Semantic modeling and mode recognition method and system for energy industrial control application instruction flow

Abstract

The invention discloses an energy industrial control application instruction flow semantic modeling and mode recognition method and system, and belongs to the technical field of energy industry internet security, and the method comprises the steps: collecting industrial control flow data of a preset node in an internet constructed between energy industry equipment, and constructing a data set; performing industrial control protocol identification and analysis on the data set, and extracting an industrial control instruction stream logically associated with energy industrial control application instruction stream semantics; constructing a semantic association model based on semantic label mapping between the energy industry knowledge base and the industrial control instruction; establishing a time sequence feature learning model of the industrial control instruction stream; based on a knowledge base of the energy industry, establishing a semantic constraint rule base; and fusing the time sequence feature learning model, the semantic association model and the semantic constraint rule base, constructing an industrial control instruction flow anomaly detection model, and performing abnormal mode identification on the target energy industrial control application instruction flow. The problem that in the prior art, semantic label analysis is low in accuracy is solved.

Description

Technical Field

[0001] This invention relates to the field of energy industrial internet security technology, and more specifically, to a method and system for semantic modeling and pattern recognition of command flow in energy industrial control applications. Background Technology

[0002] While current energy industrial control application instruction flow semantic modeling and anomaly detection technologies have initially covered protocol parsing, feature extraction, and classification detection, they still have significant shortcomings in semantic depth understanding, temporal correlation adaptation, data augmentation effectiveness, and anomaly scoring comprehensiveness, which seriously limit their reliable application in complex energy scenarios such as photovoltaic, wind power, and substations.

[0003] First, existing semantic modeling technologies lack quantitative confidence mechanisms and dynamic adaptation capabilities, making it difficult to cope with the diversity of equipment and process changes from multiple vendors. For example, the intrusion detection method proposed in CN112383563A only maps protocol fields (such as Modbus register addresses) to semantic tags through static point table configuration, without considering differences in equipment models (such as the different register address definitions between Siemens S7-1500 and Schneider M340) and updates to process parameters (such as the register address associated with the "output power" parameter of a photovoltaic inverter changing with firmware upgrades). This static mapping method not only requires engineers to invest a lot of manual time in maintaining the point table, resulting in low configuration efficiency, but also lacks a quantitative verification mechanism for tag accuracy. When there is a mismatch in equipment model matching or changes in process parameters, the semantic tag error rate is high, leading to subsequent anomaly detection based on incorrect semantics, resulting in false alarms such as "misjudging normal parameter adjustments as attacks".

[0004] Secondly, the extraction of temporal features fails to correlate business priorities with temporal relationships, easily obscuring the abnormal features of critical instructions. While the intelligent analysis method for industrial control protocols proposed in CN119071369A employs deep learning to extract temporal features from the instruction stream, it uses a globally weighted feature extraction approach. This fails to differentiate between the business priorities of critical instructions such as "emergency stop" and "fault reset" and secondary instructions such as "status query" and "log read," and also neglects the impact of time intervals between instructions on correlation (e.g., significant abnormal fluctuations in the normal interval of "startup → running"). In simulated attack scenarios involving "forged emergency stop instructions inserted into the normal instruction stream," existing methods, lacking enhanced temporal weighting for critical instructions, result in attack features being overshadowed by normal fluctuations in secondary instructions, leading to poor detection performance and difficulty in accurately identifying such attacks. This falls far short of meeting the security requirements for critical operations in energy scenarios.

[0005] Furthermore, data augmentation fails to adhere to the semantic and logical constraints of industrial control commands, resulting in inefficient sample generation and misleading model training. Existing technologies (such as general GANs or basic CVAE models) only augment data by randomly perturbing protocol fields or temporal sequences when generating attack samples, without considering the inherent logical rules of energy industrial control commands (such as "a speed reduction command must precede a shutdown command" and "authorization verification is required before parameter modification commands"). For example, in wind turbine PLC control scenarios, traditional CVAE generates a high proportion of samples that violate semantic logic, such as "direct shutdown without speed reduction" and "parameter modification without authorization." When such invalid samples enter the training process, the model learns incorrect control logic rules, resulting in insufficient detection capabilities for "logic violation attacks" (such as skipping speed reduction and directly sending a shutdown command), thus reducing the model's generalization ability.

[0006] Finally, anomaly scoring relies on a single-dimensional indicator, failing to balance the contradiction between false positives and false negatives. The AI-based industrial control protocol anomaly detection method proposed in CN119652802A judges anomalies solely by setting a fixed threshold based on the probability value output by the classifier, without integrating temporal anomaly (such as abrupt changes in instruction intervals) and semantic relevance (such as the business relevance between "shutdown" and preceding instructions). In photovoltaic inverter control scenarios, this single-dimensional scoring method, on the one hand, misjudges "power fine-tuning caused by cloudy weather" (with normal timing and reasonable semantics) as an anomaly, resulting in a high false positive rate; on the other hand, it ignores the attack characteristics of "register read / write without authorized addresses" (where the classifier probability is close to the threshold, but the semantic relevance is extremely low), leading to a high false negative rate, making it difficult to meet the stringent requirements for detection accuracy in energy industrial control systems.

[0007] In summary, existing technologies cannot construct an instruction flow semantic modeling and anomaly detection system adapted to energy industrial control scenarios through quantitative semantic confidence, differentiated temporal weights, semantic constraint data enhancement, and multi-dimensional anomaly fusion. This results in low detection accuracy for complex attacks such as semantic confusion attacks and temporal logic attacks, and fails to guarantee the control security of the energy industrial internet. Summary of the Invention

[0008] To address the above problems, this invention proposes a method for semantic modeling and pattern recognition of instruction flows in energy industrial control applications, comprising:

[0009] Collect industrial control traffic data from preset nodes in the Internet constructed between energy industry equipment rooms to build a dataset;

[0010] The dataset is used to identify and parse industrial control protocols, and to extract industrial control command streams that have logical associations with the semantics of energy industrial control application command streams.

[0011] Based on the semantic tag mapping between the energy industry knowledge base and industrial control instructions, a semantic association model is constructed.

[0012] Establish a timing feature learning model for industrial control command flow;

[0013] A semantic constraint rule base is established based on the knowledge base of the energy industry.

[0014] By integrating a temporal feature learning model, a semantic association model, and a semantic constraint rule base, an anomaly detection model for industrial control command flow is constructed to identify abnormal patterns in the command flow of target energy industrial control applications.

[0015] Optionally, industrial control traffic data from preset nodes in the internet constructed between energy industry equipment can be collected, including:

[0016] For core scenarios in the energy industrial internet, the data collection objects and collection links are determined. Based on the data collection objects and collection links, data collection tools are deployed. The deployed data collection tools collect industrial control traffic data of preset nodes in the internet constructed between energy industrial equipment on the collection links for the data collection objects.

[0017] The core scenarios include at least one of the following: photovoltaic power plants, wind farms, and substations.

[0018] Optionally, building the dataset includes the following steps:

[0019] The original traffic data is parsed, and redundant data is removed from the parsed data. The parsed data with redundant data removed is then processed into structured data to generate structured data. A dataset is then constructed based on the structured data, and the quality of the dataset is verified.

[0020] Optionally, the dataset is subjected to industrial control protocol identification and parsing, and the industrial control command streams that have logical correlation with the semantics of energy industrial control application command streams are extracted, including:

[0021] The constructed dataset is parsed by matching protocol type with the parser to obtain the parsed protocol features. The core control fields are extracted from the protocol features and associated with the semantics of the energy industrial control application instruction stream to obtain the associated sequence. The associated sequence is then reorganized to generate an industrial control instruction stream with logical association.

[0022] Optionally, the method also includes:

[0023] After constructing the semantic association model, the confidence of the semantic mapping is calculated by three-factor nonlinear fusion to verify the constructed semantic association model.

[0024] Optionally, the semantic model is optimized to construct a multi-dimensional anomaly detection model, including:

[0025] For the semantic model, instruction flow temporal feature learning and semantic constraint enhancement training are performed to optimize the semantic model. After optimization, a multi-dimensional anomaly detection model is constructed by integrating multi-dimensional detection indicators, multi-dimensional anomaly scores, and anomaly reasoning and level determination conditions.

[0026] Optionally, the method also includes:

[0027] The constructed industrial control command flow anomaly detection model is adapted for edge deployment and optimized for lightweight design. The dimensional anomaly detection model is then incrementally optimized online using the feedback online detection data.

[0028] Furthermore, this invention also proposes a semantic modeling and pattern recognition system for instruction flows in energy industrial control applications, comprising:

[0029] The data acquisition unit is used to collect industrial control traffic data from preset nodes in the Internet constructed between energy industrial equipment, and construct a dataset; to identify and parse the industrial control protocol in the dataset, and to extract the industrial control command stream that has a logical relationship with the semantics of the energy industrial control application command stream;

[0030] The modeling unit is used to construct a semantic association model based on the semantic tag mapping between the energy industry knowledge base and industrial control instructions; establish a temporal feature learning model for industrial control instruction flow; and establish a semantic constraint rule base based on the energy industry knowledge base.

[0031] The identification unit is used to integrate a time-series feature learning model, a semantic association model, and a semantic constraint rule base to construct an anomaly detection model for industrial control command flow, and to identify abnormal patterns in the command flow of the target energy industrial control application.

[0032] In another aspect, the present invention also provides a computing device, comprising: one or more processors;

[0033] A processor is used to execute one or more programs;

[0034] When the one or more programs are executed by the one or more processors, the method described above is implemented.

[0035] In another aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described above.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] This invention provides a method for semantic modeling and pattern recognition of command flows in energy industrial control applications, comprising: collecting industrial control traffic data from preset nodes in an internet network constructed between energy industrial equipment to build a dataset; identifying and parsing the industrial control protocols in the dataset and extracting industrial control command flows that are logically related to the semantics of energy industrial control application command flows; constructing a semantic association model based on the semantic tag mapping between an energy industry knowledge base and industrial control commands; establishing a temporal feature learning model for industrial control command flows; establishing a semantic constraint rule base based on the energy industry knowledge base; and integrating the temporal feature learning model, the semantic association model, and the semantic constraint rule base to construct an anomaly detection model for industrial control command flows, thereby identifying abnormal patterns in target energy industrial control application command flows. This invention solves the problems of existing technologies where semantic parsing relies on manual intervention and label accuracy is low. Attached Figure Description

[0038] Figure 1 This is a flowchart of the method of the present invention;

[0039] Figure 2 This is a structural diagram of the system of the present invention. Detailed Implementation

[0040] Exemplary embodiments of the invention will now be described with reference to the accompanying drawings. However, the invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided to fully and completely disclose the invention and to fully convey its scope to those skilled in the art. The terminology used in the exemplary embodiments illustrated in the drawings is not intended to limit the invention. In the drawings, the same units / elements are referred to by the same reference numerals.

[0041] Unless otherwise stated, the terms used herein (including technical terms) have their common meaning as understood by one of ordinary skill in the art. Furthermore, it is understood that terms defined in commonly used dictionaries should be understood to have a meaning consistent with the context of their relevant field, and not to be interpreted as having an idealized or overly formal meaning.

[0042] Example 1:

[0043] This invention proposes a semantic modeling and pattern recognition method S100 for instruction flow in energy industrial control applications, such as... Figure 1 As shown, it includes:

[0044] S101, collect industrial control traffic data from preset nodes in the Internet constructed between energy industrial equipment, and construct a dataset;

[0045] S102, Identify and parse the industrial control protocol in the dataset, and extract the industrial control command stream that has a logical relationship with the semantics of the energy industrial control application command stream;

[0046] S103, based on the semantic tag mapping between the energy industry knowledge base and industrial control instructions, constructs a semantic association model;

[0047] S104, Establish a timing feature learning model for industrial control instruction flow;

[0048] S105, Based on the knowledge base of the energy industry, establish a semantic constraint rule base;

[0049] S106 integrates a time-series feature learning model, a semantic association model, and a semantic constraint rule base to construct an anomaly detection model for industrial control command flow, and identifies abnormal patterns in the command flow of target energy industrial control applications.

[0050] The following is a detailed explanation of steps S101-S106:

[0051] This includes collecting industrial control traffic data from preset nodes in an internet network constructed between energy industry equipment to build a dataset, including:

[0052] For core scenarios in the energy industrial internet, the data collection objects and collection links are determined. Based on the data collection objects and collection links, data collection tools are deployed. The deployed data collection tools collect industrial control traffic data of preset nodes in the internet constructed between energy industrial equipment on the collection links for the data collection objects.

[0053] This step mainly targets core scenarios in the energy industrial internet, such as photovoltaic power plants, wind farms, and substations, and conducts targeted data collection around the communication links of key control equipment to ensure coverage of core control traffic.

[0054] Specifically, it includes:

[0055] 1. Data Collection Targets and Link Selection: Focusing on the OPC UA communication links between photovoltaic inverters and SCADA systems, the protocol interaction links of wind turbine PLCs (such as Siemens S7-1500 and Schneider M340 series), the message links between substation bay layers and station control layers, and the control links of traditional power distribution systems, direct connections between equipment or core ports of switches are selected as data collection points to avoid traffic loss or delay.

[0056] 2. Data Acquisition Tools and Deployment Methods: Industrial-grade flow acquisition equipment (such as the DeepControl DK-ICS100 acquisition card, which supports a wide temperature range of -40℃ to 70℃) is deployed in bypass mode to avoid interference with the existing control network. Full message data is captured in real time using message acquisition software (such as DeepControl Flow Collector), and device metadata (such as device model, IP address, firmware version, and process stage) is recorded simultaneously. At the same time, the TShark tool is used to help extract message details, including request frames, response frames, data payload, and interaction timing information, to ensure that the acquired data contains both the original message and the associated device and process context.

[0057] 3. Data Collection and Management: Collected messages are stored in PCAPng format, and a directory structure is established according to the dimension of "Scenario-Device-Time (accurate to μs)" (e.g., "PV Power Station-Inv1-20240520-1030") for easy subsequent retrieval. Simultaneously, an integrity verification identifier is added to the collected data, and a data fingerprint is generated using the SHA-256 hash algorithm (FIPS180-4 standard), as shown in the following formula:

[0058] F = SHA256(P||M||T)

[0059] Wherein, F is the data fingerprint, P is the original message data, M is the device metadata, and T is the acquisition timestamp (format conforming to the "Data Elements and Exchange Format Information Exchange Date and Time Representation Method"); by comparing the data fingerprint, it is ensured that the data has not been tampered with, and the storage process refers to the requirements of the "Power Monitoring System Security Protection Regulations", providing a complete and reliable original data foundation for subsequent protocol parsing and instruction stream extraction.

[0060] Building a dataset involves the following steps:

[0061] The original traffic data is parsed, and redundant data is removed from the parsed data. The parsed data with redundant data removed is then processed into structured data to generate structured data. A dataset is then constructed based on the structured data, and the quality of the dataset is verified.

[0062] This step mainly involves systematically processing the collected raw traffic data, removing interference information, standardizing the data format, and constructing a high-quality dataset suitable for subsequent modeling.

[0063] The specific steps are as follows:

[0064] 1. Data Parsing and Redundancy Removal: The original packets are parsed layer by layer using protocol parsing tools (such as libmodbus and open62541) to extract industrial protocol-related data (such as Modbus function codes and register addresses, OPC UA node IDs and data values). Redundant low-level protocol information, such as TCP / IP headers (such as IP addresses and port numbers) and checksum fields (such as CRC32), is removed, retaining only the core content related to industrial control logic. For incomplete packets encountered during parsing (such as lost frames or missing fields), interpolation based on adjacent packets is used for completion, as shown in the following formula:

[0065]

[0066] Where, x miss For the missing field value, x i-1 x i+1 t represents the valid field values ​​adjacent to the missing field. i-1 t i The corresponding field should be assigned a data collection timestamp (format conforming to GB / T 7408-2022 "Data Elements and Interchange Formats - Date and Time Representation for Information Interchange") to avoid data loss affecting subsequent analysis and ensure data traceability (refer to "Regulations on Security Protection of Power Monitoring Systems").

[0067] 2. Data Structure Organization: The parsed data is classified according to protocol type (Modbus, OPC UA, IEC 61850, etc.), and the key information of each data item is stored in JSON format;

[0068] At the same time, an "Energy Industrial Control Data Dictionary" was established to define the meaning and relationship of each field, providing a unified data standard for subsequent semantic modeling.

[0069] 3. Dataset Partitioning and Quality Verification: The structured data is divided into training, validation, and test sets using any existing stratified sampling algorithm (such as Stratified Sampling). During the partitioning process, it is ensured that each set covers control data for different equipment and process scenarios (such as start-up, shutdown, fault, and grid connection scenarios of photovoltaic inverters) to avoid dataset bias. The dataset quality is verified through statistical analysis, calculating data integrity (field missing rate <0.5%) and logical consistency (such as no "speed increase" data after "shutdown command"), removing outliers and duplicate data to ensure the accuracy and representativeness of the dataset.

[0070] Specifically, the dataset is used to identify and parse industrial control protocols, and to extract industrial control command streams that have logical connections with the semantics of energy industrial control application command streams, including:

[0071] The constructed dataset is parsed by matching protocol type with the parser to obtain the parsed protocol features. The core control fields are extracted from the protocol features and associated with the semantics of the energy industrial control application instruction stream to obtain the associated sequence. The associated sequence is then reorganized to generate an industrial control instruction stream with logical association.

[0072] This step mainly uses the preprocessed dataset to perform in-depth analysis of multiple types of industrial control protocols and extract logically related industrial control instruction streams, laying the foundation for semantic modeling.

[0073] The specific steps are as follows.

[0074] 1. Protocol Type Identification and Parser Matching: The protocol type of the message is automatically identified through protocol feature matching. Features include port number (e.g., port 502 for Modbus TCP, port 4840 for OPC UA), header identifier (e.g., APPID = 0x8001 for IEC 61850), and field structure (e.g., TPKT header + COPT header for S7Comm). The dedicated parser for the corresponding protocol is called. For vendor-specific protocol variants (e.g., custom Modbus function code 0x16 for Huawei SUN2000 inverters), parsing is achieved through joint matching of device fingerprint and protocol features. The device fingerprint matching degree formula adopts the weighted cosine similarity algorithm in the existing technology (refer to the core logic of device identification described in the device identification method in patent CN119071369A, which is to achieve device matching through "multi-dimensional device feature extraction (firmware version, protocol interaction features, port features, etc.) + feature weight allocation + similarity calculation". Its core idea is "prioritize the improvement of identification accuracy based on key features (e.g., protocol fields, firmware version)"). Based on this, the corresponding formula for calculating device fingerprint matching degree is:

[0075]

[0076] Where M is the device fingerprint matching degree, with a value range of [0,1]. A successful match is determined when M≥0.85 (the threshold is based on the "Device Identification Confidence Requirements" in CN119071369A); m is the device fingerprint feature dimension, which is based on the "Core Feature Types" in CN119071369A, selecting four key features for energy industrial control scenarios, i.e., m=4 (namely: firmware version features, protocol core field features, device model identifier features, and response latency features); w i The weights for the i-th feature are: protocol field and firmware version contribute the most to device identification; values ​​are assigned after adaptation to energy industrial control scenarios.

[0077] Firmware version feature weight w1 = 0.4 (Firmware compatibility of energy industrial control equipment directly affects the accuracy of protocol parsing, and has the highest priority);

[0078] The feature weight w2 of the core protocol fields is 0.3 (such as Modbus function code, OPCUA node ID);

[0079] The weight of the equipment model identifier feature w3 = 0.2 (there is a strong correlation between the model of energy industrial control equipment and the control logic);

[0080] The response delay feature weight w4 = 0.1 (to assist in verifying device consistency);

[0081] Furthermore, the total weight is 1, ensuring that the weight allocation logic does not conflict with the patent technology framework;

[0082] f i,test The normalized value of the i-th dimension feature of the device to be identified (the original feature value is mapped to [0,1] through min-max normalization);

[0083] f i,std The normalized value of the i-th dimension feature of "standard equipment" in the device fingerprint database is used. The fingerprint database construction method is described in CN119071369A.

[0084] 2. Extraction and Association of Core Control Fields: Extract core fields directly related to the control logic from the parsed protocol data, including device control commands (start, stop, parameter adjustment), status feedback data (temperature, pressure, operating status), and operation permission identifiers (such as user level, authorization code); associate the scattered fields according to the device interaction logic through information such as device IP, session ID, and timestamp. For example, associate the "request command-response data" of the same device through "session ID = 0x1234" to ensure the logical consistency between fields.

[0085] 3. Industrial Control Command Stream Sequence Reassembly: Based on the timing relationships and business logic of the control session, the associated control fields are reassembled into a continuous industrial control command stream. A timing logic reassembly algorithm is used, with the following formula:

[0086]

[0087] Where S is the reassembled instruction stream sequence, x k For the k-th control field, t kThe field timestamp, [T0,T1] is the single session time window (set according to the device interaction cycle to ensure coverage of the complete control cycle of the wind turbine / photovoltaic inverter, such as a 5-minute control session window for wind turbines), and D0 is the target device ID; at the same time, it marks key nodes in the instruction stream (such as emergency stop instructions, permission change instructions) to focus on the core control logic for subsequent semantic modeling and anomaly detection.

[0088] In this process, after constructing the semantic association model, the confidence of the semantic mapping is calculated by three-factor nonlinear fusion and then verified.

[0089] This step mainly involves semantic modeling and confidence verification of the instruction stream. The extracted industrial control instruction stream is deeply integrated with the business scenarios and process logic of the energy industry to build a semantic model that is business-understandable. Multi-dimensional verification is used to ensure the accuracy of semantic mapping.

[0090] The specific implementation is as follows:

[0091] 1. Construction of process knowledge base and semantic tag mapping: sort out the process flow and equipment control rules of various scenarios in the energy industry, and build a structured process knowledge base. The semantic tag mapping rules are based on Appendix B "DCS system control instruction semantic library" of GB / T33009.2-2016 "Industrial automation and control system network security distributed control system (DCS) Part 2: management requirements". For example, in the photovoltaic inverter scenario, "assigning 0x000A to register 0x0001" maps to "wind turbine motor speed = 1000rpm", with a process constraint of speed range of 500-1500rpm (refer to Table 3 of GB / T 36572-2018 "Guidelines for Network Security Protection of Power Monitoring Systems"); in the substation scenario, "setting function code 0x05 to 0xFF" maps to "closing 10kV switch", with a process constraint that there must be no short circuit fault before closing (refer to DL / T 544-2022 "Regulations for Communication Management of Power Systems"); through this type of mapping, the instruction flow is transformed from the "code level" to the "business level".

[0092] 2. Instruction Flow Semantic Association Modeling: Analyze the business relationships between semantic tags and construct a semantic association model. Semantic association strength is calculated using the following formula:

[0093]

[0094] Among them, S rel (L i ,L j ) is a semantic tag L i To L j The correlation strength, Count(L) i →L jL is in normal scenarios i L followed j The number of times, Count(L) i ) for L i Total number of occurrences, W proc The process weight (defined by Appendix C, "Industrial Control Command Risk Weight Table," of the "Information Security Technology Guidelines for Cybersecurity Protection of Important Industrial Control Systems"), such as the W associated with "emergency shutdown" proc =1.5); This formula forms a semantic logic graph, which clearly depicts the semantic association patterns in normal scenarios.

[0095] 3. Semantic Mapping Confidence Verification: The confidence of the semantic mapping is calculated using a three-factor nonlinear fusion mechanism, as shown in the following formula:

[0096] C = (M·K) α ·H (1-α)

[0097] Where: C is the semantic label confidence score (value range 0-1, C≥0.9 is a valid label); M is the process knowledge base matching score (value range 0-1, calculated based on the semantic library of Appendix B of GB / T 33009.2-2016, M=1 if there is a perfect match); K is the historical mapping consistency score (value range 0-1, such as the historical mapping library of the Siemens S7 series PLC official operation manual, calculate the similarity between the current mapping and the historical correct mapping); H is the equipment status correlation score (value range 0-1, calculated based on the real-time status of the equipment, such as H=1 if the "start command" matches the current "standby status" of the equipment); α is the coupling coefficient (value range 0.6, obtained through validation set optimization, the validation set is 3 months of real semantic mapping data of a wind farm); semantic labels with C<0.7 are marked as "to be reviewed", and the reliability of the semantic model is ensured through manual verification or knowledge base update optimization.

[0098] After verification, the timing features of the instruction stream are learned and semantic constraints are enhanced. Deep learning methods are used to extract timing features based on the temporal and semantic logic of the industrial control instruction stream, and semantic constraints are used to strengthen the business relevance of these features, thereby improving the accuracy of subsequent anomaly detection. The specific operations are as follows:

[0099] 1. Temporal Feature Learning Model Construction: A bidirectional LSTM model is adopted, using semantic label sequences as input to learn the temporal evolution patterns of the instruction stream. The model incorporates temporal attention weights, as shown in the following formula:

[0100] W t =W b ·e -β·Δt ·(1+γ·S rel )

[0101] Among them: Wt Temporal attention weights (values ​​range from 0 to 1; higher weights result in greater attention during feature extraction); W b The business importance coefficient (valued between 0.3 and 1.0, based on the existing energy industrial control instruction risk level table, such as "emergency shutdown" W) is used. b =1.0, "Status Query" W b =0.3); β is the time-series attenuation coefficient (the average attenuation rate calculated based on measured data from multiple substations (e.g., 100 substations) in multiple regions); Δt is the time interval between the current command and the previous command (unit: s); γ is the semantic enhancement coefficient (value 0.8, defined according to existing relevant process rule bases, such as semantic association strength S). rel Enhancement is triggered when the weight is ≥0.8; through this weight, the model prioritizes the characteristics of instructions with high business importance and strong temporal correlation, avoiding excessive attention to irrelevant instructions.

[0102] 2. Semantic Constraint Rule Base Design and Embedding: Based on energy industry safety control standards (such as the "Technical Guidelines for Network Security Protection of Power System Industrial Control Systems"), covering the logic of instruction execution sequence (such as "stop → speed reduction → standby") and equipment status matching rules (such as "fault status → prohibit start-up"), a semantic constraint rule base is designed. The rule base is embedded into the temporal feature learning process, and the model is optimized through a constraint loss function, as shown in the following formula:

[0103]

[0104] Among them, L cinst Let S be the semantic constraint loss, m be the number of instruction pairs that violate the rule, and S be the number of instruction pairs that violate the rule. rel (L i ,L i+1 ) represents the correlation strength between adjacent pairs of non-compliant instructions, and δ is the rule strictness coefficient (value 1.2, determined by, for example, the "Regulations on Security Protection of Power Monitoring Systems"). Through this loss function, we ensure that the time-series features learned by the model conform to the business security logic and avoid learning pseudo-features that do not conform to the actual process.

[0105] 3. Feature Validation and Optimization: The effectiveness of the learned temporal-semantic fusion features is validated using a validation set. TSNE dimensionality reduction is used to visualize the differences in feature distribution between normal and abnormal instruction streams. The feature discriminant is calculated using the following formula:

[0106]

[0107] Where D is the feature discrimination index (D≥1.5 is considered an effective feature), μ normal μ abnormal These are the means of normal and abnormal characteristics, respectively. These correspond to the variances. For feature dimensions with D < 1.5, optimization is achieved by increasing the number of attention heads (e.g., from 1 to 2 heads) or supplementing process rules (e.g., adding a rule that "voltage detection must be completed before grid connection"). This ensures that the features have high discriminative power.

[0108] The semantic model is optimized to construct a multi-dimensional anomaly detection model, including:

[0109] For the semantic model, instruction flow temporal feature learning and semantic constraint enhancement training are performed to optimize the semantic model. After optimization, a multi-dimensional anomaly detection model is constructed by integrating multi-dimensional detection indicators, multi-dimensional anomaly scores, and anomaly reasoning and level determination conditions.

[0110] This step mainly involves building and reasoning a multi-dimensional anomaly detection model, integrating information from multiple dimensions such as temporal features, semantic associations, and business rules to construct a comprehensive industrial control instruction flow anomaly detection model, enabling accurate identification and reasoning of different types of anomalies.

[0111] The specific steps are as follows:

[0112] 1. Multi-dimensional detection index design: Three types of core detection indicators are designed:

[0113] Temporal anomaly degree A t The edit distance is normalized and calculated using the following formula:

[0114]

[0115] Where S is the instruction stream to be detected, S0 is the normal timing template, ED is the edit distance, and max(ED) is the maximum possible edit distance (value 0-1);

[0116] Semantic association anomaly degree A s The calculation formula is:

[0117]

[0118] Where n is the instruction stream length.

[0119] The output probability P of the classifier is the abnormal probability of the sample to be detected (with a value of 0-1, obtained by training the training set (6 months of data from a substation)).

[0120] 2. Multi-dimensional anomaly score fusion: Construct a non-linear anomaly score fusion model, the formula of which is as follows:

[0121]

[0122] Wherein: S abnThe abnormal comprehensive score is denoted as 0-1; a=3, b=2, c=2 are the indicator weights (obtained through grid search of the validation set, which consists of one month's data from a photovoltaic power station); d=2.5 is the offset (to concentrate the scores of normal scenarios in the range of 0.1-0.3 and those of abnormal scenarios in the range of 0.7-0.9); this formula achieves nonlinear fusion of multiple indicators through the Sigmoid function.

[0123] 3. Anomaly Reasoning and Level Determination: Based on S abn Set three-level detection thresholds:

[0124] High-risk abnormality: S abn If the value is ≥0.85, an emergency shutdown is triggered (e.g., a forged "emergency shutdown" command is used), and the cause of the error is output (e.g., "semantic association error: a start command was sent under fault conditions").

[0125] Intermediate-risk abnormality: 0.7≤S abn <0.85, triggering manual review (e.g., parameter adjustments exceeding the normal range but not reaching the danger value);

[0126] Normal: S abn <0.7; Anomaly cause reasoning is based on semantic logic graphs, which is achieved by tracing the violation of instruction pairs and association rules, providing operation and maintenance personnel with a basis for fault location.

[0127] Among these measures, the constructed industrial control command flow anomaly detection model is adapted for edge deployment and optimized for lightweighting, and the dimensional anomaly detection model is incrementally optimized online using the feedback online detection data.

[0128] This step mainly involves edge deployment and online optimization of the model. The trained and optimized anomaly detection model is deployed to the edge nodes of the energy industrial internet to achieve real-time detection. An online optimization mechanism is used to adapt to the dynamic changes of the industrial control system. The specific implementation is as follows:

[0129] 1. Edge Deployment Adaptation and Lightweight Optimization: Addressing the hardware limitations of edge nodes, a "teacher-student" model distillation technique is used to compress the model. The distillation loss formula is as follows:

[0130]

[0131] Among them, L distill For distillation losses, L CE The loss function is called cross-entropy loss, where y is the true label. Output for the teacher model (a complex CatBoost model with 2 million parameters). Output for the student model (lightweight model with 500,000 parameters).

[0132] 2. Real-time detection and data feedback closed loop: The edge node and the traffic acquisition module work together to receive pre-processed instruction stream data in real time (1,000 messages per second). After anomaly detection is completed, the results are fed back to the on-site operation and maintenance system (such as Huawei FusionPlant) and the remote monitoring platform via the MQTT protocol. At the same time, the detection data (normal / abnormal samples, model decision results) are recorded to the feedback data pool. The data pool capacity is set to 100,000 messages. If the capacity is exceeded, the data pool will be updated according to the "first-in, first-out" principle.

[0133] 3. Online Incremental Optimization of the Model: Incremental optimization is triggered based on the feedback data pool. The triggering condition formula is as follows:

[0134] T=D·λ+R·μ

[0135] Where: T is the optimization trigger value (triggered when T≥0.6); D is the data distribution difference (calculated using KL divergence to determine the distribution difference between feedback data and training data, with a value of 0-1); R is the proportion of abnormal samples (the proportion of abnormal samples in the feedback data, with a value of 0-1); λ=0.4 and μ=0.6 are weights (from historical optimization effect statistics, six months of data from a wind farm); incremental training uses the SGD optimizer, with a learning rate of η. t+1 =η t 0.95 t Attenuation (η) t Let η0 be the learning rate for the t-th training iteration (initial η0 = 0.001). Simultaneously, establish model version management (refer to ISO / IEC 25010 software quality standards), record the optimization time, data source, and detection accuracy of each version, ensure that the model is traceable and rollbackable, and ensure that the model adapts to the dynamic changes of the energy industrial control system in the long term (such as new equipment, process upgrades, and new attacks), and continuously provide reliable anomaly detection capabilities.

[0136] In summary, compared with existing technologies, the innovations of this invention are as follows: For core scenarios in the energy industrial internet, such as photovoltaic power plants, wind farms, and substations, firstly, through deep protocol parsing and equipment fingerprint matching, a dynamic mapping of "protocol fields - semantic tags - process attributes" for industrial control instructions is established. A confidence quantification mechanism is innovatively introduced to achieve autonomous tag verification, solving the efficiency problem of traditional semantic modeling relying on manual correction. Secondly, through a business-related temporal attention mechanism, feature weights are dynamically adjusted based on the importance of instructions to production safety and temporal relevance, strengthening the feature expression of key instructions and overcoming the shortcomings of existing technologies in capturing attacks on important instructions. Furthermore, a two-layer mechanism of "semantic constraint data enhancement + multi-dimensional anomaly fusion detection" is constructed. The former improves the effectiveness of attack samples by embedding a generative model of industrial control logic rules, while the latter integrates classifier output, temporal anomaly degree, and semantic relevance to achieve a comprehensive score, solving the problems of sample scarcity and prominent false positives and false negatives in single-dimensional detection. Simultaneously, an edge-based online optimization architecture is designed to adapt to the dynamic changes of the energy industrial control system through model distillation and incremental training, ultimately overcoming the core challenges of low semantic parsing accuracy, weak detection of key attacks, and difficulty in engineering deployment in existing technologies.

[0137] This invention solves the problems of semantic parsing relying on manual intervention and low label accuracy;

[0138] This invention achieves accurate semantic mapping of energy industrial control commands from the "code level" to the "business level" through a nonlinear confidence model that combines process knowledge base association, historical mapping consistency verification, and equipment status matching. It eliminates the need for manual review of each tag, significantly reducing the labor costs of semantic modeling. Simultaneously, it avoids subsequent detection deviations caused by semantic misjudgments. It can accurately identify the semantics of energy-specific commands such as photovoltaic inverter speed adjustment, substation switching operations, and wind turbine pitch control, overcoming the shortcomings of traditional semantic parsing that relies solely on field matching and lacks independent verification.

[0139] This invention solves the problem of failing to detect attacks on critical control commands;

[0140] This invention utilizes an attention weighting mechanism based on the attenuation of business importance coefficients and temporal correlation to enhance the feature representation of critical instructions such as emergency shutdowns, fault resets, and permission changes. This avoids the problem of traditional time-series models extracting features indiscriminately from important and ordinary instructions. Whether it's a forged critical instruction inserted into the normal flow or an unauthorized critical operation being sent, it can be accurately detected, overcoming the limitation of high false negative rates in existing technologies for attacks on core control logic and ensuring the core operational security of energy industrial control systems.

[0141] This invention resolves the contradiction between false alarms and false negatives in balanced anomaly detection;

[0142] This invention utilizes a nonlinear anomaly score model that integrates classifier output, temporal anomaly degree, and semantic relevance, rather than relying on a single dimension for anomaly determination. This model accurately distinguishes between normal process fluctuations (such as power adjustments in photovoltaic power plants due to changes in sunlight) and genuine abnormal operations, while also capturing hidden anomalies where the command format is legal but the logic is flawed (such as sending a start command under fault conditions). This effectively resolves the contradiction in traditional detection methods where "high false alarm rates interfere with operation and maintenance, or high false negative rates pose safety hazards," thus improving the reliability of anomaly detection.

[0143] This invention solves the problem of improving the effectiveness of attack sample enhancement and addressing model skewness.

[0144] This invention embeds semantic constraint rules of energy industrial control commands during data augmentation (such as speed reduction before shutdown, status detection before startup, and parameter adjustments within the equipment's rated range). Through a rule-based penalty-based generative model, it generates effective attack samples that conform to actual process logic, avoiding the high proportion of "meaningless violation samples" (such as shutdown immediately after startup) generated by traditional random perturbations. This provides high-quality data support for model training, solves the model skewness caused by scarce attack samples, and significantly improves the model's ability to detect logically violated attacks (such as control commands that skip pre-operations).

[0145] This invention solves the problems of adaptability and stability in the engineering deployment of enhanced models.

[0146] This invention utilizes a lightweight optimization model distillation and incremental training mechanism for edge nodes to adapt to wide-temperature, low-computing-power hardware environments in energy scenarios such as photovoltaic power plants, substations, and wind farms, achieving real-time detection without relying on high-computing-power cloud support. Simultaneously, by periodically incrementally optimizing the model based on newly collected field data, it can quickly adapt to new equipment (such as new inverters), process upgrades (such as grid connection process updates), or new attack modes, avoiding the adaptation lag problem caused by the need for full retraining of traditional models and ensuring the model's long-term stable detection performance.

[0147] Compared with existing technologies, this invention overcomes the core limitations of "low semantic parsing accuracy, many missed detections of key attacks, prominent false positives and false negatives, ineffective sample enhancement, and poor engineering adaptation," and constructs an anomaly detection system that is more suitable for energy industry control scenarios. It can be widely used in industrial control network security monitoring in fields such as power and new energy, and provides technical support for the safe and stable operation of key energy infrastructure.

[0148] Example 2:

[0149] This invention also proposes a semantic modeling and pattern recognition system 200 for instruction flow in energy industrial control applications, such as... Figure 2 As shown, it includes:

[0150] The data acquisition and processing unit 201 is used to collect multi-source industrial control traffic in the core scenarios of the energy industrial internet, obtain raw traffic data, preprocess the raw traffic data, and construct a dataset based on the preprocessed raw traffic data.

[0151] The feature extraction unit 202 is used to parse the constructed dataset for multiple types of industrial control protocols in the energy industrial internet, and extract the industrial control command streams that are logically related to the semantics of the energy industrial control application command streams from the parsed multiple types of industrial control protocols.

[0152] The anomaly detection unit 203 is used to construct a semantic model based on the industrial control command flow, as well as the business scenarios and process logic of the energy industry, and to optimize the semantic model to construct a multi-dimensional anomaly detection model, and to identify anomaly patterns in the target energy industrial control application command flow based on the multi-dimensional anomaly detection model.

[0153] This invention solves the problems of existing technologies, such as reliance on manual semantic parsing and low label accuracy.

[0154] Example 3:

[0155] Based on the same inventive concept, this invention also provides a computer device, which includes a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to implement corresponding method flows or corresponding functions, thereby implementing the steps of the methods in the above embodiments.

[0156] Example 4:

[0157] Based on the same inventive concept, this invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the steps of the method in the above embodiments.

[0158] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of the present invention can be implemented using various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0159] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0163] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for energy industrial control application instruction flow semantic modeling and pattern recognition, characterized in that, The method comprises the following steps: Collecting industrial control traffic data of preset nodes in an internet constructed by energy industry devices; Identifying and analyzing the data set according to the industrial control protocol, and extracting the industrial control instruction flow having logical correlation with the energy industrial control application instruction flow semantics; Based on the semantic mapping between the energy industry knowledge base and the industrial control instruction, a semantic correlation model is constructed; A time sequence feature learning model of the industrial control instruction flow is established; Based on the knowledge base of the energy industry, a semantic constraint rule library is established; Fusion of the time sequence feature learning model, the semantic correlation model and the semantic constraint rule library, construction of the industrial control instruction flow anomaly detection model, identification of the abnormal mode of the target energy industrial control application instruction flow.

2. The energy industrial application instruction flow semantic modeling and pattern recognition method according to claim 1, characterized in that, The method comprises the following steps: According to the core scene of the energy industry internet, the collection object and the collection link are determined, and the collection tool is deployed according to the collection object and the collection link. The collection tool is used to collect the industrial control traffic data of the preset nodes in the internet constructed by the energy industry devices on the collection link. The core scene includes at least one of the following: photovoltaic power station, wind power station and transformer substation.

3. The energy industrial application instruction flow semantic modeling and pattern recognition method of claim 1, wherein, The method comprises the following steps: The raw traffic data is parsed, and the redundant data in the parsed data is removed. The parsed data after removing the redundant data is structured to generate structured data. Based on the structured data, a data set is constructed, and the data set is quality checked.

4. The energy industrial application instruction flow semantic modeling and pattern recognition method of claim 1, wherein, The method comprises the following steps: The data set is parsed by matching the protocol type identifier and the parser, and the protocol features are obtained. The core control field is extracted from the protocol features, and the core control field is associated with the energy industrial control application instruction flow semantics to obtain an association sequence. The association sequence is reorganized to generate an industrial control instruction flow having logical correlation.

5. The energy industrial application instruction flow semantic modeling and pattern recognition method of claim 1, wherein, The method further comprises the following steps: After constructing the semantic correlation model, the confidence of the semantic mapping is calculated by three-factor nonlinear fusion, and the semantic correlation model is verified.

6. The energy industrial application instruction flow semantic modeling and pattern recognition method of claim 1, wherein, The method further comprises the following steps: The semantic model is optimized, and a multi-dimensional anomaly detection model is constructed. The method comprises the following steps:

7. The energy industrial application instruction flow semantic modeling and pattern recognition method of claim 1, wherein, The instruction flow time sequence feature learning and semantic constraint enhancement training are performed on the semantic model to optimize the semantic model. After optimization, the multi-dimensional anomaly detection model is constructed by fusing the multi-dimensional detection index, the multi-dimensional anomaly score and the abnormal reasoning and grade determination condition. The method further comprises the following steps:

8. An energy industrial control application instruction flow semantics modeling and pattern recognition system, characterized in that, The industrial control instruction flow anomaly detection model is edge-deployed, adapted and optimized, and the multi-dimensional anomaly detection model is online incrementally optimized through the feedback of online detection data. The method comprises the following steps: A data collection unit is configured to collect industrial control traffic data of preset nodes in an internet constructed by energy industry devices, and construct a data set. The data set is subjected to identification and analysis of the industrial control protocol, and the industrial control instruction stream logically associated with the energy industrial control application instruction stream semantics is extracted; A modeling unit is configured to construct a semantic association model based on semantic tag mapping between an energy industry knowledge base and industrial control instructions, and to establish a time sequence feature learning model of the industrial control instruction stream; A semantic constraint rule base is established based on the energy industry knowledge base; An identification unit is configured to fuse the time sequence feature learning model, the semantic association model, and the semantic constraint rule base to construct an industrial control instruction stream anomaly detection model, and to identify an abnormal pattern of a target energy industrial control application instruction stream.

9. A computer device, comprising: comprising: one or more processors; a processor configured to execute one or more programs; when the one or more programs are executed by the one or more processors, the method as claimed in any one of claims 1-7 is implemented.

10. A computer-readable storage medium, characterized in that, a computer program is stored thereon, and when the computer program is executed, the method as claimed in any one of claims 1-7 is implemented.

Images