Industrial control system abnormal intrusion detection method and system based on behavior analysis

Abstract

The application relates to the technical field of industrial control system security, and discloses an industrial control system abnormal intrusion detection method and system based on behavior analysis. The method first collects multi-source data of equipment operation, network interaction and operation behavior, and carries out cleaning and standardization pretreatment. Then, in a set time window, the peak deviation degree and the change rate abnormality degree of equipment parameters are calculated, the frequency and the message size deviation degree of network communication flow are calculated, the frequency and the sequence logic abnormality degree of operation behavior are calculated, and the three behavior abnormality indexes of equipment, network and operation are formed by weighted fusion. Finally, whether abnormal intrusion exists is determined by directly comparing the indexes with the early warning threshold or calculating the cosine similarity of the characteristic vector and the standard vector formed by the indexes. The application realizes accurate quantification and fusion perception of multi-level and multi-dimensional abnormal behaviors of the industrial control system, and effectively improves the detection capability of complex attacks.

Description

Technical Field

[0001] This invention relates to the field of industrial control system security technology, and specifically to an abnormal intrusion detection method and system for industrial control systems based on behavior analysis. Background Technology

[0002] Industrial control systems are widely used in critical infrastructure sectors such as power, petroleum, chemical, and intelligent manufacturing. Their safe and stable operation is directly related to national economic security and public interests. With the development of the Industrial Internet, industrial control systems are gradually shifting from a closed, offline operating mode to an open, networked mode, which significantly increases the risk of cyberattacks and intrusions against them.

[0003] For the detection of abnormal intrusions in industrial control systems, existing detection methods typically analyze a single dimension in isolation, such as network traffic, device logs, or user operations. They lack the ability to correlate and integrate the physical operating status of the device, network communication modes, and operator (or program) control behavior from multiple dimensions, thus failing to solve the above problems. This invention provides a method and system for detecting abnormal intrusions in industrial control systems based on behavior analysis. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for detecting abnormal intrusions into industrial control systems based on behavior analysis, thereby solving the aforementioned technical problems.

[0005] A behavioral analysis-based method for detecting abnormal intrusions into industrial control systems, comprising the following steps:

[0006] Step S1: Real-time acquisition of multi-source behavioral data from the industrial control system, including: equipment operation behavior data, network interaction behavior data, and operational behavior data;

[0007] Step S2: Preprocess the behavioral data collected in step S1, the preprocessing including cleaning and standardization.

[0008] Step S3: Extract features from the preprocessed data to obtain feature indicators that characterize each behavior;

[0009] Step S4: Determine whether there is an abnormal intrusion based on the characteristic indicators representing each behavior and the warning threshold of the characteristic indicators representing each behavior.

[0010] As a further description of the technical solution of the present invention, in step S1:

[0011] Device behavior data includes various device operating parameters; network behavior data includes communication frequency and message size; operation behavior data includes the number of times various operation types occur.

[0012] As a further description of the technical solution of the present invention, the working process of step S2 includes:

[0013] Data cleaning: For missing values, fill with the mean, median, or interpolation method according to the data type; for outliers, identify and remove them using the 3σ criterion and box plot method; for duplicate data, perform deduplication directly.

[0014] After cleaning, the data is standardized: the data is converted into standardized data of a uniform magnitude using a standardization formula, which is: ,in The original data, It is the minimum value among all historical normal data under the current behavior data dimension. This represents the maximum value among all historical normal data within the current behavior data dimension. This is the standardized data.

[0015] As a further description of the technical solution of the present invention, the working process of step S3 includes:

[0016] The system has n operating parameters for each device. For the i-th device operating parameter, within the currently set time window... Within a given time window, acquire the operating parameter data of the i-th device at m consecutive sampling time points, and construct its value within the time window. The observation sequence within is Where i belongs to n, , It is the current moment;

[0017] For sequences Given m parameters, the system calculates two characteristic quantities: peak deviation. and rate of change anomaly ;

[0018] The peak deviation Calculation process:

[0019] In the set time window Within, find the maximum value of the operating parameter data of the i-th device. Calculate the operating parameters of the i-th device within the time window based on sequence A. mean within and standard deviation Then the peak deviation: ;

[0020] The rate of change anomaly Calculation process:

[0021] First, calculate the sequence. Find the rate of change of m parameters for two consecutive data points within a window, and construct their time window. The observation sequence within is ,in, j belongs to m, within the set time window Within, find the maximum rate of change of the operating parameter of the i-th device. Calculate the rate of change of the operating parameter of the i-th device within the time window based on sequence B. mean within and standard deviation Then the abnormality of the rate of change: ;

[0022] Equipment behavior abnormality indicators ,in, The weighting coefficient corresponding to the peak deviation. The weighting coefficients are the operating parameters of the i-th device.

[0023] As a further description of the technical solution of the present invention, the working process of step S3 also includes:

[0024] The system's network has x communication flows, each denoted as the y-th communication flow, where y belongs to x, and within the currently set time window... Within this context, the working status parameters for monitoring the y-th communication flow include: communication frequency and message size, and the corresponding frequency deviation index is calculated. and message size deviation ;

[0025] The frequency deviation index Calculation process:

[0026] Get the communication frequency of the y-th communication stream within the current time window T. Based on historical normal data, the communication frequency of the y-th communication stream is within a periodic range. The inner order follows the mean and standard deviation The frequency deviates from the index. ;

[0027] The message size deviation Calculation process:

[0028] Get the size of the y-th communication stream packet within the current time window T. Based on historical normal data, the message size of the y-th communication stream within the time window The inner order follows the mean and standard deviation Then the message size deviation ;

[0029] Network Behavior Anomaly Indicators ,in, The weighting coefficient corresponding to the frequency deviation index. Let y be the weight coefficient corresponding to the y-th communication flow.

[0030] As a further description of the technical solution of the present invention, the working process of step S3 also includes:

[0031] The system has the following operation types: Class, No. Class operation type is denoted as ,in, belong Based on historical normal data, the baseline of its normal behavior within period T is calculated: average frequency of occurrence. Frequency standard deviation and the set of allowed operation contexts, for the first Class operation type is denoted as Calculate its position in the current time window. Internal corresponding operation frequency anomaly and operation sequence anomaly degree ;

[0032] The operational frequency anomaly Calculation process:

[0033] Get the current time window within, operate Actual number of occurrences Then its frequency is Then the anomaly degree of operation frequency ;

[0034] The anomaly of the operation sequence Calculation process:

[0035] Define a transition matrix , , =1 indicates an operation Then allow execution to continue. , =0 indicates an operation Then proceed with execution It has never appeared or been prohibited in the normal process;

[0036] Get the current time window Inside Total occurrence This operation forms the operation sequence. According to the operation log, statistics The number of illegal transfers after this operation, i.e., during the operation Then, the number of times operations that never occurred or were prohibited in the normal process were executed. Then the anomaly degree of the operation sequence ,in, ≥2, if If less than 2, then =0;

[0037] Abnormal operational behavior indicators In the formula, The weighting coefficients corresponding to the anomaly degree of operation frequency. For the first The weight coefficient corresponding to the class operation type.

[0038] As a further description of the technical solution of the present invention, the working process of step S4 includes:

[0039] The current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators are compared with the warning thresholds of the feature indicators for each behavior. If any abnormal indicator is greater than the corresponding warning threshold, an abnormal intrusion is determined to exist. Otherwise, the current behavior feature vector is constructed by using the current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators. The warning thresholds of the feature indicators for each behavior are obtained to construct the standard behavior feature vector. The cosine similarity between the current behavior feature vector and the standard behavior feature vector is calculated. If the cosine similarity is less than the deviation threshold set by the system, it indicates that an abnormal intrusion exists.

[0040] A behavior-based industrial control system anomaly intrusion detection system is provided for implementing a behavior-based industrial control system anomaly intrusion detection method. The system includes:

[0041] The data acquisition module is used to collect equipment operation behavior data, network interaction behavior data, and operational behavior data involved in the industrial control system.

[0042] The data preprocessing module, connected to the data acquisition module, is used to clean, standardize, and extract features from the acquired behavioral data.

[0043] The anomaly detection module, connected to the data acquisition module and the data preprocessing module, is used to determine whether there is an abnormal intrusion.

[0044] The beneficial effects of this invention are:

[0045] This invention first collects multi-source data on equipment operation, network interaction, and operational behavior, and performs cleaning and standardization preprocessing. Then, within a set time window, it calculates the peak deviation and rate of change anomalies for equipment parameters, the frequency and message size deviations for network communication flows, and the frequency and sequence logic anomalies for operational behaviors. These are then weighted and fused to form three major behavioral anomaly indicators: equipment, network, and operation. Finally, by directly comparing these indicators with warning thresholds or calculating the cosine similarity between the resulting feature vector and the standard vector, it determines whether an abnormal intrusion exists. This invention achieves accurate quantification and fusion perception of multi-level and multi-dimensional abnormal behaviors in industrial control systems, effectively improving the detection capability for complex attacks. Attached Figure Description

[0046] The present invention will now be further described with reference to the accompanying drawings.

[0047] Figure 1 This is a partial flowchart of the abnormal intrusion detection method for industrial control systems based on behavior analysis provided by the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Please see Figure 1 As shown, an abnormal intrusion detection method for industrial control systems based on behavior analysis is described, and the method includes the following steps:

[0050] Step S1: Real-time acquisition of multi-source behavioral data from the industrial control system, including: equipment operation behavior data, network interaction behavior data, and operational behavior data;

[0051] Step S2: Preprocess the behavioral data collected in step S1, the preprocessing including cleaning and standardization.

[0052] Step S3: Extract features from the preprocessed data to obtain feature indicators that characterize each behavior;

[0053] Step S4: Determine whether there is an abnormal intrusion based on the characteristic indicators representing each behavior and the warning threshold of the characteristic indicators representing each behavior.

[0054] Through the above technical solution, the method of this invention first collects multi-source behavioral data in real time from three key dimensions: equipment, network, and operation. This includes equipment operating parameters (such as temperature, pressure, and rotational speed), network interaction characteristics (such as communication frequency and message size), and operational behavior records (such as the frequency and sequence of various control commands). These raw data undergo rigorous preprocessing, including outlier cleaning and data standardization based on the 3σ criterion or box plots, to eliminate noise and dimensional influences, forming a high-quality analytical foundation.

[0055] For equipment behavior, the system calculates the peak deviation and rate of change anomaly for each operating parameter within a fixed time window: peak deviation is captured by calculating the standard deviation multiple of the parameter's maximum value and its mean within the window; rate of change anomaly is identified by calculating the deviation of the maximum value in the parameter's rate of change sequence from its mean, thus identifying unstable states such as parameter mutations. Finally, by weighted fusion of the anomaly scores of all parameters, an equipment behavior anomaly index is obtained.

[0056] For network behavior, the system also calculates the "frequency deviation" and "message size deviation" for each communication flow. This involves comparing the communication frequency and average message size observed in the current window with the mean and standard deviation obtained from historical normal data statistics, calculating their standard scores, and thus quantifying the degree to which the current traffic characteristics deviate from their historical normal baseline. The network behavior anomaly index is obtained by weighted summation.

[0057] For operational behaviors, the system not only calculates the degree of deviation between the frequency of each type of operation in the current window and the historical normal frequency baseline (operation frequency anomaly), but also strictly verifies the logical compliance of the operation instruction sequence through a predefined "operation transfer matrix" and counts the proportion of illegal or abnormal operation sequences (operation sequence anomaly), thereby effectively identifying malicious or erroneous operations that violate the process flow.

[0058] In the final anomaly detection phase, the system employs a two-layer fusion strategy. The first layer uses threshold comparison: real-time calculated behavioral anomaly indicators across three dimensions—device, network, and operation—are compared with pre-set warning thresholds based on training or expert experience. If any indicator exceeds the threshold, an abnormal intrusion is directly identified, enabling rapid response. The second layer uses pattern similarity analysis as a supplement to threshold detection: when all single-dimensional indicators are within their thresholds, the system constructs a behavioral feature vector representing the overall current system state from these three anomaly indicators. Simultaneously, a standard behavioral feature vector is constructed based on the safety thresholds of each indicator under completely normal system conditions. The cosine similarity between these two vectors is calculated to assess the deviation of the current system's overall behavioral pattern from a healthy pattern. If the similarity is below a set deviation threshold, the overall system behavioral pattern is deemed abnormal. This method, by combining threshold detection with pattern recognition, ensures efficient capture of obvious anomalies while enhancing the ability to detect novel, complex, or slow attacks, providing a scientific basis and automated tools for proactive security defense of industrial control systems.

[0059] As a further description of the technical solution of the present invention, in step S1:

[0060] Device behavior data includes various device operating parameters; network behavior data includes communication frequency (number of messages per unit time) and message size (load length); operation behavior data includes the number of times various operation types occur.

[0061] As a further description of the technical solution of the present invention, the working process of step S2 includes:

[0062] Data cleaning: For missing values, fill with the mean, median, or interpolation method according to the data type; for outliers, identify and remove them using the 3σ criterion and box plot method; for duplicate data, perform deduplication directly.

[0063] After cleaning, the data is standardized: the data is converted into standardized data of a uniform magnitude using a standardization formula, which is: ,in The original data, It is the minimum value among all historical normal data under the current behavior data dimension. This represents the maximum value among all historical normal data within the current behavior data dimension. This is the standardized data.

[0064] As a further description of the technical solution of the present invention, the working process of step S3 includes:

[0065] The system has n operating parameters for each device. For the i-th device operating parameter, within the currently set time window... Within a given time window, acquire the operating parameter data of the i-th device at m consecutive sampling time points, and construct its value within the time window. The observation sequence within is Where i belongs to n, , It refers to the current moment;

[0066] For sequences Given m parameters, the system calculates two characteristic quantities: peak deviation. and rate of change anomaly ;

[0067] The peak deviation Calculation process:

[0068] In the set time window Within, find the maximum value of the operating parameter data of the i-th device. Calculate the operating parameters of the i-th device within the time window based on sequence A. mean within and standard deviation Then the peak deviation: ;

[0069] The rate of change anomaly Calculation process:

[0070] First, calculate the sequence. Find the rate of change of m parameters for two consecutive data points within a window, and construct their time window. The observation sequence within is ,in, j belongs to m, within the set time window Within, find the maximum rate of change of the operating parameter of the i-th device. Calculate the rate of change of the operating parameter of the i-th device within the time window based on sequence B. mean within and standard deviation Then the abnormality of the rate of change: ;

[0071] Equipment behavior abnormality indicators ,in, The weighting coefficient corresponding to the peak deviation. The weighting coefficients are the operating parameters of the i-th device.

[0072] Through the above technical solution, this embodiment provides the working principle of device behavior anomaly detection. First, a certain parameter is acquired in the window. The system uses a continuous sequence of observations. Anomaly quantification is performed using two independent features: peak deviation and rate of change anomaly. Peak deviation focuses on static distribution anomalies by identifying the maximum value within a window and calculating its standard deviation relative to the mean of the entire window. This value increases significantly if the device experiences abnormal spikes or peaks. Rate of change anomaly focuses on dynamic process anomalies by calculating the rate of change between adjacent sampling points in the sequence and identifying the maximum value in the rate of change sequence, calculating its standard deviation relative to the mean of the rate of change. This value increases significantly if the parameter experiences severe fluctuations or unexpected rapid changes. These two features characterize abnormal parameter behavior from two complementary dimensions: state anomaly and process anomaly. Finally, for a device with n monitoring parameters, the overall device behavior anomaly index is calculated using a weighted linear combination formula: for each parameter, peak deviation and rate of change anomaly are weighted by an adjustable coefficient. The parameters are combined, multiplied by their own importance weight, and finally summed for weighted anomaly scores. This outputs a comprehensive quantitative indicator characterizing the degree of anomaly in device operation, providing crucial information for subsequent intrusion detection.

[0073] As a further description of the technical solution of the present invention, the working process of step S3 also includes:

[0074] The system's network has x communication flows, each denoted as the y-th communication flow, where y belongs to x, and within the currently set time window... Within this context, the working status parameters for monitoring the y-th communication flow include: communication frequency (number of messages per unit time) and message size (load length), and the corresponding frequency deviation index is calculated. and message size deviation ;

[0075] The frequency deviation index Calculation process:

[0076] Get the communication frequency of the y-th communication stream within the current time window T. Based on historical normal data, the communication frequency of the y-th communication stream is within a periodic range. The inner order follows the mean and standard deviation The frequency deviates from the index. ;

[0077] The message size deviation Calculation process:

[0078] Get the size of the y-th communication stream packet within the current time window T. Based on historical normal data, the message size of the y-th communication stream within the time window The inner order follows the mean and standard deviation Then the message size deviation ;

[0079] Network Behavior Anomaly Indicators ,in, The weighting coefficient corresponding to the frequency deviation index. Let y be the weight coefficient corresponding to the y-th communication flow.

[0080] Through the above technical solution, this embodiment provides the working principle of network behavior anomaly detection. This method focuses on two core observable characteristics of communication flows: communication frequency (number of packets per unit time) and packet size (load length). For each communication flow, the system calculates two key anomaly metrics: first, frequency deviation, which involves obtaining the actual communication frequency within the current window and comparing it with the inherent frequency distribution (mean and standard deviation) of the communication flow within period T, learned from historical normal data, to calculate its standard score (Z-score), thereby quantifying whether the current traffic rate is abnormally high or low; second, packet size deviation, which uses the same statistical inference principle, comparing the currently observed average packet size with the mean and standard deviation of historical normal packet sizes and calculating a standard score to identify abnormally large or small packets that do not conform to the typical load characteristics of the communication flow. These anomalies may indicate malicious code transmission, abnormal commands, or protocol abuse. These two metrics reveal anomalous patterns in network interaction behavior from the two dimensions of communication rhythm and data carrier, respectively. Finally, for the x communication flows in the system, the overall network behavior anomaly index is calculated using a weighted fusion formula: that is, for each communication flow, its frequency deviation and message size deviation are weighted by an adjustable coefficient. The system performs a linear combination of these anomaly scores, multiplies them by the weight of the communication flow's importance in overall network monitoring, and finally sums the weighted anomaly scores of all communication flows. This mechanism allows the system to flexibly adjust the emphasis on communication frequency anomalies versus packet size anomalies based on network architecture and business logic (for example, focusing more on frequency stability for control command flows and size compliance for data upload flows), and distinguish the criticality of different data links. This generates a quantitative indicator that comprehensively reflects the intrusion risk at the network communication layer, providing key input from the network behavior dimension for cross-layer correlation analysis and final security decisions.

[0081] As a further description of the technical solution of the present invention, the working process of step S3 also includes:

[0082] The system has the following operation types: Class, number Class operation type is denoted as ,in, belong Based on historical normal data, the baseline of its normal behavior within period T is calculated: average frequency of occurrence. Frequency standard deviation and the set of allowed operation contexts (such as "pump cannot be started immediately after shutdown"), for the first Class operation type is denoted as Calculate its position in the current time window. Internal corresponding operation frequency anomaly and operation sequence anomaly degree ;

[0083] The operational frequency anomaly Calculation process:

[0084] Get the current time window within, operate Actual number of occurrences Then its frequency is Then the anomaly degree of operation frequency ;

[0085] The anomaly of the operation sequence Calculation process:

[0086] Define a transition matrix , , =1 indicates an operation Then allow execution to continue. , =0 indicates an operation Then proceed with execution It has never appeared or been prohibited in the normal process;

[0087] Get the current time window Inside Total occurrence This operation forms the operation sequence. According to the operation log, statistics The number of illegal transfers after this operation, i.e., during the operation Then, the number of times operations that never occurred or were prohibited in the normal process were executed. Then the anomaly degree of the operation sequence ,in, ≥2, if If less than 2, then =0;

[0088] Abnormal operational behavior indicators In the formula, The weighting coefficients corresponding to the anomaly degree of operation frequency. For the first The weight coefficient corresponding to the class operation type.

[0089] Through the above technical solution, this embodiment provides the working principle of anomaly detection in operational behavior. The system pre-establishes a multi-dimensional behavioral baseline for each type of operation based on historical normal data, including its average occurrence frequency within period T, frequency statistical fluctuation (standard deviation), and most importantly, the set of allowed operational contexts. This set is defined in the form of a state transition matrix, clearly specifying the legitimate successive relationships between various operations in the normal process flow. In real-time detection, for each type of operation, the system calculates two key indicators: one is the anomaly degree of operation frequency. This is achieved by statistically analyzing the actual number of occurrences of this type of operation within the current window and calculating its frequency, then comparing it with the mean and standard deviation of the historical frequency baseline for this type of operation to calculate its standard score, in order to detect significant deviations in frequency. For example, high-frequency execution of critical start / stop commands within a short period may indicate an attack attempt. Secondly, there's the more distinctive operation sequence anomaly metric. This metric analyzes the actual instruction sequence formed when such an operation occurs within a window. Based on a predefined legal transition matrix, it precisely counts the number of prohibited or never-before-seen illegal operations immediately following the previous one. The ratio of this count to the total number of occurrences of the operation (minus one) is used as the anomaly metric. This effectively captures hidden attacks that appear normal in frequency but violate process logic in sequence, such as attempting to start immediately after a machine emergency stop, or trying to modify setpoints without the necessary permissions. These two metrics, from the dimensions of quantitative and logical anomalies respectively, form a comprehensive monitoring system for the integrity of operational behavior. Finally, for all... For each type of operation, the overall abnormal behavior index is calculated using a weighted fusion formula: for each type of operation, its frequency anomaly and sequence anomaly are combined using an adjustable weighting coefficient λ, multiplied by the security criticality weight of that type of operation, and finally the weighted scores of all operation types are summed. This design allows the system to dynamically adjust the detection focus based on the nature of different operations (e.g., monitoring operations focus more on frequency, control operations focus more on sequence), and ultimately output a comprehensive index that quantitatively assesses whether there are intrusion behaviors at the operational level that violate established policies and procedures, providing crucial behavioral evidence for determining advanced persistent threats or insider threats.

[0090] As a further description of the technical solution of the present invention, the working process of step S4 includes:

[0091] The current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators are compared with the warning thresholds of the feature indicators for each behavior. If any abnormal indicator is greater than the corresponding warning threshold, an abnormal intrusion is determined to exist. Otherwise, the current behavior feature vector is constructed by using the current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators. The warning thresholds of the feature indicators for each behavior are obtained to construct the standard behavior feature vector. The cosine similarity between the current behavior feature vector and the standard behavior feature vector is calculated. If the cosine similarity is less than the deviation threshold set by the system, it indicates that an abnormal intrusion exists.

[0092] A behavior-based industrial control system anomaly intrusion detection system is provided for implementing a behavior-based industrial control system anomaly intrusion detection method. The system includes:

[0093] The data acquisition module is used to collect equipment operation behavior data, network interaction behavior data, and operational behavior data involved in the industrial control system.

[0094] The data preprocessing module, connected to the data acquisition module, is used to clean, standardize, and extract features from the acquired behavioral data.

[0095] The anomaly detection module, connected to the data acquisition module and the data preprocessing module, is used to determine whether there is an abnormal intrusion.

[0096] For ease of understanding, examples are provided for embodiments of the present invention:

[0097] The monitored system: an industrial water pumping station controlled by a PLC.

[0098] Key equipment: One main water pump motor.

[0099] Network communication: A Modbus TCP communication stream between the engineer station and the PLC.

[0100] Operational behavior: The operator issues three types of operation commands through the HMI (Human Machine Interface): "Start", "Stop", and "Adjust Speed".

[0101] Equipment behavior data: The operating current of the motor and the bearing temperature are collected through sensors.

[0102] Network behavior data: The communication frequency (number of messages / minute) and average message size (bytes) between the engineer station and the PLC are collected through network probes.

[0103] Operational behavior data: The number of times the three types of operations, "start", "stop", and "speed adjustment", occur per minute is counted from the operation log.

[0104] Set the detection time window T=10 minutes.

[0105] Example of calculating abnormal equipment behavior indicators: The current data sequence is {100, 101, 99, 102, 150, 148, 149, 101, 100, 102}, with a maximum value of 150A, a mean of 115.2A, and a standard deviation of 19.6A. Weights are set. =0.4 (focusing more on the rate of change), current corresponds to a weighting coefficient of 0.6, calculated as follows. =1.65;

[0106] Example of calculating abnormal network behavior indicators: The communication flow is from the engineer's station to the PLC. Within 10 minutes, the normal communication frequency of this flow... =20 times, =3 times; average message size =120 bytes 20 bytes, set weight =0.7 (more focus on frequency), unique communication flow, corresponding weight of 1, calculated as follows. =9.7;

[0107] Example of calculating abnormal operation behavior indicators: Operation type: Startup ( ),stop( ), speed regulation ( ).start up( After that, you can stop ( ) or speed adjustment ( );stop( After that, it can only be started. Speed ​​regulation After that, you can stop ( ) or adjust the speed again ( );

[0108] Current window: Operation sequence is { , , , , , }

[0109] Occurred 3 times in the sequence The following steps are: (legitimate), (Illegal, in the matrix) =0) (Legal). Number of illegal transfers: 1. =3.

[0110] Set weights =0.5, start ( ),stop( ), speed regulation ( The contributions were 1, 0.2, and 0.5 respectively. The abnormal contribution is 2.25. and Calculations are similar (details omitted), total operational anomaly index =2.95.

[0111] Abnormal Intrusion Detection

[0112] First layer: Single indicator threshold determination

[0113] Assumption , and The preset warning thresholds are 2.0, 5.0, and 2.0.

[0114] Conclusion: All three indicators exceeded the threshold, and the system directly determined it to be an abnormal intrusion.

[0115] In this example, the equipment malfunctions: the current exhibits an abnormal peak (150A) and violent fluctuations (abnormally high rate of change), which may indicate that the motor is overloaded or has encountered malicious control signals.

[0116] Network anomaly: A surge in communication frequency (scanning for signs of attack) and an abnormally large message size (possibly carrying malicious payload) strongly indicate an attack at the network level.

[0117] Operational anomaly: The frequency of the "start" command is too high, and there is an illegal sequence of "start" followed by "start" again, which may mean that an automated attack script is trying to repeatedly start the device to cause damage.

[0118] It should be noted that the formulas in this application are all dimensionless and numerical calculations. The system settings or preset parameters and coefficients involved in this application are all empirical values, and the selection should be made by those skilled in the art according to the actual situation.

[0119] The foregoing has provided a detailed description of one embodiment of the present invention, but this description is merely a preferred embodiment and should not be construed as limiting the scope of the invention. All equivalent variations and modifications made within the scope of the claims of this invention should still fall within the patent coverage of this invention.

Claims

1. A method for detecting abnormal intrusions into industrial control systems based on behavioral analysis, characterized in that, The method includes the following steps: Step S1: Real-time acquisition of multi-source behavioral data from the industrial control system, including: equipment operation behavior data, network interaction behavior data, and operational behavior data; Step S2: Preprocess the behavioral data collected in step S1, the preprocessing including cleaning and standardization. Step S3: Extract features from the preprocessed data to obtain feature indicators that characterize each behavior; Step S4: Determine whether there is an abnormal intrusion based on the characteristic indicators representing each behavior and the warning threshold of the characteristic indicators representing each behavior; The working process of step S3 also includes: The system has the following operation types: Class, number Class operation type is denoted as ,in, belong Based on historical normal data, the baseline of its normal behavior within period T is calculated: average frequency of occurrence. Frequency standard deviation and the set of allowed operation contexts, for the first Class operation type is denoted as Calculate its position in the current time window. Internal corresponding operation frequency anomaly and operation sequence anomaly degree ; The operational frequency anomaly Calculation process: Get the current time window within, operate Actual number of occurrences Then its frequency is Then the anomaly degree of operation frequency ; The anomaly of the operation sequence Calculation process: Define a transition matrix , , =1 indicates an operation Then allow execution to continue. , =0 indicates an operation Then proceed with execution It has never appeared or been prohibited in the normal process; Get the current time window Inside Total occurrence This operation forms the operation sequence. According to the operation log, statistics The number of illegal transfers after this operation, i.e., during the operation Then, the number of times operations that never occurred or were prohibited in the normal process were executed. Then the anomaly degree of the operation sequence ,in, ≥2, if If less than 2, then =0; Abnormal operational behavior indicators In the formula, The weighting coefficients corresponding to the anomaly degree of operation frequency. For the first Weight coefficients corresponding to class operation types; The working process of step S4 includes: The current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators are compared with the warning thresholds of the feature indicators for each behavior. If any abnormal indicator is greater than the corresponding warning threshold, an abnormal intrusion is determined to exist. Otherwise, the current behavior feature vector is constructed by using the current abnormal device behavior indicators, network behavior indicators, and operational behavior indicators. The warning thresholds of the feature indicators for each behavior are obtained to construct the standard behavior feature vector. The cosine similarity between the current behavior feature vector and the standard behavior feature vector is calculated. If the cosine similarity is less than the deviation threshold set by the system, it indicates that an abnormal intrusion exists.

2. The abnormal intrusion detection method for industrial control systems based on behavior analysis according to claim 1, characterized in that, In step S1: Device behavior data includes various device operating parameters; network behavior data includes communication frequency and message size; operation behavior data includes the number of times various operation types occur.

3. The abnormal intrusion detection method for industrial control systems based on behavior analysis according to claim 2, characterized in that, The working process of step S2 includes: Data cleaning: For missing values, fill with the mean, median, or interpolation method according to the data type; for outliers, identify and remove them using the 3σ criterion and box plot method; for duplicate data, perform deduplication directly. After cleaning, the data is standardized: the data is converted into standardized data of a uniform magnitude using a standardization formula, which is: ,in The original data, It is the minimum value among all historical normal data under the current behavior data dimension. This represents the maximum value among all historical normal data within the current behavior data dimension. This is the standardized data.

4. The abnormal intrusion detection method for industrial control systems based on behavior analysis according to claim 2, characterized in that, The working process of step S3 includes: The system has n operating parameters for each device. For the i-th device operating parameter, within the currently set time window... Within a given time window, acquire the operating parameter data of the i-th device at m consecutive sampling time points, and construct its value within the time window. The observation sequence within is Where i belongs to n, , It refers to the current moment; For sequences Given m parameters, the system calculates two characteristic quantities: peak deviation. and rate of change anomaly ; The peak deviation Calculation process: In the set time window Within, find the maximum value of the operating parameter data of the i-th device. Calculate the operating parameters of the i-th device within the time window based on sequence A. mean within and standard deviation Then the peak deviation: ; The rate of change anomaly Calculation process: First, calculate the sequence. Find the rate of change of m parameters for two consecutive data points within a window, and construct their time window. The observation sequence within is ,in, j belongs to m, within the set time window Within, find the maximum rate of change of the operating parameter of the i-th device. Calculate the rate of change of the operating parameter of the i-th device within the time window based on sequence B. mean within and standard deviation Then the abnormality of the rate of change: ; Equipment behavior abnormality indicators ,in, The weighting coefficient corresponding to the peak deviation. The weighting coefficients are the operating parameters of the i-th device.

5. The abnormal intrusion detection method for industrial control systems based on behavior analysis according to claim 2, characterized in that, The working process of step S3 also includes: The system's network has x communication flows, each denoted as the y-th communication flow, where y belongs to x, and within the currently set time window... Within this context, the working status parameters for monitoring the y-th communication flow include: communication frequency and message size, and the corresponding frequency deviation index is calculated. and message size deviation ; The frequency deviation index Calculation process: Get the communication frequency of the y-th communication stream within the current time window T. Based on historical normal data, the communication frequency of the y-th communication stream is within a periodic range. The inner order follows the mean and standard deviation The frequency deviates from the index. ; The message size deviation Calculation process: Get the size of the y-th communication stream packet within the current time window T. Based on historical normal data, the message size of the y-th communication stream within the time window The inner order follows the mean and standard deviation Then the message size deviation ; Network Behavior Anomaly Indicators ,in, The weighting coefficient corresponding to the frequency deviation index. Let y be the weight coefficient corresponding to the y-th communication flow.

6. A behavioral analysis-based industrial control system for detecting abnormal intrusions, the system being used to implement the behavioral analysis-based industrial control system for detecting abnormal intrusions according to any one of claims 1-5, characterized in that, The system includes: The data acquisition module is used to collect equipment operation behavior data, network interaction behavior data, and operational behavior data involved in the industrial control system. The data preprocessing module, connected to the data acquisition module, is used to clean, standardize, and extract features from the acquired behavioral data. The anomaly detection module, connected to the data acquisition module and the data preprocessing module, is used to determine whether there is an abnormal intrusion.

Images