Power distribution terminal abnormity pre-screening system and method based on multi-granularity instruction semantic fingerprints

Abstract

The invention relates to the technical field of power industrial control system network security, and provides a power distribution terminal abnormity pre-screening system and method based on multi-granularity instruction semantic fingerprints. The method comprises the following steps: monitoring a message in an industrial control network in real time, and extracting a type identifier, a transmission reason and a public address field; maintaining a micro context recording the state of the last remote control operation, wherein the state comprises whether a selection command is received or not; judging whether the current message conforms to a preset service rule or not according to the field and the micro context; if yes, a first semantic fingerprint representing legal operation is generated; if not, generating a second semantic fingerprint representing the abnormal operation; only the semantic fingerprints and the corresponding timestamps are packaged to form lightweight feature packets, and the lightweight feature packets are uploaded to edge computing nodes periodically or in an event triggering manner; and when the second semantic fingerprint is detected, locally recording an alarm log and limiting the uploading frequency of subsequent non-critical data.

Description

Technical Field

[0001] This invention relates to the field of network security technology for power industrial control systems, and in particular to a pre-screening system and method for anomalies in power distribution terminals based on multi-granularity instruction semantic fingerprints. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] As the scale of power distribution automation systems continues to expand, security monitoring solutions based on a cloud-edge-device collaborative architecture are gradually becoming mainstream. This architecture collects industrial control traffic by deploying security monitoring gateways on the terminal side, performs real-time analysis on the edge side, and coordinates model training and global response through a cloud platform, theoretically balancing detection efficiency and system scalability.

[0004] However, in practical applications, the operating environment of edge devices is extremely limited. Most power distribution terminals use low-power embedded hardware with limited computing and storage resources, making it difficult to support complex traffic parsing or feature extraction tasks. Currently, common practices include periodically counting basic indicators such as packet count and byte rate, or directly uploading raw traffic summaries. While these methods are simple to implement, they fail to reflect the business semantics of industrial control commands, and are particularly difficult to identify abnormal behaviors that violate protocol operation logic. For example, the IEC 60870-5-104 protocol requires the master station to first send a selection command with a transmission reason of "6," and the terminal must confirm before executing the operation with a transmission reason of "7." However, attackers often bypass the selection step and directly issue execution commands to evade auditing. Because existing security monitoring gateways typically do not parse the timing legitimacy of application layer commands, such obviously illegal operations are still uploaded as ordinary traffic, wasting valuable wireless bandwidth (e.g., 4G private network uplink bandwidth is often less than 10 Mbps) and causing the edge side to process a large amount of invalid data that could have been filtered at the edge. Furthermore, even when some solutions incorporate feature compression mechanisms, their strategies are mostly statically configured, failing to dynamically adjust the data acquisition granularity based on whether the current communication involves critical operations (such as remote control or parameter settings). As a result, redundant information is uploaded during normal telemetry phases, while insufficient criteria are available for high-risk operations, limiting overall detection efficiency. Summary of the Invention

[0005] To address the issues of limited resources, insufficient communication bandwidth, and difficulty in identifying illegal industrial control commands locally in existing power distribution automation systems, this invention provides a power distribution terminal anomaly pre-screening system and method based on multi-granularity command semantic fingerprinting. Without increasing the burden on end-side hardware, it designs a data processing mechanism that can combine power industrial control protocol business rules to achieve lightweight anomaly prediction locally, thereby improving the response speed and bandwidth utilization efficiency of the cloud-edge-end collaborative security system from the source.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting.

[0007] A distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting includes: Multiple security monitoring gateways are used to listen to packets in the industrial network and extract the type identifier, transmission reason, and common address field. If the type identifier is a control operation, different types of fingerprints are generated based on the transmission reason and common address field. If the transmission reason is a selection command, the selection command is processed based on the common address field, and a first-level valid fingerprint is generated. If the transmission reason is an execution command and the command is not selected in the common address field, or the execution command is received directly without receiving a selection command, a second-level abnormal fingerprint is generated. If the command has been selected in the common address field, a second-level valid fingerprint is generated. If a second-level abnormal fingerprint is generated twice consecutively or more cumulatively in a certain common address field, a third-level fingerprint is generated for subsequent control operations in that common address field. At least one edge computing node is used to receive different types of fingerprints uploaded by the security monitoring gateway and perform legality judgment; The cloud-based security analysis platform is used to receive abnormal data reported by edge computing nodes, train and optimize artificial intelligence detection models, and send lightweight model update packages to edge computing nodes through a differential update strategy.

[0008] Furthermore, the security monitoring gateway collects traffic non-intrusively through switch port mirroring, without blocking or deeply decrypting the original industrial control business packets, but only parsing the key control fields of the application layer.

[0009] Furthermore, the security monitoring gateway is equipped with an upload scheduling module, which is used to maintain a cache area and package and upload fingerprints in the cache area to the edge computing node according to a policy.

[0010] Furthermore, when a Level 3 fingerprint is detected or a Level 2 abnormal fingerprint is generated twice consecutively, an emergency upload is immediately triggered, the current cache is cleared, and the data is sent in real time.

[0011] Furthermore, after receiving the fingerprint, the edge computing node maps it to node attributes in the graph database and performs cross-device association analysis in conjunction with multi-terminal communication relationships to identify lateral movement-type collaborative attacks.

[0012] Furthermore, the edge computing node is equipped with a fingerprint parsing engine, which parses secondary abnormal fingerprints and tertiary fingerprints, determines their legality, and stores the parsing results in a graph database.

[0013] Furthermore, the cloud-based security analysis platform is used to receive anonymized abnormal data reported by edge computing nodes and perform cluster analysis. If it is a new attack model, a semantic encoding template is generated and distributed to the edge computing nodes and security monitoring gateway for deployment, so that the edge computing nodes and security monitoring gateway can perform subsequent anomaly identification.

[0014] Furthermore, the data structure of the first-level legitimate fingerprint includes: operation type and legitimacy flag; the data structures of the second-level legitimate fingerprint and the second-level abnormal fingerprint are the same, both including: operation type, legitimacy flag, device abbreviation obtained by mapping the lower 8 bits of the public address, object address hash value and timestamp compressed value; the data structure of the third-level fingerprint includes: operation type, legitimacy flag, device abbreviation, object address hash value, timestamp compressed value, status response code, operation duration and associated device ID list.

[0015] Furthermore, the security monitoring gateway is deployed on the field terminal side of the power distribution automation system, the edge computing node is deployed at the district / county power distribution master station, and the cloud security analysis platform is deployed at the provincial data center.

[0016] A second aspect of the present invention provides a method for pre-screening anomalies in power distribution terminals based on multi-granularity instruction semantic fingerprints.

[0017] A method for pre-screening distribution terminal anomalies based on multi-granularity command semantic fingerprints, applied to the distribution terminal anomaly pre-screening system based on multi-granularity command semantic fingerprints described in the first aspect, includes: Multiple security monitoring gateways are used to listen to packets in the industrial network and extract the type identifier, transmission reason, and common address field. If the type identifier is a control operation, different types of fingerprints are generated based on the transmission reason and common address field. If the transmission reason is a selection command, the selection command is processed based on the common address field, and a first-level valid fingerprint is generated. If the transmission reason is an execution command and the command is not selected in the common address field, or the execution command is received directly without receiving a selection command, a second-level abnormal fingerprint is generated. If the command has been selected in the common address field, a second-level valid fingerprint is generated. If a second-level abnormal fingerprint is generated twice consecutively or more cumulatively in a certain common address field, a third-level fingerprint is generated for subsequent control operations in that common address field. At least one edge computing node is used to receive different types of fingerprints uploaded by the security monitoring gateway and to perform legality judgment. The system uses a cloud-based security analysis platform to receive abnormal data reported by edge computing nodes, trains and optimizes an artificial intelligence detection model, and sends lightweight model update packages to edge computing nodes through a differential update strategy.

[0018] Compared with the prior art, the beneficial effects of the present invention are: To address the computational and storage constraints of low-power embedded hardware in power distribution terminals, the system abandons complex full-traffic parsing and extracts only key fields such as type identifier, transmission reason, and common address to generate fingerprints. This achieves a leap from basic traffic statistics to business semantic recognition at extremely low cost. Through refined fingerprint management of control operations, it can directly identify abnormal behaviors that violate operational logic, such as skipping selection commands and directly issuing execution commands in the IEC60870-5-104 protocol. This solves the core defect of traditional methods that cannot perceive the legality of protocol timing, enabling the end-side to have accurate anomaly filtering capabilities.

[0019] Leveraging the pre-screening capabilities of the edge-side security monitoring gateway, illegal operations and invalid traffic are identified and intercepted before entering network transmission, avoiding the bandwidth waste caused by uploading such data as ordinary traffic in traditional solutions. For scenarios with limited uplink bandwidth, such as 4G private networks, this significantly reduces the occupation of valuable bandwidth resources by invalid data, improves the transmission efficiency of core business data, alleviates the performance pressure on edge nodes handling massive amounts of redundant data, and optimizes the resource allocation efficiency of the entire industrial network.

[0020] This invention abandons static and rigid feature extraction strategies, dynamically adjusting the granularity of fingerprint generation based on whether critical operations are involved. In conventional scenarios such as telemetry, it simplifies data collection dimensions to reduce redundancy, while in high-risk operation scenarios such as remote control and parameter setting, it achieves rigorous monitoring through multi-level fingerprint generation. This differentiated processing mechanism ensures resource economy in normal business scenarios while providing sufficient criteria for high-risk operations, resolving the contradiction of redundancy in normal scenarios and insufficient coverage in high-risk scenarios in traditional static solutions, thus improving the overall targeting and reliability of security monitoring. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a structural diagram of a power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting, as shown in an embodiment of the present invention. Figure 2 This is a flowchart illustrating the distribution terminal anomaly pre-screening method based on multi-granularity instruction semantic fingerprinting, as shown in an embodiment of the present invention. Figure 3 This is a data structure diagram of first-level, second-level, and third-level semantic fingerprints as shown in an embodiment of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] Figure 1 This is a structural diagram of a power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprints, as shown in an embodiment of the present invention. (Refer to...) Figure 1 The system is deployed in multiple power distribution terminal sites as security monitoring gateways, set up in edge computing nodes at district and county power distribution master stations, and in a cloud security analysis platform located in the provincial data center.

[0027] The security monitoring gateway collects industrial control network traffic non-intrusively through switch port mirroring and communicates with edge computing nodes via a 4G power grid. The edge computing nodes are connected to the cloud security analysis platform through an encrypted IP channel, forming a cloud-edge-device collaborative architecture.

[0028] In this embodiment, the security monitoring gateway has a miniature state context table inside. The state context table is a hash mapping structure, with the key being the public address CA and the value being the structure {last_select_time: uint32, object_addr_hash: uint16, has_selected: bool}, which is used to record whether each master station has completed the selection step for a certain device.

[0029] In this embodiment, after the security monitoring gateway collects the industrial control network traffic, the built-in protocol parsing module performs shallow parsing on the IEC 60870-5-104 message. The protocol parsing module only extracts three fields from the Application Service Data Unit (ASDU): Type Identifier (TypeID, 1 byte), Transmission Reason (COT, 1 byte), and Common Address (CA, 2 bytes), and does not parse the business data content other than the information body address.

[0030] In this embodiment, the security monitoring gateway collects traffic non-intrusively through switch port mirroring, without blocking or deeply decrypting the original industrial control service packets, but only parsing the application layer key control fields.

[0031] In this embodiment, the security monitoring gateway is further provided with a semantic fingerprint generation module, which performs the following operations each time an ASDU is received: First, determine whether TypeID belongs to the control operation set {45, 46, 58, 103}; if not, discard the message; if yes, proceed to the validity verification process.

[0032] In this system, "45" represents single-point remote control (with time stamp), "46" represents dual-point remote control (with time stamp), "58" represents setpoint command (normalized value, with time stamp), and "103" represents parameter setting command (read / write system parameters). In power distribution automation systems: "45" / "46": directly control circuit breakers and disconnectors; unauthorized execution could lead to power outages or equipment damage; "58": adjust operating parameters; abnormal operation could cause voltage instability; "103": modify protection settings or communication configurations, a common entry point for Advanced Persistent Threats (APTs). Attackers often bypass traditional security detection by: skipping the "selection" step and directly sending "execute" commands (COT=7 without COT=6); forging legitimate TypeIDs to send malicious commands. Therefore, this invention only activates a semantic fingerprint mechanism for these high-risk TypeIDs, balancing efficiency and security.

[0033] Secondly, if the "select" command is processed (i.e., COT equals "6"), then in the state context table, with CA as the key, has_selected is updated to true, object_addr_hash is recorded as the lower 16 bits of the information body address, and last_select_time is set to the current system timestamp; then a first-level valid fingerprint is generated, with its byte order being [0x01, 0xAA].

[0034] Next, if the "execute" command is processed (i.e., COT equals "7"), the corresponding CA entry in the state context table is queried; if the entry does not exist or has_selected is false, it is determined to be an abnormal operation, and a secondary abnormal fingerprint is generated, with its byte order being [0x01, 0xFF, CA_low8, obj_hash_low16, time_hash_low24]; if has_selected is true and the current information body address hash is consistent with the record, a secondary valid fingerprint is generated, and has_selected is reset to false.

[0035] In some embodiments, the semantic fingerprint generation module is further configured with a dynamic granularity controller. The dynamic granularity controller maintains an array of exception counters, indexed as CA. Whenever an exception fingerprint is generated, the counter of the corresponding CA is incremented by 1. If the counter value is ≥2, then for the next 300 seconds, all control operations of the CA will be enabled with three-level fingerprint encoding, that is, the response status code (extracted from subsequent confirmation messages), operation duration (current time minus last_select_time), and associated device list (obtained from the pre-stored topology table for the same bus device ID) will be added to the two-level fingerprint to generate a three-level fingerprint.

[0036] In some embodiments, the security monitoring gateway is further provided with an upload scheduling module, which maintains a feature packet buffer. Under normal circumstances, all fingerprints in the buffer are packaged and uploaded every 300 seconds. However, when a level 3 fingerprint is detected or two abnormal fingerprints are detected consecutively, an emergency upload is immediately triggered, the current buffer is cleared and sent in real time.

[0037] In some embodiments, for remote control operations, a selection command with a transmission reason of "6" must be received first, followed by an execution command with a transmission reason of "7", and both must have the same common address and object address; if a message with a transmission reason of "7" is received directly without a preceding selection command, it is determined to be an abnormal operation.

[0038] In some embodiments, the edge computing node is equipped with a fingerprint parsing engine. The fingerprint parsing engine identifies the operation type based on the first byte, determines the legality based on the second byte, and parses the subsequent bytes into a device shortcode, an object address hash, and a time sequence label. The edge computing node stores each parsing result in a Neo4j graph database to construct a relationship graph with node attributes of {device_id, op_type, is_anomalous} and edge attributes of {time_window, object_hash}.

[0039] In some embodiments, the cloud-based security analysis platform periodically performs cluster analysis on anonymized anomaly samples reported from the edge. When a new attack pattern is discovered (such as a combination of "high-frequency parameter reading + low-frequency fixed value modification"), a semantic encoding template is generated. The template is in JSON format: {"trigger_type": 100, "follow_type": 103, "window_sec": 10, "target_level": 2}. The semantic encoding template is compressed using Snappy and then distributed to the edge nodes, which in turn broadcast it to each security monitoring gateway. After receiving the semantic encoding template, the security monitoring gateway loads it into the dynamic policy table of the rule engine and automatically increases the encoding granularity when matching conditions.

[0040] In one specific embodiment, the security monitoring gateway hardware platform is an NXP i.MX6UL processor (ARM Cortex-A7, 800 MHz, 256 MB DDR3) running a Linux 4.19 kernel; the maximum capacity of the state context table is 64 entries, and the memory usage does not exceed 2 KB; the average time for a single ASDU processing flow is 0.87 ms; the generated secondary fingerprint is fixed at 8 bytes, and the maximum tertiary fingerprint is 32 bytes; in a 4G wireless private network environment (uplink bandwidth 10 Mbps), the average daily total upload traffic of the 8 gateways is 69.6 MB, while the traditional solution (uploads 4.3 KB every 5 minutes) is 115.2 GB, reducing communication overhead by 99.94%.

[0041] This invention achieves efficient collaboration and iterative upgrades of security capabilities through a layered architecture of "edge-side pre-screening - edge judgment - cloud optimization". The edge gateway performs initial anomaly filtering, edge nodes focus on fingerprint legitimacy verification, and the cloud platform trains and optimizes the AI ​​model by receiving anomaly data, then distributes lightweight model packages using a differential update strategy. This avoids the resource consumption of full cloud model updates on the edge and edge sides, while ensuring that the detection model is always synchronized with the latest attack methods. This architecture enables continuous evolution of security protection capabilities, forming a closed-loop protection chain from edge to cloud, significantly improving the overall security resilience of the power distribution terminal network.

[0042] This invention maps a public address field to a multi-level fingerprint. When a public address shows a second-level anomalous fingerprint twice consecutively or more cumulatively, a third-level fingerprint can be generated to track subsequent operations, achieving precise binding between abnormal behavior and specific terminal addresses. This design not only enables timely detection of anomalies but also provides clear clues for the tracing and analysis of security incidents. It solves the problems of difficulty in locating abnormal behavior and insufficient audit evidence in traditional solutions, providing strong support for the handling and liability determination of industrial control network security incidents.

[0043] Figure 2 This is a flowchart illustrating an anomaly pre-screening method for power distribution terminals based on multi-granularity instruction semantic fingerprints, as shown in an embodiment of the present invention. When the security monitoring gateway detects a control operation with a type identifier of 45, 46, 58, or 103, it initiates... Figure 2 The flowchart of the distribution terminal anomaly pre-screening method based on multi-granularity instruction semantic fingerprinting is shown.

[0044] like Figure 2 As shown, the security monitoring gateway performs the following steps: Step S201: Receive an IEC 60870-5-104 application layer message; Step S202: Determine whether the type identifier belongs to remote control, remote adjustment, or parameter setting operation; if not, discard; if yes, proceed to the next step. Step S203: Read the transmission reason field of the message; if it is "6" (indicating "select" command), record in the internal status table that the public address has received the selection instruction and generate a first-level valid fingerprint; Step S204: If the transmission reason is "7" (indicating "execute" command), then check if there is a corresponding "selected" record in the status table; Step S205: If it does not exist, it is determined to be an illegal operation and marked as abnormal. A secondary abnormal fingerprint is generated based on the operation type, legality, and current risk level; otherwise, it is considered a legal operation and a secondary legal fingerprint is generated. Step S206: If two or more consecutive or cumulative second-level abnormal fingerprints appear in the same CA, then a third-level fingerprint is generated; Step S207: The generated Level 1 legitimate fingerprint, Level 2 legitimate fingerprint, Level 2 abnormal fingerprint, and Level 3 fingerprint are temporarily stored in the buffer, and a decision is made according to the policy whether to upload them immediately or wait for periodic reporting.

[0045] Figure 3 This is a data structure diagram of first-level, second-level, and third-level semantic fingerprints as shown in an embodiment of the present invention. (Refer to...) Figure 3 The first-level semantic fingerprint is 2 bytes long. The first byte indicates the operation type (e.g., 0x01 = remote control) and the second byte indicates the validity flag (0xAA = valid, 0xFF = abnormal). The second-level semantic fingerprint extends the first-level fingerprint by 6 bytes and includes the device abbreviation (mapped from the lower 8 bits of the public address), the object address hash value (2 bytes), and the timestamp compression value (3 bytes), for a total of 8 bytes. The third-level semantic fingerprint adds the status response code (1 byte), the operation duration (2 bytes), and the associated device ID list (≤21 bytes) to the second-level fingerprint, with a total length not exceeding 32 bytes.

[0046] In some embodiments, the security monitoring gateway internally maintains a miniature status table that records only whether each master station has completed the "selection" step for a particular device. This status table supports a maximum of 64 entries, occupies no more than 2 KB of memory, and on an ARM Cortex-A7 processor, a single query takes less than 0.1 milliseconds.

[0047] In some embodiments, the upload strategy employs a dynamic scheduling mechanism: under normal circumstances, all fingerprints in the buffer are packaged and uploaded once every 300 seconds; however, when two abnormal fingerprints are generated consecutively, or when a "key monitoring" instruction is received from an edge node, an emergency upload is immediately triggered to ensure that high-risk events are reported in real time.

[0048] In some embodiments, after receiving a semantic fingerprint, the edge computing node can identify abnormal operations without parsing the original traffic. For example, when multiple security monitoring gateways report fingerprints with "Operation Type = 0x01, Legality = 0xFF" within the same second, the edge computing node determines that a distributed illegal remote control attack exists and automatically issues isolation instructions to the relevant terminals.

[0049] In some embodiments, the cloud-based security analysis platform periodically analyzes historical anomaly samples to generate new encoding templates. For example, when it is discovered that attackers frequently read parameters and then tamper with the set values, the cloud generates a template and sends it to the edge node, which then notifies the security monitoring gateway: "From now on, secondary fingerprinting will be enabled for parameter reading operations." This achieves dynamic evolution of edge-side perception capabilities.

[0050] In a real-world deployment, the security monitoring gateway, based on the NXP i.MX6UL chip (800 MHz, 256MB memory), processes approximately 1600 control commands per day, generating about 12 KB of fingerprints per day; while traditional solutions require uploading approximately 1.2 GB of raw features per day. The system achieves a 1.2 millisecond latency and 100% detection rate for "no-selection direct execution" attacks, without increasing hardware costs.

[0051] To address the issues of limited end-side device resources, insufficient communication bandwidth, and difficulty in locally identifying illegal industrial control commands in existing power distribution automation systems, this invention introduces a lightweight anomaly pre-screening mechanism into the end-side security monitoring gateway. By parsing key fields of the IEC 60870-5-104 protocol, a structured semantic fingerprint is generated based on the business state sequence of remote control operations (such as pre-verification of selection commands). The first-level fingerprint (2 bytes) contains an operation type identifier and a legality flag; the second-level fingerprint (8 bytes) dynamically expands to include fields such as device abbreviations; and the third-level fingerprint (≤32 bytes) further includes associated device information. During abnormal operations, the legality is marked as 0xFF, triggering an emergency upload; during normal operations, fingerprints are uploaded periodically. This invention significantly reduces end-side communication overhead (daily upload volume reduced from 1.2GB to 69.6MB, saving 99.94%), improves anomaly detection timeliness (1.2 millisecond delay, 100% detection rate), and requires no hardware upgrades.

[0052] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting, characterized in that, include: Multiple security monitoring gateways are used to listen to packets in the industrial network and extract the type identifier, transmission reason, and common address field. If the type identifier is a control operation, different types of fingerprints are generated based on the transmission reason and common address field. If the transmission reason is a selection command, the selection command is processed based on the common address field, and a first-level valid fingerprint is generated. If the transmission reason is an execution command and the command is not selected in the common address field, or the execution command is received directly without receiving a selection command, a second-level abnormal fingerprint is generated. If this command has been selected in the public address field, a secondary valid fingerprint will be generated; If a public address field generates a Level 2 abnormal fingerprint twice consecutively or more cumulatively, a Level 3 fingerprint will be generated for subsequent control operations in that public address field. At least one edge computing node is used to receive different types of fingerprints uploaded by the security monitoring gateway and perform legality judgment; The cloud-based security analysis platform is used to receive abnormal data reported by edge computing nodes, train and optimize artificial intelligence detection models, and send lightweight model update packages to edge computing nodes through a differential update strategy.

2. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, The security monitoring gateway collects traffic non-intrusively through switch port mirroring, without blocking or deeply decrypting the original industrial control business packets, but only parsing the key control fields of the application layer.

3. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, The security monitoring gateway is equipped with an upload scheduling module, which is used to maintain a cache area and package the fingerprints in the cache area to upload to the edge computing node according to the policy.

4. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 3, characterized in that, However, when a Level 3 fingerprint is detected or two Level 2 abnormal fingerprints are generated consecutively, an emergency upload is immediately triggered, the current cache is cleared, and the data is sent in real time.

5. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, After receiving the fingerprint, the edge computing node maps it to node attributes in the graph database and performs cross-device association analysis in conjunction with multi-terminal communication relationships to identify lateral movement-type collaborative attacks.

6. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 5, characterized in that, The edge computing node is equipped with a fingerprint parsing engine, which parses level 2 and level 3 abnormal fingerprints, determines their legality, and stores the parsing results in the graph database.

7. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, The cloud-based security analysis platform is used to receive anonymized abnormal data reported by edge computing nodes and perform cluster analysis. If it is a new attack model, it generates a semantic encoding template and distributes it to the edge computing nodes and security monitoring gateway for deployment, so that the edge computing nodes and security monitoring gateway can perform subsequent anomaly identification.

8. The power distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, The data structure of a Level 1 legitimate fingerprint includes: operation type and legitimacy flag; the data structures of Level 2 legitimate fingerprints and Level 2 abnormal fingerprints are the same, both including: operation type, legitimacy flag, device abbreviation obtained by mapping the lower 8 bits of the public address, object address hash value, and timestamp compressed value; the data structure of a Level 3 fingerprint includes: operation type, legitimacy flag, device abbreviation, object address hash value, timestamp compressed value, status response code, operation duration, and a list of associated device IDs.

9. The distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting according to claim 1, characterized in that, The security monitoring gateway is deployed on the field terminal side of the power distribution automation system, the edge computing node is deployed at the district and county power distribution master station, and the cloud security analysis platform is deployed at the provincial data center.

10. A method for pre-screening anomalies in power distribution terminals based on multi-granularity instruction semantic fingerprints, characterized in that, The distribution terminal anomaly pre-screening system based on multi-granularity instruction semantic fingerprinting, as described in any one of claims 1-9, comprises: Multiple security monitoring gateways are used to listen to packets in the industrial network and extract the type identifier, transmission reason, and common address field. If the type identifier is a control operation, different types of fingerprints are generated based on the transmission reason and common address field. If the transmission reason is a selection command, the selection command is processed based on the common address field, and a first-level valid fingerprint is generated. If the transmission reason is an execution command and the command is not selected in the common address field, or the execution command is received directly without receiving a selection command, a second-level abnormal fingerprint is generated. If the command has been selected in the common address field, a second-level valid fingerprint is generated. If a second-level abnormal fingerprint is generated twice consecutively or more cumulatively in a certain common address field, a third-level fingerprint is generated for subsequent control operations in that common address field. At least one edge computing node is used to receive different types of fingerprints uploaded by the security monitoring gateway and to perform legality judgment. The system uses a cloud-based security analysis platform to receive abnormal data reported by edge computing nodes, trains and optimizes an artificial intelligence detection model, and sends lightweight model update packages to edge computing nodes through a differential update strategy.

Images