Distributed massive heterogeneous industrial control traffic deep analysis method and system and electronic equipment

Abstract

The invention discloses a distributed mass heterogeneous industrial control traffic deep analysis method and system and electronic equipment, and the method comprises the steps: collecting multi-modal industrial control data comprising traffic data, equipment state data and operation log data, generating a global unique identifier, distributing the data to distributed nodes through employing a consistent Hash algorithm and a virtual node mechanism, and carrying out the distributed mass heterogeneous industrial control traffic deep analysis. After features are extracted and spliced into a fusion feature vector, a CNN model is used for identifying a protocol type and complementing an unknown protocol grammar structure, data are scheduled according to a TSN standard in combination with service importance, each node loads an analysis module, a Diffusion generation model is called to complement an unknown protocol field, a BERT model mines semantic association and synchronizes a result, and an unknown protocol grammar structure is obtained. And the central controller aggregates results, converts the results into an industrial general standard format, filters abnormal data, outputs effective results to the upper security detection module and feeds back an abnormal case optimization model. The method is suitable for an energy industry Internet traffic analysis scene.

Description

Technical Field

[0001] This invention relates to the field of industrial internet security technology, specifically providing a method, system, and electronic device for deep analysis of distributed massive heterogeneous industrial control traffic. Background Technology

[0002] With the intelligent upgrading of the energy industry and the deep integration of industrial control systems and enterprise information systems, the network attack surface is constantly expanding. The traffic of the energy industrial internet is characterized by large scale, complex protocols, and high real-time requirements. Existing technologies face many bottlenecks. Centralized traffic parsing solutions struggle to meet real-time demands, while distributed solutions, lacking dynamic load balancing mechanisms, cannot handle massive traffic pressure. Protocol parsing relies on static feature matching or fixed rule bases, resulting in poor identification of private and variant protocols and an inability to extract semantic information through encryption layers. Traditional architectures lack a dynamic priority scheduling system based on business importance, leading to the easy loss of critical control messages and significant fluctuations in cross-node scheduling latency. While some solutions incorporate machine learning, they largely remain at the level of statistical analysis of broad traffic categories, resulting in high costs for manual feature engineering adaptation and a lack of a complete solution that balances efficiency, compatibility, and scalability. Summary of the Invention

[0003] To address the technical problems faced by existing industrial control systems in the distributed massive heterogeneous industrial control traffic parsing of the energy industrial internet, including the contradiction between processing efficiency and scalability, poor adaptability to heterogeneous protocol parsing, lack of real-time guarantee mechanisms, and insufficient intelligent parsing capabilities, this invention provides a method, system, and electronic equipment for deep parsing of distributed massive heterogeneous industrial control traffic.

[0004] This invention provides a method for deep analysis of distributed, massive, heterogeneous industrial control traffic, comprising the following steps: Collect multimodal industrial control data, including flow data, equipment status data, and operation log data, and generate a globally unique identifier; The globally unique identifier is mapped to the distributed node IP address using the consistent hashing algorithm, and the multimodal industrial control data is allocated to the corresponding distributed nodes through the hash ring and virtual node mechanism. Extract the binary features of the traffic data, the device type-protocol association features of the device status data, and the instruction type-protocol mapping features of the operation log data, concatenate them to form a fusion feature vector, identify the protocol type according to the CNN model, and complete the syntax structure of unknown protocols through reverse engineering; Based on the TSN standard and business importance, the multimodal industrial control data is prioritized and weighted, and data of different priorities is scheduled according to a weighted round-robin algorithm and a preemptive scheduling strategy. Each distributed node loads the parsing module according to the protocol type to initially parse the protocol fields, calls Diffusion to generate a model to complete the unknown protocol fields, calculates the attention weights of the protocol fields with device status data and operation log data based on the BERT model to mine semantic associations, and synchronously parses the data to the central controller. The central controller analyzes the parsed data of the distributed nodes according to preset dimensions such as protocol type, device, ID, and timestamp. It converts the analyzed parsed data into an industrial standard format, filters out abnormal data based on preset conditions for segment transition anomaly judgment and protocol device matching anomaly judgment, and outputs the filtered parsing results.

[0005] Furthermore, the hash values ​​of the globally unique identifier and the distributed node IP address are calculated according to the SHA-256 hash function, and mapped to the hash ring through a modulo operation. The identifier of the virtual node consists of the distributed node IP address and the virtual sequence number, and the calculation method of the virtual node hash value is consistent with that of the physical node.

[0006] Furthermore, the CNN model includes multiple convolutional layers and multiple fully connected layers. The model parameters are optimized according to the cross-entropy loss function to output the probability distribution of multiple protocol types. When the probability of a protocol type in the probability distribution is lower than a preset threshold, it is determined to be an unknown protocol. The grammatical structure is inferred by generating a protocol state transition graph and combining it with field length statistics.

[0007] Furthermore, the multimodal industrial control data is divided into multiple priority levels: control commands and core equipment status data are high priority, routine data is medium priority, and non-real-time data is low priority. The sum of the weights of each priority level is 1, and time slices corresponding to the weights are allocated to each priority level within each scheduling cycle.

[0008] Furthermore, the Diffusion generation model gradually injects Gaussian noise into the multimodal data through forward diffusion and gradually denoises it through reverse generation to restore the structure of unknown protocol fields. The diffusion rate of forward diffusion is dynamically adjusted based on the volatility of energy industrial control data, and a multimodal covariance matrix of the correlation between fusion protocol, device and log features is constructed in the model.

[0009] Furthermore, the preset judgment conditions include field transition anomaly judgment and protocol-device matching anomaly judgment. Field transition anomaly judgment is achieved by calculating whether the transition rate of the protocol field value between the current moment and the previous moment exceeds the transition threshold. Protocol-device matching anomaly judgment is achieved by calculating whether the matching degree between the parsed protocol field and the device supported field is lower than the matching threshold.

[0010] The present invention also provides a distributed massive heterogeneous industrial control traffic deep analysis system, including a data acquisition module, a protocol identification module, a scheduling management module, a deep analysis module and a result feedback module connected in sequence; The data acquisition module is used to collect multimodal industrial control data, generate a globally unique identifier for each data item, and distribute the data to distributed computing nodes based on a consistent hashing algorithm and a virtual node mechanism to form distributed node data. The protocol identification module is connected to the data acquisition module and is used to receive the distributed node data, extract its features and concatenate them into a fusion feature vector, use a convolutional neural network (CNN) model to identify its protocol type, and complete the syntax structure of the identified unknown protocol data. The scheduling management module, connected to the protocol identification module, is used to prioritize and assign weights to the data that has undergone protocol identification and structural completion, perform scheduling based on a weighted round-robin algorithm, and output policy scheduling data. The deep parsing module, connected to the scheduling management module, is used to load the parser corresponding to the protocol to perform preliminary field parsing on the policy scheduling data, complete the unknown fields, and mine the semantic relationships between the parsed fields based on the BERT model, and finally output the deep-parsed structured data. The result feedback module is connected to the deep analysis module and is used to aggregate the deep analysis results of distributed nodes, convert them into a standard industrial general data format, filter out abnormal data, and output the final result.

[0011] Furthermore, the data acquisition module includes a data format processing unit and a hash mapping unit. The data format processing unit processes traffic data into PCAP format, device status data into JSON format, and operation log data into CSV format, and generates a globally unique identifier according to data type-timestamp-unique sequence number. The hash mapping unit calculates the hash value according to the SHA-256 hash function and maps it to the hash ring, configuring the identifier as a virtual node.

[0012] Furthermore, the scheduling management module includes a parsing module loading unit, a Diffusion completion unit, a BERT semantic parsing unit, and a result synchronization unit. The parsing module loading unit loads the dedicated parsing module to initially parse the fields according to the protocol type. The Diffusion completion unit generates and completes unknown fields through forward diffusion and backward diffusion and dynamically adjusts the diffusion rate. The BERT semantic parsing unit calculates the attention weights of the protocol field query vector and the device and log field key vectors, and performs semantic matching based on the association loss function.

[0013] The present invention also provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the steps of the distributed massive heterogeneous industrial control traffic deep analysis method described in any one of the claims.

[0014] Beneficial effects This invention effectively addresses the core shortcomings of existing technologies. By combining a consistent hashing algorithm with a virtual node mechanism, it achieves uniform distribution of multimodal industrial control data among distributed nodes, reducing data migration during node expansion or shutdown, significantly improving the load balancing and scalability of the distributed cluster, and avoiding parsing interruptions caused by single-node overload. It employs a combination of multimodal feature fusion and a CNN model to expand the protocol recognition range and improve the recognition effect of private and variant protocols, eliminating the need to develop custom parsing modules for new protocols and reducing adaptation costs. Furthermore, it leverages a Diffusion generation model to dynamically adjust the diffusion rate and utilizes multimodal covariance... The difference matrix efficiently completes unknown protocol fields, and combines the BERT model with a business constraint attention mechanism to mine the deep semantic relationships between protocol fields and device and log data, meeting the "field-level + semantic-level" parsing requirements of energy industrial control. Prioritization is based on the TSN standard, and a weighted polling and preemptive scheduling strategy is adopted to prioritize the processing of critical control commands, reducing the latency and loss rate of critical data. Anomaly case feedback iterates the model, improving its generalization ability and shortening the access time for new protocols. This provides high-precision, high-real-time parsing data support for upper-layer security detection modules, effectively ensuring the stable operation of the energy industrial internet control system. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0016] Figure 1 This invention provides a method for deep analysis of distributed massive heterogeneous industrial control traffic in embodiments of the present invention. Figure 2 A block diagram of a distributed massive heterogeneous industrial control traffic deep analysis system provided in an embodiment of the present invention; Figure 3 This invention provides a distributed, massive, heterogeneous industrial control traffic deep analysis device as another embodiment of the invention.

[0017] Attached reference numerals: 1. Data acquisition module; 2. Protocol identification module; 3. Scheduling management module; 4. Deep parsing module; 5. Result feedback module. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that if the embodiments of the present invention involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a specific posture. If the specific posture changes, the directional indicators will also change accordingly.

[0020] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Thus, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the use of "and / or" or "and / or" throughout the text implies three parallel solutions. For example, "A and / or B" includes solution A, solution B, or a solution where both A and B are satisfied. Furthermore, the technical solutions of the various embodiments can be combined, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0021] To address the technical challenges faced by existing industrial control systems in the distributed massive heterogeneous industrial control traffic parsing of the energy industrial internet, including the contradiction between processing efficiency and scalability, poor adaptability to heterogeneous protocol parsing, lack of real-time guarantee mechanisms, and insufficient intelligent parsing capabilities.

[0022] refer to Figure 1 This embodiment provides a method for deep analysis of distributed massive heterogeneous industrial control traffic, including the following steps: S110. Collect multimodal industrial control data, including flow data, equipment status data and operation log data, and generate a globally unique identifier; S120. Map the globally unique identifier and the distributed node IP address to a hash ring according to the consistent hashing algorithm, and allocate the multimodal industrial control data to the corresponding distributed nodes through the hash ring and virtual node mechanism; S130. Extract the binary features of the traffic data, the device type-protocol association features of the device status data, and the instruction type-protocol mapping features of the operation log data, and concatenate them to form a fusion feature vector. Identify the protocol type according to the CNN model and complete the syntax structure of unknown protocols through reverse engineering. S140. Based on the TSN standard and business importance, prioritize the multimodal industrial control data and assign weights. Schedule data of different priorities according to the weighted round-robin algorithm and preemptive scheduling strategy. S150. Each distributed node loads the parsing module according to the protocol type to initially parse the protocol fields, calls Diffusion to generate the model to complete the unknown protocol fields, calculates the attention weights of the protocol fields and device status data and operation log data according to the BERT model to mine semantic associations, and synchronously parses the data to the central controller. S160. The central controller analyzes the parsed data of the distributed nodes according to preset dimensions such as protocol type, device, ID, and timestamp, converts the analyzed parsed data into an industrial standard format, filters out abnormal data according to preset conditions for segment transition anomaly judgment and protocol device matching anomaly judgment, and outputs the filtered parsing results.

[0023] It should be noted that in the step of collecting multimodal industrial control data and generating a globally unique identifier for the multimodal industrial control data, the traffic data is in PCAP or PCAP PNG format, the device status data is in JSON format, the operation log data is in CSV format, and the globally unique identifier consists of data type, timestamp, and unique sequence number. The data type includes traffic type, device status type, and operation log type.

[0024] In the step of mapping the globally unique identifier and the IP address of the distributed node to a hash ring within a preset range using a consistent hashing algorithm, the hash value of the globally unique identifier and the IP address of the distributed node is calculated using the SHA-256 hash function, and then the hash value is mapped to the hash ring through a modulo operation. The identifier of the virtual node consists of the IP address of the distributed node and the virtual sequence number, and the hash value of the virtual node is calculated in the same way as that of the physical node.

[0025] In some embodiments, consistent hashing calculation uses the SHA-256 hash function to map the unique identifier of the data into a 32-bit hash value, and then maps it to a modulo operation. On the hash ring; simultaneously, the IP addresses of the distributed nodes are mapped to fixed positions on the hash ring using the same hash function, as shown in the following formula: in, : Hash ring position of the data (range of values) This is used to determine the nodes where data is distributed in a distributed cluster; The data is globally uniquely identified and consists of "data type (traffic / device / log) + 10-digit timestamp (YYYYMMDDHH) + 3-digit serial number" to ensure the uniqueness of data of the same type in the time dimension. It is generated in real time through the data acquisition module. The hash function was selected based on the uniformity of its output 32-bit hash value distribution (experimentally verified that the variance of the hash value distribution for 1 million energy industrial control data is <0.05), and the security requirements for industrial data transmission are met. The upper limit of the hash ring's value range is referenced from mainstream designs in the field of distributed computing (such as the Kafka hash ring architecture) to ensure that the mapping granularity between nodes and data is sufficiently fine. : Hash ring position of the node (range of values) ), used to match data hash values; The IP address of the distributed node (e.g., "192.168.1.101") is the node registration information for the cluster management module. The hash ring rotates clockwise, transferring the hash value... The corresponding data stream is assigned to the first node with a hash value ≥ H_{data}; if such a node does not exist, it is assigned to the node at the start of the hash ring; the risk of uneven data distribution is reduced through a "virtual node" mechanism (each physical node maps to 10 virtual nodes)—the virtual nodes are identified as " +virtual serial number\)” (such as “192.168.1.101_01”), whose hash value is calculated in the same way as the physical node.

[0026] In the step of processing the fused feature vector using a CNN model to identify the protocol type, the CNN model includes multiple convolutional layers and multiple fully connected layers. The parameters of the CNN model are optimized using a cross-entropy loss function. The output of the CNN model is a probability distribution of multiple protocol types. The protocol type corresponding to the multimodal industrial control data is determined based on the probability distribution.

[0027] In some embodiments, multimodal feature fusion includes extracting the binary features of the first 128 bytes of traffic (dimension 128×8, each byte is split into 8 bits of binary number), the "device type-protocol" association features of device status data (16-dimensional one-hot vector, such as the 3rd bit of the vector corresponding to "ABBPLC" is 1, and the rest are 0, the dimension source is the 16 common device types in the statistical energy scenario), and the "instruction type-protocol" mapping features of operation logs (8-dimensional one-hot vector, such as the 2nd bit of the vector corresponding to "write register" is 1, the dimension source is the 8 core operation instructions in the statistical industrial control scenario), and concatenating them into a fusion feature vector F with a dimension of 128×8+16+8=1040.

[0028] In the step of reversing the identification of unknown protocols to complete their syntax structure, when the probability of the protocol type output by the CNN model is lower than a preset threshold, the protocol is determined to be an unknown protocol. The syntax structure of the unknown protocol is inferred by generating a protocol state transition graph and combining it with field length statistics. In the step of prioritizing and assigning weights to the multimodal industrial control data based on the TSN standard and business importance, the multimodal industrial control data is divided into multiple priority levels, where control commands and core equipment status data are high priority, regular data is medium priority, and non-real-time data is low priority. The sum of the weights of each priority level is 1, and a time slice corresponding to the weight is allocated to each priority level in each scheduling cycle.

[0029] CNN Model Training and Recognition: A CNN model with 3 convolutional layers and 2 fully connected layers is constructed. The convolutional layers use 3×3 kernels to extract local features (the number of kernels in each layer is 32, 64, and 128 respectively). The fully connected layers output the probability distribution of class C protocols (C=1000+). The cross-entropy loss function is used to optimize the model parameters and minimize the difference between the predicted probability and the true label. The formula is as follows: in, : Classification loss value of the CNN model (range [0, +∞)), the smaller the loss value, the more accurate the model prediction; N: Number of training samples (range ... This solution adopts i: Sample index ( c: Protocol category index ( ); : The true label of the i-th sample (1 if it belongs to the c-th protocol, 0 otherwise, using one-hot encoding, the label source is manually annotated public protocol samples + private protocol samples provided by the manufacturer); : The probability that the i-th sample belongs to the c-th protocol (value range [0,1]); C: The total number of protocol categories (C=1024), which are derived from 328 publicly available industrial control protocols and 696 private protocols in the energy industry, totaling 1024.

[0030] right For unknown protocols, reverse engineering is used to generate a protocol state transition diagram (based on the data interaction sequence, such as the state flow of "request → response → confirmation"), and the syntax structure is inferred by combining field length statistics to complete the identification and completion.

[0031] In some embodiments, in the step of calling the Diffusion generation model to complete the unknown protocol fields, the Diffusion generation model gradually injects Gaussian noise into the multimodal data through a forward diffusion process, and then gradually denoises through a reverse generation process to restore the structure of the unknown protocol fields. The diffusion rate of the forward diffusion process is dynamically adjusted based on the volatility of the energy industrial control data, and a multimodal covariance matrix is ​​constructed in the Diffusion generation model. The multimodal covariance matrix integrates the correlation of protocol, device and log features.

[0032] In some embodiments, in the step of using the BERT model to calculate the attention weights of the protocol field and the device status data and operation log data to mine semantic associations, the BERT model calculates the attention weights through the query vector of the protocol field and the key vectors of the device status data and operation log data, and defines an association loss function to optimize the semantic matching effect of the BERT model. The association loss function is calculated based on the maximum attention weights of the protocol field and the device status data and operation log data.

[0033] In some embodiments, in the step of filtering abnormal data by preset judgment conditions, the preset judgment conditions include field jump anomaly judgment and protocol-device matching anomaly judgment. The field jump anomaly judgment is achieved by calculating whether the jump rate between the protocol field value at the current time and the protocol field value at the previous time exceeds a jump threshold. The protocol-device matching anomaly judgment is achieved by calculating whether the matching degree between the parsed protocol field and the device supported field is lower than a matching threshold.

[0034] According to step S160 provided in this embodiment, it should be noted that the purpose of this step is to summarize the parsing results of each distributed node, generate a standardized multimodal data stream, and filter invalid / abnormal data through an anomaly filtering mechanism, providing high-quality data in a unified format for upper-layer security detection and reducing the cost of inter-system integration. The specific implementation process is as follows: The central controller aggregates and parses the results by the dimension of "protocol type-device ID-timestamp" (such as "ModbusTCP-transformer-002-202405011000"), and generates a structured report containing "field name-value-data type-related information".

[0035] The aggregation results are converted into an industry-standard format (protocol data uses OPCUA format, device status data uses MQTT format, and operation log data uses JSON format), with a conversion latency of ≤50ms (source: average latency of 48.2ms from 1000 format conversion experiments).

[0036] The following formula can be used to identify abnormal data: Field jump exception: Protocol - Device compatibility error: Wherein, R: field value jump rate (value range \([0,+∞)\)), reflects the magnitude of change between the current value and the previous value; : The protocol field value at the current moment (e.g., current 1000A, sourced from real-time parsed field data); : Protocol field value at the previous moment (1-second interval, sourced from the regular data collection interval of energy equipment parameters) (e.g., current 950A); Jump anomaly threshold: determined based on parameter fluctuations during normal operation of the energy equipment, e.g., 0.2; S: Protocol-equipment matching degree (value range [0,1]), reflecting the degree of matching between the parsed protocol field and the field supported by the equipment; Number of matching fields: the number of fields in the parsing result that are consistent with the fields marked in the equipment manual (e.g., if the equipment supports two fields, "current" and "voltage", parsing two of them indicates a match); Total number of fields: the total number of supported fields marked in the equipment manual; Matching anomaly threshold: determined based on the result of the optimal anomaly identification accuracy obtained from experimental comparison, e.g., 0.8.

[0037] Filter outlier data that satisfies any of the above formulas, with an outlier filtering accuracy of ≥98%.

[0038] The filtered and valid parsing results are output to the upper-layer security detection module (such as IDS), while abnormal cases during the parsing process (such as unrecognized protocols or field completion failures) are recorded and fed back to the model training module (the training set is updated every 24 hours) to optimize the CNN / Diffusion model. For example, samples of unrecognized protocols are added to the CNN training set to improve the subsequent recognition rate.

[0039] refer to Figure 2Another embodiment of the present invention provides a distributed massive heterogeneous industrial control traffic deep analysis system, including a data acquisition module, a protocol identification module, a scheduling management module, a deep analysis module and a result feedback module connected in sequence; The data acquisition module is used to collect multimodal industrial control data, generate a globally unique identifier for each data item, and distribute the data to distributed computing nodes based on a consistent hashing algorithm and a virtual node mechanism to form distributed node data. The protocol identification module is connected to the data acquisition module and is used to receive the distributed node data, extract its features and concatenate them into a fusion feature vector, use a convolutional neural network (CNN) model to identify its protocol type, and complete the syntax structure of the identified unknown protocol data. The scheduling management module is connected to the protocol identification module and is used to divide the processing priority and assign weights to the data that has undergone protocol identification and structural completion, perform scheduling based on the weighted round-robin algorithm, and output strategy scheduling data. The deep parsing module is connected to the scheduling management module and is used to load the parser corresponding to the protocol to perform preliminary field parsing on the policy scheduling data, fill in the unknown fields, and mine the semantic relationships between the parsed fields according to the BERT model, and finally output the structured data after deep parsing. The result feedback module is connected to the deep analysis module and is used to aggregate the deep analysis results of distributed nodes, convert them into a standard industrial general data format, filter out abnormal data, and output the final result.

[0040] In some embodiments, the data acquisition module includes a data format processing unit and a hash mapping unit. The data format processing unit processes traffic data into PCAP format, device status data into JSON format, and operation log data into CSV format, and generates a globally unique identifier according to data type-timestamp-unique sequence number. The hash mapping unit calculates the hash value according to the SHA-256 hash function and maps it to the hash ring, and configures the identifier as a virtual node.

[0041] In some embodiments, the scheduling management module includes a parsing module loading unit, a Diffusion completion unit, a BERT semantic parsing unit, and a result synchronization unit. The parsing module loading unit loads the dedicated parsing module to initially parse the fields according to the protocol type. The Diffusion completion unit generates and completes unknown fields through forward diffusion and backward diffusion and dynamically adjusts the diffusion rate. The BERT semantic parsing unit calculates the attention weights of the protocol field query vector and the device and log field key vectors, and performs semantic matching based on the association loss function.

[0042] refer to Figure 3Another embodiment of the present invention provides a distributed massive heterogeneous industrial control traffic deep analysis device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the distributed massive heterogeneous industrial control traffic deep analysis methods.

[0043] Figure 3 This is a schematic diagram of the distributed massive heterogeneous industrial control traffic deep analysis device provided in the embodiments of this application, with reference to... Figure 3 The distributed, heterogeneous industrial control flow deep analysis device includes a processor 31, a memory 32, a communication device 33, an input device 34, and an output device 35. The number of processors 31 in the distributed, heterogeneous industrial control flow deep analysis device can be one or more, and the number of memories 32 in the long-term fire hazard testing and evaluation device for solid insulation materials of power equipment can also be one or more. The processor 31, memory 32, communication device 33, input device 34, and output device 35 of the distributed, heterogeneous industrial control flow deep analysis device can be connected via a bus or other means.

[0044] The memory 32, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the distributed massive heterogeneous industrial control traffic deep analysis method in any embodiment of this application. The memory 32 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and at least one program required for a function; the data storage area may store data created according to the device's operation. Furthermore, the memory 32 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0045] The communication device 33 is used for data transmission.

[0046] The processor 31 executes various functions of the device and performs data processing by running software programs, instructions, and modules stored in the memory 32, thereby realizing the above-mentioned distributed massive heterogeneous industrial control traffic deep analysis method.

[0047] Input device 34 can be used to receive input digital or character information, and to generate key signal inputs related to the device's user settings and function control. Output device 35 may include display devices such as a display screen.

[0048] The distributed massive heterogeneous industrial control traffic deep analysis device provided above can be used to execute the distributed massive heterogeneous industrial control traffic deep analysis method provided in the above embodiments, and has corresponding functions and beneficial effects.

[0049] The above embodiments provide a distributed method, system, and electronic device for deep parsing of massive heterogeneous industrial control traffic. This method achieves dynamic load balancing through a consistent hashing algorithm and a virtual node mechanism, improves protocol parsing accuracy by combining multimodal feature fusion and a deep learning model, and ensures critical data transmission through TSN-based dynamic priority scheduling. It effectively solves the technical problems of insufficient processing capacity, weak unknown protocol parsing capability, and large scheduling latency fluctuations in traditional solutions. It has the advantages of improving the processing capacity of massive heterogeneous industrial control traffic, enhancing the accuracy of unknown protocol parsing, optimizing the real-time performance of critical data transmission, and improving system scalability.

[0050] The above description is merely a preferred embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural transformations made based on the description and drawings of the present invention under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A distributed mass heterogeneous industrial control flow deep analysis method, characterized in that, The method comprises the following steps: Collecting multi-modal industrial control data, which comprises flow data, device state data and operation log data, and generating a globally unique identifier; Mapping the globally unique identifier and the IP address of the distributed node to a hash ring according to a consistent hashing algorithm, and distributing the multi-modal industrial control data to the corresponding distributed node through the hash ring and a virtual node mechanism; Extracting binary features of the flow data, device type-protocol association features of the device state data, and instruction type-protocol mapping features of the operation log data, and splicing to form a fusion feature vector; inputting the fusion feature vector into a CNN model to identify the protocol type corresponding to the multi-modal industrial control data; wherein unknown protocols are supplemented by reverse engineering to complete the syntax structure; According to the TSN standard, the priority of the multi-modal industrial control data is divided according to the importance of the business, and the weight is allocated, and different priority data is scheduled according to the weighted round robin algorithm and the preemptive scheduling strategy; Each distributed node loads and parses the protocol field according to the protocol type, generates a Diffusion model to complete the unknown protocol field, calculates the attention weight of the protocol field, the device state data and the operation log data according to the BERT model to mine semantic association, and synchronously parses the data to the central controller; The central controller analyzes the parsed data of the distributed node according to the preset dimensions of protocol type, device, ID and timestamp, converts the analyzed parsed data into an industrial general standard format, filters the abnormal data according to the preset conditions of segment jump abnormality judgment and / or the preset conditions of protocol device matching abnormality judgment, and outputs the parsed result after filtering.

2. The distributed mass heterogeneous industrial control flow deep analysis method according to claim 1, characterized in that, The hash values of the globally unique identifier and the IP address of the distributed node are calculated according to the SHA-256 hash function, and are mapped to the hash ring through modulo operation, the identifier of the virtual node is composed of the IP address of the distributed node and the virtual serial number, and the virtual node hash value is calculated in the same way as the physical node.

3. The distributed mass heterogeneous industrial control flow deep analysis method according to claim 1, characterized in that, The CNN model comprises multiple convolution layers and multiple fully connected layers, and the model parameters are optimized according to the cross-entropy loss function to output the probability distribution of multiple protocol types, when the protocol type probability in the probability distribution is lower than a preset threshold, it is determined as an unknown protocol, and the protocol state transition graph is generated and the field length statistics are combined to speculate the syntax structure.

4. The distributed mass heterogeneous industrial control flow deep analysis method according to claim 1, characterized in that, The multi-modal industrial control data is divided into multiple priority levels, control instructions and core device state data are high priority, regular data is medium priority, and non-real-time data is low priority, the sum of the weights of each priority level is 1, and each scheduling period is allocated a time slice corresponding to the weight of each priority level.

5. The distributed mass heterogeneous industrial control flow deep parsing method according to claim 1, characterized in that, The Diffusion generative model gradually injects Gaussian noise into multi-modal data through forward diffusion, and gradually denoises to recover the unknown protocol field structure, the diffusion rate of forward diffusion is dynamically adjusted based on the volatility of energy industrial control data, and a multi-modal covariance matrix is constructed in the model.

6. The distributed mass heterogeneous industrial control flow deep parsing method according to claim 1, characterized in that, The preset determination condition includes field jump abnormality determination and protocol-device matching abnormality determination, the field jump abnormality determination is realized by calculating whether the jump rate of the current and previous time protocol field value exceeds a jump threshold, and the protocol-device matching abnormality determination is realized by calculating whether the matching degree of the parsed protocol field and the device supported field is lower than a matching threshold.

7. A distributed mass heterogeneous industrial control flow deep analysis system, characterized in that, It comprises a data acquisition module, a protocol identification module, a scheduling management module, a deep analysis module and a result feedback module connected in sequence. The data acquisition module is configured to collect multi-modal industrial control data, generate a globally unique identifier for each piece of data, and distribute the data to distributed computing nodes based on a consistent hashing algorithm and a virtual node mechanism to form distributed node data. The protocol identification module is connected to the data acquisition module and configured to receive the distributed node data, extract features thereof and splice them into a fusion feature vector, identify the protocol type thereof using a convolutional neural network (CNN) model, and complete the syntax structure of the identified unknown protocol data. The scheduling management module is connected to the protocol identification module and configured to divide the data that has undergone protocol identification and structure completion into processing priorities and assign weights, schedule based on a weighted round robin algorithm, and output strategy scheduling data. The deep analysis module is connected to the scheduling management module and configured to load a parser corresponding to the protocol to perform preliminary field analysis on the strategy scheduling data, complete unknown fields therein, and finally output structured data after deep analysis according to a BERT model to mine semantic associations between analyzed fields. The result feedback module is connected to the deep analysis module and configured to aggregate the deep analysis results of the distributed nodes, convert them into a standard industrial general data format, filter abnormal data, and output the final results.

8. The distributed mass heterogeneous industrial control flow deep parsing system according to claim 7, characterized in that, The data acquisition module comprises a data format processing unit and a hash mapping unit, the data format processing unit processes traffic data into PCAP format, device state data into JSON format, and operation log data into CSV format, and generates a globally unique identifier according to data type-time stamp-unique serial number; The hash mapping unit calculates a hash value according to a SHA-256 hash function and maps it to a hash ring, and configures an identifier as a virtual node.

9. The distributed mass heterogeneous industrial control flow deep parsing system according to claim 7, wherein, The scheduling management module comprises an analysis module loading unit, a Diffusion completion unit, a BERT semantic analysis unit and a result synchronization unit, the analysis module loading unit loads a dedicated analysis module to preliminarily analyze fields according to the protocol type; the Diffusion completion unit completes unknown fields by forward diffusion and backward generation and dynamically adjusts the diffusion rate; the BERT semantic analysis unit calculates the attention weight of the protocol field query vector and the device and log field key vector, and performs semantic matching according to an association loss function.

10. An electronic device, comprising: The device comprises a processor and a memory, the memory stores a computer program, and the processor executes the computer program to realize the steps of the distributed massive heterogeneous industrial control flow deep analysis method according to any one of claims 1 to 6.

Images