Multi-modal detection method and system for abnormal risk traffic of private network based on AI

Abstract

The invention discloses an AI-based private network abnormal risk traffic multi-modal detection method and system, relates to the technical field of network security, and is used for solving the problem that compound attacks which are high in concealment and have service context association are difficult to effectively identify in a private network. The method comprises the following steps: firstly, injecting business semantics for flow analysis through multi-modal data acquisition and business intention marking; then, by adopting a mode of combining session boundary stability analysis and protocol compliance verification, detecting anomalies from two dimensions of microscopic protocol operation and macroscopic behavior trend respectively, and generating risk events of different levels; finally, an attack chain judgment mechanism is constructed through time sequence correlation analysis, a front-end detection strategy is dynamically optimized based on a judgment result, a closed-loop detection system from data collection to threat response is formed, and the detection accuracy of advanced threats in the private network environment and the self-adaptive capacity of the system are effectively improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, in particular to an AI-based private network abnormal risk flow multi-modal detection method and system. BACKGROUND

[0002] With the rapid expansion of industrial control systems in the fields of energy, manufacturing, transportation and the like, a private communication network gradually forms a complex interaction structure composed of periodic collection tasks, parameter download instructions and program update processes. The private network flow presents the characteristics of protocol stack diversity, instruction structure multilayer, business intention interweaving and the like, and the popularity of encrypted communication makes it difficult for the traditional monitoring method relying on content inspection to maintain effectiveness. The real-time requirement and continuous operation characteristics of modern private networks make any interruption, abnormal writing or unknown program update likely to trigger a system-level chain reaction in a very short time, so the fine understanding of flow behavior and multi-dimensional analysis capability are particularly important.

[0003] Most of the existing abnormal flow detection methods rely on single modal features, such as only focusing on protocol field changes, only detecting time series fluctuations or only counting message length distribution, which makes it difficult to establish a coherent behavior chain logic when facing cross-step, multi-behavior combined abnormalities. Such methods often cannot distinguish between parameter writing in normal processes and potential illegal operations, nor can they establish dynamic rule matching relationships between different business intentions. When dealing with encrypted traffic, most traditional methods only use coarse-grained statistical indicators, which are difficult to reflect the behavior differences inside encrypted messages. In addition, existing methods usually judge abnormal events in isolation, lack of modeling of the temporal relationship between events, and thus when facing the joint occurrence of program update abnormalities and parameter writing abnormalities, it is difficult to identify continuous attack behaviors in a timely manner. SUMMARY

[0004] In view of the deficiencies of the prior art, the application provides an AI-based private network abnormal risk flow multi-modal detection method and system, which solves the problems in the background art.

[0005] To achieve the above object, the application is implemented by the following technical solutions: a special network abnormal risk flow multi-modal detection method based on AI, comprising the following steps: S1. collecting real-time flow in the special network link, extracting protocol function code sequence, packet arrival time sequence and encrypted message length parameter, simultaneously rearranging and interpolating the collected data according to the message timestamp, generating multi-modal session data segments, and marking the corresponding business intent category according to the current industrial control task process; S2. performing session boundary stability analysis on the multi-modal session data, locating the internal structural sub-sections of the session by detecting the protocol field change section, time sequence rate change point and encrypted length distribution mutation point, establishing protocol behavior rules based on business intent, monitoring write register instruction operation when the business intent is parameter setting point download, and generating a first risk event if the write operation value of the process parameter register is detected to be out of the preset fluctuation range; S3. calculating the field stability interval, time interval mean and encrypted length distribution profile of the sub-section to form a feature set, calculating the behavior deviation index and generating a session-level risk trend curve by comparing the feature differences of adjacent sub-sections, and generating a second risk event in combination with the current special network business load level; S4. establishing a time sequence association diagram of the first and second risk events, determining an attack chain and triggering device isolation response when detecting that program update abnormalities and parameter write abnormalities from the same source device occur continuously within a preset time window, and dynamically adjusting the sensitivity of the protocol change point, time sequence change point and length distribution mutation point in sub-section division according to the attack chain determination result.

[0006] Further, the specific process of generating multi-modal session data segments is as follows: deploying a flow probe at the key node of the special network link, collecting original messages through port mirroring, performing protocol analysis on the collected messages, extracting the function code field of Modbus / TCP and OPC UA industrial protocol to form a protocol function code sequence; recording the arrival time interval of adjacent messages to build a packet arrival time sequence, and generating an encrypted message length parameter sequence by counting the payload length of each encrypted message; rearranging the timestamp of the collected data according to the time sequence identifier in the message header, correcting the time sequence disorder caused by network jitter, and repairing the data of the time sequence breakpoint caused by burst packet loss using an interpolation algorithm; aligning and packaging the repaired protocol function code sequence, packet arrival time sequence and encrypted message length parameter sequence according to the session to generate multi-modal session data segments.

[0007] Further, the specific process of marking the corresponding business intent category according to the current industrial control task flow of the session data segment is as follows: obtaining the current executed work order task information, parsing the device operation instruction in the work order task, extracting the operation type, target device identifier and planned execution time window; matching the source IP address and destination IP address of the session data segment with the device identifier in the work order, and performing time alignment according to the coincidence degree of the session occurrence time and the work order execution time window; establishing a business intent mapping rule: when the session characteristics are periodic read register operation and match the data collection work order, marking as periodic data collection, when the session characteristics contain write register operation and match the parameter modification work order, marking as parameter set point download, when the session characteristics contain program block transmission operation and match the program update work order, marking as controller program update; for the sessions that cannot match the known work orders, inferring the intent based on the protocol behavior mode through a clustering algorithm.

[0008] Further, the specific process of locating the structural sub-sections within the session through detecting the protocol field change segment, time sequence rate change point and encryption length distribution mutation point is as follows: performing sliding window analysis on the protocol function code sequence to detect the mutation point of the function code type, performing wavelet transform on the packet arrival time sequence to extract the singular point of the time sequence, and performing kernel density estimation on the encrypted message length distribution to identify the steep region of the length distribution; establishing a joint detection window based on the protocol field change segment, time sequence rate change point and encryption length distribution mutation point, and determining as an effective session boundary when any two types of mutation points appear simultaneously within the time window; dividing the session into multiple structural sub-sections according to the detected session boundaries, and establishing a feature index including the start time stamp, end time stamp and dominant protocol behavior type for the divided sub-sections.

[0009] Further, the specific process of generating a first-level risk event when the business intent is parameter set point download and the write operation value of the process parameter register exceeds the preset fluctuation range is as follows: establishing a dynamic rule library based on the business intent, configuring a corresponding protocol behavior white list for each business intent, and activating the write register instruction monitoring rule when the business intent is parameter set point download; filtering out the write register instruction record target register address and write value from the protocol function code sequence, accessing the process parameter knowledge base to identify the register address range corresponding to the key process parameter; constructing the normal operation interval of the key process parameter based on historical data, calculating the confidence interval of the parameter value through kernel density estimation, and comparing the write value in the write register instruction with the corresponding parameter confidence interval in real time; when the write value exceeds the confidence interval, extracting the source device identifier, target register address, abnormal value and occurrence time stamp, and generating a first-level risk event containing the business intent, violation type and risk level.

[0010] Further, step S3 includes the following steps: calculating the value distribution interval of the protocol field of each sub-section as the field stability interval, calculating the statistical mean of the message arrival time interval as the time interval mean, and calculating the distribution profile of the encrypted message length; based on the analysis of the feature differences between adjacent sub-sections in the sliding window, calculating the comprehensive offset of adjacent sub-sections in the three dimensions of field stability interval, time interval mean, and encrypted length distribution profile through the dynamic time warping algorithm to form a behavior offset index sequence; corresponding the behavior offset index sequence to the time axis, generating a continuous risk trend curve through the spline interpolation method, and performing normalization processing on the risk trend curve according to the current private network business load level, and generating a secondary risk event when the curve amplitude exceeds the threshold dynamically adjusted based on the load level.

[0011] Further, a time sequence correlation graph of primary and secondary risk events is established, and when program update abnormalities and parameter write abnormalities from the same source device continuously occur within a preset time window, an attack chain is determined and the specific process of triggering the device isolation response is as follows: a correlation graph is established with risk events as nodes and time sequence relationships between events as edges, the node attributes include event type, source device identifier, and occurrence timestamp, and the edge weight represents the time interval between events; in the correlation graph, a path satisfying a specific mode is searched, when a directed edge exists between the program update abnormal node and the parameter write abnormal node from the same source device, and the timestamp difference of the two nodes is within the preset time window, a potential attack chain is determined; the confidence of the potential attack chain is evaluated, the evaluation factors include event severity, time window compliance, and device criticality, when the confidence exceeds a set threshold, the attack chain is confirmed, and an isolation instruction is sent to the target device.

[0012] Further, the sensitivity of the protocol change point, the time sequence change point, and the length distribution mutation point in the sub-section division is dynamically adjusted according to the attack chain determination result, and the specific process is as follows: according to the risk event types involved in the attack chain, the corresponding protocol change point, time sequence change point, and length distribution mutation point feature mode are extracted, and the detection threshold in the session boundary stability analysis is adjusted; a mutation point mode weight table is established, the weights are dynamically updated based on the appearance frequency of each mutation point mode in the attack chain, and the boundary determination is sequentially performed according to the mutation point modes sorted by weight in the joint detection window.

[0013] An AI-based private network abnormal risk flow multi-modal detection system comprises the following modules: a data acquisition and processing module is used for collecting real-time flow in a private network link, extracting protocol function code sequences, packet arrival time sequences and encrypted message length parameters, simultaneously rearranging and interpolating the collected data according to message timestamps, generating multi-modal session data segments, and marking the corresponding business intent categories according to the current industrial control task process; a session analysis module is used for performing session boundary stability analysis on multi-modal session data, locating internal structural sub-sections of the session by detecting protocol field change sections, time sequence rate change points and encrypted length distribution mutation points, establishing protocol behavior rules based on business intent, monitoring write register instruction operations when the business intent is parameter setting point download, and generating a first-level risk event if the write operation value of the process parameter register is detected to be out of the preset fluctuation range; a risk assessment module is used for calculating field stability intervals, time interval means and encrypted length distribution profiles of the sub-sections, forming a feature set, calculating behavior deviation indicators and generating a session-level risk trend curve by comparing the feature differences of adjacent sub-sections, and generating a second-level risk event in combination with the current private network business load level; and a security response module is used for establishing a time sequence correlation diagram of the first-level and second-level risk events, determining an attack chain and triggering device isolation response when detecting that program update abnormalities and parameter write abnormalities from the same source device occur continuously within a preset time window, and dynamically adjusting the sensitivity of protocol change points, time sequence change points and length distribution mutation points during sub-section division according to the attack chain determination result.

[0014] The present application has the following beneficial effects: (1) An AI-based private network abnormal risk flow multi-modal detection method, which synchronously extracts protocol function code sequences, packet arrival time sequences and encrypted message length parameters in a private network link, generates multi-modal session data segments in combination with timestamp rearrangement and interpolation correction, and realizes complete reconstruction of industrial control communication behavior. This method can avoid the problem of single behavior expression caused by relying on a single type of feature in traditional methods, so that instruction sequences, time rhythm and encrypted traffic structure jointly participate in abnormal identification. On this basis, by detecting protocol field change sections, time sequence rate change points and encrypted length distribution mutation points, a stable session boundary identification mechanism is formed, which can accurately demarcate the structural sub-sections within the session and avoid the behavior analysis misplacement phenomenon caused by fuzzy boundaries in existing methods. Further, protocol behavior rules are established based on business intent, so that key operations such as parameter setting point download can be detected in a clear business context, thereby making the identification of abnormal write register operations context-dependent and solving the actual problem that traditional methods are prone to misjudgment when facing similar instructions but different business contexts.

[0015] (2) An AI-based private network abnormal risk traffic multi-modal detection system extracts the field stable interval, time interval mean value and encryption length distribution profile of the sub-section, compares the differences between adjacent sub-sections, constructs a behavior deviation index and a session-level risk trend curve, so that abnormal behavior can be identified in the form of continuous state, rather than isolated judgment of fragmented events, making up for the shortcomings of existing methods that cannot reflect the behavior evolution trend. On this basis, the temporal relationship between primary and secondary risk events is used to establish an association graph, which can identify attack chains formed by the continuous occurrence of program update abnormalities and parameter write abnormality, and realize the inference of deep attack behavior, rather than being limited to responding to single-point abnormalities. According to the attack chain determination result, the sensitivity to protocol change points, time sequence change points and encryption length mutation points in session division is dynamically adjusted, so that the system has self-adaptive ability and can continuously maintain detection accuracy during the evolution of attack behavior, improving the overall protection capability of the private network.

[0016] Of course, implementing any product of the present application does not necessarily require all the advantages described above to be achieved at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 A flowchart of an AI-based private network abnormal risk traffic multi-modal detection method of the present application.

[0018] Figure 2 A flowchart of an AI-based private network abnormal risk traffic multi-modal detection system of the present application. DETAILED DESCRIPTION

[0019] The embodiments of the present application solve the problem that the prior art cannot effectively identify complex attacks in private networks that are strong in concealment and have business context association through an AI-based private network abnormal risk traffic multi-modal detection method and system.

[0020] The scheme in the embodiments of the present application has the following overall idea: Through multi-modal data fusion and business intent understanding, a hierarchical detection system is constructed. First, in the data collection stage, integrate protocol, time sequence and encryption features, and inject business semantics to provide a rich and practical business meaning data basis for subsequent analysis. Second, adopt a dual detection mechanism: on the one hand, based on business rules, perform protocol compliance verification to find immediate threats that violate process logic; on the other hand, through behavior pattern analysis, identify abnormal sessions that deviate from the normal baseline. Finally, through association analysis, link point-like abnormalities into attack chains, and use the detection results to optimize the sensitivity of the front-end analysis, forming a closed-loop defense system with self-learning ability.

[0021] Please refer to Figure 1The embodiment of the application provides a technical scheme: an AI-based private network abnormal risk flow multi-modal detection method, comprising the following steps: S1. collecting real-time flow in a private network link, extracting protocol function code sequence, packet arrival time sequence and encrypted message length parameters, simultaneously rearranging and interpolating the collected data according to the message timestamp, generating multi-modal session data segments, and marking the corresponding business intent category according to the current industrial control task process; S2. performing session boundary stability analysis on the multi-modal session data, locating the internal structural sub-sections of the session by detecting the protocol field change section, time sequence rate change point and encrypted length distribution mutation point, establishing protocol behavior rules based on the business intent, monitoring the write register instruction operation when the business intent is parameter setting point download, and if the write operation value of the process parameter register is detected to be out of the preset fluctuation range, a first-level risk event is generated; S3. calculating the field stability interval, time interval mean and encrypted length distribution profile of the sub-section, forming a feature set, calculating the behavior offset index and generating a session-level risk trend curve by comparing the feature differences of adjacent sub-sections, and generating a second-level risk event in combination with the current private network business load level; S4. establishing a time sequence correlation diagram of the first-level and second-level risk events, when program update abnormalities and parameter write abnormalities from the same source device are detected to occur continuously within a preset time window, it is determined as an attack chain and a device isolation response is triggered, and the sensitivity of the protocol change point, time sequence change point and length distribution mutation point is dynamically adjusted according to the attack chain determination result.

[0022] In this embodiment, S1: This step is used to build a multi-modal session data base in real time for subsequent analysis in private network nodes. Specifically, by deploying traffic probes in key links to collect raw packets in port mirroring mode, extracting protocol function code sequence (i.e. industrial protocol instruction code arranged in time sequence, such as Modbus function code or OPC UA operation type), packet arrival time sequence (i.e. adjacent packet arrival time interval sequence, used to reflect the timing rhythm of the session) and encrypted packet length parameter (i.e. record the payload length of each encrypted packet, used as a side channel feature of encrypted traffic); the collected packets are rearranged by timestamp and the time breakpoints caused by network jitter or packet loss are interpolated to ensure the synchronization of the three types of sequences on the time axis. Through time alignment and interpolation repair, the analysis error caused by timing misalignment is eliminated, ensuring that each session segment contains protocol behavior, timing characteristics and encryption length information, providing complete and consistent data units for subsequent boundary division and behavior analysis. S2: This step is used to identify internal structural sub-sections at the session granularity and perform rule checking based on business semantics. Specifically, using the variable point detection method to identify function code mutation points (protocol field change section) in the protocol field sequence, rate variation points (i.e. the position where the statistical characteristics of the arrival interval change significantly within a short period of time) in the arrival time sequence, and distribution mutation points (i.e. the time point where the length distribution pattern jumps from one stable mode to another) in the encrypted packet length sequence; superimpose these change points on the same time axis as the basis for dividing the internal structural sub-sections of the session. Based on the business intent (i.e. operation semantics obtained from work orders or control processes, such as periodic collection, parameter download, program update) labeled in S1, establish corresponding protocol behavior rules; for parameter setting point download intent, further monitor the write register instruction and compare the write value with the historical fluctuation interval (estimated confidence interval through historical sampling data), if it is out of bounds, a first-level risk event is generated. Through multi-dimensional variable point joint determination, accurate sub-section segmentation is achieved, and by combining rule checking with business semantics, immediate rule violations can be identified while ensuring the correctness of the context, reducing false positives and improving positioning accuracy. S3: This step is used to quantitatively represent the sub-sections and identify the behavior evolution trend within the session. Calculate the field stable interval (i.e. the common value range of the protocol field in the section), the time interval mean (the statistical mean of the arrival time interval in the section) and the encrypted length distribution profile (the distribution pattern of the packet length in the section) for each sub-section; combine these indicators into a sub-section feature set, and calculate the behavior offset indicator (representing the magnitude and direction of the behavior change from one stable state to another) by comparing the differences between adjacent sub-sections in the above dimensions. Based on the sequence of behavior offset indicators along the time axis, a session-level risk trend curve (i.e. interpolate discrete offset quantities into a continuous curve to reflect abnormal evolution) is constructed, and combined with the current private network business load level (used for normalization and threshold adaptation) to determine whether to trigger a second-level risk event.The isolated abnormal signals are converted into a continuous risk evolution view, slow penetration or gradually deteriorating attack behaviors are captured, and false alarms caused by business fluctuations are reduced by a load perception threshold. S4: This step is used for time sequence association of the detection results of the rule layer (primary events) and the behavior layer (secondary events) to identify attack chains composed of multiple events and drive responses and adaptive optimization. A time sequence association graph is constructed with risk events as nodes and event occurrence relationships as directed edges. In the graph, paths satisfying specific patterns are searched, for example, if a program update abnormal node and a parameter write abnormal node of the same source device appear adjacent to each other within a preset time window, it is determined that an attack chain exists and a device isolation response is triggered (the isolation response refers to issuing a network isolation strategy or closing a suspicious communication channel, etc.). At the same time, the attack chain determination result is mapped to a dynamic adjustment strategy for the sub-section division detection threshold (for example, the detection sensitivity of a mutation point type that frequently appears in the attack chain is improved), so as to realize the closed-loop self-adaptation of the detection process. The event cascade inference improves the recognition ability of complex and multi-stage attacks, and the result-driven parameter adjustment improves the detection accuracy and robustness of the system in subsequent traffic.

[0023] Specifically, the specific process of generating the multi-modal session data segment is as follows: deploying a traffic probe at a key node of the private network link, collecting original packets through port mirroring, performing protocol analysis on the collected packets, extracting the function code field of the Modbus / TCP and OPC UA industrial protocols to form a protocol function code sequence, recording the time interval between adjacent packets to construct a packet arrival time sequence, and counting the payload length of each encrypted packet to generate an encrypted packet length parameter sequence; according to the time sequence identifier in the packet header, the collected data is timestamped and rearranged, the time sequence disorder caused by network jitter is corrected, and the time sequence breakpoint caused by burst packet loss is repaired by an interpolation algorithm; the repaired protocol function code sequence, packet arrival time sequence and encrypted packet length parameter sequence are aligned and packaged according to the session to generate a multi-modal session data segment.

[0024] In the embodiment, a traffic probe is deployed at a key node of the private network link (for real-time capture of all data packets on the link), and original packets are collected through port mirroring. Port mirroring refers to copying all traffic passing through a port on a switch or router without affecting normal communication. The collected packets are first subjected to protocol analysis, and the function code field of the Modbus / TCP, OPC UA and other industrial protocols is extracted to form a protocol function code sequence , wherein, represents the The function code of each message identifies the specific operation type performed by the message, such as reading a register or writing a register, providing basic information for subsequent business intent identification. Simultaneously, the arrival time intervals of adjacent messages are recorded to construct a packet arrival time sequence. ,in ; Indicates the first The timestamps of each message reflect the timing characteristics of message transmission, revealing periodic operations or sudden events. For each encrypted message, the payload length is calculated to form an encrypted message length sequence. ,in This represents the payload length of the r-th message; this sequence is used to analyze abnormal fluctuations in message volume, such as abnormal data uploads or tampering. To ensure time series consistency, the collected data is rearranged according to the message header timestamp, and out-of-order errors caused by network jitter are corrected. For time series breaks caused by packet loss, interpolation algorithms are used to repair them, generating a corrected time series. The formula is as follows: ;in This indicates the repaired time interval; "valid" indicates the time interval is normal, and "lost or abnormal" indicates the time interval is missing or abnormal. This operation ensures the continuity of time series analysis, providing a stable foundation for subsequent session segmentation. Finally, the repaired... , and Alignment and packaging based on session identifiers generate multimodal session data fragments. Each fragment contains protocol, timing, and length characteristics, forming a multimodal data representation that provides a unified data foundation for service intent marking and anomaly detection.

[0025] Specifically, the process of labeling session data fragments with corresponding business intent categories according to the current industrial control task flow is as follows: Obtain the currently executing work order task information, parse the device operation instructions in the work order task, and extract the operation type, target device identifier, and planned execution time window; match the source IP address and destination IP address of the session data fragment with the device identifier in the work order, and align the time based on the overlap between the session occurrence time and the work order execution time window; establish business intent mapping rules: when the session feature is a periodic read register operation and matches a data acquisition work order, mark it as periodic data acquisition; when the session feature includes a write register operation and matches a parameter modification work order, mark it as parameter setpoint download; when the session feature includes a program block transfer operation and matches a program update work order, mark it as controller program update; for sessions that cannot match known work orders, infer intent based on protocol behavior patterns using a clustering algorithm.

[0026] In the embodiment, the generated multi-modal session data segment is marked with a corresponding business intent category according to the current industrial control task flow. The information of the currently executed work order task is acquired, the device operation instructions therein are parsed, and the operation type , target device identification and planned execution time window are extracted for matching with the session data segment. The business intent here refers to the operation purpose of the message, such as periodic data collection, parameter setting or program updating. The source IP address and destination IP address of the session data segment are matched with the work order device identification, and the time alignment is performed according to the coincidence degree of the session occurrence time and the work order execution time window. The coincidence degree is calculated according to the following formula: ; wherein is an indicator function, which is 1 when the time of the a-th message falls within the work order time window , and 0 otherwise; is the total number of messages in the session segment; reflects the time matching degree of the session and the work order, and the higher the matching degree, the higher the credibility of the segment being marked as the corresponding business intent. The business intent mapping rule is established: when the session feature is a periodic read register operation and matches a data collection work order, it is marked as periodic data collection; when the session feature contains a write register operation and matches a parameter modification work order, it is marked as parameter setting download; when the session feature contains a program block transmission operation and matches a program update work order, it is marked as controller program update. For sessions that cannot match known work orders, the protocol behavior mode is used to infer the intent through a clustering algorithm. The clustering distance function can use a multi-modal weighted distance: ; wherein respectively represent the function code sequence, time sequence and length sequence of the session ; are the distance metrics of the respective sequences; is a normalized weight coefficient (determined through historical statistics); the formula is used to quantify the similarity of two sessions in the multi-modal feature space, so as to infer the business intent of unknown sessions.

[0027] Specifically, the session boundary stability analysis is performed on the multi-modal session data, and the specific process of locating the internal structural sub-sections of the session by detecting protocol field change sections, time series rate change points and encryption length distribution mutation points is as follows: the sliding window analysis is performed on the protocol function code sequence to detect the mutation points of the function code type, the wavelet transform is performed on the packet arrival time sequence to extract the singular points of the time sequence, and the kernel density estimation is performed on the encryption message length distribution to identify the steep change area of the length distribution; a joint detection window is established based on the protocol field change section, the time series rate change point and the encryption length distribution mutation point, and when any two types of mutation points appear at the same time in the time window, it is determined as an effective session boundary; the session is divided into multiple structural sub-sections according to the detected session boundary, and the feature index of the divided sub-sections including the start time stamp, the end time stamp and the dominant protocol behavior type is established.

[0028] In the embodiment, in order to accurately divide the session boundary and identify the internal structural sub-sections, the boundary stability analysis is performed on the multi-modal session data. First, the protocol function code sequence The sliding window analysis is performed on the protocol function code sequence The change frequency of the function code type in each window is counted, and the change index is calculated: ; wherein, The function code change index of the kth window is represented by k. The window length is represented by L. The m function codes in the window are represented by m. The function code weight is dynamically allocated based on the frequency of use; the index is used to identify the mutation point of the protocol operation type. Second, the wavelet transform is performed on the packet arrival time sequence to extract the singular points ; wherein, The wavelet transform operation is represented by WT. The wavelet basis function is represented by φ; and rt represents the scale parameter. The singular point reflects the mutation position of the time series rate, and is used to capture the burst traffic or periodic interruption. At the same time, the kernel density estimation is performed on the encryption message length sequence to identify the steep change area of the length distribution ; wherein The length probability density function estimation value is represented by f. The kernel function is represented by K. The bandwidth parameter is represented by h; the steep change area is used to capture the length characteristics of the abnormal data upload or illegal control message. Based on the above three types of mutation points, a joint detection window is established. When any two types of mutation points appear at the same time in the same time window, it is determined that the position is an effective session boundary, so as to divide the session into multiple structural sub-sections. For each sub-section, the feature index including the start time stamp, the end time stamp and the dominant protocol behavior type is established, which provides a structured basis for subsequent risk event detection.

[0029] Specifically, based on business intent, protocol behavior rules are established. When the business intent is parameter setpoint download, write register instruction operations are monitored. If the write operation value of the process parameter register exceeds the preset fluctuation range, a Level 1 risk event is generated. The specific process is as follows: A dynamic rule base based on business intent is established, and a corresponding protocol behavior whitelist is configured for each business intent. When the business intent is parameter setpoint download, the write register instruction monitoring rule is activated. The target register address and written value of the write register instruction are filtered out from the protocol function code sequence. The register address range corresponding to the key process parameters is identified by accessing the process parameter knowledge base. The normal operating range of the key process parameters is constructed based on historical data. The confidence interval of the parameter value is calculated by kernel density estimation. The written value in the write register instruction is compared with the corresponding parameter confidence interval in real time. When the written value exceeds the confidence interval, the source device identifier, target register address, abnormal value, and occurrence timestamp are extracted to generate a Level 1 risk event containing business intent, violation type, and risk level.

[0030] In this implementation scheme, to capture abnormal operations, a dynamic rule base based on business intent is established, and a protocol behavior whitelist is configured for each business intent. For example, when the business intent is parameter setpoint download, the write register instruction monitoring rule is activated. This is based on the protocol function code sequence. Filter out write register instructions Record the target register address for each instruction. and write values Access the process parameter knowledge base to identify the register address ranges corresponding to key process parameters. Based on historical operational data, normal ranges for key parameters are constructed, and confidence intervals for the parameters are calculated using kernel density estimation. ;in, Indicates the historical average; Indicates standard deviation; This represents the confidence level coefficient; this step is used to determine whether the written value deviates from the normal process range. When the written value... At that time, extract the source device identifier. Target register address Abnormal values and timestamp of occurrence Generate a Level 1 risk event that includes business intent, violation type, and risk level. This step can promptly detect abnormal write operations of process parameters, enabling targeted protection.

[0031] Specifically, step S3 comprises the following steps: calculating the value distribution interval of the protocol field as the field stable interval, calculating the statistical mean of the message arrival time interval as the time interval mean, and calculating the distribution profile of the encrypted message length for each sub-section; analyzing the feature difference between adjacent sub-sections based on a sliding window, calculating the comprehensive offset of adjacent sub-sections in the three dimensions of the field stable interval, the time interval mean and the encrypted length distribution profile by a dynamic time warping algorithm to form a behavior offset index sequence; corresponding the behavior offset index sequence to the time axis, generating a continuous risk trend curve by a spline interpolation method, and performing normalization processing on the risk trend curve according to the current private network business load level, and generating a secondary risk event when the curve amplitude exceeds the threshold dynamically adjusted based on the load level.

[0032] In the embodiment, first, for each sub-section The features in three dimensions are calculated: the field stable interval: the protocol field sequence in the sub-section is The value distribution interval is calculated, which is defined as ; wherein The field stable interval is used to measure the change range of the protocol operation in the sub-section; the index can reflect the stability of the sub-section protocol behavior. 2. The time interval mean: the message arrival time sequence in the sub-section is The average value of the time interval is calculated ; wherein The average arrival time interval of the sub-section is used to evaluate the flow rhythm and periodicity of the sub-section. 3. The encrypted message length distribution profile: the probability distribution of the encrypted message length sequence in the sub-section is calculated ; wherein The distribution profile reflects the message length change mode and can be used to capture abnormal data upload or abnormal instructions. Then, the feature difference between adjacent sub-sections is analyzed based on a sliding window The comprehensive offset ; wherein: The field stable interval difference degree is represented; The time interval mean difference degree is represented; The encrypted length distribution profile difference degree is represented, The distribution similarity degree is calculated; The weight coefficients of each dimension are determined by fitting historical data to ensure that the comprehensive offset can truly reflect the behavior change strength. The obtained comprehensive offset sequence is arranged in time sequence, corresponding to the time axis, and a continuous risk trend curve is generated by a spline interpolation method ; wherein represents the sub-section start time; the spline interpolation method can smooth the continuous behavior offset index, facilitating observation of the risk change trend , according to the current private network service load level , the risk trend curve is normalized: ; wherein is a load level adjustment function, which can be fitted according to the historical load offset relationship. If the amplitude of the normalized curve exceeds a set threshold ( determined by historical anomaly statistics), a session-level secondary risk event is generated to indicate the abnormal behavior trend across sub-sections and trigger the corresponding security response.

[0033] Specifically, a timing correlation graph of primary and secondary risk events is established, and when program update anomalies and parameter write anomalies from the same source device occur continuously within a preset time window, it is determined as an attack chain and the specific process of triggering the device isolation response is as follows: a correlation graph is established with risk events as nodes and the timing relationship between events as edges, the node attributes include event type, source device identifier, and occurrence timestamp, and the edge weight represents the time interval between events; in the correlation graph, search for a path that meets a specific pattern, when a directed edge exists between the program update anomaly node and the parameter write anomaly node from the same source device, and the time stamp difference of the two nodes is within the preset time window, it is determined as a potential attack chain; the confidence of the potential attack chain is evaluated, the evaluation factors include event severity, time window compliance, and device criticality, when the confidence exceeds a set threshold, it is confirmed as an attack chain, and an isolation instruction is sent to the target device.

[0034] In this embodiment, the attack chain identification first unifies the primary risk events and the secondary risk events as nodes to construct a risk event timing correlation graph represents a set of nodes in the graph, each node contains attributes: event type ; source device identifier ; event occurrence time represents a directed edge between nodes, and the edge weight reflects the time interval between events, which is used to judge the continuity of events. Then search for a path in the graph that meets the attack pattern, and define the determination condition of the potential attack chain as:

[0035] ; wherein: represents the source device identifier, represents the node event type, represents the time interval between events, ParameterWrite represents parameter writing, ProgramUpdate represents program updating, represents a preset time window threshold value, determined by historical attack chain statistics, used to ensure the continuity and relevance of the determination. For each potential attack chain calculate the confidence ; wherein: represents the event severity score; represents the time window compliance score; represents the device criticality score; is a weight coefficient, determined by fitting historical data, to ensure that the confidence can reasonably reflect the attack risk; when (threshold value determined by statistics of normal and abnormal event distribution), it is determined as a real attack chain, and an isolation instruction is sent to the corresponding source device.

[0036] Specifically, the specific process of dynamically adjusting the sensitivity of the protocol change point, the timing change point and the length distribution mutation point in the sub-section division according to the attack chain determination result is as follows: according to the risk event type involved in the attack chain, the corresponding protocol change point, timing change point and length distribution mutation point feature mode are extracted, and the detection threshold in the session boundary stability analysis is adjusted; a mutation point mode weight table is established, and the weight is dynamically updated based on the frequency of each mutation point mode in the attack chain. In the joint detection window judgment, the mutation point modes are sequentially determined according to the weight in order.

[0037] In this embodiment, after the attack chain determination is completed, the sensitivity of the sub-section division is dynamically adjusted based on the attack chain information to improve the capture ability of potential anomalies. Define a set of mutation point feature modes , including protocol field change points, time sequence rate change points and encryption length mutation points. According to the event type involved in the attack chain, the corresponding mode is extracted, and the determination threshold in the joint detection window is updated ; wherein: is the basic detection threshold; is an adjustment coefficient dynamically calculated according to the attack chain frequency; represents the th mutation point mode; the adjusted threshold is used to improve the sensitivity to high-frequency patterns and ensure that abnormal sub-sections can be divided in time. Further, a mutation point mode weight table is established for the joint detection window, and the weight calculation formula is: ; wherein: is the frequency of the mutation point mode in the attack chain; indicates the priority of the mode in boundary determination; in the joint detection window judgment, according to The sub-section boundary determination is performed in a high-to-low order, and the key mutation point is ensured to trigger the division first, and the risk event capture efficiency is optimized. Technical action: by dynamically adjusting the threshold and weight order, the system can adaptively optimize the sub-section division according to the characteristics of the discovered attack chain, improve the identification ability of abnormal operations, and form a closed-loop self-learning defense system.

[0038] Please refer to Figure 2 An AI-based private network abnormal risk flow multi-modal detection system, comprising the following modules: a data acquisition and processing module for collecting real-time traffic in a private network link, extracting protocol function code sequences, packet arrival time sequences and encrypted message length parameters, simultaneously rearranging and interpolating the collected data according to the message timestamp, generating multi-modal session data segments, and marking the corresponding business intent category according to the current industrial control task process; a session analysis module for performing session boundary stability analysis on multi-modal session data, locating the internal structural sub-sections of the session by detecting protocol field change segments, time sequence rate change points and encrypted length distribution mutation points, establishing protocol behavior rules based on business intent, monitoring write register instruction operations when the business intent is parameter setting point download, and generating a first-level risk event if the write operation value of the process parameter register is detected to be outside the preset fluctuation range; a risk assessment module for calculating the field stability interval, time interval mean and encrypted length distribution profile of the sub-section, forming a feature set, calculating the behavior deviation index and generating a session-level risk trend curve by comparing the feature differences of adjacent sub-sections, and generating a second-level risk event in combination with the current private network business load level; a security response module for establishing a time sequence correlation diagram of the first and second level risk events, determining an attack chain and triggering device isolation response when detecting that program update abnormalities and parameter write abnormalities from the same source device occur continuously within a preset time window, and dynamically adjusting the sensitivity of the protocol change point, time sequence change point and length distribution mutation point in sub-section division according to the attack chain determination result.

[0039] In this embodiment, the data acquisition and processing module is responsible for real-time acquisition of industrial protocol messages in the private network link, extraction of protocol function code sequences, grouping of arrival time sequences, and encryption message length parameters, and rearrangement and interpolation correction of the collected data according to the timestamp to generate multi-modal session data segments. At the same time, the session data segments are marked with the corresponding business intent category according to the current industrial control task process, providing a basis for subsequent analysis with business semantics. This module ensures data integrity and synchronization of multi-modal features, enabling the system to obtain rich and structured inputs from the underlying network traffic. The session analysis module performs session boundary stability analysis on multi-modal session data, divides the internal structural sub-sections by detecting protocol field change segments, time sequence rate change points, and encryption length distribution mutation points. At the same time, based on the business intent, the protocol behavior rules are established, and when abnormal write register instructions are detected under parameter setting points, a first-level risk event is generated. This module achieves precise identification of abnormal operations through fine-grained sub-section division and rule matching, providing basic information for risk assessment. The risk assessment module calculates the field stability interval, time interval mean, and encryption length distribution profile for the sub-sections to form a sub-section feature set; by comparing the feature differences between adjacent sub-sections, it calculates the behavior deviation index and generates a session-level risk trend curve, and generates a second-level risk event in combination with the current private network business load level. This module can quantify local abnormal behavior into an assessable risk trend, enabling comprehensive assessment from single-point anomalies to overall session behavior deviation. The security response module establishes a time sequence correlation graph of first- and second-level risk events, determines potential attack chains, and triggers device isolation responses when conditions are met. At the same time, it dynamically adjusts the sensitivity of sub-section division to protocol change points, time sequence change points, and length distribution mutation points based on attack chain determination results. This module correlates dispersed abnormal events into an overall attack chain, enabling continuous threat identification across events, and improving the system's detection capability for potential attacks through adaptive adjustment.

[0040] In summary, the present application has at least the following effects: An AI-based private network abnormal risk traffic multi-modal detection method and system, through multi-modal data fusion, business intent understanding, and hierarchical risk assessment, achieves precise detection of complex abnormal behaviors with strong concealment and high business relevance in private networks. This method can obtain structured session data segments with business semantics in the acquisition stage, fine-grained division of sub-sections and generation of first-level risk events in the session analysis stage, quantification of abnormalities through behavior deviation indexes and generation of second-level risk events in the risk assessment stage, and correlation of dispersed abnormal events into attack chains through the security response module, enabling continuous threat identification across events and device isolation. The overall scheme forms a closed-loop defense system from data acquisition, anomaly identification, risk assessment, to automatic response, improving the accuracy, timeliness, and operability of anomaly detection in private network environments.

[0041] Those skilled in the art will appreciate that embodiments of the present application can be readily used as software, hardware, or a combination of software and hardware. In one

[0042] The present application is described in reference to the drawings using a flowchart and / or a block diagram of the system, apparatus (system), and computer program product according to embodiments of the application. It will be understood that each block of the flowchart and / or block diagram, and combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 means for carrying out each of the

[0043] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 means for carrying out each of the

[0044] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 means for carrying out each of the

[0045] While preferred embodiments of the application have been described, modifications and alterations thereto will occur to those skilled in the art upon reading the preceding description. In particular, it will be apparent to those skilled in the art that parts can be added to, or substituted for, parts of the described embodiment. It is intended that the application be construed as including all such modifications and alterations. Accordingly, the drawings and descriptions are to be regarded as illustrative in nature, and not as restrictive.

[0046] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. An AI-based private network abnormal risk traffic multi-modal detection method, characterized in that, Comprise the following steps: S1. Collecting real-time traffic in a private network link, extracting protocol function code sequence, packet arrival time sequence and encrypted message length parameter, simultaneously rearranging and interpolating the collected data according to the message timestamp, generating multi-modal session data segments, and marking the corresponding business intent category according to the current industrial control task process; S2. Perform session boundary stability analysis on multi-modal session data, locate the internal structural sub-sections of the session by detecting protocol field change sections, time sequence rate change points and encrypted length distribution mutation points, establish protocol behavior rules based on business intent, when the business intent is parameter setting point download, monitor the write register instruction operation, if the write operation value of the process parameter register is detected to be out of the preset fluctuation range, a first-level risk event is generated; S3. Calculate the field stability interval, time interval mean and encrypted length distribution profile of the sub-section to form a feature set, calculate the behavior deviation index and generate a session-level risk trend curve by comparing the feature differences of adjacent sub-sections, and generate a second-level risk event combined with the current private network business load level; S4. Establish a time sequence correlation diagram of first-level and second-level risk events, when detecting that program update anomalies and parameter write anomalies from the same source device occur continuously within a preset time window, determine as an attack chain and trigger device isolation response, dynamically adjust the sensitivity of protocol change points, time sequence change points and length distribution mutation points when dividing sub-sections according to the attack chain determination result.

2. The AI-based private network abnormal risk flow multi-modal detection method according to claim 1, characterized in that: The specific process of generating multi-modal session data segments is as follows: Deploy a traffic probe at the key node of the private network link, collect raw messages through port mirroring, perform protocol analysis on the collected messages, extract the function code field of Modbus / TCP and OPC UA industrial protocols, and form a protocol function code sequence; Record the arrival time interval of adjacent messages, build a packet arrival time sequence, and count the payload length of each encrypted message to generate an encrypted message length parameter sequence; According to the time sequence identifier in the message header, rearrange the timestamp of the collected data, correct the time sequence disorder caused by network jitter, and use interpolation algorithm to repair the data caused by burst packet loss; Align and package the repaired protocol function code sequence, packet arrival time sequence and encrypted message length parameter sequence according to the session to generate multi-modal session data segments.

3. The AI-based private network abnormal risk traffic multi-modal detection method according to claim 2, characterized in that: The specific process of marking the corresponding business intent category according to the current industrial control task process for the session data segment is as follows: Get the current executed work order task information, parse the device operation instructions in the work order task, extract the operation type, target device identifier and planned execution time window; Match the source IP address and destination IP address of the session data segment with the device identifier in the work order, and perform time alignment according to the coincidence degree of the session occurrence time and the work order execution time window; Establishing business intent mapping rules: when the session characteristics are periodic read register operations and match data collection work orders, mark as periodic data collection; when the session characteristics contain write register operations and match parameter modification work orders, mark as parameter setting point download; when the session characteristics contain program block transmission operations and match program update work orders, mark as controller program update; For sessions that cannot match known work orders, intent inference is performed based on protocol behavior patterns through clustering algorithms.

4. The AI-based private network abnormal risk flow multi-modal detection method according to claim 1, characterized in that: The specific process of locating the internal structural sub-sections of the session is as follows: Perform sliding window analysis on the protocol function code sequence to detect mutation points of function code types, perform wavelet transform on the packet arrival time sequence to extract singular points of the time sequence, and perform kernel density estimation on the encrypted message length distribution to identify steep regions of the length distribution; Based on the protocol field change segment, the time sequence rate change point and the encrypted length distribution mutation point, a joint detection window is established, and when any two types of mutation points appear at the same time within the time window, it is determined as an effective session boundary; According to the detected session boundary, the session is divided into multiple structural sub-sections, and a feature index including the start time stamp, the end time stamp and the dominant protocol behavior type is established for the divided sub-sections.

5. The AI-based private network abnormal risk traffic multi-modal detection method according to claim 4, characterized in that: Based on the business intent, the protocol behavior rules are established, and when the business intent is parameter setting point download, the write register instruction operation is monitored. If the write operation value of the process parameter register exceeds the preset fluctuation range, a first-level risk event is generated. The specific process is as follows: A dynamic rule library based on business intent is established, and a corresponding protocol behavior white list is configured for each business intent. When the business intent is parameter setting point download, the write register instruction monitoring rule is activated; From the protocol function code sequence, the write register instruction record target register address and write value are filtered out, and the process parameter knowledge base is accessed to identify the register address range corresponding to the key process parameters; Based on historical data, the normal operation interval of the key process parameters is constructed, the confidence interval of the parameter value is calculated through kernel density estimation, and the write value in the write register instruction is compared with the corresponding parameter confidence interval in real time; When the write value exceeds the confidence interval, the source device identifier, target register address, abnormal value and occurrence time stamp are extracted, and a first-level risk event containing business intent, violation type and risk level is generated.

6. The AI-based private network abnormal risk flow multi-modal detection method and system according to claim 1, characterized in that: Step S3 includes the following steps: Calculate the value distribution interval of the protocol field as the field stable interval for each sub-section, calculate the statistical mean of the packet arrival time interval as the time interval mean, and count the distribution profile of the encrypted message length; Based on sliding window analysis of the feature differences between adjacent sub-sections, the comprehensive offset of adjacent sub-sections in the field stable interval, time interval mean and encrypted length distribution profile is calculated through dynamic time warping algorithm to form a behavior offset index sequence; The behavior deviation index sequence is corresponded to a time axis, a continuous risk trend curve is generated by a spline interpolation method, the risk trend curve is normalized according to a current private network service load level, and a secondary risk event is generated when the curve amplitude exceeds a threshold dynamically adjusted based on the load level.

7. The AI-based private network abnormal risk flow multi-modal detection method according to claim 1, characterized in that: A timing correlation diagram of the primary and secondary risk events is established, when program update abnormities and parameter write abnormities from the same source device continuously occur within a preset time window, it is determined as an attack chain and a specific process of a device isolation response is triggered as follows: A correlation diagram is established with risk events as nodes and time sequence relationships between the events as edges, node attributes include event types, source device identifiers and occurrence time stamps, and edge weights represent time intervals between the events; In the correlation diagram, a path meeting a specific mode is searched, when a directed edge exists between a program update abnormity node and a parameter write abnormity node from the same source device, and a time stamp difference value of the two nodes is within a preset time window, it is determined as a potential attack chain; Confidence evaluation is performed on the potential attack chain, evaluation factors include event severity, time window compliance and device criticality, when the confidence exceeds a set threshold, it is confirmed as an attack chain, and an isolation instruction is sent to the target device.

8. The AI-based private network abnormal risk traffic multi-modal detection method according to claim 7, characterized in that: According to the attack chain determination result, the sensitivity of the protocol change point, the time sequence change point and the length distribution mutation point in the sub-section division is dynamically adjusted as follows: According to the risk event types involved in the attack chain, corresponding protocol change points, time sequence change points and length distribution mutation point feature modes are extracted, and detection thresholds in session boundary stability analysis are adjusted; A mutation point mode weight table is established, weights are dynamically updated based on the appearance frequencies of the mutation point modes in the attack chain, and the boundary is determined in sequence according to the mutation point modes sorted by the weights when the joint detection window is judged.

9. An AI-based private network abnormal risk traffic multi-modal detection system, applied to the AI-based private network abnormal risk traffic multi-modal detection method of any one of claims 1-8, characterized in that, The following modules are included: The data acquisition and processing module is used for collecting real-time traffic in the private network link, extracting protocol function code sequences, packet arrival time sequences and encrypted message length parameters, rearranging and interpolating the collected data according to the message time stamps, generating multi-modal session data segments, and marking the corresponding business intent categories according to the current industrial control task process; The session analysis module is used for performing session boundary stability analysis on the multi-modal session data, locating the internal structural sub-sections of the session by detecting protocol field change sections, time sequence rate change points and encrypted length distribution mutation points, establishing protocol behavior rules based on business intent, when the business intent is parameter setting point download, monitoring write register instruction operations, and if the write operation value of the process parameter register exceeds the preset fluctuation range, a primary risk event is generated; The risk evaluation module is used for calculating field stability intervals, time interval means and encrypted length distribution profiles of the sub-sections, forming a feature set, comparing the feature differences between adjacent sub-sections, calculating behavior deviation indexes and generating a session-level risk trend curve, and generating a secondary risk event in combination with the current private network service load level; The security response module is used for establishing a time sequence correlation diagram of primary and secondary risk events, determining an attack chain and triggering a device isolation response when detecting that program update abnormities and parameter write abnormities from the same source device occur continuously within a preset time window, and dynamically adjusting the sensitivity of the protocol change point, the time sequence change point and the length distribution mutation point to the sub-section division according to the attack chain determination result.

Images