Industrial control intrusion detection method and system based on regionalized double-circulation federated learning

Abstract

The invention discloses an industrial control intrusion detection method and system based on regionalized double-circulation federated learning, and the method comprises the steps: dividing all industrial control systems into a plurality of federated subsets based on a plurality of distance dimensions, and can automatically adapt to the dynamic change of a working condition system compared with the conventional single-dimension distance clustering grouping, thereby improving the detection efficiency. In addition, a double-loop knowledge sharing training architecture composed of loop knowledge sharing in federal subsets and loop knowledge sharing between federal subsets is also constructed, and compared with an existing one-way training mode, the model sharing range is limited, global broadcast is avoided, cross-subset information leakage and communication overhead are reduced, and the method has the advantages of being high in practicability and easy to popularize. According to the method, the privacy risk is reduced, the safety and controllability are greatly improved, double circulation of knowledge sharing is also realized, a high-performance model can circularly influence a low-performance model, and the overall detection capability is improved, so that the accuracy and generalization capability of intrusion detection of the industrial control system are greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control system intrusion detection, in particular, to an industrial control intrusion detection method and system based on regionalized double-cycle federated learning, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With the development of digitalization and networking of Industrial Control Systems (ICS), industrial control systems are facing increasingly severe network security threats such as malware attacks, data tampering, denial of service attacks (DoS), etc. Traditional Intrusion Detection Systems (IDS) usually adopt a centralized training method, i.e. all industrial control device data is uploaded to a central server for unified model training, and then the trained model is distributed to each industrial control device for intrusion detection. However, since industrial control systems involve critical infrastructure (such as power, transportation, manufacturing, etc.), their operation data is highly sensitive, and centralized storage and training may lead to data leakage risks; moreover, industrial control devices usually have limited computing power, and frequent uploading of large amounts of data can cause network congestion and delay, resulting in high communication and computing overhead; in addition, the data distribution (such as attack patterns, network traffic characteristics) of industrial control systems in different factories, industries or regions differs greatly, and due to the heterogeneity of data, global federated learning may lead to a decrease in model generalization ability.

[0003] Therefore, in order to improve the defects existing in the global federated learning mechanism, the existing research proposes a hierarchical federated learning mechanism based on clustering, which first clusters all industrial control devices based on network distance, then performs federated training within each cluster group to obtain a local model, and finally aggregates the models of each group at the global level to form the final detection model. However, the existing hierarchical federated learning mechanism based on clustering only clusters based on network distance, and the grouping method is fixed, which cannot adapt to the dynamic changes of industrial control systems, such as new devices joining, network topology changes, etc., and has poor generalization ability; moreover, the training mode is one-way, i.e. the model is only aggregated from local to global, lacking of cyclic reverse knowledge sharing, which makes it difficult for high-performance models to transfer knowledge to low-performance models, and the overall detection ability needs to be improved. Therefore, the existing industrial control intrusion detection method based on hierarchical federated learning mechanism has the problems of poor generalization ability and detection accuracy needs to be improved. In addition, since the models in each group use fixed weights when fusing, the contribution difference of different models is not considered, resulting in poor robustness and accuracy of the fused model, thereby leading to poor robustness and accuracy of the intrusion detection method. SUMMARY

[0004] The application provides an industrial control intrusion detection method and system based on regionalized double-cycle federated learning, an electronic device and a computer readable storage medium, which can improve the accuracy and generalization ability of industrial control system intrusion detection.

[0005] According to one aspect of the application, an industrial control intrusion detection method based on regionalized double-cycle federated learning is provided, including the following contents: All industrial control systems participating in federated intrusion detection model training are divided into multiple federated subsets based on multidimensional distance, wherein the multidimensional distance includes network distance, business scenario similarity distance and security posture similarity distance; A double-cycle knowledge sharing training architecture is constructed based on the multiple federated subsets for model training until the model converges, wherein the double-cycle knowledge sharing training architecture includes intra-federated subset cycle knowledge sharing and inter-federated subset cycle knowledge sharing; Based on the converged model, an intrusion detection task is performed.

[0006] Further, the process of constructing a double-cycle knowledge sharing training architecture based on the multiple federated subsets for model training until the model converges includes the following contents: Based on the security score of each working condition system, an intra-federated subset cycle knowledge sharing training architecture and an inter-federated subset cycle knowledge sharing training architecture are respectively constructed in descending order of security score; The performance scores of the inter-federated subset shared model, the intra-federated subset shared model and the current local model are respectively evaluated using the local validation set; The dynamic weights of the inter-federated subset shared model and the intra-federated subset shared model are calculated based on the performance scores of the above three models; Double-cycle knowledge sharing training is performed using the local training set, and a double-teacher knowledge sharing loss function is constructed based on the dynamic weights of the inter-federated subset shared model and the intra-federated subset shared model until the performance of the current local model is stable; Based on the preset cycle path, the local stable model is shared between all industrial control systems.

[0007] Further, the dynamic weights of the inter-federated subset shared model and the intra-federated subset shared model are calculated based on the following formula: ; ; wherein, and represent the dynamic weights of the inter-federated subset shared model and the intra-federated subset shared model, and represent the performance scores of the inter-federated subset shared model and the intra-federated subset shared model, denotes the attenuation intensity coefficient, and denote the sliding variance of past rounds of performance scores of the federated inter-subset shared model and the federated intra-subset shared model, respectively, denotes the model k belongs to any one of the federated inter-subset shared model, the federated intra-subset shared model and the current local model.

[0008] Further, the double-teacher knowledge sharing loss function is: ; wherein, denotes the double-teacher knowledge sharing loss, denotes the distance loss of the local model and the federated inter-subset shared model, denotes the distance loss of the local model and the federated intra-subset shared model, denotes the cross-entropy loss of the local model classification.

[0009] Further, the process of sharing the model between all industrial control systems based on the preset cyclic path for the local stable model includes the following contents: updating the intra-subset shared model of the federated subset to which the local stable model belongs, and determining whether the node where the local stable model is located is the last node of the federated subset to which the local stable model belongs, if not, pushing the local stable model to the next node in the federated subset to which the local stable model belongs, if yes, pushing the local stable model to the first node in the federated subset to which the local stable model belongs, thereby completing the model sharing in the federated subset to which the local stable model belongs; updating the inter-federated shared model based on the updated intra-federated shared model, and determining whether the federated subset is the last subset, if not, pushing the local stable model to the next federated subset, if yes, pushing the local stable model to the first federated subset.

[0010] Further, the process of dividing all industrial control systems participating in the federated intrusion detection model training into multiple federated subsets based on multi-dimensional distance includes the following contents: constructing a multi-dimensional weighted distance matrix between industrial control systems based on network distance, business scenario similarity distance and security posture similarity distance; performing clustering based on the weighted distance matrix using a spectral clustering algorithm with KL divergence constraint to obtain multiple federated subsets.

[0011] Further, the multi-dimensional weighted distance between industrial control systems is calculated based on the following formula: ; wherein, denotes the weighted distance, denotes the network distance, represents a business scenario similarity distance, represents a security posture similarity distance, , , represents a business scenario similarity distance between industrial control system i and industrial control system j, and respectively represent a business feature vector of industrial control system i and industrial control system j, represents a security posture similarity distance between industrial control system i and industrial control system j, and respectively represent a historical security posture feature vector of industrial control system i and industrial control system j, , , represents a weight coefficient, .

[0012] In addition, the present application also provides an industrial control intrusion detection system based on regionalized double-cycle federated learning, comprising: a federal subset division module, configured to divide all industrial control systems participating in federated intrusion detection model training into multiple federal subsets based on multidimensional distance, wherein the multidimensional distance includes network distance, business scenario similarity distance and security posture similarity distance; a double-cycle model training module, configured to construct a double-cycle knowledge sharing training architecture based on the multiple federal subsets to perform model training until the model converges, wherein the double-cycle knowledge sharing training architecture includes intra-federal subset cycle knowledge sharing and inter-federal subset cycle knowledge sharing; an intrusion detection module, configured to perform an intrusion detection task based on the converged model.

[0013] In addition, the present application also provides an electronic device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to execute the steps of the method described above by invoking the computer program stored in the memory.

[0014] In addition, the present application also provides a computer readable storage medium for storing a computer program for industrial control intrusion detection based on regionalized double-cycle federated learning, wherein the computer program executes the steps of the method described above when running on a computer.

[0015] The present application has the following advantages: The industrial control intrusion detection method based on the regionalized double-cycle federal learning provided by the present application first divides all industrial control systems participating in federal intrusion detection model training into multiple federal subsets based on multiple distance dimensions, compared with the existing single-dimensional distance clustering grouping, can automatically adapt to the dynamic changes of the system, improves the generalization ability of the algorithm, and further constructs a double-cycle knowledge sharing training framework composed of intra-federal subset cycle knowledge sharing and inter-federal subset cycle knowledge sharing, compared with the existing one-way training mode, not only limits the model sharing range, avoids global broadcasting, reduces cross-subset information leakage and communication overhead, reduces privacy risks, greatly improves security and controllability, and further realizes double-cycle knowledge sharing, so that the high-performance model can cyclically affect the low-performance model, improves the overall detection capability, and greatly improves the accuracy and generalization ability of the industrial control system intrusion detection.

[0016] In addition, the industrial control intrusion detection system based on the regionalized double-cycle federal learning provided by the present application also has the above advantages.

[0017] In addition to the purposes, features and advantages described above, the present application has other purposes, features and advantages. The present application will be further described below with reference to the drawings. BRIEF DESCRIPTION OF DRAWINGS

[0018] The accompanying drawings, which form a part of this application, are included to provide a further understanding of the application, and are incorporated in and constitute a part of this application. The embodiments of the present application and their description are used to explain the present application, and do not constitute an improper limitation on the present application. In the drawings: Figure 1 is a flowchart of the industrial control intrusion detection method based on the regionalized double-cycle federal learning of the preferred embodiment of the present application; Figure 2 is a subflowchart of step S1 in Figure 1 Figure 3 is a subflowchart of step S2 in Figure 1 Figure 4 is a block diagram of the industrial control intrusion detection system based on the regionalized double-cycle federal learning of another embodiment of the present application. DETAILED DESCRIPTION

[0019] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the drawings and in combination with the embodiments.

[0020] With reference to Figure 1 The preferred embodiment of the present application provides an industrial control intrusion detection method based on regionalized double-cycle federal learning, including the following contents: ​​Step S1: divide all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multi-dimensional distances, wherein the multi-dimensional distances include network distance, business scenario similarity distance, and security posture similarity distance; Step S2: construct a double-cycle knowledge sharing training architecture based on the multiple federated subsets to perform model training until the model converges, wherein the double-cycle knowledge sharing training architecture includes intra-federated subset cycle knowledge sharing and inter-federated subset cycle knowledge sharing; Step S3: perform an intrusion detection task based on the converged model.

[0021] It can be understood that the industrial control intrusion detection method based on regionalized double-cycle federated learning of the embodiment first divides all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multiple distance dimensions. Compared with the existing single-dimensional distance clustering grouping, it can automatically adapt to the dynamic changes of the industrial control system, improve the generalization ability of the algorithm, and further construct a double-cycle knowledge sharing training architecture composed of intra-federated subset cycle knowledge sharing and inter-federated subset cycle knowledge sharing. Compared with the existing one-way training mode, not only is the model sharing range limited to avoid global broadcasting, but also the cross-subset information leakage and communication overhead are reduced, the privacy risk is reduced, the security and controllability are greatly improved, and the double-cycle knowledge sharing is realized. The high-performance model can cyclically affect the low-performance model, improving the overall detection capability, thereby greatly improving the accuracy and generalization ability of the industrial control system intrusion detection.

[0022] In the step S1, as shown in the formula (1), the process of dividing all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multi-dimensional distances includes the following contents: Figure 2 The process of dividing all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multi-dimensional distances includes the following contents: Step S11: construct a multi-dimensional weighted distance matrix between industrial control systems based on network distance, business scenario similarity distance, and security posture similarity distance; Step S12: perform clustering based on the weighted distance matrix using a KL divergence constrained spectral clustering algorithm to obtain multiple federated subsets.

[0023] Specifically, for the set of all industrial control systems participating in the training of the federated intrusion detection model , n wherein n represents the number of industrial control systems, the network distance, the business scenario similarity distance, and the security posture similarity distance between any two industrial control systems are calculated first, and then the weighted distance between any two industrial control systems is calculated to construct a multi-dimensional weighted distance matrix between industrial control systems.

[0024] wherein the network distance is calculated based on the following formula: , represents the network distance between the industrial control system i and the industrial control system j, represents the network communication delay between the industrial control system i and the industrial control system j, and respectively represent the maximum network delay and the minimum network delay between two industrial control systems; the business scenario similarity distance is calculated based on the following formula: , represents the business scenario similarity distance between the industrial control system i and the industrial control system j, and respectively represent the business feature vectors of the industrial control system i and the industrial control system j, which are constructed according to the proportion of the main industrial control protocols running on the industrial control equipment, and the specific construction process belongs to the prior art and will not be repeated here; the security situation similarity distance is calculated based on the following formula: , represents the security situation similarity distance between the industrial control system i and the industrial control system j, and respectively represent the historical security situation feature vectors of the industrial control system i and the industrial control system j, and each dimension of the vector represents a specific industrial control type of attack, and the value is the number of times that the industrial control equipment has been attacked in the history. Finally, the multi-dimensional weighted distance between the industrial control systems is calculated based on the following formula: ; wherein, represents the weighted distance, represents the network distance, represents the business scenario similarity distance, represents the security situation similarity distance, , , represents the weight coefficient, , the present application preferably .

[0025] Then, based on the weighted distance matrix, a spectral clustering algorithm with KL divergence constraint is used for clustering, and the industrial control systems with similar weighted distances are combined into a federation subset, which can constrain the difference between the local model and the shared model through the KL divergence, avoid knowledge forgetting, and ensure the data distribution consistency within the federation subset through the spectral clustering algorithm, and the multiple federation subsets obtained can be represented as , m represents the number of federation subsets, and satisfies .

[0026] It is understood that this invention, starting from three distance dimensions—network transmission, service similarity, and historical attack pattern similarity—divides all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets. Compared to existing single-dimensional distance clustering, this approach can automatically adapt to the dynamic changes in the operating system, improving the algorithm's generalization ability. Furthermore, a KL divergence-constrained spectral clustering algorithm is employed for clustering, ensuring data distribution consistency within the federated subsets and providing a theoretical foundation for subsequent knowledge distillation.

[0027] Additionally, in step S2, as Figure 3 As shown, the process of training the model by constructing a dual-loop knowledge-sharing training architecture based on multiple federated subsets until the model converges includes the following: Step S21: Based on the safety score of each working system, construct the inner loop knowledge sharing training architecture within the federated subset and the outer loop knowledge sharing training architecture between federated subsets in descending order; Step S22: Evaluate the performance scores of the shared model between federated subsets, the shared model within federated subsets, and the current local model using the local validation set; Step S23: Calculate the dynamic weights of the shared model between federated subsets and the shared model within federated subsets based on the performance scores of the three models mentioned above; Step S24: Perform double-loop knowledge sharing training using the local training set, and construct a dual-teacher knowledge sharing loss function based on the dynamic weights of the shared model between federated subsets and the shared model within federated subsets, until the performance of the current local model is stable; Step S25: Based on the preset loop path, perform model sharing between all industrial control systems on the local stable model.

[0028] Specifically, first obtain the security score for each industrial control system. The security score is calculated based on the historical attack identification rate of the industrial control system. The higher the identification rate, the higher the security score. The specific calculation process of the security score is existing technology and will not be elaborated here. Of course, in other embodiments of the present invention, the historical attack identification rate can also be directly used as the security score. For multiple industrial control systems within each federated subset, they are sorted and numbered in descending order of security score, and the subset is trained in descending order of number to construct an inner-loop knowledge-sharing training architecture within the federated subset. Similarly, for multiple federated subsets, the number of each federated subset is also determined by sorting the average security score of the industrial control systems within the subset in descending order. All federated subsets are trained in descending order of number to construct an outer-loop knowledge-sharing training architecture between federated subsets.

[0029] It can be understood that the present application constructs a double-cycle knowledge sharing training framework composed of intra-federal subset cycle knowledge sharing and inter-federal subset cycle knowledge sharing. Compared with the existing one-way training mode, not only the model sharing range is limited, avoiding global broadcast, reducing cross-subset information leakage and communication overhead, reducing privacy risk, greatly improving security and controllability, but also realizing double-cycle knowledge sharing, making high-performance models cyclically affect low-performance models, improving the overall detection capability, thereby greatly improving the accuracy and generalization ability of industrial control system intrusion detection. Moreover, based on the order of the safety score of the industrial control system from large to small, the knowledge sharing training is sequentially performed from large to small, which enhances the safety orientation.

[0030] Then, the performance scores of the inter-federal subset shared model , the intra-federal subset shared model and the current local model are respectively evaluated by using the local verification set, wherein the performance score can be determined based on the attack identification accuracy of the model. The higher the attack identification accuracy, the higher the performance score. The specific performance score process belongs to the prior art and will not be described here. Of course, the attack identification accuracy can also be directly used as the performance score. For example, the performance score of the inter-federal subset shared model can be represented as: The performance score of the intra-federal subset shared model can be represented as: The performance score of the current local model can be represented as: , , and respectively represent the performance scores of the inter-federal subset shared model, the intra-federal subset shared model and the current local model, represents the local verification set.

[0031] Next, the dynamic weights of the inter-federal subset shared model and the intra-federal subset shared model are calculated based on the performance scores of the above three models. The specific calculation formula is: ; ; wherein and respectively represent the dynamic weights of the inter-federal subset shared model and the intra-federal subset shared model, and respectively represent the performance scores of the inter-federal subset shared model and the intra-federal subset shared model, represents the decay intensity coefficient, preferably 1.5, and respectively represent the sliding variances of the performance scores of the inter-federal subset shared model and the intra-federal subset shared model in the past multiple rounds, Representation Model k It belongs to any of the following models: inter-federal subset sharing model, intra-federal subset sharing model, and current local model. For example, and The sliding variance of the model performance scores from the past 5 rounds can be used, and the calculation formula is as follows: ,in, and represents the moving average of the performance scores of the shared model between federated subsets and the shared model within federated subsets on the local validation set over the past 5 rounds, respectively.

[0032] Then, a dual-loop knowledge-sharing training process is performed using the local training set. The local model is guided by both the inter-fed subset sharing model and the intra-fed subset sharing model, improving the dynamic adaptability of the model training and enabling it to quickly adapt to new attacks. Furthermore, a dual-teacher knowledge-sharing loss function is constructed based on the dynamic weights of the inter-fed subset sharing model and the intra-fed subset sharing model. The dual-teacher knowledge-sharing loss function is as follows: ; in, This indicates the loss of knowledge sharing between two teachers. This represents the distance loss between the local model and the shared model between the federated subsets. , This represents the distance loss between the local model and the shared model within the federated subset. , This represents the cross-entropy loss for classification by the local model. , This represents samples from the local training set. C The number of labels indicating the category. Indicates sample The true label vector in one-hot encoded form, , Represents the local model Will The probability distribution of classification into each category. Continuously conduct dual-cycle knowledge-sharing training until knowledge sharing between the two teachers is lost. If the decrease is less than a preset threshold (e.g., 0.15) for two consecutive rounds, the local model is considered to have stable performance.

[0033] Finally, the local stable model is shared among all industrial control systems based on a preset loop path. Specifically, the process of sharing the local stable model among all industrial control systems based on a preset loop path includes the following: The local stable model is used for updating the intra-subset shared model of the subset to which the local stable model belongs, and it is determined whether the node where the local stable model is located is the last node of the subset to which the local stable model belongs. If not, the local stable model is pushed to the next node in the subset to which the local stable model belongs. If yes, the local stable model is pushed to the first node in the subset to which the local stable model belongs, so as to complete the model sharing in the subset to which the local stable model belongs. The updated intra-subset shared model is used for updating the inter-subset shared model, and it is determined whether the subset is the last subset. If not, the local stable model is pushed to the next subset. If yes, the local stable model is pushed to the first subset.

[0034] It can be understood that the performance scores of the inter-subset shared model, the intra-subset shared model and the current local model are calculated by using the local validation set respectively, and then the dynamic weights of the inter-subset shared model and the intra-subset shared model are calculated based on the performance scores of the respective models. Not only the dynamic change of the weights is realized, but also the high-performance model has a greater impact on the local low-performance model. In addition, the hierarchical training method is adopted, the intra-subset model is optimized first, and then the global generalization ability is improved through inter-subset sharing. The intra-subset cycle and the inter-subset cycle are alternately performed, realizing the double-cycle training mechanism of the intra-subset small-scale exchange as the main and the inter-subset sparse interaction. This is conducive to reducing redundant communication. The double-teacher knowledge sharing loss function is constructed based on the dynamic weights, realizing the double-teacher knowledge distillation, so as to greatly improve the training efficiency, convergence speed and dynamic adaptability of the model training, so that the local model can quickly adapt to new attacks. At the same time, by introducing the exponential term in the weight calculation function, the model stability can be quantified into the weight calculation. In addition, the decay strength coefficient can effectively suppress the negative impact of the high-variance model, and the stability is improved.

[0035] Optionally, the application also designs a cycle knowledge sharing weight freezing mechanism. When the performance score of the inter-subset shared model or the intra-subset shared model is significantly lower than the performance score of the current local model, for example, the difference between the attack recognition accuracy of the current local model and the attack recognition accuracy of the inter-subset shared model or the intra-subset shared model is greater than a preset threshold (for example, 0.3), the weight is frozen, that is, or , until the next round of validation performance recovers, so that the invalid propagation of the low-performance model can be avoided, and the communication overhead is reduced.

[0036] In addition, in the step S3, after completing the model sharing according to the cycle path, each industrial control system can perform an intrusion detection task based on the local model.

[0037] In addition, as Figure 4As shown, the application also provides an industrial control intrusion detection system based on regionalized double-cycle federated learning, preferably using the industrial control intrusion detection method based on regionalized double-cycle federated learning as described above, comprising: a federated subset division module for dividing all industrial control systems participating in federated intrusion detection model training into multiple federated subsets based on multi-dimensional distances, wherein the multi-dimensional distances include network distance, business scenario similarity distance and security posture similarity distance; a double-cycle model training module for constructing a double-cycle knowledge sharing training architecture based on the multiple federated subsets for model training until the model converges, wherein the double-cycle knowledge sharing training architecture includes intra-federated subset cycle knowledge sharing and inter-federated subset cycle knowledge sharing; an intrusion detection module for performing an intrusion detection task based on the converged model.

[0038] It can be understood that the industrial control intrusion detection system based on regionalized double-cycle federated learning of the embodiment first divides all industrial control systems participating in federated intrusion detection model training into multiple federated subsets based on multiple distance dimensions, which can automatically adapt to the dynamic changes of the working condition system compared to the existing single-dimensional distance clustering grouping, improving the generalization ability of the algorithm. Moreover, a double-cycle knowledge sharing training architecture composed of intra-federated subset cycle knowledge sharing and inter-federated subset cycle knowledge sharing is constructed, which not only limits the model sharing range, avoids global broadcasting, reduces cross-subset information leakage and communication overhead, reduces privacy risks, greatly improves security and controllability compared to the existing one-way training mode, and also realizes double-cycle knowledge sharing, so that high-performance models can cyclically affect low-performance models, improving the overall detection capability, thereby greatly improving the accuracy and generalization ability of industrial control system intrusion detection.

[0039] In addition, the application also provides an electronic device comprising a processor and a memory, wherein the memory stores a computer program, and the processor is configured to execute the steps of the method as described above by invoking the computer program stored in the memory.

[0040] In addition, the application also provides a computer-readable storage medium for storing a computer program for industrial control intrusion detection based on regionalized double-cycle federated learning, wherein the computer program executes the steps of the method as described above when running on a computer.

[0041] The computer readable storage medium can be a machine-readable storage medium, a machine-readable communication medium, or any combination thereof. Examples of the computer readable storage medium include, but are not limited to: an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, a portable computer diskette (magnetic), a RAM (Random Access Memory), a flash memory card, a volatile memory, a non-volatile memory, a ROM (Read Only Memory), an erasable programmable ROM (EPROM), a FLASH-EPROM, any other memory chip or cartridge, or any other tangible or non-transitory medium suitable for storing or transmitting computer software.

[0042] Those skilled in the art will appreciate that embodiments of the present application can be further implemented in a computer program product tangibly embodied in a machine-readable storage medium (e.g., magnetic disk s, optical disks, memory, etc.) including a sequence of instructions designed for execution on a machine. The program product can also be implemented in a portable or non-portable computer program product that includes a sequence of instructions designed for execution on a machine. The program product can be further implemented in an information storage medium that is readable by a machine.

[0043] The present application is described in terms of exemplary embodiments, devices (systems), and computer program products in flowcharts and / or block diagrams. It will be understood that each block of the flowchart and / or block diagrams, and / or combinations of blocks in the flowchart and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 The flowchart and / or block diagrams in the present application can illustrate a flow of the processes and / or functions in one or more of the embodiments of the present application. It will also be understood that each block of the flowchart and / or block diagrams and / or combinations of blocks in the flowchart and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 The flowchart and / or block diagrams in the present application can illustrate a flow of the processes and / or functions in one or more of the embodiments of the present application. It will also be understood that each block of the flowchart and / or block diagrams and / or combinations of blocks in the flowchart and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing element or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks.

[0044] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0046] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0047] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An industrial control system intrusion detection method based on regionalized dual-loop federated learning, characterized in that, Includes the following: Based on multi-dimensional distance, all industrial control systems participating in the training of the federated intrusion detection model are divided into multiple federated subsets. The multi-dimensional distance includes network distance, business scenario similarity distance, and security posture similarity distance. The model is trained by constructing a dual-loop knowledge-sharing training architecture based on multiple federated subsets until the model converges. The dual-loop knowledge-sharing training architecture includes loop knowledge sharing within federated subsets and loop knowledge sharing between federated subsets. Intrusion detection tasks are performed based on the converged model.

2. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 1, characterized in that, The process of training the model using a dual-loop knowledge-sharing training architecture built on multiple federated subsets until the model converges includes the following: Based on the safety score of each working system, the inner loop knowledge sharing training architecture within the federated subset and the outer loop knowledge sharing training architecture between federated subsets are constructed in descending order of safety score. The performance scores of the shared model between federated subsets, the shared model within federated subsets, and the current local model are evaluated using the local validation set. The dynamic weights of the shared model between federated subsets and the shared model within federated subsets are calculated based on the performance scores of the three models mentioned above. Double-loop knowledge sharing training is performed using the local training set, and a dual-teacher knowledge sharing loss function is constructed based on the dynamic weights of the shared model between federated subsets and the shared model within federated subsets, until the performance of the current local model is stable. Based on a preset loop path, the local stable model is shared among all industrial control systems.

3. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 2, characterized in that, The dynamic weights of the shared model between federated subsets and the shared model within federated subsets are calculated based on the following formula: ； ； in, and These represent the dynamic weights of the shared model between federated subsets and the shared model within federated subsets, respectively. and These represent the performance scores of the shared model between federated subsets and the shared model within federated subsets, respectively. Indicates the attenuation intensity coefficient. and These represent the sliding variances of the shared model between federated subsets and the shared model within federated subsets over multiple rounds of performance scoring, respectively. Representation Model k It belongs to any of the following models: shared model between federated subsets, shared model within federated subsets, and current local model.

4. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 3, characterized in that, The loss function for dual-teacher knowledge sharing is: ； in, This indicates the loss of knowledge sharing between two teachers. This represents the distance loss between the local model and the shared model between the federated subsets. This represents the distance loss between the local model and the shared model within the federated subset. This represents the cross-entropy loss for classification by the local model.

5. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 2, characterized in that, The process of sharing the local stable model among all industrial control systems based on a preset loop path includes the following: The shared model within the subset of the federated subset is updated based on the local stable model. It is determined whether the node where the local stable model is located is the last node of the federated subset. If not, the local stable model is pushed to the next node in the federated subset. If so, the local stable model is pushed to the first node in the federated subset, thereby completing the model sharing within the federated subset. Based on the updated shared model within the federated subset, the shared model between federated subsets is updated, and it is determined whether the federated subset is the last subset. If not, the local stable model is pushed to the next federated subset; if so, the local stable model is pushed to the first federated subset.

6. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 1, characterized in that, The process of dividing all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multi-dimensional distance includes the following: A multi-dimensional weighted distance matrix is ​​constructed between industrial control systems based on network distance, business scenario similarity distance, and security situation similarity distance; Clustering is performed using a spectral clustering algorithm with KL divergence constraints based on a weighted distance matrix, resulting in multiple federated subsets.

7. The industrial control system intrusion detection method based on regionalized dual-loop federated learning as described in claim 6, characterized in that, The weighted distance between industrial control systems is calculated using the following formula: ； in, Indicates the weighted distance. Indicates network distance. Indicates the distance between businesses with similar business scenarios. Indicates a distance indicating similar security situations. , , This represents the business scenario similarity distance between industrial control system i and industrial control system j. and Let these represent the business feature vectors of industrial control system i and industrial control system j, respectively. This represents the distance between industrial control systems i and j, indicating the similarity in their security situations. and These represent the historical security status feature vectors of industrial control system i and industrial control system j, respectively. , , Indicates the weighting coefficient. .

8. An industrial control system intrusion detection system based on regionalized dual-loop federated learning, characterized in that, include: The federated subset partitioning module is used to divide all industrial control systems participating in the training of the federated intrusion detection model into multiple federated subsets based on multi-dimensional distances, including network distance, business scenario similarity distance, and security posture similarity distance. The dual-loop model training module is used to build a dual-loop knowledge-sharing training architecture based on multiple federated subsets for model training until the model converges. The dual-loop knowledge-sharing training architecture includes loop knowledge sharing within federated subsets and loop knowledge sharing between federated subsets. The intrusion detection module is used to perform intrusion detection tasks based on the converged model.

9. An electronic device, characterized in that, The method includes a processor and a memory, wherein the memory stores a computer program, and the processor executes the steps of the method as described in any one of claims 1 to 7 by calling the computer program stored in the memory.

10. A computer-readable storage medium for storing a computer program for industrial control system intrusion detection based on regionalized dual-loop federated learning, characterized in that, The computer program, when run on a computer, performs the steps of the method as described in any one of claims 1 to 7.

Images