Communication behavior baseline library construction method for industrial control network anomaly detection

Abstract

The application relates to the technical field of communication security, in particular to a communication behavior baseline library construction method for industrial control network anomaly detection, which comprises the following steps: collecting communication data in an industrial control network, preprocessing to obtain multi-dimensional baseline features and constructing an initial baseline library, placing the initial baseline library in a test environment for optimization to form a communication behavior baseline library; obtaining the matching accuracy of the communication behavior baseline library, judging whether the verification accuracy of the communication behavior baseline library meets the requirements; if the requirements are not met, determining whether the redundancy data filtering intensity coefficient of the communication data needs to be increased; if the redundancy data filtering intensity coefficient is not increased, obtaining the redundancy data proportion of the communication data in a unit time to determine whether the communication data collection reliability meets the requirements; if the requirements are not met, determining whether the multi-dimensional baseline feature forced check trigger threshold needs to be increased; if the multi-dimensional baseline feature forced check trigger threshold does not need to be increased, determining the timestamp time sequence deviation tolerance threshold based on the valid timestamp proportion of the communication data in a unit time. The application improves the verification accuracy of the communication behavior baseline library.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a method for constructing a communication behavior baseline library for anomaly detection in industrial control networks. Background Technology

[0002] In existing technologies, industrial control networks serve as the core hub of industrial production, and their communication security directly determines production stability. However, the characteristics of low-frequency burst communication and dense electromagnetic interference pose significant challenges to anomaly detection. Current baseline database construction methods mostly employ static feature comparison models, which suffer from high anomaly identification delays and baseline accuracy often exceeding safety response thresholds. Training data is easily contaminated by atypical operating conditions such as debugging, leading to model inaccuracies due to invalid data. Furthermore, the lack of anti-interference design allows timing disturbances caused by electromagnetic noise to easily generate invalid matches. These problems result in insufficient verification accuracy of communication behavior baseline databases.

[0003] Chinese Patent Publication No. CN116232752A discloses a method, apparatus, system, and medium for anomaly detection in industrial networks. The method includes: extracting the contents of multiple fields from multiple packets in the industrial network according to an industrial network protocol, wherein the multiple packets are generated based on data collected from sensors; generating multiple feature values ​​corresponding to the multiple packets based on the extracted contents of the multiple fields, wherein the contents include at least an industrial protocol identifier and an industrial message type; converting a time series representing the multiple feature values ​​and multiple time points corresponding to the multiple feature values ​​into a bitmap image; and detecting anomalies in the industrial network based on the bitmap image. It is evident that the method, apparatus, system, and medium for anomaly detection in industrial networks suffer from problems such as low and unadjustable feature matching efficiency, leading to feature loss and computational delays. Furthermore, the lack of a matching efficiency adjustment parameter makes it unable to meet the real-time requirements of anomaly identification in industrial control networks. When faced with electromagnetic interference from devices such as frequency converters, it easily identifies normal timing disturbances as anomalies, resulting in a high invalid matching rate and affecting the accuracy of the communication behavior baseline verification. Summary of the Invention

[0004] To address these issues, this invention provides a method for constructing a communication behavior baseline library for anomaly detection in industrial control networks. This method overcomes the problems in existing technologies, such as low and unadjustable feature matching efficiency leading to feature loss and computational delay, lack of matching efficiency adjustment parameters, inability to meet the real-time requirements of anomaly identification in industrial control networks, and the tendency to misidentify normal timing disturbances as anomalies when faced with electromagnetic interference from devices such as frequency converters, resulting in a high invalid matching rate and insufficient verification accuracy of the communication behavior baseline library.

[0005] This invention provides a method for constructing a communication behavior baseline library for anomaly detection in industrial control networks, comprising:

[0006] The communication data in the industrial control network is collected, and the communication data is sequentially filtered, cleaned and feature extracted to obtain multi-dimensional baseline features. An initial baseline library is constructed based on the multi-dimensional baseline features.

[0007] The initial baseline library is placed in a test environment for testing and verification to obtain a communication behavior baseline library, and abnormal behaviors in the industrial control network are detected based on the communication behavior baseline library to obtain detection results;

[0008] Obtain the matching accuracy of the communication behavior baseline library, and determine whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the communication behavior baseline library;

[0009] If the verification accuracy of the communication behavior baseline library does not meet the requirements, then it is determined whether the redundancy data filtering strength coefficient of the communication data needs to be increased.

[0010] If it is not necessary to increase the redundancy filtering strength coefficient of communication data, then obtain the proportion of redundant data in communication data per unit time to determine whether the reliability of communication data collection meets the requirements.

[0011] If the reliability of the collected communication data does not meet the requirements, then determine whether it is necessary to increase the multi-dimensional baseline feature forced verification trigger threshold.

[0012] If it is not necessary to increase the multi-dimensional baseline feature forced verification trigger threshold, then the timestamp timing deviation tolerance threshold is determined based on the proportion of valid timestamps of communication data within a unit of time.

[0013] Furthermore, the initial baseline library is placed in a test environment for testing and verification to obtain a communication behavior baseline library, including:

[0014] The newly acquired communication data is used as test data in the test environment, and the initial baseline library is placed in the test environment;

[0015] The test data is matched with the baselines of the initial baseline library to obtain the matching results;

[0016] If a false alarm occurs based on the matching result, the newly collected communication data is determined to be abnormal data.

[0017] If no false alarms are detected in the matching results, the newly collected communication data is determined to be a qualified match with the baseline, and a communication behavior baseline library is obtained.

[0018] Further, determining whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the baseline library includes:

[0019] The matching accuracy of the communication behavior baseline library is compared with the preset second accuracy.

[0020] If the matching accuracy of the communication behavior baseline library is greater than or equal to the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to meet the requirements.

[0021] If the matching accuracy of the communication behavior baseline library is less than the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to be unsatisfactory.

[0022] Further, determine whether it is necessary to increase the redundancy filtering strength coefficient of the communication data, including:

[0023] The matching accuracy of the communication behavior baseline library is compared with the preset first accuracy and the preset second accuracy, respectively.

[0024] If the matching accuracy of the communication behavior baseline library is less than or equal to the preset first accuracy, then it is determined that the redundancy data filtering strength coefficient of the communication data needs to be increased.

[0025] If the matching accuracy of the communication behavior baseline library is greater than the preset first accuracy and less than the preset second accuracy, then it is determined that there is no need to increase the redundancy data filtering strength coefficient of the communication data.

[0026] Furthermore, the increase in the redundancy filtering intensity coefficient of the communication data is determined by the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library.

[0027] Furthermore, the reliability of communication data acquisition is determined based on the proportion of redundant data within a unit of time, including:

[0028] Compare the percentage of redundant data in communication data per unit time with the preset first percentage;

[0029] If the proportion of redundant data in the communication data per unit time is less than or equal to the preset first proportion, then it is determined that the reliability of the communication data collection meets the requirements, and it is determined whether the redundancy data filtering strength coefficient of the communication data meets the requirements.

[0030] If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion, then it is determined that the reliability of the communication data collection does not meet the requirements.

[0031] Further, determine whether it is necessary to increase the multi-dimensional baseline feature mandatory verification trigger threshold, including:

[0032] The percentage of redundant data in the communication data per unit time is compared with the preset first percentage and the preset second percentage, respectively.

[0033] If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion and less than the preset second proportion, it is determined that the multi-dimensional baseline feature forced verification trigger threshold needs to be increased.

[0034] If the proportion of redundant data in the communication data per unit time is greater than or equal to the preset second proportion, then it is determined that there is no need to increase the multi-dimensional baseline feature forced verification trigger threshold.

[0035] Furthermore, the increase in the multi-dimensional baseline feature forced verification trigger threshold is determined by the difference between the proportion of redundant data in the communication data per unit time and the preset first proportion.

[0036] Furthermore, the time stamp timing deviation tolerance threshold is determined based on the proportion of valid timestamps of communication data per unit time, including:

[0037] Compare the percentage of valid timestamps of communication data within a unit of time with the preset percentage of timestamps;

[0038] If the proportion of valid timestamps of communication data within the unit time is greater than or equal to the preset timestamp proportion, then it is determined that the anti-interference of the communication data acquisition process meets the requirements, and it is determined whether the multi-dimensional baseline feature forced verification trigger threshold meets the requirements.

[0039] If the proportion of valid timestamps of communication data within a unit time period is less than the preset timestamp proportion, it is determined that the anti-interference capability of the communication data acquisition process does not meet the requirements, and the timestamp timing deviation tolerance threshold needs to be reduced.

[0040] Furthermore, the reduction in the timestamp timing deviation tolerance threshold is determined by the difference between the preset timestamp proportion and the effective timestamp proportion of the communication data within the unit time.

[0041] Compared with existing technologies, the beneficial effects of this invention are as follows: The method of this invention adjusts the redundancy filtering strength coefficient of communication data based on the matching accuracy of the communication behavior baseline library. Because interference data in industrial control networks is mistakenly included in the valid matching dataset, the proportion of normal data is diluted, resulting in a low matching accuracy. By increasing the redundancy filtering strength coefficient of communication data, interference data can be identified and filtered, reducing the proportion of invalid data entering the matching process and improving the purity of the data participating in the matching. The method also adjusts the multi-dimensional baseline feature forced verification trigger threshold based on the proportion of redundant data in the communication data per unit time. Due to problems such as the false triggering of redundant transmission mechanisms in industrial control equipment, redundant data with duplicate content is mixed in, which amplifies the impact of the redundancy during matching. The weighting of multi-dimensional baseline features is increased, and the forced verification trigger threshold for multi-dimensional baseline features is increased to strengthen the verification of core data features, identify and eliminate duplicate and redundant data, and reduce the proportion of redundant data per unit time. The tolerance threshold for timestamp timing deviation is adjusted according to the proportion of effective timestamps of communication data per unit time. Due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in industrial control sites, instantaneous interruptions in the synchronization between acquisition nodes and reference clocks, some communication data timestamps may jump or become abnormal. By reducing the tolerance threshold for timestamp timing deviation, abnormal timestamp data can be intercepted, reducing interference to the matching process and ensuring that the baseline library is built based on complete timing communication data, thereby improving the verification accuracy of the communication behavior baseline library.

[0042] Furthermore, the method of the present invention adjusts the redundancy filtering intensity coefficient of communication data by setting a preset first accuracy rate and a preset second accuracy rate. Since interference data in the industrial control network is mistakenly included in the effective matching dataset, the proportion of normal data is diluted, resulting in a low matching accuracy. By increasing the redundancy filtering intensity coefficient of communication data, interference data can be identified and filtered, reducing the proportion of invalid data entering the matching process, improving the purity of the data participating in the matching, and further improving the verification accuracy of the communication behavior baseline library.

[0043] Furthermore, the method of the present invention adjusts the trigger threshold for forced verification of multi-dimensional baseline features by setting a preset first proportion and a preset second proportion. Due to problems such as the false triggering of redundant transmission mechanisms in industrial control equipment, redundant data with duplicate content is mixed in, which will amplify the weight of local multi-dimensional baseline features during matching. By increasing the trigger threshold for forced verification of multi-dimensional baseline features, the verification of core data features can be strengthened, duplicate redundant data can be identified and eliminated, the proportion of redundant data per unit time can be reduced, and the verification accuracy of the communication behavior baseline library can be further improved.

[0044] Furthermore, the method described in this invention adjusts the tolerance threshold for timestamp timing deviation by setting a preset timestamp ratio. Due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in industrial control sites, and momentary interruptions in the synchronization between acquisition nodes and reference clocks, some communication data timestamps may exhibit abnormalities such as jumps. By reducing the tolerance threshold for timestamp timing deviation, abnormal timestamp data can be intercepted, reducing interference to the matching process and ensuring that the baseline library is constructed based on complete timing communication data, thereby further improving the verification accuracy of the communication behavior baseline library. Attached Figure Description

[0045] Figure 1 This is an overall flowchart of the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention;

[0046] Figure 2 This is a logical flowchart of the process of filtering redundant data intensity coefficients for communication data in the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0047] Figure 3 This is a flowchart illustrating the process of determining the multi-dimensional baseline feature mandatory verification trigger threshold in the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0048] Figure 4 This is a flowchart illustrating the process of determining the tolerable threshold for timestamp timing deviation in the communication behavior baseline library construction method for anomaly detection in industrial control networks, as described in this embodiment of the invention. Detailed Implementation

[0049] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0050] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0051] Please see Figure 1 As shown, it is an overall flowchart of the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0052] This invention provides a method for constructing a communication behavior baseline library for anomaly detection in industrial control networks, comprising:

[0053] Step S1: Collect communication data in the industrial control network, and sequentially filter, clean and extract features from the communication data to obtain multi-dimensional baseline features, and construct an initial baseline library based on the multi-dimensional baseline features;

[0054] Step S2: Place the initial baseline library in a test environment for testing and verification to obtain a communication behavior baseline library, and detect abnormal behaviors in the industrial control network based on the communication behavior baseline library to obtain detection results;

[0055] Step S3: Obtain the matching accuracy of the communication behavior baseline library, and determine whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the communication behavior baseline library;

[0056] Step S4: If the verification accuracy of the communication behavior baseline library does not meet the requirements, determine whether it is necessary to increase the redundancy data filtering strength coefficient of the communication data.

[0057] Step S5: If it is not necessary to increase the redundancy filtering strength coefficient of communication data, then obtain the proportion of redundant data of communication data per unit time to determine whether the reliability of communication data collection meets the requirements.

[0058] Step S6: If the reliability of the communication data acquisition does not meet the requirements, determine whether it is necessary to increase the multi-dimensional baseline feature forced verification trigger threshold.

[0059] Step S7: If it is not necessary to increase the multi-dimensional baseline feature forced verification trigger threshold, then determine the timestamp timing deviation tolerance threshold based on the proportion of valid timestamps of communication data within a unit time.

[0060] Specifically, an industrial control network is a dedicated communication network consisting of industrial equipment, communication links, industrial protocols, and control software.

[0061] Specifically, the communication data includes the source device's MAC address, the IP layer packet length, and the destination IP address.

[0062] Specifically, the process of building an initial baseline library based on multi-dimensional baseline features involves transforming multi-dimensional baseline features into a structured benchmark database for testing matching through a closed-loop process of standardized preprocessing, modular storage design, matching rule solidification, and integrity verification.

[0063] Specifically, multi-dimensional baseline features include communication topology features, communication parameter features, protocol features, and data content features.

[0064] Specifically, the initial baseline database is an initial structured benchmark database constructed based on historical normal communication data of industrial control networks after screening, cleaning, and multi-dimensional feature extraction.

[0065] Specifically, the test environment is a dedicated, independent verification environment that replicates the actual production scenario of an industrial control network and is used to verify the effectiveness of the initial baseline library.

[0066] Specifically, the communication behavior baseline library is a standardized benchmark database that adapts to the normal communication behavior patterns of industrial control networks, formed after the initial baseline library has been verified and optimized in the test environment.

[0067] Specifically, abnormal behaviors include destination device codes in communication data not being in the baseline authorization list, external illegal devices forging IP addresses to access the industrial control network, and accessing the network using unauthorized Profinet protocols.

[0068] Specifically, the detection results include normal detection, data packet length exceeding the limit, and timestamp jump.

[0069] Specifically, the matching accuracy of the communication behavior baseline library is the ratio of the amount of communication data that is correctly matched to the total amount of communication data during the process of matching communication data with multi-dimensional baseline features.

[0070] Specifically, a correct match is a determination state where the actual attributes of the communication data are consistent with the matching results based on multi-dimensional baseline feature rules.

[0071] Specifically, the redundancy filtering strength coefficient of communication data is an adjustable parameter used to quantify and control the redundancy filtering intensity. By dynamically adjusting the value, the criteria for judging redundancy are defined. The larger the coefficient, the more lenient the threshold for judging data as redundant, and the stronger the elimination intensity.

[0072] Specifically, redundant data includes TCP retransmission mechanisms, synchronization messages from dual-machine hot standby devices, and PLC control commands that are repeatedly sent due to link delays.

[0073] Specifically, the percentage of redundant data in communication data per unit time is the ratio of the amount of redundant data in the communication data of the industrial control network to the total amount of communication data per unit time.

[0074] Specifically, the multi-dimensional baseline feature mandatory verification trigger threshold is an adjustable parameter used to quantify and control the multi-dimensional baseline feature collaborative verification logic. It is the minimum critical value set to identify abnormal behavior during cross-analysis of multiple data dimensions.

[0075] Specifically, the percentage of valid timestamps in communication data per unit time is the ratio of the amount of valid timestamps in communication data to the total amount of communication data per unit time.

[0076] Specifically, a valid timestamp is timestamp data that conforms to the timing specifications of industrial control network communication and can accurately reflect the time correlation of data transmission.

[0077] Specifically, the timestamp timing deviation tolerance threshold is a critical value for determining the abnormal timing range of timestamp data, and is an adjustable parameter used to quantify and define the rationality of timestamp data timing.

[0078] In implementation, the method of this invention adjusts the redundancy filtering strength coefficient of communication data based on the matching accuracy of the communication behavior baseline library. Due to interference data in the industrial control network being mistakenly included in the valid matching dataset, the proportion of normal data is diluted, resulting in a low matching accuracy. By increasing the redundancy filtering strength coefficient of the communication data, interference data can be identified and filtered, reducing the proportion of invalid data entering the matching process and improving the purity of the data participating in the matching. The forced verification trigger threshold of multi-dimensional baseline features is adjusted based on the proportion of redundant data in the communication data per unit time. Due to problems such as the false triggering of redundant transmission mechanisms in industrial control equipment, redundant data with duplicate content is mixed in, which amplifies local multi-dimensional baselines during matching. By increasing the threshold for mandatory verification of multi-dimensional baseline features, the weight of features can be adjusted to strengthen the verification of core data features, identify and eliminate duplicate and redundant data, and reduce the proportion of redundant data per unit time. The proportion of effective timestamps of communication data per unit time can be adjusted to adjust the tolerance threshold for timestamp timing deviation. Due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in industrial control sites, instantaneous interruptions in the synchronization between acquisition nodes and reference clocks, some communication data timestamps may jump or become abnormal. By reducing the tolerance threshold for timestamp timing deviation, abnormal timestamp data can be intercepted, reducing interference to the matching process and ensuring that the baseline library is built based on complete timing communication data, thereby improving the verification accuracy of the communication behavior baseline library.

[0079] Specifically, the initial baseline library is placed in a test environment for testing and verification to obtain a communication behavior baseline library, including:

[0080] The newly acquired communication data is used as test data in the test environment, and the initial baseline library is placed in the test environment;

[0081] The test data is matched with the baselines of the initial baseline library to obtain the matching results;

[0082] If a false alarm occurs based on the matching result, the newly collected communication data is determined to be abnormal data.

[0083] If no false alarms are detected in the matching results, the newly collected communication data is determined to be a qualified match with the baseline, and a communication behavior baseline library is obtained.

[0084] Specifically, the determination of abnormal data is based on the baseline of the initial baseline library. The accuracy is verified by matching and comparing the test data with the baseline. The false alarm type and the corresponding baseline entry are recorded. The baseline library is updated for false alarm information. In scenarios such as industrial control network equipment updates and process adjustments, data is collected again and the baseline library is updated regularly.

[0085] Specifically, the baselines in the initial baseline library include communication topology baselines, communication parameter baselines, protocol feature baselines, and data content baselines.

[0086] Specifically, the matching result is a set of structured judgment information output after comparing the newly collected test data with the baseline of the initial baseline library, indicating whether the test data conforms to normal communication.

[0087] Please continue reading. Figure 2 The diagram shown is a logical flowchart of the process for filtering the redundancy data intensity coefficient of communication data in the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0088] Specifically, determining whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the baseline library includes:

[0089] The matching accuracy of the communication behavior baseline library is compared with the preset second accuracy.

[0090] If the matching accuracy of the communication behavior baseline library is greater than or equal to the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to meet the requirements.

[0091] If the matching accuracy of the communication behavior baseline library is less than the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to be unsatisfactory.

[0092] The reasons why the verification accuracy of the communication behavior baseline library may not meet the requirements could be that the reliability of the communication data collection is not up to standard, or that the redundancy filtering strength coefficient of the communication data is not up to standard. The next step is to determine which specific cause it is, which is also the process of determining whether to increase the redundancy filtering strength coefficient of the communication data.

[0093] Specifically, determining whether it is necessary to increase the redundancy filtering strength coefficient of communication data includes:

[0094] The matching accuracy of the communication behavior baseline library is compared with the preset first accuracy and the preset second accuracy, respectively.

[0095] If the matching accuracy of the communication behavior baseline library is less than or equal to the preset first accuracy, then it is determined that the redundancy data filtering strength coefficient of the communication data needs to be increased.

[0096] If the matching accuracy of the communication behavior baseline library is greater than the preset first accuracy and less than the preset second accuracy, then it is determined that there is no need to increase the redundancy data filtering strength coefficient of the communication data.

[0097] Specifically, if the matching accuracy of the communication behavior baseline library is less than or equal to a preset first accuracy rate, it indicates that the reason for the failure of the verification accuracy of the communication behavior baseline library is that the redundancy filtering strength coefficient of the communication data does not meet the requirements. Therefore, it is necessary to increase the redundancy filtering strength coefficient of the communication data. If the matching accuracy of the communication behavior baseline library is greater than the preset first accuracy rate but less than the preset second accuracy rate, it can be preliminarily determined that the reliability of the communication data collection does not meet the requirements. The next step is to determine whether the reliability of the communication data collection meets the requirements based on the proportion of redundant data in the communication data per unit time, i.e., to determine whether the failure of the verification accuracy of the communication behavior baseline library is due to the failure of the reliability of the communication data collection.

[0098] Understandably, the preset first accuracy rate is lower than the preset second accuracy rate. The three intervals divided by the preset first accuracy rate and the preset second accuracy rate correspond to three different scenarios:

[0099] The first interval is when the matching accuracy of the communication behavior baseline library is less than or equal to the preset first accuracy. The corresponding situation is: due to interference data in the industrial control network, it is mistakenly included in the effective matching dataset, diluting the proportion of normal data, resulting in a low matching accuracy. At this time, it is necessary to adjust the redundant data filtering strength coefficient of the communication data.

[0100] The second interval is when the matching accuracy of the communication behavior baseline library is greater than the preset first accuracy but less than the preset second accuracy. The corresponding situation is: due to problems such as the false triggering of the redundant transmission mechanism of industrial control equipment, redundant data with duplicate content is mixed in. During matching, the weight of local multi-dimensional baseline features will be amplified. At this time, it is necessary to further judge whether the reliability of the communication data collection meets the requirements.

[0101] If the matching accuracy of the third interval communication behavior baseline library is greater than or equal to the preset second accuracy, the corresponding situation is: the verification accuracy of the communication behavior baseline library meets the requirements, and no adjustment is required.

[0102] Understandably, in the process of constructing the communication behavior baseline library for industrial control network anomaly detection, the accuracy of the baseline library verification is characterized by preset first accuracy and preset second accuracy. The core logic is to transform the verification accuracy into a quantifiable matching accuracy range judgment. The preset first accuracy is the boundary between the need to adjust the redundant data filtering intensity coefficient and the need to judge the reliability of the data collection. The preset second accuracy is the critical point for determining whether the baseline library verification accuracy meets the standard, providing a quantitative basis for targeted optimization. The preset first accuracy and preset second accuracy can be set according to actual working conditions. The setting of the preset first accuracy and preset second accuracy aims to ensure the accuracy and practicality of the industrial control network communication behavior baseline library verification. Optionally, the preset first accuracy and preset second accuracy are determined through a limited number of experiments by evaluating the effect of different accuracy rates on industrial control network anomaly detection. The determined preset first accuracy and preset second accuracy should meet the requirement that they are neither too small nor cause excessive interference to the detection process. For example, the preset first accuracy is generally selected in the range of [88%, 92%], and the preset second accuracy is generally selected in the range of [93%, 97%].

[0103] Preferably, the first accuracy rate is 90% in the preferred embodiment, and the second accuracy rate is 95% in the preferred embodiment.

[0104] Specifically, the increase in the redundancy filtering intensity coefficient of the communication data is determined by the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library.

[0105] Specifically, when the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library is within 3%, the redundancy data filtering strength coefficient of the communication data is increased to 1.15 times the original value. When the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library exceeds 3%, the redundancy data filtering strength coefficient of the communication data increases by 0.15 for every 1% increase beyond the original value of 1.15. For example, when the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library is 4%, the current redundancy data filtering strength coefficient of the communication data is 3.0, and the increased redundancy data filtering strength coefficient of the communication data is 3.0 × 1.15 + 0.15 × 1 = 3.6.

[0106] In practice, the method of the present invention adjusts the redundancy filtering intensity coefficient of communication data by setting a preset first accuracy rate and a preset accuracy rate. Because interference data in the industrial control network is mistakenly included in the effective matching dataset, the proportion of normal data is diluted, resulting in a low matching accuracy. By increasing the redundancy filtering intensity coefficient of communication data, interference data can be identified and filtered, the proportion of invalid data entering the matching process can be reduced, the purity of the data participating in the matching process can be improved, and the verification accuracy of the communication behavior baseline library can be further improved.

[0107] Please continue reading. Figure 3 The diagram shown is a logical flowchart illustrating the process of determining the multi-dimensional baseline feature mandatory verification trigger threshold in the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0108] Specifically, the reliability of communication data acquisition is determined based on the proportion of redundant data within a unit of time, including:

[0109] Compare the percentage of redundant data in communication data per unit time with the preset first percentage;

[0110] If the proportion of redundant data in the communication data per unit time is less than or equal to the preset first proportion, then it is determined that the reliability of the communication data collection meets the requirements, and it is determined whether the redundancy data filtering strength coefficient of the communication data meets the requirements.

[0111] If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion, then it is determined that the reliability of the communication data collection does not meet the requirements.

[0112] Specifically, when the proportion of redundant data in communication data per unit time is less than or equal to the preset first invalid data proportion, it is determined that the reliability of communication data collection meets the requirements. However, if the verification accuracy of the previously determined communication behavior baseline library does not meet the requirements, it is necessary to further determine whether the redundant data filtering strength coefficient of the communication data meets the requirements.

[0113] In implementation, the redundancy filtering strength coefficient of the actual communication data is compared with the predetermined filtering strength coefficient threshold to determine whether the redundancy filtering strength coefficient of the communication data meets the requirements. If the redundancy filtering strength coefficient of the actual communication data is less than the predetermined filtering strength coefficient threshold, the redundancy filtering strength coefficient of the communication data is determined to be unacceptable. The predetermined filtering strength coefficient threshold is the average value of the redundancy filtering strength coefficients monitored in the previous three months of the historical period.

[0114] If the redundancy filtering strength coefficient of the communication data does not meet the requirements, the redundancy filtering strength coefficient of the communication data is increased; if the redundancy filtering strength coefficient of the communication data meets the requirements, the matching accuracy of the communication behavior baseline library is re-collected, and the verification accuracy of the communication behavior baseline library is re-evaluated to determine whether it meets the requirements.

[0115] When the proportion of redundant data in communication data per unit time exceeds a preset first proportion, it can be determined that the reason for the failure to meet the verification accuracy requirements of the communication behavior baseline library is that the reliability of communication data collection is not up to standard. The reasons for this may include: the multi-dimensional baseline feature mandatory verification trigger threshold not meeting requirements, or the anti-interference capability of the communication data collection process not meeting requirements. The next step is to determine which specific cause it is, which is also the process of determining whether to increase the multi-dimensional baseline feature mandatory verification trigger threshold.

[0116] Specifically, determining whether to increase the mandatory verification trigger threshold for multi-dimensional baseline features includes:

[0117] The percentage of redundant data in the communication data per unit time is compared with the preset first percentage and the preset second percentage, respectively.

[0118] If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion and less than the preset second proportion, it is determined that the multi-dimensional baseline feature forced verification trigger threshold needs to be increased.

[0119] If the proportion of redundant data in the communication data per unit time is greater than or equal to the preset second proportion, then it is determined that there is no need to increase the multi-dimensional baseline feature forced verification trigger threshold.

[0120] Specifically, when the proportion of redundant data in communication data per unit time is greater than a preset first proportion but less than a preset second proportion, the reason for the unsatisfactory reliability of communication data acquisition is determined to be that the multi-dimensional baseline feature mandatory verification trigger threshold does not meet the requirements. Therefore, it is necessary to increase the multi-dimensional baseline feature mandatory verification trigger threshold. When the proportion of redundant data in communication data per unit time is greater than the preset second proportion, it can be preliminarily determined that the anti-interference of the communication data acquisition process does not meet the requirements. Next, it is necessary to make a final determination on whether the anti-interference of the communication data acquisition process meets the requirements based on the proportion of valid timestamps of communication data per unit time, that is, to determine whether the reason for the unsatisfactory reliability of communication data acquisition is that the anti-interference of the communication data acquisition process does not meet the requirements.

[0121] It is understandable that the first preset percentage is less than the second preset percentage, and the three intervals divided by the first and second preset percentages correspond to three different scenarios:

[0122] The first interval is when the proportion of redundant data in the communication data per unit time is less than or equal to the preset first proportion. The corresponding situation is: the reliability of the communication data collection meets the requirements. At this time, it is necessary to further determine whether the redundancy data filtering strength coefficient of the communication data meets the requirements.

[0123] The second interval is where the proportion of redundant data in communication data per unit time is greater than the preset first proportion and less than the preset second proportion. The corresponding situation is: due to problems such as the false triggering of the redundant transmission mechanism of industrial control equipment, redundant data with repeated content is mixed in. During matching, the weight of local multi-dimensional baseline features will be amplified. At this time, it is necessary to adjust the multi-dimensional baseline feature forced verification trigger threshold.

[0124] The third interval is when the proportion of redundant data in the communication data per unit time is greater than or equal to the preset second proportion. The corresponding situation is: due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in the industrial control field, instantaneous interruption of the synchronization between the acquisition node and the reference clock, some communication data timestamps may jump or other abnormalities. At this time, it is necessary to further determine whether the anti-interference of the communication data acquisition process meets the requirements.

[0125] Understandably, in the process of constructing the communication behavior baseline library for industrial control network anomaly detection, the introduction of a preset first proportion and a preset second proportion to characterize the reliability of communication data collection is crucial. The core logic is to transform collection reliability into a quantifiable range of redundant data proportions. The preset first proportion serves as the boundary between the redundancy filtering strength coefficient that needs confirmation and the multi-dimensional baseline feature forced verification trigger threshold that needs adjustment. The preset second proportion serves as the critical point between the multi-dimensional baseline feature forced verification trigger threshold that needs adjustment and the anti-interference capability of the collection process that needs to be assessed, providing a quantitative basis for targeted optimization. The preset first and second proportions can be set according to actual working conditions. Their setting aims to ensure the accuracy and practicality of the industrial control network communication behavior baseline library verification. Optionally, the preset first and second proportions are determined through a limited number of experiments by evaluating the effect of different redundant data proportions on industrial control network anomaly detection. The determined preset first and second proportions should satisfy the condition that they are neither too small nor cause excessive interference to the detection process. For example, the preset first proportion is generally selected within the range of [4%, 6%], and the preset second proportion is generally selected within the range of [7%, 9%].

[0126] Preferably, the first percentage is 5% in the preferred embodiment, and the second percentage is 8% in the preferred embodiment.

[0127] Specifically, the increase in the multi-dimensional baseline feature forced verification trigger threshold is determined by the difference between the proportion of redundant data in the communication data per unit time and the preset first proportion.

[0128] Specifically, when the difference between the redundant data ratio of communication data per unit time and the preset first ratio is within 2%, the multi-dimensional baseline feature mandatory verification trigger threshold is increased to 1.05 times the original value. When the difference between the redundant data ratio of communication data per unit time and the preset first ratio exceeds 2%, in addition to increasing to 1.05 times the original value, for every 1% exceeding the original value, the multi-dimensional baseline feature mandatory verification trigger threshold is increased by 0.05. For example, when the difference between the redundant data ratio of communication data per unit time and the preset first ratio is 4%, the current multi-dimensional baseline feature mandatory verification trigger threshold is 4.0, and the increased multi-dimensional baseline feature mandatory verification trigger threshold is 4.0×1.05+0.05×2=4.3.

[0129] In practice, the method of the present invention adjusts the trigger threshold for forced verification of multi-dimensional baseline features by setting a preset first proportion and a preset second proportion. Due to problems such as the false triggering of redundant transmission mechanisms in industrial control equipment, redundant data with duplicate content is mixed in, which amplifies the weight of local multi-dimensional baseline features during matching. By increasing the trigger threshold for forced verification of multi-dimensional baseline features, the verification of core data features can be strengthened, duplicate redundant data can be identified and eliminated, the proportion of redundant data per unit time can be reduced, and the verification accuracy of the communication behavior baseline library can be further improved.

[0130] Please continue reading. Figure 4 The diagram shown is a logical flowchart illustrating the process of determining the timestamp timing deviation tolerance threshold in the communication behavior baseline library construction method for anomaly detection in industrial control networks according to an embodiment of the present invention.

[0131] Specifically, the tolerance threshold for timestamp timing deviation is determined based on the proportion of valid timestamps of communication data within a unit of time, including:

[0132] Compare the percentage of valid timestamps of communication data within a unit of time with the preset percentage of timestamps;

[0133] If the proportion of valid timestamps of communication data within the unit time is greater than or equal to the preset timestamp proportion, then it is determined that the anti-interference of the communication data acquisition process meets the requirements, and it is determined whether the multi-dimensional baseline feature forced verification trigger threshold meets the requirements.

[0134] If the proportion of valid timestamps of communication data within a unit time period is less than the preset timestamp proportion, it is determined that the anti-interference capability of the communication data acquisition process does not meet the requirements, and the timestamp timing deviation tolerance threshold needs to be reduced.

[0135] Specifically, when the proportion of valid timestamps of communication data within a unit of time is greater than the preset proportion of timestamps, it is determined that the anti-interference of the communication data acquisition process meets the requirements. However, if the reliability of the communication data acquisition has been determined to be unacceptable, it is necessary to further determine whether the multi-dimensional baseline feature forced verification trigger threshold meets the requirements.

[0136] In implementation, the multi-dimensional baseline feature mandatory verification trigger threshold is compared with the predetermined verification trigger threshold to determine whether the multi-dimensional baseline feature mandatory verification trigger threshold meets the requirements. If the actual multi-dimensional baseline feature mandatory verification trigger threshold is less than the predetermined verification trigger threshold, the multi-dimensional baseline feature mandatory verification trigger threshold is determined to not meet the requirements. The predetermined verification trigger threshold is the average value of the multi-dimensional baseline feature mandatory verification trigger threshold monitored in the previous three months of the historical period.

[0137] If the multi-dimensional baseline feature mandatory verification trigger threshold does not meet the requirements, then the multi-dimensional baseline feature mandatory verification trigger threshold is increased; if the multi-dimensional baseline feature mandatory verification trigger threshold meets the requirements, then the proportion of redundant data in the communication data per unit time is re-collected, and the reliability of the communication data collection is re-evaluated.

[0138] When the proportion of valid timestamps in communication data per unit time is less than the preset proportion of timestamps, it can be determined that the reason for the failure of communication data acquisition reliability is that the anti-interference of the communication data acquisition process is not up to standard. Therefore, it is necessary to reduce the tolerance threshold for timestamp timing deviation.

[0139] It is understandable that the two intervals divided by the preset timestamp proportions correspond to two different scenarios:

[0140] The first interval is when the proportion of valid timestamps of communication data within a unit of time is less than the preset proportion of timestamps. The corresponding situation is: due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in the industrial control field, instantaneous interruption of the synchronization between the acquisition node and the reference clock, etc., some communication data timestamps will jump and other abnormalities. At this time, it is necessary to reduce the timetamp timing deviation tolerance threshold.

[0141] The second interval is when the proportion of valid timestamps of communication data per unit time is greater than or equal to the preset timestamp proportion. This corresponds to the situation where the anti-interference of the communication data acquisition process meets the requirements. At this time, it is necessary to further determine whether the multi-dimensional baseline feature forced verification trigger threshold meets the requirements.

[0142] Understandably, in the process of constructing the communication behavior baseline library for industrial control network anomaly detection, the preset timestamp percentage is used to characterize the anti-interference capability of the communication data acquisition process. The core logic is to transform the anti-interference capability of the acquisition process into a quantifiable effective timestamp percentage judgment. The preset timestamp percentage serves as the critical threshold for distinguishing between the mandatory verification trigger threshold for multi-dimensional baseline features that need to be confirmed and the tolerance threshold for timestamp timing deviation that needs to be adjusted. It clarifies the targeted processing direction under different effective timestamp percentage scenarios, providing a quantitative judgment basis for ensuring the accuracy of the baseline library timing judgment. The preset timestamp percentage can be set according to actual working conditions. The setting of the preset timestamp percentage aims to ensure the accuracy and practicality of the industrial control network communication behavior baseline library verification. Optionally, the preset timestamp percentage is determined through a limited number of experiments by evaluating the effect of different effective timestamp percentages on industrial control network anomaly detection. The determined preset timestamp percentage should meet the requirement that it is neither too small nor causes excessive interference to the detection process. For example, the preset timestamp percentage is generally selected in the range of [90%, 95%].

[0143] Preferably, the preset timestamp percentage is 93% in the preferred embodiment.

[0144] Specifically, the reduction in the timestamp timing deviation tolerance threshold is determined by the difference between the preset timestamp ratio and the effective timestamp ratio of the communication data within the unit time.

[0145] Specifically, when the difference between the preset timestamp percentage and the effective timestamp percentage of communication data within the unit time is within 2%, the timestamp timing deviation tolerance threshold is reduced to 0.9 times the original value. When the difference between the preset timestamp percentage and the effective timestamp percentage of communication data within the unit time exceeds 2%, the timestamp timing deviation tolerance threshold is reduced by 0.05 for every 1% exceeding the original value, in addition to being reduced to 0.9 times the original value. For example, when the difference between the preset timestamp percentage and the effective timestamp percentage of communication data within the unit time is 4%, and the current timestamp timing deviation tolerance threshold is 50ms, the reduced timestamp timing deviation tolerance threshold is 50×0.9-0.05×2=44.9.

[0146] In practice, the method described in this invention adjusts the tolerance threshold for timestamp timing deviation by setting a preset timestamp ratio. Due to electromagnetic pulses generated by the start-up and shutdown of high-power equipment in industrial control sites, and momentary interruptions in the synchronization between acquisition nodes and reference clocks, some communication data timestamps may jump or become abnormal. By reducing the tolerance threshold for timestamp timing deviation, abnormal timestamp data can be intercepted, reducing interference to the matching process and ensuring that the baseline library is built based on complete timing communication data, thereby further improving the verification accuracy of the communication behavior baseline library.

[0147] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for constructing a communication behavior baseline library for anomaly detection in industrial control networks, characterized in that, include: The communication data in the industrial control network is collected, and the communication data is sequentially filtered, cleaned and feature extracted to obtain multi-dimensional baseline features. An initial baseline library is constructed based on the multi-dimensional baseline features. The initial baseline library is placed in a test environment for testing and verification to obtain a communication behavior baseline library, and abnormal behaviors in the industrial control network are detected based on the communication behavior baseline library to obtain detection results; Obtain the matching accuracy of the communication behavior baseline library, and determine whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the communication behavior baseline library; If the verification accuracy of the communication behavior baseline library does not meet the requirements, then it is determined whether the redundancy data filtering strength coefficient of the communication data needs to be increased. If it is not necessary to increase the redundancy filtering strength coefficient of communication data, then obtain the proportion of redundant data in communication data per unit time to determine whether the reliability of communication data collection meets the requirements. If the reliability of the collected communication data does not meet the requirements, then determine whether it is necessary to increase the multi-dimensional baseline feature forced verification trigger threshold. If it is not necessary to increase the multi-dimensional baseline feature forced verification trigger threshold, then the timestamp timing deviation tolerance threshold is determined based on the proportion of valid timestamps of communication data within a unit of time. Determine whether it is necessary to increase the redundancy filtering strength factor of communication data, including: The matching accuracy of the communication behavior baseline library is compared with the preset first accuracy and the preset second accuracy, respectively. If the matching accuracy of the communication behavior baseline library is less than or equal to the preset first accuracy, then it is determined that the redundancy data filtering strength coefficient of the communication data needs to be increased. If the matching accuracy of the communication behavior baseline library is greater than the preset first accuracy and less than the preset second accuracy, then it is determined that there is no need to increase the redundancy data filtering strength coefficient of the communication data. Determine whether it is necessary to increase the multi-dimensional baseline feature mandatory verification trigger threshold, including: The percentage of redundant data in the communication data per unit time is compared with the preset first percentage and the preset second percentage, respectively. If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion and less than the preset second proportion, it is determined that the multi-dimensional baseline feature forced verification trigger threshold needs to be increased. If the proportion of redundant data in the communication data per unit time is greater than or equal to the preset second proportion, then it is determined that there is no need to increase the multi-dimensional baseline feature forced verification trigger threshold. The time stamp timing deviation tolerance threshold is determined based on the proportion of valid timestamps in communication data per unit time, including: Compare the percentage of valid timestamps of communication data within a unit of time with the preset percentage of timestamps; If the proportion of valid timestamps of communication data within the unit time is greater than or equal to the preset timestamp proportion, then it is determined that the anti-interference of the communication data acquisition process meets the requirements, and it is determined whether the multi-dimensional baseline feature forced verification trigger threshold meets the requirements. If the proportion of valid timestamps of communication data within a unit time period is less than the preset timestamp proportion, it is determined that the anti-interference capability of the communication data acquisition process does not meet the requirements, and the timestamp timing deviation tolerance threshold needs to be reduced.

2. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 1, characterized in that, The initial baseline library is placed in a test environment for testing and verification to obtain a communication behavior baseline library, including: The newly acquired communication data is used as test data in the test environment, and the initial baseline library is placed in the test environment; The test data is matched with the baselines of the initial baseline library to obtain the matching results; If a false alarm occurs based on the matching result, the newly collected communication data is determined to be abnormal data. If no false alarms are detected in the matching results, the newly collected communication data is determined to be a qualified match with the baseline, and a communication behavior baseline library is obtained.

3. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 2, characterized in that, Determining whether the verification accuracy of the communication behavior baseline library meets the requirements based on the matching accuracy of the baseline library includes: The matching accuracy of the communication behavior baseline library is compared with the preset second accuracy. If the matching accuracy of the communication behavior baseline library is greater than or equal to the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to meet the requirements. If the matching accuracy of the communication behavior baseline library is less than the preset second accuracy, then the verification accuracy of the communication behavior baseline library is determined to be unsatisfactory.

4. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 3, characterized in that, The increase in the redundancy filtering intensity coefficient of the communication data is determined by the difference between the preset first accuracy rate and the matching accuracy rate of the communication behavior baseline library.

5. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 4, characterized in that, The reliability of communication data acquisition is determined based on the proportion of redundant data within a unit of time, including: Compare the percentage of redundant data in communication data per unit time with the preset first percentage; If the proportion of redundant data in the communication data per unit time is less than or equal to the preset first proportion, then it is determined that the reliability of the communication data collection meets the requirements, and it is determined whether the redundancy data filtering strength coefficient of the communication data meets the requirements. If the proportion of redundant data in the communication data per unit time is greater than the preset first proportion, then it is determined that the reliability of the communication data collection does not meet the requirements.

6. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 5, characterized in that, The increase in the multi-dimensional baseline feature forced verification trigger threshold is determined by the difference between the proportion of redundant data in the communication data per unit time and the preset first proportion.

7. The method for constructing a communication behavior baseline library for anomaly detection in industrial control networks according to claim 6, characterized in that, The reduction in the timestamp timing deviation tolerance threshold is determined by the difference between the preset timestamp percentage and the effective timestamp percentage of the communication data within the unit time.

Images