to obtain the five-tuple feature corresponding to the traffic data packet. The five-tuple feature is used to perform fine-grained tracing and positioning of the traffic data packet to obtain the source tracing result.

8. A device for anomaly detection and tracing of industrial network traffic, characterized in that, include: The traffic data packet acquisition module is used to collect traffic data packets of the industrial network using the mirror port of a preset industrial switch, convert the traffic data packets into a process characteristic analysis software package, and then use a traffic analysis tool to extract several dimensions of statistical features from the process characteristic analysis software package, and convert each dimension of statistical features into tabular data in tabular data format; the tabular data includes connection behavior features, time features, and statistical features; The conversion result determination module is used to classify and encode the connection behavior features in the table data to obtain the target encoding result, and to normalize the statistical features using normalization technology to obtain the normalization result. Then, the time features are converted based on a preset period to obtain the conversion result. The connection behavior features include source address, destination address, source port, port information, protocol type, and traffic start time. An anomaly detection result determination module is used to concatenate the target encoding result, the normalization result, and the transformation result to obtain a mixed feature vector, and to construct a DAGMM model including a self-encoder and a Gaussian mixture model in an unsupervised manner. Then, anomaly detection is performed on the mixed feature vector using the DAGMM model and based on a preset threshold to obtain an anomaly detection result. The source tracing result determination module is used to perform reverse decoding on the hybrid feature vector using a source tracing algorithm if the anomaly detection result indicates an anomaly, to obtain a source tracing result corresponding to the hybrid feature vector, including traffic source IP and traffic source port information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the method for anomaly detection and tracing of industrial network traffic as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the method for anomaly detection and tracing of industrial network traffic as described in any one of claims 1 to 7.

Images