Personalized practical training method, industrial control test box, mini-host and storage medium

By calculating the multidimensional ability characteristics of trainees and configuring personalized difficulty coefficients, the difficulty of attack operations is dynamically adjusted, which solves the problem of the disconnect between training scenarios and actual situations in existing technologies. This enables personalized offensive and defensive training, improving training effectiveness and efficiency.

CN121834801APending Publication Date: 2026-04-10INTEGRITY TECH GRP INC
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-12-02
Publication Date
2026-04-10

AI Technical Summary

Technical Problem

Existing technologies cannot simulate the adaptive behavior of real attackers, the training scenarios are out of touch with reality, and the training content and difficulty cannot be dynamically adjusted according to the trainees' ability level, resulting in poor training effects and low training efficiency.

Method used

Personalized difficulty coefficients are calculated based on the trainees' multidimensional ability characteristics, and simulation scenarios of corresponding complexity are configured. By receiving attack scripts and executing attack operations, defense capabilities are evaluated, and reinforcement learning algorithms are used to dynamically adjust the difficulty of attack operations to achieve personalized training.

Benefits of technology

It improves the realism of training scenarios and training efficiency, dynamically matches training difficulty with trainees' abilities, and enhances the assessment of trainees' defense capabilities and the effectiveness of training.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121834801A_ABST
    Figure CN121834801A_ABST
Patent Text Reader

Abstract

The invention provides a personalized practical training method, an industrial control test box, a mini-host and a storage medium. The method comprises the following steps: calculating a personalized difficulty coefficient based on multi-dimensional ability characteristics of a student; according to the personalized difficulty coefficient, configuring a simulation scene with corresponding complexity; in the simulation scene, executing a corresponding attack operation according to a received attack script; according to a defense operation executed by the student for the attack operation, the defense capability of the student is evaluated; and dynamically adjusting the difficulty of the attack operation based on the defense capability through a reinforcement learning algorithm so as to carry out personalized practical training on the trainee. In the technical scheme provided by the invention, the simulation scene matched with the ability of the trainee is configured based on the multi-dimensional ability characteristics of the trainee, and the difficulty of attack operation is dynamically adjusted based on the defense ability of the trainee in the practical training process, so that the practical training scene is closer to a real attack and defense behavior, and the practical training efficiency is improved.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, specifically to a personalized training method, an industrial control test box, a mini host, and a storage medium. Background Technology

[0002] In related technologies, fixed attack patterns are usually used in network attack and defense training, which cannot simulate the adaptive behavior of real attackers, and the training scenario is out of touch with the actual situation. Furthermore, the training content and difficulty cannot be dynamically adjusted according to the trainees' ability level, resulting in poor training effect and low training efficiency. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention provide a personalized training method, an industrial control test box, a mini host, and a storage medium to solve the problems in the prior art that cannot simulate the adaptive behavior of real attackers, the training scenario is out of touch with the actual situation, and the training content and difficulty cannot be dynamically adjusted according to the trainees' ability level, resulting in poor training effect and low training efficiency.

[0004] In a first aspect, embodiments of the present invention provide a personalized training method, the method comprising:

[0005] Calculate personalized difficulty coefficients based on the trainees' multidimensional ability characteristics;

[0006] Configure simulation scenarios of corresponding complexity based on the personalized difficulty coefficient;

[0007] In the simulation scenario, the corresponding attack operation is executed according to the received attack script;

[0008] Assess the student's defensive capabilities based on the defensive actions taken in response to the attack.

[0009] By using reinforcement learning algorithms, the difficulty of the attack operation is dynamically adjusted based on the defense capability, so as to provide personalized training for the trainees.

[0010] In one possible implementation, the simulation scenario is associated with corresponding physical devices, and the execution of corresponding attack operations based on the received attack script includes:

[0011] Receive an attack script from a cloud platform, the attack script being automatically generated by the cloud platform in response to an attack task instruction;

[0012] The attack script operates on the PLC to cause the physical device to exhibit an abnormal state resulting from the attack operation. The PLC contains the control logic for the physical device.

[0013] In one possible implementation, the attack script may include attack types such as protocol tampering, instruction injection, or man-in-the-middle attacks.

[0014] In one possible implementation, after executing the corresponding attack operation based on the received attack script, the method further includes:

[0015] Real-time collection of network traffic, and determination of whether the traffic is malicious based on the protocol fields of the traffic;

[0016] If it is determined that the traffic is not malicious, then the traffic is allowed to pass and the relevant information of the traffic is recorded in the log file;

[0017] If the traffic is determined to be malicious, the malicious traffic will be automatically blocked, an anomaly alarm will be triggered, and an attack analysis report will be generated based on the malicious traffic.

[0018] In one possible implementation, after dynamically adjusting the difficulty of the attack operation based on the defense capability using a reinforcement learning algorithm to provide personalized training for the trainee, the method further includes:

[0019] Based on the recorded personalized training data, training scores and training reports are generated.

[0020] In one possible implementation, after dynamically adjusting the difficulty of the attack operation based on the defense capability using a reinforcement learning algorithm to provide personalized training for the trainee, the method further includes:

[0021] In response to the recovery command, the control logic in the PLC is reset, and the association between the simulation scene and the corresponding physical device is canceled.

[0022] Secondly, embodiments of the present invention provide an industrial control test box, the industrial control test box including a mini host computer;

[0023] The mini-host is used to calculate a personalized difficulty coefficient based on the student's multidimensional ability characteristics; configure a simulation scenario of corresponding complexity according to the personalized difficulty coefficient; execute corresponding attack operations according to the received attack script in the simulation scenario; evaluate the student's defense capability based on the defense operation performed by the student in response to the attack operation; and dynamically adjust the difficulty of the attack operation based on the defense capability through a reinforcement learning algorithm to provide personalized training for the student.

[0024] In one possible implementation, the industrial control test box further includes sensing devices, execution devices, and a PLC, wherein control logic is programmed in the PLC;

[0025] The sensing device is used to simulate and generate sensing signals, and upload the sensing signals to the PLC;

[0026] The PLC is used to generate control commands based on the control logic and the sensing signals, and send the control commands to the execution device;

[0027] The execution device is used to simulate an execution mechanism in response to control commands.

[0028] Thirdly, embodiments of the present invention provide a mini-host, the mini-host including one or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the mini-host, cause the mini-host to perform the personalized training method as described in the first aspect or any possible implementation of the first aspect.

[0029] Fourthly, embodiments of the present invention provide a computer-readable storage medium comprising a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to execute the personalized training method as described in the first aspect or any possible implementation thereof.

[0030] In the technical solution provided by the embodiments of the present invention, a simulation scenario matching the student's ability is configured based on the student's multidimensional ability characteristics. During the training process, the difficulty of the attack operation is dynamically adjusted based on the student's defense ability, making the training scenario closer to real attack and defense behavior and improving the training efficiency. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating a personalized training method provided in an embodiment of the present invention.

[0032] Figure 2 This is a structural schematic diagram of an industrial control test chamber provided in an embodiment of the present invention.

[0033] Figure 3 This is a schematic diagram of a mini-host provided as an embodiment of the present invention. Detailed Implementation

[0034] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0035] Figure 1This is a flowchart illustrating a personalized training method provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0036] Step 101: Calculate the personalized difficulty coefficient based on the student's multidimensional ability characteristics.

[0037] In this step, the multidimensional capability characteristics include knowledge dimension characteristics, skill dimension characteristics, strategy dimension characteristics, innovation dimension characteristics, and psychological dimension characteristics. Knowledge dimension characteristics reflect the trainee's mastery of theoretical knowledge, system knowledge, and protocol knowledge. For example, trainees are given separate tests on theoretical knowledge, system knowledge, and protocol knowledge, and the scores from these three tests are weighted or averaged to quantify the knowledge dimension characteristics. Skill dimension characteristics reflect the trainee's operational proficiency, tool usage proficiency, and vulnerability analysis proficiency. Strategy dimension characteristics reflect the rationality (matching defense operations with attack operations, avoiding both over-defense and wasted resources, and under-defense and inability to block attacks) and effectiveness (whether attacks can be accurately blocked). Innovation dimension characteristics reflect the innovativeness of the trainee's defense operations, such as whether there are innovative solutions or optimized methods when executing defense operations. Psychological dimension characteristics reflect the trainee's psychological state, such as stress resistance and concentration. Physiological parameters such as heart rate, blood pressure, and respiratory rate are collected through physiological parameter sensors to quantify the trainee's psychological dimension characteristics. A multi-task learning algorithm is used to simultaneously evaluate the trainee's multidimensional capability characteristics. After quantifying the multidimensional ability characteristics, a weighted calculation is performed to generate a personalized difficulty coefficient.

[0038] Optionally, based on multi-dimensional ability characteristics, a trainee ability profile is constructed, intuitively displaying the trainee's multi-dimensional abilities, making their strengths and weaknesses immediately apparent. This provides data support for personalized training, accurately matching training content and difficulty, and improving training efficiency. Through collaborative filtering algorithms, training programs are recommended for each trainee based on their ability profiles, maximizing training efficiency.

[0039] Step 102: Configure simulation scenarios with corresponding difficulty levels according to the personalized difficulty coefficient.

[0040] In this embodiment of the invention, the personalized difficulty coefficient determines the complexity of the simulation scenario, the initial difficulty of the attack operation, and the initial reward function. The higher the student's ability, the greater the personalized difficulty coefficient, the higher the complexity of the simulation scenario, and the higher the initial difficulty of the attack operation; conversely, the lower the student's ability, the smaller the personalized difficulty coefficient, the lower the complexity of the simulation scenario, and the lower the initial difficulty of the attack operation. Through personalized settings, the training difficulty is matched to the student's ability, avoiding the resource waste caused by uniform difficulty training and improving training efficiency.

[0041] Step 103: In the simulation scenario, execute the corresponding attack operation according to the received attack script.

[0042] In this step, an attack script is received from the cloud platform. This script is automatically generated by the cloud platform in response to attack task instructions. The attack script acts on the Programmable Logic Controller (PLC) to cause physical devices to exhibit abnormal conditions resulting from the attack operation. The PLC contains the control logic for the physical devices. For example, the simulation scenario simulates the fractionation tower process in an oil refining scenario. The physical devices associated with the simulation scenario include temperature sensors and DC motors. Control logic is written in the PLC to trigger valve closure when the tank temperature exceeds 270°C. The temperature sensor simulates the temperature signal in an industrial environment, and the DC motor simulates the valve actuator. The temperature sensor uploads the temperature signal to the PLC; the PLC generates control instructions based on the control logic and the temperature signal, and sends these instructions to the DC motor; the DC motor responds to the control instructions, simulating valve start and stop. Correspondingly, the tank temperature and valve status are displayed in real time on the HMI interface. The valve status displayed on the HMI interface is the same as the valve status simulated by the DC motor, achieving state synchronization.

[0043] In this embodiment of the invention, the attack types of the attack script include protocol tampering, instruction injection, and man-in-the-middle attacks. Protocol tampering refers to modifying Modbus-TCP instructions, such as changing the motor start / stop instruction 0x01 to 0x00. When subjected to a protocol tampering attack, this will cause the DC motor to stop abnormally, and the valve status displayed on the HMI interface will be inconsistent with the actual state of the DC motor. Instruction injection refers to writing malicious instructions into the PLC, such as skipping the control logic that triggers valve closure when the tank temperature exceeds 270°C. In this case, the valve will not be triggered when the temperature exceeds the limit, potentially leading to a safety accident. A man-in-the-middle attack refers to intercepting real sensor data and forging sensor data, such as forging real sensor data of 200°C into 150°C.

[0044] In this embodiment of the invention, after step 103, the method further includes: real-time collection of network traffic, and determination of whether the traffic is malicious traffic based on the protocol fields of the traffic; if the traffic is determined to be non-malicious, the traffic is allowed to pass, and the relevant traffic information is recorded in a log file; if the traffic is determined to be malicious, the malicious traffic is automatically blocked, an anomaly alarm is triggered, and an attack analysis report is generated based on the malicious traffic. For example, the protocol fields include Modbus protocol fields or Open Platform Communications Unified Architecture (OPC UA) protocol fields. The protocol fields of normal network traffic strictly follow the standard format of the corresponding protocol. If the protocol fields do not conform to the standard format of the corresponding protocol, the traffic is determined to be malicious traffic. The attack analysis report includes the attack type, the attack source IP, and the affected devices. For example, the anomaly alarm method is a buzzer alarm, which is linked to the HMI interface to display alarm information.

[0045] In this embodiment of the invention, the industrial control test box supports deep decoding of industrial protocols, such as parsing the "data item read / write request" field of OPC UA, which can identify complex threats such as APT attacks (such as continuously forging sensor data) and illegal access (such as unauthorized IP access to PLC), and link the HMI interface to display alarm information.

[0046] Step 104: Assess the student's defensive capabilities based on the defensive actions taken by the student in response to the attack.

[0047] This step assesses the trainee's defense capabilities from two aspects: attack detection ability and response speed. Attack detection ability reflects the accuracy and comprehensiveness of the trainee's attack detection, i.e., whether they correctly identify attack operations and whether they comprehensively identify attack operations and correctly execute defensive actions against them. Response speed reflects the timeliness of the trainee's attack detection, i.e., whether they can quickly identify attack operations. For example, the trainee's attack detection ability is quantified by the proportion of times they correctly identify attack operations and correctly execute defensive actions out of the total number of attacks; the trainee's response speed is quantified by the time taken to identify attack operations.

[0048] Traditional training often involves using only a single attack or defense device for skills practice, achieving only a single attack or defense, failing to integrate offense and defense. A single attack device can only issue attack commands (such as protocol tampering) but lacks defensive devices like industrial firewalls, making it impossible to verify the effectiveness of defense strategies. A single defense device (such as an industrial firewall) can only passively intercept attacks, lacking attack simulation capabilities. Trainees cannot understand the correspondence between attack principles and defense logic, resulting in fragmented skills that are inadequate to cope with multi-layered attacks on real industrial control networks. The technical solution provided in this invention can achieve both attack simulation and defense verification, forming an integrated offensive and defensive training system, thus improving training efficiency.

[0049] Step 105: Using reinforcement learning algorithms, the difficulty of attack operations is dynamically adjusted based on defense capabilities to provide personalized training for trainees.

[0050] In this step, the difficulty of the attack operation is dynamically adjusted using a multi-armed gambling machine algorithm. When the student's defense ability is strong, resulting in multiple successful defenses, or when the success rate exceeds a preset percentage, the attack difficulty is increased. Conversely, when the student's defense ability is weak, resulting in multiple failed defenses, or when the failure rate exceeds a preset percentage, the attack difficulty is decreased. For example, the preset percentage is 70%. Reinforcement learning algorithms are then used to adjust the attack difficulty based on the student's performance, optimizing the generation logic of subsequent attack operations. Examples of reinforcement learning algorithms include Proximal Policy Optimization (PPO), Soft Actor-Critic (SAC), and Deep Q-Network (DQN).

[0051] In this embodiment of the invention, an attack knowledge base is constructed. This knowledge base is partitioned and stores attack operations of varying difficulty. Lower-difficulty attacks are single-dimensional attacks with obvious characteristics, such as simple protocol field tampering. Medium-difficulty attacks are composite attacks, combining multiple single-dimensional attacks. Higher-difficulty attacks are composite attacks incorporating advanced techniques such as social engineering and zero-day exploitation. In practical applications, more difficulty levels can be set to achieve precise adjustment of attack difficulty.

[0052] Optionally, prompts can be provided if trainees fail to identify attack operations for an extended period of time, or if they have identified attack operations but have not taken defensive actions for an extended period of time, in order to ensure trainees' motivation and learning status.

[0053] In this embodiment of the invention, after step 105, the method further includes: generating a training score and a training report based on the recorded personalized training data. The training report includes attack detection capability (accuracy and comprehensiveness), response speed (timeliness), and improvement suggestions. For example, if a trainee performs well in terms of the accuracy and comprehensiveness of attack detection but poorly in terms of timeliness; that is, although the trainee can accurately and comprehensively identify attack operations and correctly execute defensive operations against them, the time taken to identify the attack operations is relatively long. In this case, the improvement suggestion is to improve the response speed.

[0054] Optionally, the evolution trajectory of trainees' defensive capabilities can be displayed based on time series data to identify learning bottlenecks and adjust training strategies accordingly.

[0055] In this embodiment of the invention, after step 105, the method further includes resetting the control logic in the PLC in response to the restoration command, canceling the association between the simulation scene and the corresponding physical device, which can restore the initial state in a short time, shorten the maintenance time after the training is completed, and improve the maintenance efficiency and training flexibility.

[0056] In the technical solution provided by the embodiments of the present invention, a simulation scenario matching the student's ability is configured based on the student's multidimensional ability characteristics. During the training process, the difficulty of the attack operation is dynamically adjusted based on the student's defense ability, making the training scenario closer to real attack and defense behavior and improving the training efficiency.

[0057] Figure 2 This is a structural schematic diagram of an industrial control test chamber provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the industrial control test box includes a mini-host, which is used to calculate a personalized difficulty coefficient based on the trainee's multi-dimensional ability characteristics; configure simulation scenarios of corresponding complexity according to the personalized difficulty coefficient; execute corresponding attack operations according to the received attack script in the simulation scenario; evaluate the trainee's defense capabilities based on the defense operations performed by the trainee in response to the attack operations; and dynamically adjust the difficulty of the attack operations based on the defense capabilities through reinforcement learning algorithms to provide personalized training for the trainee.

[0058] like Figure 2 As shown, the industrial control test chamber also includes sensing devices, execution devices, and a PLC. The PLC contains control logic. The sensing devices are used to simulate and generate sensing signals and upload them to the PLC. The PLC is used to generate control commands based on the control logic and sensing signals and send the control commands to the execution devices. The execution devices are used to respond to the control commands and simulate the execution mechanism. For example, the sensing device is a temperature sensor, and the execution device is a DC motor to simulate the opening and closing of a valve.

[0059] In this embodiment of the invention, the mini host is also used to receive attack scripts from the cloud platform. The attack scripts are automatically generated by the cloud platform in response to attack task instructions. The attack scripts act on the PLC to make the physical devices (i.e., sensing devices and execution devices) exhibit abnormal conditions caused by the attack operation. The control logic of the physical devices is written in the PLC.

[0060] In this embodiment of the invention, the mini-host is also used to generate training scores and training reports based on the recorded personalized training data.

[0061] In this embodiment of the invention, the mini-host is also used to respond to the recovery command, reset the control logic in the PLC, and cancel the association between the simulation scene and the corresponding physical device.

[0062] like Figure 2 As shown, the industrial control test box also includes a firewall. The firewall is used to collect network traffic in real time and determine whether the traffic is malicious by the protocol field of the traffic. If the traffic is determined to be not malicious, the traffic is allowed to pass and the relevant information of the traffic is recorded in the log file. If the traffic is determined to be malicious, the malicious traffic is automatically blocked, an abnormal alarm is triggered, and an attack analysis report is generated based on the malicious traffic.

[0063] like Figure 2 As shown, the industrial control test box also includes an industrial switch, which is used to realize network connection between PLC, HMI and firewall.

[0064] like Figure 2 As shown, the industrial control test box also includes a monitor, which is used to display at least one of the HMI interface, SCADA system interface, and training operation interface.

[0065] like Figure 2 As shown, the industrial control test box is equipped with multiple communication interfaces, including an Ethernet interface, a Universal Serial Bus (USB) interface, and an RS485 interface. The RS485 interface supports the Modbus-RTU communication protocol. The number of each type of communication interface can be set based on actual needs, and this embodiment of the invention does not limit this.

[0066] In the technical solution provided by the embodiments of the present invention, a simulation scenario matching the student's ability is configured based on the student's multidimensional ability characteristics. During the training process, the difficulty of the attack operation is dynamically adjusted based on the student's defense ability, making the training scenario closer to real attack and defense behavior and improving the training efficiency.

[0067] In this embodiment of the invention, multiple hardware devices are integrated into a portable industrial control test box, facilitating mobile teaching and shortening the deployment time of the training equipment. Furthermore, the initial state can be restored quickly using a recovery command, reducing maintenance time after training and improving maintenance efficiency and training flexibility.

[0068] This invention provides a computer-readable storage medium that includes a stored program. When the program runs, it controls the device where the computer-readable storage medium is located to execute the steps of the above-described personalized training method. For a detailed description, please refer to the embodiments of the above-described personalized training method.

[0069] Figure 3 A schematic diagram of a mini-host provided as an embodiment of the present invention, as shown below. Figure 3 As shown, the mini-host 3 in this embodiment includes a processor 301, a memory 302, and a computer program 303 stored in the memory 302 and executable on the processor 301. When the processor 301 executes the computer program 303, it implements the steps in the various method embodiments described above. Alternatively, when the processor 301 executes the computer program 303, it implements the functions of each module / unit in the various device embodiments described above.

[0070] The mini-host 3 can be an electronic device such as a desktop computer, laptop, handheld computer, or cloud-based mini-host. The mini-host 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 3 This is merely an example of a mini PC 3 and does not constitute a limitation on the mini PC 3. It may include more or fewer parts than shown, or different parts.

[0071] The processor 301 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0072] The memory 302 can be an internal storage unit of the mini-PC 3, such as a hard drive or RAM. The memory 302 can also be an external storage device of the mini-PC 3, such as a plug-in hard drive, SmartMedia Card (SMC), Secure Digital (SD) card, or Flash Card. The memory 302 can also include both internal and external storage units of the mini-PC 3. The memory 302 is used to store computer programs and other programs and data required by electronic devices.

[0073] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0074] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A personalized training method, characterized in that, The method includes: Calculate personalized difficulty coefficients based on the trainees' multidimensional ability characteristics; Configure simulation scenarios of corresponding complexity based on the personalized difficulty coefficient; In the simulation scenario, the corresponding attack operation is executed according to the received attack script; Assess the student's defensive capabilities based on the defensive actions taken in response to the attack. By using reinforcement learning algorithms, the difficulty of the attack operation is dynamically adjusted based on the defense capability, so as to provide personalized training for the trainees.

2. The method according to claim 1, characterized in that, The simulation scenario is associated with corresponding physical devices. The step of executing corresponding attack operations based on the received attack script includes: Receive an attack script from a cloud platform, the attack script being automatically generated by the cloud platform in response to an attack task instruction; The attack script operates on the PLC to cause the physical device to exhibit an abnormal state resulting from the attack operation. The PLC contains the control logic for the physical device.

3. The method according to claim 2, characterized in that, The attack types of the attack scripts include protocol tampering, instruction injection, or man-in-the-middle attacks.

4. The method according to claim 1, characterized in that, After executing the corresponding attack operation based on the received attack script, the process further includes: Real-time collection of network traffic, and determination of whether the traffic is malicious based on the protocol fields of the traffic; If it is determined that the traffic is not malicious, then the traffic is allowed to pass and the relevant information of the traffic is recorded in the log file; If the traffic is determined to be malicious, the malicious traffic will be automatically blocked, an anomaly alarm will be triggered, and an attack analysis report will be generated based on the malicious traffic.

5. The method according to claim 1, characterized in that, After using reinforcement learning algorithms to dynamically adjust the difficulty of the attack operation based on the defense capability to provide personalized training for the trainees, the method further includes: Based on the recorded personalized training data, training scores and training reports are generated.

6. The method according to claim 2, characterized in that, After using reinforcement learning algorithms to dynamically adjust the difficulty of the attack operation based on the defense capability to provide personalized training for the trainees, the method further includes: In response to the recovery command, the control logic in the PLC is reset, and the association between the simulation scene and the corresponding physical device is canceled.

7. An industrial control test chamber, characterized in that, The industrial control test box includes a mini host computer; The mini-host is used to calculate a personalized difficulty coefficient based on the student's multidimensional ability characteristics; and to configure a simulation scenario of corresponding complexity according to the personalized difficulty coefficient. In the simulation scenario, corresponding attack operations are executed based on the received attack script; the student's defense capabilities are evaluated based on the defense operations performed by the student in response to the attack operations. By using reinforcement learning algorithms, the difficulty of the attack operation is dynamically adjusted based on the defense capability, so as to provide personalized training for the trainees.

8. The industrial control test chamber according to claim 7, characterized in that, The industrial control test box also includes sensing devices, execution devices and a PLC, and the PLC contains control logic. The sensing device is used to simulate and generate sensing signals, and upload the sensing signals to the PLC; The PLC is used to generate control commands based on the control logic and the sensing signals, and send the control commands to the execution device; The execution device is used to simulate an execution mechanism in response to control commands.

9. A mini PC, characterized in that, The mini-host includes one or more processors; memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the mini-host, cause the mini-host to perform the personalized training method as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the personalized training method as described in any one of claims 1-6.