An industrial control network high-interaction honeypot method based on finite state machine and time sequence prediction

Abstract

The application discloses an industrial control network high-interaction honeynet method based on a finite state machine and timing prediction, and belongs to the field of industrial control network security. The method solves the problems of lack of real industrial control network communication state transition timing characteristic modeling and process data simulation method staticity, which leads to insufficient concealment and limited trapping ability of the existing industrial control honeynet protocol interaction model. The application accurately models the communication behavior of industrial control equipment through a finite state machine model, simulates periodic protocol interaction and state transition, uses a Transformer model for long-period timing prediction, generates dynamic process data, applies dynamic balance constraints to process the prediction data to ensure compliance with physical laws, and integrates the state machine model and the prediction data to build a high-interaction honeynet system. The application realizes significant improvement of the interaction fidelity and deception ability of the honeypot, enhances the data authenticity and continuity, forms a multi-level defense system to effectively trap attack behaviors and collect attack information.

Description

Technical Field

[0001] This invention belongs to the field of industrial control network security technology, and particularly relates to a high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction. Background Technology

[0002] As a core component of critical infrastructure, industrial control systems (ICS) face increasingly severe cybersecurity threats, particularly advanced persistent threats (APS) and attacks specific to ICS protocols. ICS honeypot technology, as a proactive defense mechanism, aims to enhance network security by simulating the services and behaviors of programmable logic controllers (PLCs), human-machine interfaces (HMIs), and other devices within real industrial control systems, thereby luring attackers and collecting attack information. However, existing ICS honeypot technologies still have significant shortcomings in dealing with complex attacks, primarily in the realism of protocol interactions and the dynamic nature of process data simulation.

[0003] Regarding the realism of protocol interactions, existing industrial control honeypots suffer from overly rigid communication behavior models, making it difficult to simulate the periodic interaction characteristics of real industrial control equipment based on state transitions. Specifically, existing models cannot accurately abstract and reproduce the communication baseline between the human-machine interface and the programmable logic controller (PLC), or between PLCs, based on strict timing and state cycles. This insufficient modeling leads to honeypot interactions exhibiting overly regular or logically chaotic characteristics, making them easily recognizable as simulation environments by attackers. Existing research reviews of industrial control honeypot deployments point out that many low-interaction honeypots have limited practical applications due to the gap between their simulated systems and real-world industrial control equipment in terms of configuration and operation. While high-interaction environments offer broader capabilities and value, most existing honeypot solutions still have significant shortcomings in building highly realistic, adaptive protocol interaction models.

[0004] Regarding the dynamism of process data simulation, traditional honeypots often use predefined data or simple random algorithms to generate process data such as sensor readings, lacking consistency with the dynamic evolution of the physical process. Although some studies have proposed scalable industrial control system honeypot designs based on description files, defining device characteristics through definition files to improve deployment flexibility and simulation realism, this method still essentially relies on static or predefined configurations to drive data simulation. This static or semi-static data simulation mode cannot model and predict the inherent patterns of long-term, multi-variable time-series data, making honeypots highly susceptible to exposure when faced with prolonged and frequent snooping by attackers due to abnormal data patterns or disconnection from the real physical process.

[0005] These issues severely limit the practical deployment effectiveness and trapping value of industrial control honeypots in highly adversarial network environments. Existing technologies face difficulties in constructing protocol interaction models capable of simulating complex inter-device polling and command interactions, and also pose challenges in achieving long-cycle time-series data simulation consistent with the dynamic evolution of real physical processes. Solving these technical challenges requires overcoming the complexity of modeling the timing characteristics of state transitions in industrial control communication, as well as the technical bottleneck of ensuring that dynamic process data generation maintains consistency with physical laws. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction, thereby resolving the issues present in the prior art.

[0007] Firstly, to achieve the above objectives, this invention provides a high-interaction honeycomb method for industrial control networks based on finite state machines and timing prediction, comprising the following steps: Collect and preprocess industrial control network traffic data to extract protocol sessions and generate session identifiers; A finite state machine model is constructed to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; Extract time-series data from the sensors and construct a time series. Using the Transformer model to perform time series forecasting and generate dynamic process data; Dynamic equilibrium constraints are applied to process the predicted data to ensure that the data conforms to physical laws; By integrating finite state machine models and predictive data into the honeynet system, highly interactive honeynet deployment can be achieved.

[0008] Optionally, the process of collecting and preprocessing industrial control network traffic data includes: Collect raw PCAP traffic data from the industrial control network and extract ENIP / TCP protocol communication traffic; Parse the ENIP session handle and sequence number of each data packet, where the session handle is extracted from the fourth to eighth bytes of the data packet payload, and the sequence number is extracted from different positions according to the command type; Generate a unique session identifier key for each request packet, including session handle, sequence number, source IP address, source port, destination IP address, and destination port, and establish a session dictionary mapping key to the tag, request packet count, request source IP, and request destination IP.

[0009] Optionally, the process of constructing a finite state machine model includes: Define a state tuple, including state identifier, sensor tag, source IP address, destination IP address, start timestamp, and sensor reading; Set the state transition trigger condition. When the sensor tag of the current state is different from that of the new state, the state transition is triggered, the current state is recorded, and the new state is initialized. The state time interval is calculated as the difference between the state start times, reflecting the communication cycle characteristics. The longest common subsequence algorithm is used to extract state patterns and identify repetitive patterns in state sequences.

[0010] Optionally, the process of extracting sensor time-series data and constructing a time series includes: Parse the sensor values ​​from the response packet. For discrete tags, extract two bytes of data from the value offset position of the data packet payload and unpack them into an integer. For continuous tags, extract four bytes of data and unpack them into a floating-point number. Using a one-minute sampling interval, a time series is constructed, including a sequence of timestamps and sensor readings, forming a historical data basis for prediction.

[0011] Optionally, the process of using the Transformer model to perform time series forecasting includes: Convert the time series data into a model input format, including the input series length and the prediction length; Attention weights are computed using a multi-head self-attention mechanism, where the query, key, and value matrices are generated from the input sequence using learnable parameters. The model is trained using a trend-aware loss function, which is a combination of mean absolute error, trend consistency loss, and smoothing loss.

[0012] Optionally, the process of applying dynamic equilibrium constraints to the forecast data includes: Dynamic constraint boundaries are constructed based on historical data quantiles, including basic minimum and basic maximum values; Dynamic constraints are applied to the predicted values. When the predicted values ​​are lower than the physical minimum or higher than the dynamic maximum, the constraint strength coefficient is used for adjustment. Apply global trend correction, using correction factors to adjust for the deviation between the predicted data and the actual data trend.

[0013] Secondly, the present invention also provides a high-interaction honeynet system for industrial control networks based on finite state machines and timing prediction, for implementing a high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction, the system comprising: The data acquisition and preprocessing module is used to collect industrial control network traffic data and preprocess it to extract protocol sessions and generate session identifiers; The state machine modeling module is used to build finite state machine models to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; The time-series data construction module is used to extract sensor time-series data and construct time series data. The time series forecasting module is used to perform time series forecasting using the Transformer model and generate dynamic process data. The constraint processing module is used to apply dynamic equilibrium constraints to process the predicted data, ensuring that the data conforms to physical laws. The honeynet integration module is used to integrate finite state machine models and prediction data into the honeynet system to achieve highly interactive honeynet deployment.

[0014] Thirdly, the present invention also provides a computer terminal device, comprising: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction in the first aspect above.

[0015] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction described in the first aspect above.

[0016] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction described in the first aspect above.

[0017] Compared with the prior art, the present invention has the following advantages and technical effects: This invention provides a highly interactive honeypot method for industrial control networks based on finite state machines and time-series prediction. The invention accurately models the communication behavior between industrial control devices using a finite state machine model, abstracting network interactions into executable state sequences, and can automatically simulate the periodic protocol interactions of programmable logic controller (PLC) devices. A state extraction method based on common subsequences effectively captures irregular interaction patterns, making the honeypot's communication behavior highly consistent with real industrial control networks, significantly improving the realism and deception capability of the honeypot's interactions. In terms of sensor data simulation, this invention utilizes a Transformer model for long-term time-series prediction, combined with dynamic equilibrium constraint processing. The generated simulation data not only maintains historical statistical characteristics but also conforms to the dynamic laws of physical processes. Through a trend-aware loss function and a global trend correction mechanism, the predicted data maintains a reasonable fluctuation range and trend in the long-term sequence, effectively enhancing the realism and continuity of the honeypot data. In terms of overall system performance, this invention synergistically enhances the realism of the honeypot from two dimensions: protocol interaction simulation and data simulation. Time synchronization ensures the consistency between state transitions and data predictions, constructing a highly realistic industrial control honeypot environment. Finite state machine-driven protocol interaction provides realism at the communication behavior level, while the process data generated by Transformer provides realism at the physical level. The combination of the two forms a multi-layered defense system, enabling the honeynet system to more effectively capture attack behaviors and collect attack information. Attached Figure Description

[0018] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart of the finite state machine flow generation method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the state transition of the finite state machine of the PLC device according to an embodiment of the present invention; Figure 3 This is a state transition diagram of a finite state machine for a human-machine interface (HMI) according to an embodiment of the present invention; Figure 4 This is a comparison chart of the time-series prediction results and the probability density of the actual data in an embodiment of the present invention. Detailed Implementation

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0021] Example 1 like Figure 1 As shown, this embodiment provides a high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction, including: Collect and preprocess industrial control network traffic data to extract protocol sessions and generate session identifiers; A finite state machine model is constructed to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; Extract time-series data from the sensors and construct a time series. Using the Transformer model to perform time series forecasting and generate dynamic process data; Dynamic equilibrium constraints are applied to process the predicted data to ensure that the data conforms to physical laws; By integrating finite state machine models and predictive data into the honeynet system, highly interactive honeynet deployment can be achieved.

[0022] Specifically, it includes: S1. Industrial Control Network Traffic Data Acquisition and Preprocessing: S1.1 Network traffic data acquisition: Raw PCAP traffic data is collected from the SWaT industrial control network, and ENIP / TCP protocol communication traffic is extracted. Assume the collected data packet sequence is as follows: ; in Indicates the first Data packets, This represents the total number of data packets.

[0023] S1.2 Protocol Session Parsing: For each data packet Extract the ENIP session handle and sequence number: ; ; in The ENIP session handle is a unique 32-bit identifier assigned by the controller when a session is established, used to multiplex multiple logical sessions over a TCP connection. This is a Python standard library function that parses a byte buffer into Python values ​​according to a specified byte order format. The sequence number is a 16-bit counter used to match requests and responses, ensuring the reliability and order of communication. This is the command field in the ENIP protocol frame, and the payload is ENIP layer data.

[0024] S1.3, Session Key-Value Generation: Generate a unique session identifier for each request packet: ; Establish a session dictionary mapping: ;in, For ENIP session handle, For serial number, The source IP address The source TCP port number. For the target IP address, The target TCP port number.

[0025] As one implementation method in this embodiment, the process of collecting and preprocessing industrial control network traffic data includes: Collect raw PCAP traffic data from the industrial control network and extract ENIP / TCP protocol communication traffic; Parse the ENIP session handle and sequence number of each data packet, where the session handle is extracted from the fourth to eighth bytes of the data packet payload, and the sequence number is extracted from different positions according to the command type; Generate a unique session identifier key for each request packet, including session handle, sequence number, source IP address, source port, destination IP address, and destination port, and establish a session dictionary mapping key to the tag, request packet count, request source IP, and request destination IP.

[0026] Specifically, it includes: like Figure 2 As shown, the process of constructing the S2 finite state machine model includes: S2.1 Definition of state tuple: Define the states of a finite state machine as a six-tuple: ; in: It serves as a unique identifier for the status; A set of sensor tags; A set of IP addresses; The timestamp indicating the start of the state; For sensor readings; S2.2, State transition triggering condition: The state transition is triggered by a change in the sensor tag. Define the state transition function: ; when When the current state is reached, record the current state and initialize the new state. Currently active status. This refers to the information about the upcoming new state, which is parsed from the newly arrived data packet (response packet).

[0027] S2.3, Calculation of Time Attributes: Calculate the state time interval: ; in For the first The start time of each state. It reflects the characteristics of the communication cycle.

[0028] S2.4, Common Subsequence State Extraction: Extracting state patterns based on the longest common subsequence algorithm: ; in For state sequences, recurring state patterns are identified using LCS.

[0029] As one implementation method in this embodiment, the process of constructing a finite state machine model includes: Define a state tuple, including state identifier, sensor tag, source IP address, destination IP address, start timestamp, and sensor reading; Set the state transition trigger condition. When the sensor tag of the current state is different from that of the new state, the state transition is triggered, the current state is recorded, and the new state is initialized. The state time interval is calculated as the difference between the state start times, reflecting the communication cycle characteristics. The longest common subsequence algorithm is used to extract state patterns and identify repetitive patterns in state sequences.

[0030] As one implementation method in this embodiment, the process of extracting sensor time-series data and constructing a time series includes: Parse the sensor values ​​from the response packet. For discrete tags, extract two bytes of data from the value offset position of the data packet payload and unpack them into an integer. For continuous tags, extract four bytes of data and unpack them into a floating-point number. Using a one-minute sampling interval, a time series is constructed, including a sequence of timestamps and sensor readings, forming a historical data basis for prediction.

[0031] Specifically, it includes: S3. Sensor time series data extraction: S3.1 Sensor numerical analysis: Extract sensor readings from the response packet: For discrete labels : ; For consecutive labels: ; in For a predefined set of discrete labels, The type and unit of the obtained sensor readings depend on the sensor tag. This is a Python standard library function that parses a byte buffer (buffer) into Python values ​​according to a specified byte order format (format). For the data portion of the CIP protocol response message, This is the starting byte offset of the sensor value.

[0032] S3.2 Time Series Construction: The sensor time series was constructed with a sampling interval of 1 minute: ; in For timestamps, For sensor readings, This represents the number of sampling points.

[0033] As one implementation method in this embodiment, the process of using the Transformer model to perform time series prediction includes: Convert the time series data into a model input format, including the input series length and the prediction length; Attention weights are computed using a multi-head self-attention mechanism, where the query, key, and value matrices are generated from the input sequence using learnable parameters. The model is trained using a trend-aware loss function, which is a combination of mean absolute error, trend consistency loss, and smoothing loss.

[0034] Specifically, it includes: S4, Transformer time series prediction model; S4.1 Model input encoding; Convert the time series data into the model input format. Given the length of the input sequence, For predicted length: ; ; S4.2, Multi-head self-attention mechanism: Define the query, key, and value matrix: ; in For learnable parameters, This represents the encoder input sequence, which is a continuous segment extracted from the original sensor time series and then normalized.

[0035] Attention weight calculation: ; Output representation: ; in It is a value matrix; S4.3 Trend-aware loss function: Define the composite loss function: ; in: Mean absolute error; This represents a loss due to trend consistency. To smooth out the loss; These are hyperparameters, set to 0.15 and 0.1 respectively; As one implementation method in this embodiment, the process of applying dynamic equilibrium constraints to process the prediction data includes: Dynamic constraint boundaries are constructed based on historical data quantiles, including basic minimum and basic maximum values; Dynamic constraints are applied to the predicted values. When the predicted values ​​are lower than the physical minimum or higher than the dynamic maximum, the constraint strength coefficient is used for adjustment. Apply global trend correction, using correction factors to adjust for the deviation between the predicted data and the actual data trend.

[0036] Specifically, it includes: S5. Dynamic equilibrium constraint handling: S5.1 Statistical characteristic constraints: Constructing dynamic constraint boundaries based on historical data statistics: ; in This is a vector of historical sensor readings. For quantiles, To calculate the α percentile of vector v.

[0037] Basic constraint boundaries: ; ; in, This is the lower physical limit of the sensor; for example, the liquid level cannot be negative.

[0038] S5.2 Application of Dynamic Constraints: For the predicted value Application constraints: For each : ; in The constraint strength coefficient is dynamically adjusted with each prediction round.

[0039] S5.3 Trend Correction: Apply global trend correction: ; in: For real data trend vectors, To predict the trend vector of the data, As a correction factor; like Figure 3 As shown, the process of integrating and deploying the S6 and honeynet systems includes: S6.1, State Machine Driven Protocol Interaction: Deploy a finite state machine model in a honeypot to simulate PLC device communication: ; in: For a set of states, For input alphabet (protocol instructions). This is the state transition function. This is the initial state. For accepting the set of states; S6.2, Predictive Data Injection: Inject the predicted data generated by the Transformer into the honeypot response: ; in For a moment Predicted sensor readings, This refers to the data payload of a complete response message conforming to the CIP / ENIP industrial protocol format that a honeypot needs to send over the network when responding to an attacker's read request. This is the encoding function, which encapsulates the floating-point number or integer value into a byte string according to the CIP protocol format, based on the sensor tag type.

[0040] S6.3, Construction of Highly Interactive Honeynets: By leveraging the synergy of state machine models and predictive data, a complete honeynet system can be constructed: ; Each honey pot Includes: Protocol interaction module: Data simulation module: ; Time synchronization module: Ensures consistency between state transitions and data predictions in terms of timing; S7. Parameter Configuration and Optimization: S7.1 Model Hyperparameter Settings: Key parameters of the Transformer model: (Model dimension); (Attention count); (Number of encoder layers); (Feedforward network dimension); Learning rate ; Weight decay ; S7.2 Training optimization strategy: Using the AdamW optimizer: ; in and For the estimation of the first and second moments after bias correction, Let be the values ​​of the model parameters at the t-th iteration. The learning rate is set to 0.001. is the numerical stability constant.

[0041] It combines an early stopping mechanism (patience=10) and learning rate scheduling (ReduceLROnPlateau).

[0042] This invention uses finite state machines to accurately model the communication behavior of industrial control networks and combines it with Transformer long-period time series prediction to generate realistic simulation data. The two work together to significantly improve the interactivity and deceptiveness of the honeynet system, making it difficult for attackers to distinguish between the simulation environment and the real industrial control system.

[0043] The method proposed in this invention was experimentally verified, and the process included: To verify the effectiveness of the proposed method, industrial control flow and sensor data were both derived from the SWAT dataset. Existing flow was analyzed using a finite state machine to identify polling patterns and generate new flow. The new flow data was then compared with the original flow data to verify the reliability of the state machine. Specific indicators are shown in Table 1. For the numerical prediction part, a transformer was used for long-term prediction of the physical process. The training data used were real sensor data from the previous 3.5 days of the SWAT dataset to predict data for the next month. The differences in standard deviations of the four sensors were 0.27, 0.17, 1.80, and 2.14, respectively; the differences in means were 0.02, 0.04, 3.77, and 4.06, respectively. This indicates that the honeypot scheme using the Transformer model can guarantee long-term online operation, and the probability density is as follows: Figure 4 The four figures shown are FIT101, FIT201, FIT301, and FIT401. The blue bars represent the training data, and the orange lines represent the prediction data. The training mean, training standard deviation, prediction mean, and prediction standard deviation are marked above each small figure.

[0044] Table 1 Based on this, the present invention provides a high-interaction honeycomb method for industrial control networks based on finite state machines and timing prediction. Compared with the prior art, the beneficial effects of the present invention are as follows: (1) In addressing the issue of insufficient realism in honeypot interactions, traditional honeypots often employ static response modes or simple polling mechanisms, which struggle to simulate the complex state transitions and protocol interaction patterns in real industrial control networks. This results in limited interaction levels that are easily identified by attackers. This invention uses a finite state machine model to accurately model the communication behavior between industrial control devices, abstracting network interactions into executable state sequences, which can automatically simulate the periodic protocol interactions of PLC devices. The state extraction method based on common subsequences effectively captures irregular interaction patterns, making the communication behavior of the honeypot highly consistent with that of real industrial control networks, significantly improving the realism and deception capability of the honeypot's interactions.

[0045] (2) In addressing the challenges of sensor data simulation, existing honeypots mostly provide sensor readings using fixed values ​​or simple random generation, lacking consistency with the dynamic evolution of physical processes and making it difficult to deceive advanced attackers who attempt data snooping. This invention utilizes the Transformer model for long-term time series prediction, combined with dynamic equilibrium constraint processing. The generated simulation data not only maintains historical statistical characteristics but also conforms to the dynamic laws of physical processes. Through a trend-aware loss function and a global trend correction mechanism, it ensures that the predicted data maintains a reasonable fluctuation range and trend in the long-term sequence, effectively enhancing the authenticity and continuity of honeypot data.

[0046] (3) Regarding the overall performance improvement of the honeypot system, this invention enhances the realism of the honeypot from two dimensions: protocol interaction simulation and data simulation. It also ensures the consistency between state transitions and data predictions through time attribute synchronization, thus constructing a highly simulated industrial control honeypot environment. The protocol interaction driven by the finite state machine provides realism at the communication behavior level, while the process data generated by the Transformer provides realism at the physical level. The combination of the two forms a multi-layered defense system, enabling the honeypot system to more effectively capture attack behaviors and collect attack information, providing a reliable technical means for the network security protection of industrial control systems.

[0047] Example 2 In this embodiment, a computer terminal device is provided, including: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the steps of the above-described high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction.

[0048] In this embodiment, a computer-readable storage medium is also provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the above-described high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction.

[0049] In this embodiment, an electronic device is also provided, including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the above-described high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction.

[0050] In this embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the above-described high-interaction honeynet method for industrial control networks based on finite state machines and timing prediction.

[0051] The aforementioned program can run on a processor or be stored in memory (or a computer-readable medium). Computer-readable media includes both permanent and non-permanent, removable and non-removable media, and information storage can be achieved by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0052] These computer programs may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes can be implemented by different modules for different steps.

[0053] This embodiment provides such a device or system. The system, referred to as a high-interaction honeycomb system for industrial control networks based on finite state machines and timing prediction, includes: The data acquisition and preprocessing module is used to collect industrial control network traffic data and preprocess it to extract protocol sessions and generate session identifiers; The state machine modeling module is used to build finite state machine models to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; The time-series data construction module is used to extract sensor time-series data and construct time series data. The time series forecasting module is used to perform time series forecasting using the Transformer model and generate dynamic process data. The constraint processing module is used to apply dynamic equilibrium constraints to process the predicted data, ensuring that the data conforms to physical laws. The honeynet integration module is used to integrate finite state machine models and prediction data into the honeynet system to achieve highly interactive honeynet deployment.

[0054] As one implementation method in this embodiment, the data acquisition preprocessing module includes: The traffic acquisition unit is used to collect raw PCAP traffic data from the industrial control network and extract ENIP / TCP protocol communication traffic. The session resolution unit is used to parse the ENIP session handle and sequence number of each data packet. The session handle is extracted from the fourth to eighth bytes of the data packet payload, and the sequence number is extracted from different positions according to the command type. The session identifier generation unit is used to generate a unique session identifier key value for each request packet, including session handle, sequence number, source IP address, source port, destination IP address, and destination port, and to establish a session dictionary mapping key value to tag, request packet count, request source IP, and request destination IP.

[0055] As one implementation method in this embodiment, the state machine modeling module includes: The state definition unit is used to define the state tuple, including the state identifier, sensor tag, source IP address, destination IP address, start timestamp, and sensor reading; The state transition unit is used to set the state transition trigger conditions. When the sensor tag of the current state is different from that of the new state, the state transition is triggered, the current state is recorded, and the new state is initialized. The time calculation unit is used to calculate the state time interval, which is the difference between the state start times and reflects the communication cycle characteristics. The pattern extraction unit is used to extract state patterns based on the longest common subsequence algorithm and identify repeating patterns in the state sequence.

[0056] As one implementation method in this embodiment, the time-series data construction module includes: The data parsing unit is used to parse sensor values ​​from the response packet. For discrete tags, it extracts two bytes of data from the value offset position of the data packet payload and unpacks it into an integer. For continuous tags, it extracts four bytes of data and unpacks it into a floating-point number. The sequence construction unit is used to construct time series, including timestamp and sensor reading pairs, with a sampling interval of one minute, forming a historical data basis for prediction.

[0057] As one implementation method in this embodiment, the time series prediction module includes: The input encoding unit is used to convert the time series into the model input format, including the input series length and the prediction length; The attention computation unit is used to compute attention weights using a multi-head self-attention mechanism, where the query, key, and value matrix is ​​generated from the input sequence through learnable parameters. The loss training unit is used to train the model using a trend-aware loss function, which includes a combination of mean absolute error, trend consistency loss, and smoothing loss.

[0058] As one implementation method in this embodiment, the constraint processing module includes: Constraint building units are used to construct dynamic constraint boundaries based on historical data quantiles, including basic minimum and basic maximum values; The constraint application unit is used to apply dynamic constraints to the predicted value. When the predicted value is lower than the physical minimum or higher than the dynamic maximum, the constraint strength coefficient is used for adjustment. The trend correction unit is used to apply global trend correction, using correction factors to adjust the deviation between the predicted data and the actual data trend.

[0059] The system or apparatus is used to implement the functions of the methods in the above embodiments. Each module in the system or apparatus corresponds to each step in the method, as has been described in the method and will not be repeated here.

[0060] The above implementation method solves the problem of highly interactive honeynets in industrial control networks based on finite state machines and timing prediction in related technologies, thereby ensuring that the problems existing in the prior art are resolved.

[0061] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A high-interaction honeynet method for industrial control networks based on finite state machines and time-series prediction, characterized in that, Includes the following steps: Collect and preprocess industrial control network traffic data to extract protocol sessions and generate session identifiers; A finite state machine model is constructed to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; Extract time-series data from the sensors and construct a time series. The process of extracting sensor time-series data includes: Sensor numerical analysis: Extract sensor readings from the response packet: For discrete labels : ； For consecutive labels: ； in For a predefined set of discrete labels, The type and unit of the obtained sensor readings depend on the sensor tag. This is a Python standard library function that parses a byte buffer (buffer) into Python values ​​according to a specified byte order format (format). For the data portion of the CIP protocol response message, This is the starting byte offset of the sensor value; Using the Transformer model to perform time series forecasting and generate dynamic process data; Dynamic equilibrium constraints are applied to process the predicted data to ensure that the data conforms to physical laws; The process of applying dynamic equilibrium constraints to process forecast data includes: Dynamic constraint boundaries are constructed based on historical data quantiles, including basic minimum and basic maximum values; Dynamic constraints are applied to the predicted values. When the predicted values ​​are lower than the physical minimum or higher than the dynamic maximum, the constraint strength coefficient is used for adjustment. Apply global trend correction and use correction factors to adjust the deviation between the predicted data and the actual data trend; By integrating finite state machine models and predictive data into the honeynet system, highly interactive honeynet deployment can be achieved.

2. The method according to claim 1, characterized in that, The process of collecting and preprocessing industrial control network traffic data includes: Collect raw PCAP traffic data from the industrial control network and extract ENIP / TCP protocol communication traffic; Parse the ENIP session handle and sequence number of each data packet, where the session handle is extracted from the fourth to eighth bytes of the data packet payload, and the sequence number is extracted from different positions according to the command type; Generate a unique session identifier key for each request packet, including session handle, sequence number, source IP address, source port, destination IP address, and destination port, and establish a session dictionary mapping key to the tag, request packet count, request source IP, and request destination IP.

3. The method according to claim 1, characterized in that, The process of constructing a finite state machine model includes: Define a state tuple, including state identifier, sensor tag, source IP address, destination IP address, start timestamp, and sensor reading; Set the state transition trigger condition. When the sensor tag of the current state is different from that of the new state, the state transition is triggered, the current state is recorded, and the new state is initialized. The state time interval is calculated as the difference between the state start times, reflecting the communication cycle characteristics. The longest common subsequence algorithm is used to extract state patterns and identify repetitive patterns in state sequences.

4. The method according to claim 1, characterized in that, The process of extracting sensor time-series data and constructing a time series includes: Parse the sensor values ​​from the response packet. For discrete tags, extract two bytes of data from the value offset position of the data packet payload and unpack them into an integer. For continuous tags, extract four bytes of data and unpack them into a floating-point number. Using a one-minute sampling interval, a time series is constructed, including a sequence of timestamps and sensor readings, forming a historical data basis for prediction.

5. The method according to claim 1, characterized in that, The process of using the Transformer model to perform time series forecasting includes: Convert the time series data into a model input format, including the input series length and the prediction length; Attention weights are computed using a multi-head self-attention mechanism, where the query, key, and value matrices are generated from the input sequence using learnable parameters. The model is trained using a trend-aware loss function, which is a combination of mean absolute error, trend consistency loss, and smoothing loss.

6. A high-interaction honeycomb system for industrial control networks based on finite state machines and timing prediction, characterized in that, The system for implementing the method of any one of claims 1-5 comprises: The data acquisition and preprocessing module is used to collect industrial control network traffic data and preprocess it to extract protocol sessions and generate session identifiers; The state machine modeling module is used to build finite state machine models to simulate the communication behavior of industrial control equipment, where state transitions are triggered by changes in sensor tags; The time-series data construction module is used to extract sensor time-series data and construct time series data. The time series forecasting module is used to perform time series forecasting using the Transformer model and generate dynamic process data. The constraint processing module is used to apply dynamic equilibrium constraints to process the predicted data. The honeynet integration module is used to integrate finite state machine models and prediction data into the honeynet system to achieve highly interactive honeynet deployment.

7. A computer terminal device, characterized in that, include: One or more processors; A memory, coupled to the processor, for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors perform the steps of the method as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5.

Images