Industrial malicious code detection method

Abstract

The invention relates to the technical field of computers, and discloses an industrial malicious code detection method, which comprises the following steps of: acquiring network flow data, industrial protocol data and physical process data of an industrial control system, and generating multi-source industrial security data; performing data cleaning and normalization processing on the multi-source industrial safety data to generate standardized industrial safety data; when industrial malicious code detection is carried out, whether a control instruction is matched with an equipment running state or not is judged in real time by constructing an industrial behavior context model and combining physical process correlation analysis, the missing report rate of malicious code detection can be reduced, and when a behavior that a protocol level is compliant but a physical process is abnormal is detected, the detection efficiency is improved. Detection deviation can be corrected in real time through a context model, so that industrial malicious code detection keeps high reliability and adaptability in a complex industrial environment.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to a method for detecting industrial malware. Background Technology

[0002] With the rapid development of computer technology, it has brought tremendous impact and changes to people's economy, culture, politics, education, medical care and other industries, and has brought about tremendous changes in human life. At the same time, the computer field has also suffered from the troubles and attacks of malicious code. Faced with the complex network environment and the endless stream of complex and ever-changing malicious code, traditional malicious code detection solutions lack flexibility when facing anti-detection and anti-debugging techniques of malicious code, which can easily affect the detection effect of malicious code.

[0003] Currently, in the process of security protection of industrial control systems, due to the increasing diversity and concealment of industrial malware, existing detection methods mostly rely on static matching of known malware feature libraries. This makes it impossible to accurately identify unknown malware and advanced persistent threats constructed using legitimate instructions of industrial protocols, resulting in a high false negative rate for malware and failing to guarantee the accuracy and reliability of security detection for industrial production systems.

[0004] Therefore, a method for detecting industrial malware is proposed to solve the above problems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method for detecting industrial malicious code, which solves the problem mentioned in the background that leads to a high false negative rate for malicious code and fails to guarantee the accuracy and reliability of security detection in industrial production systems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for detecting industrial malware, the method comprising the following steps: S1. Collect network traffic data, industrial protocol data, and physical process data of industrial control systems to generate multi-source industrial safety data; S2. Perform data cleaning and normalization on the multi-source industrial safety data to generate standardized industrial safety data; S3. Based on the standardized industrial security data, perform deep analysis of industrial protocols, extract industrial protocol feature parameters, and generate industrial protocol feature data. S4. Perform physical process correlation analysis based on the industrial protocol feature data, construct an industrial behavior context model, and generate industrial behavior context data. S5. Based on the industrial behavior context data and combined with machine learning algorithms, malicious behavior feature extraction processing is performed to generate malicious behavior feature data. S6. Perform pattern matching processing between the malicious behavior feature data and the industrial malicious code feature library to generate malicious code suspicion data. S7. Based on the suspected malicious code data, perform dynamic threshold adaptive adjustment to generate malicious code detection threshold data; S8. Based on the suspected malicious code data and the malicious code detection threshold data, perform malicious code determination processing to generate industrial malicious code detection result data; S9. When industrial malicious code is detected, a real-time alarm is triggered and an isolation response operation is performed, generating security response execution data.

[0007] Preferably, generating multi-source industrial safety data in step S1 includes the following steps: S11. Collect raw network traffic data in the industrial control network through industrial firewalls and network probes, and generate raw network traffic data. S12. Collect Modbus, PROFIBUS, and OPC UA industrial protocol communication data through the industrial protocol parser, and generate raw industrial protocol data; S13. Collect physical process data of industrial equipment through sensors and data acquisition modules, including temperature, pressure, and flow parameters, and generate raw physical process data; S14. The original network traffic data, original industrial protocol data, and original physical process data are time-stamped and fused to generate multi-source industrial safety data.

[0008] Preferably, the generation of standardized industrial safety data in step S2 includes the following steps: S21. The multi-source industrial safety data is filled with missing values ​​and outliers are removed. The sliding window algorithm is used to smooth the data and generate preliminary cleaned data. S22. Normalize the preliminary cleaning data and map different dimensional parameters to the 0, 1 interval to generate standardized industrial safety data. S23. Reduce data storage overhead through data compression algorithms to generate compressed, standardized industrial safety data.

[0009] Preferably, generating industrial protocol feature data in step S3 includes the following steps: S31. Parse the industrial protocol fields of the standardized industrial safety data, extract the protocol header, function code, and data payload features, and generate basic protocol feature data. S32. Perform protocol semantic analysis based on protocol basic feature data, identify abnormal instruction sequences and illegal parameter assignments, and generate protocol abnormal feature data; S33. Verify protocol behavior compliance by combining the industrial protocol state machine model and generate protocol compliance feature data; S34. Integrate basic protocol feature data, protocol anomaly feature data, and protocol compliance feature data to generate industrial protocol feature data.

[0010] Preferably, generating industrial behavior context data in step S4 includes the following steps: S41. Establish a digital twin model of the industrial physical process, map the industrial protocol feature data to physical process variables, and generate physical process mapping data; S42. Based on physical process mapping data, perform causal relationship analysis to identify the logical association between control commands and physical responses, and generate behavioral association data; S43. Use time series analysis algorithms to detect abnormal patterns in physical processes and generate physical anomaly context data; S44. Integrate behavioral correlation data and physical anomaly context data to construct an industrial behavioral context model and generate industrial behavioral context data.

[0011] Preferably, generating malicious behavior feature data in step S5 includes the following steps: S51. Use a deep learning algorithm to learn features from the industrial behavior context data, and use a convolutional neural network to extract spatial features and generate spatial feature data. S52. Use a long short-term memory network to extract time series features and generate time series feature data; S53. Focus on key behavioral nodes through an attention mechanism to generate weighted malicious behavior feature data; S54. Integrate spatial feature data, temporal feature data, and weighted malicious behavior feature data to generate malicious behavior feature data.

[0012] Preferably, the generation of malicious code suspicion data in step S6 includes the following steps: S61. Construct an industrial malware signature database, which includes known malware signatures, behavior patterns, and attack indicators; S62. The malicious behavior feature data is matched with the industrial malicious code feature library using a similarity calculation algorithm to generate initial matching degree data; S63. Based on the fuzzy logic algorithm, handle matching uncertainty and generate optimized matching degree data; S64. Normalize the optimized matching data to generate malicious code suspicion data.

[0013] Preferably, generating malicious code detection threshold data in step S7 includes the following steps: S71. Dynamically monitor historical malicious code suspicion data, calculate baseline thresholds using an exponentially weighted moving average algorithm, and generate baseline threshold data. S72. Adjust the threshold sensitivity based on real-time network load and system resource status to generate adaptive threshold parameters; S73, integrates baseline threshold data and adaptive threshold parameters to generate malicious code detection threshold data.

[0014] Preferably, the step S8 of generating industrial malware detection result data includes the following steps: S81. Compare the suspected malicious code data with the malicious code detection threshold data. If the suspected malicious code exceeds the threshold, it is determined to be malicious code, and a preliminary judgment result is generated. S82. Integrate historical detection results and real-time context through a multi-evidence fusion algorithm to generate the final judgment result; S83. Output industrial malware detection results data, including malware type, risk level, and scope of impact.

[0015] Preferably, generating security response execution data in step S9 includes the following steps: S91. When the industrial malware detection result is confirmed as positive, an audible and visual alarm and log recording are triggered. S92. Automatically execute network isolation policies to block the propagation path of malicious code; S93. Initiate the recovery procedure to roll back the affected industrial equipment to a safe state; S94. Generate security response execution data and report it to the security management platform.

[0016] Compared with existing technologies, this invention provides a method for detecting industrial malware, which has the following beneficial effects: 1. In this invention, when performing industrial malware detection, multi-source industrial security data is collected and cleaned and normalized. Industrial protocol feature parameters are extracted based on deep analysis of industrial protocols to ensure the comprehensiveness and consistency of the data foundation for industrial malware detection. At the same time, the correlation analysis between protocol features and physical processes is performed to detect in real time whether there are covert attacks constructed using legitimate instructions in the industrial control system, thus ensuring the accuracy of industrial malware detection and reducing detection errors.

[0017] 2. In this invention, when performing industrial malware detection, by constructing an industrial behavior context model and combining it with physical process correlation analysis, it is possible to determine in real time whether the control commands match the equipment operating status, which can reduce the false negative rate of malware detection. Furthermore, when detecting behaviors that are compliant at the protocol level but abnormal in the physical process, the context model can be used to correct detection biases in real time, enabling industrial malware detection to maintain high reliability and adaptability in complex industrial environments.

[0018] 3. In this invention, when performing industrial malware detection, malicious behavior features are extracted using machine learning algorithms, and a dynamic threshold adaptive adjustment mechanism is used to evaluate the suspected malware level in real time. The detection sensitivity is optimized according to different network loads and system resource states, enabling adaptive detection of unknown malware and advanced persistent threats. This reduces false positives and false negatives during the detection process, and improves the accuracy and real-time response of industrial malware detection. Attached Figure Description

[0019] Figure 1 This is a flowchart of a method for detecting industrial malicious code according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] For specific implementation examples, please refer to: Figure 1 A method for detecting industrial malware, characterized by comprising the following steps: S1. Collect network traffic data, industrial protocol data, and physical process data of industrial control systems to generate multi-source industrial safety data; S2. Perform data cleaning and normalization on multi-source industrial safety data to generate standardized industrial safety data; S3. Based on standardized industrial security data, perform in-depth analysis of industrial protocols, extract characteristic parameters of industrial protocols, and generate characteristic data of industrial protocols. S4. Perform physical process correlation analysis based on industrial protocol characteristic data, construct an industrial behavior context model, and generate industrial behavior context data. S5. Based on industrial behavior context data and machine learning algorithms, malicious behavior feature extraction and processing are performed to generate malicious behavior feature data. S6. Use malicious behavior feature data and industrial malware feature library to perform pattern matching to generate malware suspicion data. S7. Based on the suspected malicious code data, perform dynamic threshold adaptive adjustment to generate malicious code detection threshold data; S8. Based on the suspected malicious code data and the malicious code detection threshold data, perform malicious code judgment processing to generate industrial malicious code detection result data; S9. When industrial malicious code is detected, a real-time alarm is triggered and an isolation response operation is performed, generating security response execution data.

[0022] The generation of multi-source industrial safety data in S1 includes the following steps: S11. Collect raw network traffic data in the industrial control network through industrial firewalls and network probes, and generate raw network traffic data. S12. Collect Modbus, PROFIBUS, and OPC UA industrial protocol communication data through the industrial protocol parser, and generate raw industrial protocol data; S13. Collect physical process data of industrial equipment through sensors and data acquisition modules, including temperature, pressure, and flow parameters, and generate raw physical process data; S14. Timestamp-align and fuse the raw network traffic data, raw industrial protocol data, and raw physical process data to generate multi-source industrial safety data.

[0023] The generation of standardized industrial safety data in S2 includes the following steps: S21. Perform missing value imputation and outlier removal on multi-source industrial safety data, and use a sliding window algorithm to smooth the data to generate preliminary cleaned data. This includes the following steps: S211. Set the size of the sliding window to a fixed time interval of the time series data, and initialize the starting position of the window; S212. Divide multi-source industrial safety data into multiple window data blocks in chronological order; S213. Calculate the arithmetic mean of the parameter values ​​in each window data block to generate smoothed data within the window; The formula for calculating the arithmetic mean is as follows: ; in, This indicates smoothed data within the window. Indicates the first Data points, Indicates window size; S214. Slide the window by one time step and repeat steps S212 to S213 until all data is covered, generating preliminary cleaned data. S22. Normalize the preliminary cleaning data and map different dimensional parameters to the 0, 1 interval to generate standardized industrial safety data. S23. Reduce data storage overhead through data compression algorithms to generate compressed, standardized industrial safety data.

[0024] Generating industrial protocol feature data in S3 includes the following steps: S31. Parse the industrial protocol fields of standardized industrial safety data, extract the protocol header, function code, and data payload features, and generate basic protocol feature data. This includes the following steps: S311. Read the raw byte stream of the protocol in the standardized industrial safety data and parse the protocol header fields according to the Modbus, PROFIBUS and OPC UA protocol specifications; S312. Extract the transaction identifier, protocol identifier, and length fields from the protocol header to generate basic protocol header information; S313. Based on the protocol header basic information, parse the function code and data payload field to identify the instruction type and parameter content; The function code parsing formula is as follows: ; in, This indicates the function code field. This indicates the basic information in the protocol header. Indicates the field offset. Indicates the field length; S314. Integrate the parsed protocol header, function code, and data payload into structured data to generate basic protocol feature data; S32. Perform protocol semantic analysis based on protocol basic feature data to identify abnormal instruction sequences and illegal parameter assignments, and generate protocol abnormal feature data. This includes the following steps: S321. Construct a timing model of instruction sequences based on protocol basic feature data; S322. Detect whether there are consecutive repeated instructions and illegal parameter assignments in the instruction sequence, and generate an abnormal instruction flag; S323. By comparing the industry protocol specifications with the rule engine, identify whether the parameter values ​​are outside the reasonable range; The formula for verifying the parameter range is as follows: in, Indicates an anomaly marker. Indicates the parameter value. and Indicates the boundaries of a reasonable range; S324. Output the abnormal instruction sequence and illegal parameter assignment results to generate protocol abnormal feature data; S33. Verify protocol behavior compliance by combining the industrial protocol state machine model and generate protocol compliance feature data, specifically including the following steps: S331. Establish an industrial protocol state machine model, and define the state set, transition conditions, and compliance states; S332. Map the basic feature data of the protocol to the state machine model and check whether the current protocol state is compliant; The state transition formula is as follows: ; in, Indicates the state at time t. Indicates an action, Indicates the next state. Represents the state transition function; S333. When a protocol action violates the state transition rules, it is marked as a non-compliant event. S334. Generate a protocol compliance report as protocol compliance characteristic data; S34. Integrate basic protocol feature data, protocol anomaly feature data, and protocol compliance feature data to generate industrial protocol feature data.

[0025] Generating industrial behavior context data in S4 includes the following steps: S41. Establish a digital twin model of the industrial physical process, map industrial protocol feature data to physical process variables, and generate physical process mapping data, including the following steps: S411. Construct a three-dimensional digital model of industrial equipment based on historical physical process data; S412. Map the control commands in the industrial protocol feature data to the physical variables in the digital model; S413. Simulate the physical process response through the simulation engine to generate physical process mapping data; The physical process simulation formula is as follows: ; in, Represents the physical response. Indicates control commands. Indicates model parameters, Represents the simulation function; S42. Based on physical process mapping data, perform causal relationship analysis to identify the logical association between control commands and physical responses, and generate behavioral association data. This includes the following steps: S421. Extract the control command sequence and physical response sequence from the physical process mapping data; S422. Calculate the time delay and correlation coefficient between control commands and physical responses; The formula for the correlation coefficient is: ; in, Represents the correlation coefficient. and Indicates the first Each control command and physical response and This represents the mean. Indicates the sequence length. This represents the deviation of the i-th value of the control command from its mean. This represents the deviation of the i-th value of the physical response from its mean. S423. When the correlation is below the threshold, it is determined to be an abnormal causal relationship; S424. Generate behavioral association data and record the logical association results; S43. Detect abnormal patterns in physical processes using time-series analysis algorithms and generate physical anomaly context data, specifically including the following steps: S431. Collect time series data of physical processes and extract trend and periodic components; S432. Detecting outliers and mutations in sequences using an autoregressive model; The formula for the autoregressive model is as follows: ; in, Indicates time The observed values, Represents a constant. Represents the autoregressive coefficient. Indicates the model order. Indicates the difference. Indicates lagged observations; S433. Compare with normal operating mode and identify deviations from normal operation mode; S434. Generate physical anomaly context data; S44. Integrate behavioral correlation data and physical anomaly context data to construct an industrial behavioral context model and generate industrial behavioral context data.

[0026] Generating malicious behavior signature data in S5 includes the following steps: S51. Employ deep learning algorithms to learn features from industrial behavior context data, and use convolutional neural networks to extract spatial features and generate spatial feature data. This includes the following steps: S511. Construct a convolutional neural network model, including convolutional layers, pooling layers, and fully connected layers; S512. Input industrial behavior context data into the network and extract spatial features through convolution operations; The formula for the convolution operation is as follows: ; in, This represents the output feature map elements. Indicates input data, Indicates the convolution kernel weights, Indicates bias. and Indicates the kernel size. Indicates row index and column index. Indicates the convolution kernel Internal element index; S513. Use the backpropagation algorithm to optimize network weights and generate spatial feature data; S52. Extract time series features using a Long Short-Term Memory (LSTM) network to generate time series feature data, specifically including the following steps: S521: Configured with a long short-term memory network unit, including an input gate, a forget gate, and an output gate; S522. Input industrial behavior context data into the network by time step to remember long-term dependencies; The LSTM cell update formula is as follows: ; in, , , These represent the forget gate, input gate, and output gate, respectively. Indicates the current time step. Indicates cell state, Indicates the state of candidate cells. Indicates a hidden state. Indicates input, and Indicates weights and biases. This represents the Sigmoid function. Indicates the output gate. , , , Represents the weight matrix. , , , This represents the bias vector. This indicates that the hidden state from the previous moment will be restored. and the input at the current moment These two vectors are connected together to form a longer vector; S523. Output the hidden state at each time step as temporal feature data; S53. Focus on key behavioral nodes through an attention mechanism to generate weighted malicious behavior feature data, specifically including the following steps: S531. Calculate the attention weight of each node in the industrial behavior context data; The attention weight formula is as follows: ; in, Indicates the first Attention weights for each node, Represents the query vector. Represents the key vector. Represents the scoring function. Indicates the number of nodes; S532. Calculate the weighted sum based on the weights to highlight key behavioral nodes; S533, Generate weighted malicious behavior feature data; S54. Integrate spatial feature data, temporal feature data, and weighted malicious behavior feature data to generate malicious behavior feature data.

[0027] Generating malware suspicion data in S6 includes the following steps: S61. Construct an industrial malware signature database, which includes known malware signatures, behavior patterns, and attack indicators; S62. Using a similarity calculation algorithm, the malicious behavior feature data is matched with the industrial malware feature library to generate initial matching score data. This includes the following steps: S621. Calculate the Euclidean distance between the malicious behavior feature data and each feature in the industrial malicious code feature library; The Euclidean distance formula is as follows: ; in, Represents Euclidean distance. and Represents the elements of the feature vector. Indicates the feature dimension; S622. Convert the distance value into a similarity score to generate initial matching data; S63. Based on the fuzzy logic algorithm, handle matching uncertainty and generate optimized matching degree data, specifically including the following steps: S631. Define fuzzy sets and membership functions to represent the uncertainty of matching degree; The membership function formula is as follows: ; in, Represents the membership function. Indicates input variables, Indicates a completely irrelevant threshold. This indicates the threshold for starting a highly suspicious case. This indicates a threshold for stopping highly suspicious activity; S632. Apply fuzzy rule base for reasoning to optimize matching results; S633, Generate optimized matching data; S64. Normalize the optimized matching data to generate malicious code suspicion data.

[0028] Generating malicious code detection threshold data in S7 includes the following steps: S71. Dynamically monitor historical malicious code suspicion data, calculate baseline thresholds using an exponentially weighted moving average algorithm, and generate baseline threshold data. S72. Adjust the threshold sensitivity based on real-time network load and system resource status to generate adaptive threshold parameters; S73, integrates baseline threshold data and adaptive threshold parameters to generate malicious code detection threshold data.

[0029] The steps involved in generating industrial malware detection results data in S8 are as follows: S81. Compare the suspected malicious code data with the malicious code detection threshold data. If the suspected malicious code exceeds the threshold, it is determined to be malicious code, and a preliminary judgment result is generated. S82. Integrate historical detection results and real-time context through a multi-evidence fusion algorithm to generate the final judgment result; S83. Output industrial malware detection results data, including malware type, risk level, and scope of impact.

[0030] Generating security response execution data in S9 includes the following steps: S91. When the industrial malware detection result is confirmed as positive, an audible and visual alarm and log recording are triggered. S92. Automatically execute network isolation policies to block the propagation path of malicious code; S93. Initiate the recovery procedure to roll back the affected industrial equipment to a safe state; S94. Generate security response execution data and report it to the security management platform.

[0031] The operation steps of this industrial malware detection method are as follows: Step 1: Principles of Multi-Source Industrial Safety Data Acquisition This method first collects raw network traffic data from the industrial control network using industrial firewalls and network probes to generate raw network traffic data. Simultaneously, it uses an industrial protocol parser to collect Modbus, PROFIBUS, and OPC UA industrial protocol communication data to generate raw industrial protocol data. Furthermore, it uses sensors and data acquisition modules to collect physical process data from industrial equipment, including temperature, pressure, and flow parameters, to generate raw physical process data. These data undergo timestamp alignment and data fusion processing to form multi-source industrial safety data, providing a comprehensive and consistent data foundation for subsequent analysis. Its principle lies in integrating network, protocol, and physical layer information, overcoming the data isolation shortcomings of traditional methods, and ensuring the comprehensiveness of the detection.

[0032] Step 2: Principles of Data Cleaning and Normalization Based on multi-source industrial safety data, this method performs data cleaning and normalization. The specific principles include: eliminating data noise through missing value imputation and outlier removal; smoothing the data using a sliding window algorithm; calculating the arithmetic mean of the time series data to generate preliminary cleaned data; mapping different dimensional parameters to the 0 and 1 intervals to achieve normalization and generate standardized industrial safety data; and finally, reducing storage overhead through data compression algorithms. The principle behind this step is to improve data quality, eliminate dimensional differences, provide standardized input for subsequent protocol parsing and feature extraction, and enhance detection accuracy.

[0033] Step 3: Deep Analysis of Industrial Protocol Principles This method performs in-depth analysis of standardized industrial security data to extract protocol feature parameters. In principle, it first parses industrial protocol fields, reading the raw byte stream of the protocol and parsing the protocol header, function code, and data payload features according to the protocol specification to generate basic protocol feature data. Then, based on the basic protocol feature data, it performs protocol semantic analysis to identify abnormal instruction sequences and illegal parameter assignments, generating protocol anomaly feature data. Finally, it combines an industrial protocol state machine model to verify protocol behavior compliance, detecting non-compliant events through state transition rules to generate protocol compliance feature data. These data are then integrated to form industrial protocol feature data. The underlying principle is to deeply analyze protocol semantics and behavior to identify hidden malicious instructions.

[0034] Step 4: Principles of Physical Process Correlation Analysis Based on industrial protocol feature data, this method constructs an industrial behavior context model. In principle, it first establishes a digital twin model of the industrial physical process, maps the protocol feature data to physical process variables, and generates physical process mapping data. Then, it performs causal relationship analysis based on the physical process mapping data, calculates the correlation coefficient between control commands and physical responses, identifies logical associations, generates behavioral association data, uses time series analysis algorithms to detect abnormal patterns in the physical process, analyzes time series data through an autoregressive model to generate physical anomaly context data, and integrates these data to construct an industrial behavior context model. Its principle lies in associating control commands with physical states to detect malicious behaviors that are protocol compliant but physically abnormal.

[0035] Step 5: Principles of Malicious Behavior Feature Extraction This method is based on industrial behavior context data and combines machine learning algorithms to extract malicious behavior features. In principle, it uses deep learning algorithms, employs convolutional neural networks to extract spatial features and generate spatial feature data, and uses long short-term memory networks to extract time series features and generate time series feature data. In addition, it focuses on key behavioral nodes through an attention mechanism, calculates attention weights and sums them in a weighted manner to generate weighted malicious behavior feature data. Finally, it fuses these features to generate malicious behavior feature data. Its principle is to use intelligent algorithms to learn malicious patterns from context, adapt to unknown threats, and improve the robustness of feature representation.

[0036] Step Six: Pattern Matching Processing Principles This method utilizes malicious behavior feature data and an industrial malware feature library for pattern matching to generate malware suspicion data. In principle, it first constructs a feature library containing known malware signatures, behavior patterns, and attack indicators. Then, a similarity calculation algorithm is used to calculate the Euclidean distance between the malicious behavior features and the feature library, generating initial matching data. Subsequently, a fuzzy logic algorithm is used to process the matching, and the matching results are optimized using a membership function and a fuzzy rule base to generate optimized matching data. Finally, normalization is performed to generate malware suspicion data. The underlying principle is to combine precise matching and fuzzy inference to reduce false positives and false negatives.

[0037] Step 7: Dynamic Threshold Adaptive Adjustment Principle Based on suspected malicious code data, this method performs dynamic threshold adaptive adjustment. In principle, it dynamically monitors historical data, uses an exponentially weighted moving average algorithm to calculate the baseline threshold, generates baseline threshold data, adjusts the threshold sensitivity according to real-time network load and system resource status, generates adaptive threshold parameters, and finally merges these data to generate malicious code detection threshold data. Its principle is to make the threshold adaptively adjust with environmental changes, thereby improving the sensitivity and reliability of detection.

[0038] Step 8: Principles of Malicious Code Detection Based on malware suspicion data and detection threshold data, malware judgment is performed. In principle, the suspicion level is compared with the threshold. If the level exceeds the threshold, it is judged as malware, and a preliminary judgment result is generated. Then, a multi-evidence fusion algorithm is used to integrate historical detection results and real-time context to generate a final judgment result. Finally, industrial malware detection result data is output, including type, risk level and scope of impact. The principle is to improve the accuracy of judgment by integrating multi-source evidence.

[0039] Step Nine: Full Response Execution Principle When malicious code is detected, this method triggers a real-time alarm and performs an isolation response. In principle, it first triggers an audible and visual alarm and logs the data, then automatically executes a network isolation strategy to block the propagation path of malicious code. At the same time, it starts a recovery program to roll back the affected industrial equipment to a safe state. Finally, it generates security response execution data and reports it to the security management platform. Its principle is to achieve rapid response and system recovery, minimizing the impact of malicious code.

[0040] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0041] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting industrial malware, characterized in that: The method includes the following steps: S1. Collect network traffic data, industrial protocol data, and physical process data of industrial control systems to generate multi-source industrial safety data; S2. Perform data cleaning and normalization on the multi-source industrial safety data to generate standardized industrial safety data; S3. Based on the standardized industrial security data, perform deep analysis of industrial protocols, extract industrial protocol feature parameters, and generate industrial protocol feature data. S4. Perform physical process correlation analysis based on the industrial protocol feature data, construct an industrial behavior context model, and generate industrial behavior context data. S5. Based on the industrial behavior context data and combined with machine learning algorithms, malicious behavior feature extraction processing is performed to generate malicious behavior feature data. S6. Perform pattern matching processing between the malicious behavior feature data and the industrial malicious code feature library to generate malicious code suspicion data. S7. Based on the suspected malicious code data, perform dynamic threshold adaptive adjustment to generate malicious code detection threshold data; S8. Based on the suspected malicious code data and the malicious code detection threshold data, perform malicious code determination processing to generate industrial malicious code detection result data; S9. When industrial malicious code is detected, a real-time alarm is triggered and an isolation response operation is performed, generating security response execution data.

2. The method for detecting industrial malware according to claim 1, characterized in that: The generation of multi-source industrial safety data in S1 includes the following steps: S11. Collect raw network traffic data in the industrial control network through industrial firewalls and network probes, and generate raw network traffic data. S12. Collect Modbus, PROFIBUS, and OPC UA industrial protocol communication data through the industrial protocol parser, and generate raw industrial protocol data; S13. Collect physical process data of industrial equipment through sensors and data acquisition modules, including temperature, pressure, and flow parameters, and generate raw physical process data; S14. The original network traffic data, original industrial protocol data, and original physical process data are time-stamped and fused to generate multi-source industrial safety data.

3. The method for detecting industrial malware according to claim 1, characterized in that: The generation of standardized industrial safety data in S2 includes the following steps: S21. The multi-source industrial safety data is filled with missing values ​​and outliers are removed. The sliding window algorithm is used to smooth the data and generate preliminary cleaned data. S22. Normalize the preliminary cleaning data and map different dimensional parameters to the 0, 1 interval to generate standardized industrial safety data. S23. Reduce data storage overhead through data compression algorithms to generate compressed, standardized industrial safety data.

4. The method for detecting industrial malware according to claim 1, characterized in that: The generation of industrial protocol feature data in S3 includes the following steps: S31. Parse the industrial protocol fields of the standardized industrial safety data, extract the protocol header, function code, and data payload features, and generate basic protocol feature data. S32. Perform protocol semantic analysis based on protocol basic feature data, identify abnormal instruction sequences and illegal parameter assignments, and generate protocol abnormal feature data; S33. Verify protocol behavior compliance by combining the industrial protocol state machine model and generate protocol compliance feature data; S34. Integrate basic protocol feature data, protocol anomaly feature data, and protocol compliance feature data to generate industrial protocol feature data.

5. The method for detecting industrial malware according to claim 1, characterized in that: The generation of industrial behavior context data in S4 includes the following steps: S41. Establish a digital twin model of the industrial physical process, map the industrial protocol feature data to physical process variables, and generate physical process mapping data; S42. Based on physical process mapping data, perform causal relationship analysis to identify the logical association between control commands and physical responses, and generate behavioral association data; S43. Use time series analysis algorithms to detect abnormal patterns in physical processes and generate physical anomaly context data; S44. Integrate behavioral correlation data and physical anomaly context data to construct an industrial behavioral context model and generate industrial behavioral context data.

6. The method for detecting industrial malware according to claim 1, characterized in that: The generation of malicious behavior feature data in S5 includes the following steps: S51. Use a deep learning algorithm to learn features from the industrial behavior context data, and use a convolutional neural network to extract spatial features and generate spatial feature data. S52. Use a long short-term memory network to extract time series features and generate time series feature data; S53. Focus on key behavioral nodes through an attention mechanism to generate weighted malicious behavior feature data; S54. Integrate spatial feature data, temporal feature data, and weighted malicious behavior feature data to generate malicious behavior feature data.

7. The method for detecting industrial malware according to claim 1, characterized in that: The process of generating malicious code suspicion data in S6 includes the following steps: S61. Construct an industrial malware signature database, which includes known malware signatures, behavior patterns, and attack indicators; S62. The malicious behavior feature data is matched with the industrial malicious code feature library using a similarity calculation algorithm to generate initial matching degree data; S63. Based on the fuzzy logic algorithm, handle matching uncertainty and generate optimized matching degree data; S64. Normalize the optimized matching data to generate malicious code suspicion data.

8. The method for detecting industrial malware according to claim 1, characterized in that: The process of generating malicious code detection threshold data in S7 includes the following steps: S71. Dynamically monitor historical malicious code suspicion data, calculate baseline thresholds using an exponentially weighted moving average algorithm, and generate baseline threshold data. S72. Adjust the threshold sensitivity based on real-time network load and system resource status to generate adaptive threshold parameters; S73, integrates baseline threshold data and adaptive threshold parameters to generate malicious code detection threshold data.

9. The method for detecting industrial malware according to claim 1, characterized in that: The process of generating industrial malicious code detection result data in S8 includes the following steps: S81. Compare the suspected malicious code data with the malicious code detection threshold data. If the suspected malicious code exceeds the threshold, it is determined to be malicious code, and a preliminary judgment result is generated. S82. Integrate historical detection results and real-time context through a multi-evidence fusion algorithm to generate the final judgment result; S83. Output industrial malware detection results data, including malware type, risk level, and scope of impact.

10. The method for detecting industrial malware according to claim 1, characterized in that: The process of generating security response execution data in S9 includes the following steps: S91. When the industrial malware detection result is confirmed as positive, an audible and visual alarm and log recording are triggered. S92. Automatically execute network isolation policies to block the propagation path of malicious code; S93. Initiate the recovery procedure to roll back the affected industrial equipment to a safe state; S94. Generate security response execution data and report it to the security management platform.

Images