Industrial control message anomaly clustering method based on self-supervision characterization
By preprocessing and parsing industrial control messages using a self-supervised representation learning method, deep representation vectors are generated. Combined with local sensitivity and density scoring, this solves the problem of difficulty in identifying anomalies in key industrial control equipment in existing technologies. It achieves high-precision anomaly clustering and alarms, and improves the interpretability and traceability of industrial control security detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-05
- Publication Date
- 2026-03-10
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Existing industrial control security detection technologies struggle to identify abnormal patterns and potential attack behaviors in a timely and accurate manner at the critical equipment level. They are particularly ill-suited to adapting to normal behavior drift after process adjustments and equipment upgrades, and their ability to detect new attacks and hidden anomalies is limited.
A self-supervised representation learning method is adopted. By preprocessing and parsing the industrial control messages, a deep representation vector is generated. Combined with local sensitivity, neutral substitution and local density anomaly scoring, an improved self-supervised representation learning model is constructed to realize automatic anomaly clustering and hierarchical alarm of industrial control messages.
It improves the accuracy and interpretability of industrial control security detection, and can automatically learn fine-grained semantic features without the need for a large number of attack sample annotations, significantly improving the interpretability and traceability of anomaly detection.
Smart Images
Figure CN121644178A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial control security detection technology, and in particular to an industrial control message anomaly clustering method based on self-supervised representation. Background Technology
[0002] The core of industrial control system (ICS) security lies in ensuring the stable operation of critical equipment (such as PLCs controlling core production processes and DCS main controllers determining production start-up and shutdown). The network behavior of such critical equipment is characterized by fixed interaction objects, specific communication patterns, and direct impact from attacks. Once its communication is tampered with, blocked, or forged, it will directly affect critical process links and even production start-up and shutdown. However, most existing ICS security detection technologies perform general detection of all network traffic, lacking mechanisms for building specific communication profiles and anomaly clustering around critical equipment. This makes it difficult to identify abnormal patterns and potential attack behaviors in a timely and accurate manner at the critical equipment level.
[0003] Existing industrial control system intrusion detection methods based on signature-based or rule-based approaches typically rely on manually configuring static rules or whitelists such as function codes, addresses, and data ranges to generate alerts for packets that violate these rules. These methods struggle to characterize the session characteristics and timing patterns between critical equipment and its primary associated equipment, cannot adapt to normal behavioral shifts caused by process adjustments and equipment upgrades, and have limited ability to detect new attack samples and hidden anomalies. They can only provide coarse-grained alert conclusions and cannot support refined security protection at the critical equipment level.
[0004] Therefore, how to provide a self-supervised representation-based method for clustering abnormal industrial control messages is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] One objective of this invention is to propose an abnormal clustering method for industrial control messages based on self-supervised representation. This invention encodes industrial control messages into deep representation vectors through self-supervised representation learning, and combines field-level sensitivity, neutral substitution, protocol field graph, and local density anomaly scoring to achieve automatic abnormal clustering and hierarchical alarms for industrial control messages related to key equipment, thereby improving the accuracy and interpretability of industrial control security detection.
[0006] An industrial control message anomaly clustering method based on self-supervised representation according to an embodiment of the present invention includes the following steps: The industrial control messages collected from the industrial control network are preprocessed and parsed to extract the function code field, address field, data field and check field from the industrial control messages, and the parsing results are organized into a formatted message sequence according to the time order. Using the formatted message sequence as input, a contrastive learning task, a field mask prediction task, and a byte perturbation enhancement task are constructed to obtain a deep representation vector for characterizing the semantic features of industrial control messages. An improved self-supervised representation learning model is constructed using deep representation vectors, including local sensitivity interpretation units, graph substructure interpretation units, and local density anomaly units, to realize anomaly clustering and result interpretation of industrial control messages; In the local sensitivity interpretation unit, based on the deep representation vector, a neutral replacement perturbation operation is performed through the function code field, address field, and data field to calculate the change of the representation vector before and after the replacement, and to generate field-level anomaly contribution based on the degree of change. In the graph substructure interpretation unit, the protocol field graph is constructed using the field-level anomaly contribution results. Based on the relationship between fields and the field-level contribution, the minimum subgraph is used to extract the key field substructures that cause the anomalies from the protocol field graph. In the local density anomaly unit, based on the association between the key field substructure and the field, the deep representation vector is clustered, and the degree of anomaly of the industrial control message is evaluated by calculating the local reachability density in the clustering result, and a density score reflecting the anomaly level of the industrial control message is generated. Based on the density score, the degree of anomaly is further determined, and the industrial control messages are classified according to the density score for anomaly handling and alarm triggering.
[0007] Optionally, obtaining the formatted message sequence specifically includes: Based on the industrial control network process flow, key equipment and primary related equipment are pre-determined. Within a preset acquisition period, a continuous stream of raw industrial control messages is acquired. The acquisition time information of each raw industrial control message is recorded, and preprocessing operations are performed according to preset rules, including removing physical layer noise messages, deleting duplicate messages, and discarding messages with missing fields or abnormal lengths. The retained messages are formatted with uniform time information and written to the cache to obtain a set of preprocessed industrial control messages for protocol parsing. For each industrial control message in the preprocessed industrial control message set, the industrial control protocol type is determined according to the message header identifier. The protocol parsing program corresponding to the protocol type is called to perform field-by-field parsing on the current industrial control message. The function code field, address field, data field, and check field are extracted and processed in sequence. The function code field is normalized according to the preset function code dictionary. The address field is converted into a unified address representation according to the protocol definition. The data field is converted into a unified numerical representation according to the data type. The integrity of the message is verified according to the check field. The corresponding function code field, address field, data field, and check field are saved only when the verification passes. The verified and saved function code field, address field, data field, and verification field are combined with the corresponding acquisition time information in a preset field order to generate a formatted message sequence with a fixed structure.
[0008] Optionally, obtaining the depth representation vector specifically includes: The formatted message sequence is processed one by one, and the embedding encoding is performed in a fixed order of function code field, address field, data field and check field. The embedding results of each field are then concatenated to form the initial feature representation of the key equipment related message, and organized into a key equipment training sample set. Based on the training sample set of key equipment, a comparative learning task is constructed. Messages with the same key equipment and the same function code field are combined into positive samples, and messages with different key equipment or different function code fields are combined into negative samples. The original messages and positive and negative samples participate in training together to obtain the deep representation results of the key equipment in the first stage. Building upon the in-depth characterization of key equipment in the first phase, the project further constructs field mask prediction and byte perturbation enhancement tasks. In the field mask prediction task, masks are set for certain positions in the address field or data field. In the byte perturbation enhancement task, one byte in the data field of the message is perturbed within the allowed range, while keeping the characterization before and after the perturbation close. At the same time, the sending cycle, function code combination, and interaction timing characteristics of the message are statistically analyzed at the session granularity, and corresponding whitelists and baseline rules are generated and written into the key equipment-specific rule base. The characteristics of the formatted message are compared with the whitelist and baseline rules to calculate the deviation and record it as the degree of rule deviation. Simultaneously, the formatted message sequences of key equipment and first-level related equipment are encoded to form the in-depth characterization vector of the industrial control message.
[0009] Optionally, the construction of the improved self-supervised representation learning model specifically includes: The deep representation vector is retained as a shared hidden layer representation. A first functional branch is set up to generate local sensitivity interpretation results, a second functional branch is set up to generate graph substructure interpretation results, and a third functional branch is set up to calculate the local density anomaly index. This constitutes the overall structure of the improved self-supervised representation learning model, which includes local sensitivity interpretation unit, graph substructure interpretation unit and local density anomaly unit. In the first functional branch, a set of learnable field weight parameters are associated with each deep representation vector, a field-level perturbation mapping relationship is established with the function code field, address field, and data field, and the field identifier is associated with and stored with the deep representation vector, so that the local sensitivity interpretation unit can generate field-level anomaly contribution results based on the field perturbation results. In the second functional branch, based on the association between the function code field, address field, data field and check field in the formatted message sequence record, a protocol field node identifier and an inter-field edge relationship description are configured for each deep representation vector, and a graph substructure interpretation unit is constructed. In the third functional branch, a clustering identifier and a local density statistics buffer are maintained for each deep representation vector, and a local density anomaly unit is constructed, so that the three functional branches form an end-to-end linkage structure.
[0010] Optionally, the generation of the field-level anomaly contribution specifically includes: For each deep representation vector, record the corresponding key device identifier, first-level associated device identifier, function code field, address field, and data field. Establish an index relationship between the deep representation vector and the field position within the local sensitivity interpretation unit, and use the index relationship as the field positioning information. For each industrial control message with an established index relationship, a field neutral replacement operation is performed. Based on the whitelist and baseline rules corresponding to the key equipment in the key equipment dedicated rule library, the function code field, address field, and data field are replaced respectively by selecting the normal function type, the communication range of the key equipment, and the normal data recorded in the baseline rules. The three neutral replacement messages are then input into the self-supervised representation learning model to obtain the neutral replacement deep representation vector, which is stored together with the original deep representation vector. In the local sensitivity interpretation unit, the difference between the depth representation vectors before and after the three types of message neutral replacements is calculated, and the three types of difference values are normalized according to the field dimension to obtain the field-level anomaly contribution.
[0011] Optionally, the process of obtaining the key field substructure specifically includes: In the diagram substructure interpretation unit, session layer nodes are established according to the communication range of key equipment, and field layer nodes are established according to function code field, address field and data field. Session edges are established between session layer nodes according to the communication relationship between key equipment and first-level associated equipment. Field edges are established between field layer nodes according to the field order relationship within the same message and the cross-message request and response relationship. Message time interval, request and response direction and deviation information relative to whitelist and baseline rules are written on the field edges to construct a two-layer protocol field diagram containing session layer and field layer. Weights are assigned to field layer nodes and field edges in the two-layer protocol field graph based on field-level anomaly contribution and rule deviation. Key device session nodes are selected as the starting point for random walks. A random walk process with a restart mechanism is performed between field layer nodes and session layer nodes. The access frequency of each field layer node in the steady state of the walk is counted. Field layer nodes and their connecting edges with access frequencies lower than a preset threshold and both field-level anomaly contribution and rule deviation are lower than the corresponding thresholds are deleted from the graph. Only field layer nodes and their connecting edges with access frequencies not lower than the preset threshold or at least one of field-level anomaly contribution and rule deviation not lower than the corresponding threshold are retained. Key device session nodes and their session edges that are related to the retained field layer nodes are retained in the session layer. The resulting protocol field graph is filtered and pruned by random walk. In the filtered protocol field graph, key device session nodes and first-level associated device session nodes directly connected to key device session nodes are designated as the terminal node set. Under the premise of ensuring that the terminal nodes remain connected, a constrained Steiner tree approximation is performed. A comprehensive cost is constructed based on node weights and edge weights. Candidate edges are selected in ascending order of comprehensive cost. The nodes connected by the candidate edges are gradually added to the current subgraph. If adding a candidate edge can shorten the path between terminal nodes, the edge is retained; otherwise, the edge is discarded. When all terminal nodes are covered by a single connected subgraph, the expansion stops, and the current connected subgraph is checked in reverse. Redundant session layer nodes, field layer nodes, and edges that do not affect the connectivity of terminal nodes are deleted in turn until there are no nodes and edges that can be deleted. The final connected subgraph is determined as the key field substructure that caused the anomaly.
[0012] Optionally, the generation of the density score reflecting the anomaly level of industrial control messages specifically includes: A local outlier graph neural network is constructed in the local density anomaly unit. The deep representation vectors of all industrial control messages are used as graph nodes, and the substructure of key fields and the relationship between fields are used as the constraint information of the edges in the graph. According to the preset density-based clustering strategy, all deep representation vectors are clustered. Deep representation vectors with close connections and similarity are divided into the same cluster, and the corresponding cluster identifier is recorded for each deep representation vector. For each depth representation vector, neighboring nodes are selected according to the connection edge relationship in the graph. The neighborhood range is limited by the key field substructure. Message passing and aggregation operations of neighborhood features are performed to obtain the local reachability density value of each depth representation vector within the neighborhood range. The local reachability density value is then stored in a one-to-one correspondence with the corresponding depth representation vector and the corresponding industrial control message. For each cluster, the local reachability density values of all depth representation vectors within the cluster are summarized to obtain the reference density level of the cluster. At the same time, for each depth representation vector within the cluster, the local reachability density value is compared with the reference density level of the cluster to which it belongs. The local outlier score is calculated based on the degree of difference and is used as the density score output for the corresponding industrial control message.
[0013] Optionally, the exception handling and alarm triggering process specifically includes: Obtain the density score generated by each industrial control message, summarize all density scores to form a density score list, and pre-set density score thresholds arranged from low to high values. Each threshold corresponds to an anomaly level, which is used to divide density scores with different value ranges into different anomaly level intervals. For each industrial control message in the density score list, read the density score, compare it sequentially according to the preset density score threshold, determine the numerical range of the density score, and use the abnormal level corresponding to the numerical range as the abnormal level mark of the industrial control message. At the same time, associate and store the industrial control message identifier, density score and abnormal level mark. Based on the anomaly level marker corresponding to each industrial control message, the industrial control messages are divided into normal messages and abnormal messages according to the preset anomaly level threshold. Industrial control messages with anomaly levels not lower than the anomaly level threshold are included in the abnormal message set. Corresponding anomaly handling instructions and alarm information are generated for the abnormal messages. The processing results and alarm trigger instructions are output to the industrial control security protection device.
[0014] The beneficial effects of this invention are: This invention constructs a dedicated formatted message sequence and a self-supervised representation learning model around key equipment and its primary related equipment. By comparing learning, field mask prediction, and byte perturbation to enhance the joint training of deep representation vectors, it can automatically learn the fine-grained semantic features and normal communication patterns of industrial control messages without the need for a large number of attack sample annotations.
[0015] This invention generates field-level anomaly contribution by neutral substitution perturbation, constructs a protocol field graph by combining rule deviation degree, and then uses random walk and constrained Steiner tree to extract key field substructures, achieving a precise correspondence between anomaly results and specific function code fields, address fields, data fields and their combination patterns, significantly improving the interpretability and traceability of anomaly detection.
[0016] This invention introduces a local outlier graph neural network into the local density anomaly unit. It uses key field substructure and field association to constrain the neighborhood construction and performs density clustering and local density scoring on the depth representation vector. This enables automatic clustering and multi-level anomaly classification of similar anomaly messages. Compared with point-level anomaly detection based solely on global distance, this is more in line with actual process logic and is conducive to handling anomaly events by cluster. Attached Figure Description
[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0018] Figure 1 This is a flowchart of an industrial control message anomaly clustering method based on self-supervised representation proposed in this invention; Figure 2 This is a schematic diagram of the algorithm structure of an anomaly clustering method for industrial control messages based on self-supervised representation proposed in this invention. Detailed Implementation
[0019] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.
[0020] refer to Figure 1-2 An industrial control message anomaly clustering method based on self-supervised representation includes the following steps: The industrial control messages collected from the industrial control network are preprocessed and parsed to extract the function code field, address field, data field and check field from the industrial control messages, and the parsing results are organized into a formatted message sequence according to the time order. Using the formatted message sequence as input, a contrastive learning task, a field mask prediction task, and a byte perturbation enhancement task are constructed to obtain a deep representation vector for characterizing the semantic features of industrial control messages. An improved self-supervised representation learning model is constructed using deep representation vectors, including local sensitivity interpretation units, graph substructure interpretation units, and local density anomaly units, to realize anomaly clustering and result interpretation of industrial control messages; In the local sensitivity interpretation unit, based on the deep representation vector, a neutral replacement perturbation operation is performed through the function code field, address field, and data field to calculate the change of the representation vector before and after the replacement, and to generate field-level anomaly contribution based on the degree of change. In the graph substructure interpretation unit, the protocol field graph is constructed using the field-level anomaly contribution results. Based on the relationship between fields and the field-level contribution, the minimum subgraph is used to extract the key field substructures that cause the anomalies from the protocol field graph. In the local density anomaly unit, based on the association between the key field substructure and the field, the deep representation vector is clustered, and the degree of anomaly of the industrial control message is evaluated by calculating the local reachability density in the clustering result, and a density score reflecting the anomaly level of the industrial control message is generated. Based on the density score, the degree of anomaly is further determined, and the industrial control messages are classified according to the density score for anomaly handling and alarm triggering.
[0021] In this embodiment, obtaining the formatted message sequence specifically includes: Based on the industrial control network process flow, key equipment and primary related equipment are pre-determined. Within a preset acquisition period, a continuous stream of raw industrial control messages is acquired. The acquisition time information of each raw industrial control message is recorded, and preprocessing operations are performed according to preset rules, including removing physical layer noise messages, deleting duplicate messages, and discarding messages with missing fields or abnormal lengths. The retained messages are formatted with uniform time information and written to the cache to obtain a set of preprocessed industrial control messages for protocol parsing. For each industrial control message in the preprocessed industrial control message set, the industrial control protocol type is determined according to the message header identifier. The protocol parsing program corresponding to the protocol type is called to perform field-by-field parsing on the current industrial control message. The function code field, address field, data field, and check field are extracted and processed in sequence. The function code field is normalized according to the preset function code dictionary. The address field is converted into a unified address representation according to the protocol definition. The data field is converted into a unified numerical representation according to the data type. The integrity of the message is verified according to the check field. The corresponding function code field, address field, data field, and check field are saved only when the verification passes. The verified and saved function code field, address field, data field, and verification field are combined with the corresponding acquisition time information in a preset field order to generate a formatted message sequence with a fixed structure.
[0022] In this embodiment, obtaining the depth representation vector specifically includes: The formatted message sequence is processed one by one, and the embedding encoding is performed in a fixed order of function code field, address field, data field and check field. The embedding results of each field are then concatenated to form the initial feature representation of the key equipment related message, and organized into a key equipment training sample set. Based on the training sample set of key equipment, a comparative learning task is constructed. Messages with the same key equipment and the same function code field are combined into positive samples, and messages with different key equipment or different function code fields are combined into negative samples. The original messages and positive and negative samples participate in training together to obtain the deep representation results of the key equipment in the first stage. Building upon the in-depth characterization of key equipment in the first phase, the project further constructs field mask prediction and byte perturbation enhancement tasks. In the field mask prediction task, masks are set for certain positions in the address field or data field. In the byte perturbation enhancement task, one byte in the data field of the message is perturbed within the allowed range, while keeping the characterization before and after the perturbation close. At the same time, the sending cycle, function code combination, and interaction timing characteristics of the message are statistically analyzed at the session granularity, and corresponding whitelists and baseline rules are generated and written into the key equipment-specific rule base. The characteristics of the formatted message are compared with the whitelist and baseline rules to calculate the deviation and record it as the degree of rule deviation. Simultaneously, the formatted message sequences of key equipment and first-level related equipment are encoded to form the in-depth characterization vector of the industrial control message.
[0023] In this embodiment, the construction of the improved self-supervised representation learning model specifically includes: The deep representation vector is retained as a shared hidden layer representation. A first functional branch is set up to generate local sensitivity interpretation results, a second functional branch is set up to generate graph substructure interpretation results, and a third functional branch is set up to calculate the local density anomaly index. This constitutes the overall structure of the improved self-supervised representation learning model, which includes local sensitivity interpretation unit, graph substructure interpretation unit and local density anomaly unit. In the first functional branch, a set of learnable field weight parameters are associated with each deep representation vector, a field-level perturbation mapping relationship is established with the function code field, address field, and data field, and the field identifier is associated with and stored with the deep representation vector, so that the local sensitivity interpretation unit can generate field-level anomaly contribution results based on the field perturbation results. In the second functional branch, based on the association between the function code field, address field, data field and check field in the formatted message sequence record, a protocol field node identifier and an inter-field edge relationship description are configured for each deep representation vector, and a graph substructure interpretation unit is constructed. In the third functional branch, a clustering identifier and a local density statistics buffer are maintained for each deep representation vector, and a local density anomaly unit is constructed, so that the three functional branches form an end-to-end linkage structure.
[0024] This invention retains a unified deep representation vector as a shared hidden layer representation, and simultaneously constructs three functional branches on it: local sensitivity interpretation, graph substructure interpretation, and local density anomaly. It also associates field weights, protocol field node identifiers, and clustering and density statistics with each deep representation vector, enabling end-to-end linkage between anomaly contribution calculation, key field substructure extraction, and anomaly density scoring. This avoids problems of redundant modeling and feature inconsistency, and significantly improves the overall accuracy and interpretability of industrial control message anomaly detection results.
[0025] In this embodiment, the generation of the field-level anomaly contribution specifically includes: For each deep representation vector, record the corresponding key device identifier, first-level associated device identifier, function code field, address field, and data field. Establish an index relationship between the deep representation vector and the field position within the local sensitivity interpretation unit, and use the index relationship as the field positioning information. For each industrial control message with an established index relationship, a field neutral replacement operation is performed. Based on the whitelist and baseline rules corresponding to the key equipment in the key equipment dedicated rule library, the function code field, address field, and data field are replaced respectively by selecting the normal function type, the communication range of the key equipment, and the normal data recorded in the baseline rules. The three neutral replacement messages are then input into the self-supervised representation learning model to obtain the neutral replacement deep representation vector, which is stored together with the original deep representation vector. In the local sensitivity interpretation unit, the difference between the depth representation vectors before and after the three types of message neutral replacements is calculated, and the three types of difference values are normalized according to the field dimension to obtain the field-level anomaly contribution.
[0026] This invention binds key device identifiers, first-level associated device identifiers, and the positions of each protocol field to the deep representation vector. Based on a key device-specific rule base, it performs neutral replacements on the function code field, address field, and data field and compares the differences in the representation vector to obtain the field-level anomaly contribution. This enables a quantitative characterization of the impact of single fields and field combinations on anomalies within a unified self-supervised representation space. It can accurately distinguish whether the message anomaly is caused by a function type anomaly, an address range anomaly, or a data content anomaly, thereby significantly improving the interpretability and positioning accuracy of industrial control message anomaly detection results at the field granularity.
[0027] In this embodiment, the process of obtaining the key field substructure specifically includes: In the diagram substructure interpretation unit, session layer nodes are established according to the communication range of key equipment, and field layer nodes are established according to function code field, address field and data field. Session edges are established between session layer nodes according to the communication relationship between key equipment and first-level associated equipment. Field edges are established between field layer nodes according to the field order relationship within the same message and the cross-message request and response relationship. Message time interval, request and response direction and deviation information relative to whitelist and baseline rules are written on the field edges to construct a two-layer protocol field diagram containing session layer and field layer. Weights are assigned to field layer nodes and field edges in the two-layer protocol field graph based on field-level anomaly contribution and rule deviation. Key device session nodes are selected as the starting point for random walks. A random walk process with a restart mechanism is performed between field layer nodes and session layer nodes. The access frequency of each field layer node in the steady state of the walk is counted. Field layer nodes and their connecting edges with access frequencies lower than a preset threshold and both field-level anomaly contribution and rule deviation are lower than the corresponding thresholds are deleted from the graph. Only field layer nodes and their connecting edges with access frequencies not lower than the preset threshold or at least one of field-level anomaly contribution and rule deviation not lower than the corresponding threshold are retained. Key device session nodes and their session edges that are related to the retained field layer nodes are retained in the session layer. The resulting protocol field graph is filtered and pruned by random walk. In the filtered protocol field graph, key device session nodes and first-level associated device session nodes directly connected to key device session nodes are designated as the terminal node set. Under the premise of ensuring that the terminal nodes remain connected, a constrained Steiner tree approximation is performed. A comprehensive cost is constructed based on node weights and edge weights. Candidate edges are selected in ascending order of comprehensive cost. The nodes connected by the candidate edges are gradually added to the current subgraph. If adding a candidate edge can shorten the path between terminal nodes, the edge is retained; otherwise, the edge is discarded. When all terminal nodes are covered by a single connected subgraph, the expansion stops, and the current connected subgraph is checked in reverse. Redundant session layer nodes, field layer nodes, and edges that do not affect the connectivity of terminal nodes are deleted in turn until there are no nodes and edges that can be deleted. The final connected subgraph is determined as the key field substructure that caused the anomaly.
[0028] This invention constructs a two-layer protocol field graph containing a session layer and a field layer, and introduces field-level anomaly contribution, rule deviation degree, random walk with restart and constrained Steiner tree approximate joint screening and compressed graph structure. It automatically extracts the smallest key field substructure that can maintain the connectivity of key equipment and its first-level related equipment from complex industrial control communication relationships. It achieves accurate characterization and focus on the combination of function code fields, address fields and data fields that cause anomalies, significantly improves the interpretability and traceability efficiency of anomaly detection results at the process path and protocol granularity, and helps operation and maintenance personnel quickly locate the source of anomalies and the scope of impact.
[0029] In this embodiment, the generation of the density score reflecting the anomaly level of industrial control messages specifically includes: A local outlier graph neural network is constructed in the local density anomaly unit. The deep representation vectors of all industrial control messages are used as graph nodes, and the substructure of key fields and the relationship between fields are used as the constraint information of the edges in the graph. According to the preset density-based clustering strategy, all deep representation vectors are clustered. Deep representation vectors with close connections and similarity are divided into the same cluster, and the corresponding cluster identifier is recorded for each deep representation vector. For each depth representation vector, neighboring nodes are selected according to the connection edge relationship in the graph. The neighborhood range is limited by the key field substructure. Message passing and aggregation operations of neighborhood features are performed to obtain the local reachability density value of each depth representation vector within the neighborhood range. The local reachability density value is then stored in a one-to-one correspondence with the corresponding depth representation vector and the corresponding industrial control message. For each cluster, the local reachability density values of all depth representation vectors within the cluster are summarized to obtain the reference density level of the cluster. At the same time, for each depth representation vector within the cluster, the local reachability density value is compared with the reference density level of the cluster to which it belongs. The local outlier score is calculated based on the degree of difference and is used as the density score output for the corresponding industrial control message.
[0030] This invention introduces a local outlier factor graph neural network that combines the substructure of key fields with the correlation between fields into the local density anomaly unit. It performs density clustering on the depth representation vector of industrial control messages on the graph structure and generates fine-grained density scores based on the local reachability density differences inside and outside the clusters. This enables abnormal messages to be accurately distinguished and clustered and form quantifiable anomaly levels while conforming to the actual process logic, providing a reliable basis for subsequent graded response and strategy optimization.
[0031] In this embodiment, the process of exception handling and alarm triggering specifically includes: Obtain the density score generated by each industrial control message, summarize all density scores to form a density score list, and pre-set density score thresholds arranged from low to high values. Each threshold corresponds to an anomaly level, which is used to divide density scores with different value ranges into different anomaly level intervals. For each industrial control message in the density score list, read the density score, compare it sequentially according to the preset density score threshold, determine the numerical range of the density score, and use the abnormal level corresponding to the numerical range as the abnormal level mark of the industrial control message. At the same time, associate and store the industrial control message identifier, density score and abnormal level mark. Based on the anomaly level marker corresponding to each industrial control message, the industrial control messages are divided into normal messages and abnormal messages according to the preset anomaly level threshold. Industrial control messages with anomaly levels not lower than the anomaly level threshold are included in the abnormal message set. Corresponding anomaly handling instructions and alarm information are generated for the abnormal messages. The processing results and alarm trigger instructions are output to the industrial control security protection device.
[0032] Example 1: To verify the feasibility of this invention in practice, it was applied to the industrial control network security monitoring system of a continuous process industrial production unit. This unit uses multiple sets of PLCs and DCS main controllers to collaboratively control key process sections, where several key devices directly determine raw material feeding, key valve start / stop, and emergency shutdown logic. The field control network uses a mixed deployment of multiple industrial control protocols, and key devices maintain a fixed interaction relationship with their primary related devices for a long time. Previously, maintenance personnel mainly relied on traditional feature rules and simple threshold detection, which could only provide coarse-grained alarms for anomalies related to key devices, making it impossible to accurately distinguish different types of anomalies or quickly trace back to specific fields and message combinations. Especially under high load conditions, false alarms were numerous and missed alarms were difficult to avoid, seriously affecting the efficiency of on-site safety management.
[0033] In this scenario, continuous industrial control message streams are acquired through mirror ports of aggregation and switching nodes near critical equipment. The acquisition covers multiple shifts and different operating conditions. Using the method of this invention, the original industrial control messages are preprocessed and parsed to remove significant noise and incomplete messages. The function code field, address field, data field, and checksum field are reassembled into a formatted message sequence in a fixed order. Based on this formatted sequence, a contrastive learning task, a field mask prediction task, and a byte perturbation enhancement task are constructed. These tasks train a deep representation vector capable of simultaneously characterizing the specific communication patterns, temporal features, and fine-grained relationships between fields of the critical equipment. Furthermore, a whitelist and baseline rule base specific to the critical equipment are automatically generated.
[0034] In actual operation, the latest messages from key equipment and its primary associated equipment are continuously input into the improved self-supervised representation learning model constructed in this invention. Using local sensitivity interpretation units, each deep representation vector is bound to a key equipment identifier, a primary associated equipment identifier, and a field position. Through a neutral replacement operation based on whitelists and baseline rules, the function code field, address field, and data field in the message are replaced with normal function types, normal addressing ranges, and normal data content, respectively. The result is then re-encoded to obtain the neutrally replaced representation vector. The difference is calculated by comparing it with the original representation vector, and after normalization, a field-level anomaly contribution is formed. This maintains the overall modeling capability while providing a clear explanation of which field and which type of deviation is dominant for each anomalous message.
[0035] In the graph substructure interpretation unit, based on the actual collected session relationships, the communication sessions between key devices and primary associated devices are abstracted into session layer nodes, and the function code field, address field, and data field are abstracted into field layer nodes. Field edges are established according to the field order within the same message and the request-response relationship across messages. Time intervals, directions, and deviations from the whitelist and baseline are written to the field edges to construct a two-layer protocol field graph. Combining the field-level anomaly contribution and rule deviation, weights are assigned to field nodes and field edges. Redundant nodes and edges with low contribution and low access frequency are filtered out through a random walk with restart. Then, a constrained Steiner tree approximation is performed to automatically extract the key field substructures that maintain the connectivity between key devices and primary associated devices and minimize costs from the retained graph. This ensures that each type of anomaly can correspond to a compact set of field combinations and session paths, providing a structured basis for subsequent anomaly clustering and classification.
[0036] In the local density anomaly unit, a local outlier factor graph neural network is constructed using the aforementioned deep representation vector and key field substructure. The deep representation vector of each industrial control message is used as a graph node, and messages with correlations in the key field substructure are considered connected node pairs. Message passing and aggregation operations are used to obtain the local reachability density of each node within its structural constraint neighborhood. Then, a density-based clustering strategy is used to cluster all nodes, grouping closely connected messages with similar representations into the same cluster. Within each cluster, the local reachability density is compared with the cluster reference density to calculate the local outlier factor score, which is output as the density score. The density score is mapped to different anomaly levels using a tiered threshold and presented jointly with the key field substructure and field-level anomaly contribution, allowing operations personnel to simultaneously see which anomaly cluster it belongs to, its severity, and the locations of the main anomaly fields.
[0037] To verify the performance improvement of this invention compared to existing technologies, this embodiment selects industrial control message data within the same time window and compares them with a traditional detection scheme based on rules and statistical thresholds, a scheme using only deep representation plus global and local outlier factors, and the scheme of this invention. The experimental results are shown in Table 1: Table 1. Performance Comparison of Different Detection Solutions in Key Equipment Scenarios
[0038] As shown in Table 1, under the same test data, the solution of this invention is significantly superior to other solutions in all key indicators: the detection rate of key equipment-related anomalies increased from 87.5% and 92.1% to 98.4%, the false alarm rate of key equipment-related anomalies decreased from 7.8% and 4.6% to 1.3%, the clustering purity of similar attack messages increased from 52.3% and 68.7% to 89.5%, the average single alarm location time was shortened from 26 minutes and 17 minutes to 7 minutes, the proportion of alarms that can be explained at the field level increased from 0 and 25.4% to 91.2%, and the number of missed alarms affecting the shutdown of key equipment during the test period decreased from 3 and 2 to 0. This fully verifies the comprehensive advantages of this invention in key equipment industrial control message anomaly clustering, accurate alarms, and interpretable analysis.
[0039] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. An industrial control message anomaly clustering method based on self-supervised representation, characterized in that, The method comprises the following steps: Pretreatment and protocol analysis are performed on the industrial control messages collected in the industrial control network, and the analysis results are organized into a formatted message sequence according to the time sequence; Using the formatted message sequence as input, a contrast learning task, a field mask prediction task and a byte perturbation enhancement task are constructed to obtain a deep feature vector; Using the deep feature vector, an improved self-supervised feature learning model is constructed, including a local sensitivity explanation unit, a graph substructure explanation unit and a local density anomaly unit; In the local sensitivity explanation unit, a neutral replacement perturbation operation is performed, the change of the feature vector before and after replacement is calculated, and the field level abnormal contribution degree is generated according to the change degree; In the graph substructure explanation unit, the field level abnormal contribution degree result is used to construct a protocol field graph, and the minimum subgraph extraction is used to determine the key field substructure causing the anomaly from the protocol field graph; In the local density anomaly unit, based on the association relationship between the key field substructure and the field, the deep feature vector is clustered to generate a density score reflecting the abnormal level of the industrial control message; Based on the density score, the abnormal degree is further determined, and the industrial control message is classified according to the density score, and the abnormal processing and alarm triggering are performed.
2. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The formatted message sequence is obtained specifically as follows: Based on the key equipment and the first associated equipment determined in advance according to the process flow of the industrial control network, the continuous original industrial control message stream is obtained within a preset collection period, the collection time information of each original industrial control message record is recorded, and the preprocessing operation is performed according to the preset rule to obtain a set of preprocessed industrial control messages; For each industrial control message in the set of preprocessed industrial control messages, the corresponding protocol analysis program is called according to the message header identification to determine the type of the industrial control protocol, and the current industrial control message is analyzed field by field, and the function code field, the address field, the data field and the check field are extracted and processed in turn, and the message integrity is checked according to the check field; The function code field, the address field, the data field and the check field are combined with the corresponding collection time information in the preset field order to generate the formatted message sequence.
3. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The deep feature vector is obtained specifically as follows: The formatted message sequence is processed one by one, embedded coding is performed in a fixed order, and the field embedding results are spliced in turn to form the initial feature representation of the key equipment related message, which is arranged into a key equipment training sample set; The contrast learning task is constructed according to the key equipment training sample set to obtain the deep feature vector of the first stage key equipment; Based on the deep feature vector of the first stage key equipment, the field mask prediction task and the byte perturbation enhancement task are constructed to generate the corresponding whitelist and baseline rule, which are written into the key equipment exclusive rule library, and the feature of the formatted message is compared with the whitelist and the baseline rule to calculate the deviation and record the rule deviation degree, and the formatted message sequence is coded to form the deep feature vector of the industrial control message.
4. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The improved self-supervised feature learning model is constructed specifically as follows: The deep representation vector is reserved as a shared hidden layer representation, a first function branch for generating a local sensitivity explanation result, a second function branch for generating a graph substructure explanation result, and a third function branch for calculating a local density anomaly index are set, and an improved self-supervised representation learning model overall structure including a local sensitivity explanation unit, a graph substructure explanation unit, and a local density anomaly unit is formed; In the first function branch, a field-level perturbation mapping relationship corresponding to the function code field, the address field, and the data field is established, and the field identifier is stored in association with the deep representation vector, so that the local sensitivity explanation unit can generate a field-level anomaly contribution degree result based on the field perturbation result; In the second function branch, a protocol field node identifier and an inter-field edge relationship description are configured for each deep representation vector, and a graph substructure explanation unit is constructed, and in the third function branch, a cluster identifier and a local density statistics buffer are maintained for each deep representation vector, and a local density anomaly unit is constructed.
5. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The generation of the field-level anomaly contribution degree specifically includes: For each deep representation vector, the corresponding key device identifier, the first associated device identifier, the function code field, the address field, and the data field are recorded, and an index relationship between the deep representation vector and the field position is established in the local sensitivity explanation unit; For each industrial control message with an established index relationship, a field-neutral replacement operation is performed, and according to the white list and the baseline rule corresponding to the key device in the key device exclusive rule library, the normal function type, the key device communication range, and the normal data recorded in the baseline rule are selected to replace the function code field, the address field, and the data field respectively, and the three kinds of replaced messages are input into the self-supervised representation learning model to obtain the deep representation vectors after neutral replacement; In the local sensitivity explanation unit, the difference values between the deep representation vectors before and after the neutral replacement of the three kinds of messages are calculated, and the three kinds of difference values are normalized according to the field dimension to obtain the field-level anomaly contribution degree.
6. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The process of obtaining the key field substructure specifically includes: In the graph substructure explanation unit, session layer nodes are established according to the key device communication range, field layer nodes are established according to the function code field, the address field, and the data field, session edges are established between the session layer nodes, and field edges are established between the field layer nodes, and a double-layer protocol field graph including the session layer and the field layer is constructed; According to the field-level anomaly contribution degree and the rule deviation degree, weights are assigned to the field layer nodes and the field edges in the double-layer protocol field graph, the key device session nodes are selected as the starting points of random walk, a random walk process with a restart mechanism is performed between the field layer nodes and the session layer nodes, the access frequencies of each field layer node in the steady state of the walk are counted, the field layer nodes and the connected edges whose access frequencies are lower than a preset threshold and whose field-level anomaly contribution degrees and rule deviation degrees are lower than corresponding thresholds are deleted from the graph, and the key device session nodes and the session edges associated with the retained field layer nodes in the session layer are retained, and a protocol field graph after random walk screening and pruning is obtained. In the screened protocol field graph, the key device session node and the first associated device session node directly connected with the key device session node are collectively specified as a terminal node set, a constrained Steiner tree approximation is performed, a comprehensive cost is constructed according to node weights and edge weights, candidate edges are selected in order from small to large according to the comprehensive cost, nodes connected by the candidate edges are gradually added to the current subgraph, and the expansion is stopped when all the terminal nodes are covered by a single connected subgraph, and a reverse check is performed on the current connected subgraph, and finally the connected subgraph obtained is determined as the key field substructure causing the anomaly.
7. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The generation of the density score reflecting the abnormal level of the industrial control message specifically includes: In the local density anomaly unit, a local outlier factor graph neural network is constructed, the deep feature vectors of all industrial control messages are taken as graph nodes, the key field substructure and the field association relationship are taken as constraint information of the edges in the graph, and according to a preset density-based clustering strategy, the deep feature vectors are clustered, the deep feature vectors with close connection relationship and meeting the similarity condition are divided into the same clustering cluster, and the clustering cluster identifier corresponding to each deep feature vector is recorded; For each deep feature vector, neighbor nodes are selected according to the connection edge relationship in the graph, the neighbor range is limited in combination with the key field substructure, message passing and aggregation operation of neighborhood features is performed, and the local reachable density value of each deep feature vector in the neighborhood range is obtained; For each clustering cluster, the local reachable density values of all deep feature vectors in the clustering cluster are summarized to obtain the reference density level of the clustering cluster, and for each deep feature vector in the clustering cluster, the local reachable density value is compared with the reference density level of the clustering cluster, the local outlier factor score is calculated according to the difference, and the density score of the corresponding industrial control message is output.
8. The industrial control message anomaly clustering method based on self-supervised representation according to claim 1, characterized in that, The process of the abnormal processing and the alarm triggering specifically includes: The density score generated by each industrial control message is obtained, all the density scores are summarized to form a density score list, and a density score threshold value arranged in order from low to high is preset; For each industrial control message in the density score list, the density score is read, and the density score threshold value is compared in order according to the preset density score threshold value, the numerical interval where the density score is located is determined, and the abnormal level corresponding to the numerical interval is taken as the abnormal level mark of the industrial control message; According to the abnormal level mark corresponding to each industrial control message, the industrial control messages are divided into normal messages and abnormal messages according to the preset abnormal level threshold value, the industrial control messages with an abnormal level not lower than the abnormal level threshold value are classified into the abnormal message set, and the corresponding abnormal processing instruction and alarm information are generated for the abnormal messages.