Time delay attack detection method based on response time analysis

Abstract

The invention relates to a time delay attack detection method based on response time analysis, which specifically comprises a set of two and four periodic tasks, and the tasks share the same resource and follow a fixed priority preemptable scheduling strategy. By monitoring the response time of the low-priority observation task and combining the real-time system scheduling theory, the hidden detection of the time delay attack is realized. The result shows that whether the ongoing time delay attack exists in the network or not can be effectively detected by monitoring the response time of the task with the lowest priority. According to the method, the detection precision and sensitivity of the system to potential threats are remarkably improved, and extremely hidden and complex time delay attacks can be quickly identified and positioned. Experimental results show that the detection rate in an actual network environment reaches 94% or above and is averagely improved by about 2.4% compared with a traditional method, and the false alarm rate is reduced by about 2.4%.

Description

Technical Field

[0001] This invention relates to the field of time synchronization attack detection, specifically a time delay attack detection method based on response time analysis. Background Technology

[0002] Precision Time Protocol (PTP), a key technology for clock synchronization in packet-switched networks, relies on the exchange of timestamp messages between clients and servers to ensure data consistency. This protocol is widely used in high-precision applications such as stock market trading synchronization. It is noteworthy that PTP did not prioritize security during its standardization process, making it vulnerable to various attack methods, particularly delay attacks. In this attack model, once an attacker gains network access, they can disrupt the normal synchronization process by delaying the timestamp information in a single PTP message, thus causing multifaceted impacts on the network and its users. Although Appendix P of the IEEE 1588-2019 standard proposes several mechanisms to improve clock synchronization security, these measures are insufficient to completely defend against the threats posed by Time-Based Allocation (TDA). Therefore, Appendix P emphasizes the importance of integrating multiple security strategies and recommends enhancing the security capabilities of PTP-based networks by monitoring a range of parameters. The earlier IEEE 1588-2008 standard introduced a series of measures to enhance PTP security through Appendix K. With technological advancements, these measures have been further expanded and strengthened in Appendix P of the latest IEEE 1588-2019 standard. The new standard recommends the use of advanced security protocols such as MACsec and IPsec to achieve data source authentication, communication confidentiality assurance, data integrity checks, and prevention of replay attacks. This not only effectively prevents attempts to tamper with PTP messages but also avoids malicious message discarding or insertion, defends against denial-of-service attacks, and prevents attacks that forge master nodes. These improvements work together to significantly enhance the overall security of PTP-based systems.

[0003] Various strategies have been proposed in academic literature for the detection and mitigation of TDA (Take-Off Attack). Some of these methods focus on architectural improvements, such as introducing multiple time sources (i.e., multiple servers) between the server and client. While these schemes are theoretically sound, their practical deployment is often limited by the requirements of specific network topologies, restricting their widespread application. Another research direction focuses on setting a predefined round-trip latency threshold to detect TDA: once the actual measured value exceeds this threshold, the system is considered to be under potential TDA attack. However, this approach faces challenges in practice, especially under conditions of fluctuating network latency, which may lead to a high false positive rate. Furthermore, if attackers continuously inject latency exceeding the threshold, it may lead to denial-of-service attacks, further impacting the normal operation of the system and service provision. Therefore, while existing strategies provide theoretical solutions, more variables and potential problems need to be considered in practical applications to ensure effectiveness. In addition to the research directions mentioned above, using system timing behavior to identify anomalies has also become an important research area. A method has been proposed in the literature that uses static timing analysis to determine the maximum execution time (WCET) of each task code segment, using this as a basis for detecting unauthorized code execution. Specifically, this method involves collecting time metric data for tasks and comparing it to pre-defined worst-case thresholds. This allows the system to quickly identify potential security vulnerabilities if a task is about to exceed its predetermined time requirement. Meanwhile, some research suggests using specially designed hardware to monitor code snippet execution, rather than relying on traditional software-level monitoring. This hardware monitoring approach can more accurately measure execution time and compare these values ​​to pre-calculated WCET thresholds to detect any deviations promptly. Furthermore, it has been proposed that worst-case response time analysis techniques can be applied to establish new thresholds for task response times, which could not only optimize task execution efficiency but also serve as an effective indicator for detecting code injection attacks. Summary of the Invention

[0004] The purpose of this invention is to propose a time delay attack detection method based on response time analysis to address the problems of high synchronization complexity, the need for complex algorithms to reconcile multi-source time differences, and the potential introduction of new errors in existing research.

[0005] The objective of this invention is achieved as follows:

[0006] By monitoring the response time of low-priority observation tasks and combining it with real-time system scheduling theory, covert detection of time delay attacks was achieved.

[0007] The specific method is as follows:

[0008] A time delay attack detection method based on response time analysis includes the following steps:

[0009] Step 1: Deploy the lowest priority observation task in the client system and monitor its response time in real time;

[0010] Step 2: Construct a system model and define arrival functions for non-nominal events affected by time delay attacks;

[0011] Step 3: Based on the busy window response time analysis theory, derive the response time convergence characteristics;

[0012] Step 4: Extract time delay attack parameters based on the deviation between the actual response time and the nominal response time of the observed task;

[0013] Step 5: Input the attack parameters into the intrusion detection system to trigger the security protection mechanism;

[0014] 2. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the observation task period in step 1 is set to 1.2 times the synchronization task period, and its response time includes the interference effects of all high-priority tasks.

[0015] 3. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the non-nominal event arrival function in step 2 is defined as:

[0016]

[0017] 4. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the attack parameters in step 4 include: periodic delay δ, attack event frequency ζ. j The total system delay is Ω.

[0018] 5. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that step 3 utilizes the convergence characteristics of the busy window: defining a calculation function f i Convergence rate of (n): And through the boundary function F i (n)=ρ i n ·(w i 1 -w i 0 Limit the convergence range.

[0019] 6. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the system model includes: a trusted PTP server node, a protected client node (using MACsec / IPsec protocol), a PTP-enabled switch, and a man-in-the-middle node controlled by the attacker.

[0020] 7. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that the intrusion detection mechanism in step 5 includes: when δ>4μs and ζ is detected... j If the value is greater than 3, it is considered a valid attack, and the response time deviation threshold is set to 92% of the nominal value.

[0021] 8. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the method is implemented in a 100Mbps Ethernet environment, the synchronization error is controlled within ±19μs, and the attack detection rate is ≥94%.

[0022] 9. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that, through a resource utilization optimization strategy: the task period is generated uniformly in the interval [5, 2500] μs, and the deadline is distributed according to [T... i ,10·T i With evenly distributed configuration, system resource utilization is increased to 80%.

[0023] The positive effects of this invention are:

[0024] By monitoring the response time of low-priority observation tasks and combining it with real-time system scheduling theory, a covert detection of time delay attacks was achieved. Results show that monitoring the response time of the lowest priority tasks can effectively detect ongoing time delay attacks in the network. This method significantly improves the system's detection accuracy and sensitivity to potential threats, enabling rapid identification and localization of even extremely covert and complex time delay attacks. Experimental results show that the detection rate in a real-world network environment reaches over 94%, an average improvement of approximately 2.4% compared to traditional methods, while reducing the false positive rate by approximately 2.4%. Attached Figure Description

[0025] Figure 1 This is a flowchart of a time delay attack detection method based on response time analysis.

[0026] Figure 2 This is a simplified diagram of the pyCPA model based on the PTP network.

[0027] Figure 3 The attack parameters are δ and ζ. jDifferent values ​​of M affect the response time of the observation task k The impact diagram.

[0028] Figure 4 It is δ and ζ j Different combinations of values ​​lead to different observation tasks M k Busy window The graph reaches 255.

[0029] Figure 5 The attack parameters are δ and ζ. j For observation task M k The effect of response time is shown in the diagram.

[0030] Figure 6 This is a comparison chart of detection rates with different attack parameters δ.

[0031] Figure 7 This is a comparison chart of false positive rates for different attack parameters δ.

[0032] Figure 8 This is a comparison chart showing the relationship between system resource utilization and task set size.

[0033] Figure 9 This is a comparison chart of synchronization errors under different attack parameters.

[0034] Figure 10 This is a comparison chart of response times under different attack parameters. Detailed Implementation

[0035] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0036] like Figure 1 As shown, this invention proposes a time delay attack detection method based on response time analysis. This method deploys a lowest-priority observation task in the client system, monitors its response time changes in real time, and combines real-time system scheduling theory and busy window response time analysis technology to achieve covert detection of time delay attacks. The system first initializes the system model and time event model, sets the observation task to run with the lowest priority, and then continuously collects the response time data of the observation task, storing the collected data in a database. Next, it calculates the characteristics of response time changes during the busy window to identify abnormal fluctuations or trends. If the response time change exceeds the normal range, a time delay attack is considered possible; otherwise, monitoring continues. Finally, based on the response time changes, the key parameters of the attack are estimated, including periodic delay, attack event frequency, and total system delay. The specific technical solution of this invention includes the following steps:

[0037] Step 1: Observe the task cycle settings and deploy the lowest priority observation task M on the client system.k Its task cycle T k The task cycle Tsync is set to 1.2 times to avoid cycle overlap and reduce the impact on normal business tasks. Due to the preemptible fixed-priority scheduling strategy, observing the task response time can reflect the combined interference from all high-priority tasks. Task response times are recorded in real time by a high-precision acquisition module and stored in a time-series database, providing a data foundation for subsequent analysis.

[0038] Step 2: System Model Construction and Definition of Non-Nominal Event Arrival Functions. A system model is constructed, including trusted PTP server nodes, protected client nodes, PTP switches, and attacker man-in-the-middle nodes. Client nodes run a set of periodic tasks with defined time parameters, and nominal event arrival functions are defined for each task to describe normal activation behavior. When the system is subjected to a time delay attack, non-nominal event arrival functions are introduced to model the periodic delay in the activation of high-priority tasks.

[0039] Step 3: Busy Window Response Time Convergence Characteristic Analysis. Based on the busy window response time analysis theory, the worst-case response time of the observed task is calculated iteratively. Under attack-free conditions, the busy window calculation process exhibits stable convergence characteristics. However, when a time delay attack exists, the activation mode of high-priority tasks changes, leading to abnormal convergence speed and convergence values. By analyzing the convergence rate and boundary characteristics of the calculation function, criteria are provided for attack detection.

[0040] Step 4: Extract time delay attack parameters. By comparing the deviation between the actual response time and the nominal response time of the task, time delay attack parameters are extracted to identify abnormal response time deviations. When the deviation exceeds a preset threshold, key parameters of the time delay attack are further estimated based on the busy window convergence behavior, including the periodic delay amount δ and the attack event frequency ζ. j And the total system latency Ω. For single-task or multi-task attack scenarios, a combination of enumeration and heuristic allocation is used to determine the parameter combinations that satisfy the observation results.

[0041] Step 5: Intrusion Detection and Security Response Mechanism Triggered. The extracted attack parameters are input into the intrusion detection system, which identifies effective time-delay attacks based on multi-parameter joint judgment criteria. The system employs a layered detection mechanism, combining real-time monitoring, statistical analysis, and parameter verification to improve detection accuracy and reduce false alarm rates. Tiered security response measures are triggered based on the severity of the attack, and detection thresholds are dynamically updated and attack characteristic information is recorded.

[0042] 2. A time delay attack detection method based on response time analysis as described in claim 1. Its characteristic is that the observation task period T... kSet to 1.2 times the synchronization task cycle Tsync, i.e., T k =1.2×Tsync. This period setting ensures that the observation task does not excessively interfere with normal business tasks, while effectively capturing response time changes caused by time delay attacks. For example, when the synchronization task period is 60μs, the observation task period is set to 73.2μs. The observation task M... k Set as the lowest priority task in the system, the observation task's response time will include the interference from all high-priority tasks due to the preemptible fixed-priority scheduling strategy. This characteristic allows the observation task to comprehensively reflect the impact of time delay attacks on the entire system without requiring individual monitoring of each task, thus significantly reducing system overhead. A response time data acquisition module should be established to record the actual time from activation to completion of the observation task with microsecond-level precision. The acquisition frequency should be at least 10 times the task cycle to ensure the capture of transient changes. The acquired response time data includes task activation timestamp, task completion timestamp, actual response time, and current system load status. The collected response time data should be stored in a time-series database. The data structure should include fields such as timestamp, response time value, task identifier, and system status. The database should support efficient time-series query and statistical analysis functions to facilitate subsequent anomaly detection and attack parameter estimation.

[0043] 3. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that the non-nominal event arrival function in step 2 is defined as:

[0044]

[0045] Specifically, when constructing the system model, it is necessary to define a non-nominal event arrival function affected by a time delay attack to characterize the deviation of task activation behavior from the nominal model under attack conditions. The client system runs a set of priority-scheduled tasks T, with each task M... i With worst-case execution time C i Period or minimum arrival interval T i Deadline D i and priority P i Time parameters. The worst-case execution time is obtained through static analysis or measurement methods; the period T... i Indicates the time interval between two task activations; deadline D i Typically set in [T] i 10×T i Within the specified range, to balance scheduling feasibility and system flexibility; priority P iNumerical representation is used, with smaller values ​​indicating higher priority. Under attack-free conditions, for each task M... j Define its nominal event arrival function αj(Δt) = (Δt / T) j The function () describes the maximum number of activations a task may have within an arbitrary time window Δt. This function characterizes the worst-case arrival pattern of a task under normal operating conditions and is a crucial foundation for response time analysis and schedulability verification. When a system is subjected to a time delay attack, the activation times of some high-priority tasks will be shifted due to the delay of synchronization events, and their actual arrival behavior will no longer satisfy the assumptions of the nominal event arrival function. Attackers introduce delays periodically, i.e., every (ζ... j Delaying one of the (+1) synchronous events by δ time units alters the arrival rhythm of the tasks. To accurately describe this effect, this invention introduces a non-nominal event arrival function. In the specific implementation, the observation time window Δt is divided into several attack periods, and each attack period contains ζ. j Individual by period T j The total duration of an event that arrives normally, plus an event delayed by δ time units, is ζ. j ×T j +δ. By calculating the number of complete attack cycles contained within Δt and counting the number of normal events that may occur in the remaining time, the upper bound of the worst-case event arrival for the task within the Δt time window under attack conditions can be obtained. Compared with the nominal event arrival function, the non-nominal event arrival function reflects the event delay or merging phenomenon caused by the attack, thus appearing as a reduction in the number of event activations per unit time on the time axis. For observation task M k Define its interference set I k For all priorities higher than M k The task set. Further, based on whether the tasks are affected by time delay attacks, the interference set is divided into an unaffected task set I. k non and the set of tasks affected by time delay attacks I k TDA This division allows for the separate calculation of the interference contribution of different types of high-priority tasks to the observed task during subsequent response time analysis, thereby improving the accuracy of the analysis results. Time delay attacks utilize periodic delay amounts δ and attack frequencies ζ. j The total delay Ω within the observation window is quantified, where Ω is equal to the product of the number of delayed events and the delay amount per event, and is used to characterize the overall impact of the attack on the system's temporal behavior.

[0046] 4. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that the attack parameters in step 4 include: periodic delay δ, attack event frequency ρ, and total system delay Ω. The periodic delay δ represents the fixed delay time injected by the attacker into each PTP synchronization message during a time delay attack, measured in microseconds. This parameter directly reflects the attack intensity; the larger δ is, the more significant the time offset introduced by a single attack. The value of δ is subject to the dual constraints of network jitter and system protection mechanisms: when δ is too small (e.g., less than 1 μs), its impact may be masked by normal network jitter, making it difficult to form a stable attack effect; when δ is too large, it will lead to a significant decrease in time synchronization quality, or even trigger existing timeout or anomaly detection mechanisms, thus exposing the attack behavior. Experimental results show that in a 100Mbps Ethernet environment, the effective attack range of δ is typically 4 μs to 40 μs, where 4 μs is used as the detection sensitivity threshold, and 40 μs is close to the upper limit of the system's tolerable synchronization error. Attack event frequency ζ j Let ζ represent the number of events that an attacker allows to pass normally between two delayed injections, and ζ is a positive integer. j ≥1. This parameter reflects the frequency and stealth of the attack. When ζ j When the ζ value is small, the attack frequency is high, and the delay effect accumulates rapidly but is easier to detect; when ζ is small... j When ζ is large, the attacks are sparser, increasing stealth but weakening the cumulative effect. Experiments show that when ζ... j When the value is greater than 3, the impact of the attack on the system response time is more significant, and it can be used as one of the important criteria for judging the effectiveness of the attack. The total system delay Ω represents the total time delay introduced by the attack within an observation window, and its value is determined by δ and ζ. j The three parameters are jointly determined. Ω can be understood as the product of the number of delayed events and the amount of delay per event δ, or equivalently, as the total reduction in the response time of the observed task due to the delay of high-priority tasks. In implementation, Ω can be estimated using the convergence iteration results of the busy window calculation function under attack conditions, and is used to characterize the overall impact of the attack on the system's time behavior. There is an inherent relationship between the three parameters, which can be approximated as follows: By observing Ω and combining it with the known task period and observation window length, the possible (δ, ζ) can be deduced. j ) parameter combinations. However, since there are multiple solutions to this relationship, it is necessary to determine the parameters that best match the observation results through enumeration and verification mechanisms. The attack parameter extraction process is as follows: First, compare the actual response time of the observed task with the nominal worst-case response time. When the response time is lower than 92% of the nominal value, an anomaly judgment is triggered. Then, calculate the convergence iteration number of the busy window under the influence of the attack and estimate the total latency Ω. Next, for single-task or multi-task attack scenarios, calculate the number of latency events and the minimum periodic latency. Finally, enumerate the possible (δ, ζ) parameters within a reasonable parameter range.j The attack parameters are combined and the combination with the smallest error is selected as the final estimation result through model validation. The obtained attack parameters will serve as important inputs to the intrusion detection system for attack determination and defense decisions.

[0047] 5. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that step 3 utilizes the convergence characteristics of the busy window: defining a calculation function f i Convergence rate of (n): And through the boundary function F i (n)=ρ i n ·(w i 1 -w i 0 The convergence range is limited. Based on the fixed-priority preemptive scheduling theory of real-time systems, a busy window model is introduced to model the longest period during which the system remains busy from the release of the observed task to its completion. This time interval is determined by the execution time of the observed task itself and the cumulative interference generated by all high-priority tasks within this interval. To describe the calculation process of the busy window, a calculation function f is defined. i (n), where n represents the number of iterations, f i (n) represents the estimated busy window value obtained in the nth iteration, which approximates the worst-case response time of the observed task through recursive calculation. Under attack-free conditions, since the system task parameters are fixed and the event arrival behavior satisfies the nominal model, the calculation function stably converges to a unique solution after a finite number of iterations. To further characterize the stability of the iteration process, a convergence rate parameter of the calculation function is introduced to describe the degree of error decay between two adjacent iteration results. This convergence rate is closely related to the resource utilization rate of high-priority tasks in the system; the higher the system load, the slower the convergence process. To avoid infinite iteration or computational instability, this invention limits the range of busy window values ​​through boundary functions, providing theoretical upper and lower bounds, ensuring that the iterative calculation inevitably enters a stable interval within a finite number of iterations. When the change amplitude of the calculation function is less than a preset threshold, the busy window can be determined to have reached a convergence state. When a system is subjected to a time delay attack, the activation time of some high-priority tasks is deviated from the nominal value, and the interference distribution characteristics change accordingly. This results in a significant difference between the convergence rate and the final convergence value of the calculation function and the nominal state. By analyzing the convergence process and its changing characteristics of the busy window, the impact of time delay attacks on the system's real-time performance can be effectively identified.

[0048] 6. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that the system model comprises: a trusted PTP server node, protected client nodes (using MACsec / IPsec protocols), a PTP-enabled switch, and a man-in-the-middle node controlled by the attacker. The system model adopts a master-slave PTP time synchronization architecture, wherein the trusted PTP server node serves as a unified time reference source for the entire network, providing high-precision time synchronization services to each client node. The PTP server node is typically synchronized with a high-precision time source, such as GPS or a high-stability oscillator, to ensure the accuracy and long-term stability of the output time signal. The protected client nodes, as recipients of time synchronization information and also as deployment nodes for the time delay attack detection method, communicate with the PTP server node via the network and use MACsec or IPsec protocols to encrypt and authenticate the communication link to prevent synchronization messages from being tampered with, forged, or replayed during transmission, thereby ensuring the integrity and authenticity of the synchronization messages. The network switching equipment deployed between server and client nodes supports the PTP protocol and has transparent or boundary clock functionality. It can measure and compensate for the dwell time of synchronization messages within the switching equipment to reduce the impact of network forwarding latency on time synchronization accuracy. In this system model, an attacker is assumed to control a man-in-the-middle node in the communication path. Their attack capability primarily manifests in delaying or blocking PTP synchronization messages. However, due to the encryption and authentication mechanisms protecting the communication link, the attacker cannot directly modify or forge the message content. Under this attack capability assumption, by analyzing changes in the task response time characteristics within the client system, this invention achieves effective detection of time delay attacks.

[0049] 7. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that the intrusion detection mechanism in step 5 includes: when δ>4μs and ζ is detected... j When the value is greater than 3, it is considered a valid attack, and the response time deviation threshold is set to 92% of the nominal value. Specifically, the intrusion detection mechanism transforms the response time analysis results into security decisions by jointly judging the time delay attack parameters. The periodic delay δ is used to characterize the intensity of the time offset introduced by a single attack on the synchronization message. When δ is not greater than 4μs, this delay amplitude usually overlaps with the normal network jitter range, making it difficult to form stable and distinguishable attack characteristics; when δ exceeds 4μs, its impact on task activation timing and system response time becomes significant and can be reliably detected. Attack event frequency parameter ζ j Used to describe the sparsity of an attack, when ζ j When ζ ≤ 3, the attacks are too scattered, and their cumulative effect is insufficient to have a sustained impact on the system's scheduling behavior; when ζj When the threshold is greater than 3, the attack strikes a balance between stealth and impact, and can induce observable response time anomalies. Therefore, it is considered one of the important criteria for an effective attack. The response time deviation threshold is set to 92% of the nominal worst-case response time. This threshold is used to distinguish between normal scheduling fluctuations and abnormal changes caused by attacks. This threshold is located near the lower bound of the normal response time distribution of the system, which can effectively capture significant anomalies while avoiding misjudgments caused by natural load fluctuations.

[0050] 8. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that the method is implemented in a 100Mbps Ethernet environment, the synchronization error is controlled within ±19μs, and the attack detection rate is ≥94%. Specifically, this invention has been systematically experimentally verified in a standard-compliant real-world network environment. The experimental network includes a PTP server node, multiple client nodes, a switch supporting transparent clocks, and a man-in-the-middle node controlled by the attacker. It operates in a mixed service scenario with background traffic such as video and best-effort traffic to simulate real industrial network conditions. PTP synchronization uses a high-frequency synchronization period of 60μs, and the observation task period is set according to a 1.2x rule. Through injection tests with different time delay attack parameters, the system maintains a synchronization error within ±6μs under no-attack conditions. After introducing time delay attacks of different intensities, the synchronization error increases with the attack intensity, but even under extreme attack conditions where the periodic delay δ reaches 40μs, the synchronization error is still controlled within ±19μs, and no synchronization failure occurs, significantly outperforming existing methods based on thresholds or statistical analysis. Regarding attack detection performance, experiments cover different delay amounts δ and attack frequencies ζ. j The system was combined and repeatedly tested under each attack scenario. Results showed that the average attack detection rate of this invention reached 94.3% in the overall scenario, and approached 100% under medium to high-intensity attack conditions, significantly higher than several comparative methods. Simultaneously, through multi-parameter joint judgment, multi-layer detection mechanisms, and continuous anomaly constraints, the false alarm rate was stably controlled at approximately 4%, effectively avoiding misjudgments caused by normal network jitter and load fluctuations. Furthermore, the system's attack detection response time remained within the range of 50ms to 120ms, meeting the real-time requirements of industrial control systems.

[0051] 9. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that, through a resource utilization optimization strategy: the task period is generated in a uniform distribution within the range of [5, 2500] μs, and the deadline is set in a uniform distribution within the range of [Ti, 10·Ti], thereby increasing the system resource utilization to 80%. Specifically, firstly, a periodic real-time task set is constructed on the protected client node, with a task period T. iIt covers both high-speed control and routine business scenarios, and generates tasks in a uniform distribution within the [5, 2500] μs range to ensure a balanced distribution of tasks at different time scales; at the same time, it configures a deadline D for each task. i Its value range is [T i ,10·T i This is used to simultaneously support implicit deadline tasks and constrained deadline tasks, improving scheduling flexibility. Based on this, a unified resource utilization allocation algorithm is used to determine the worst-case execution time C for each task. i Calculations were performed to stabilize the overall system processor utilization at 80%, where task utilization ui = C. i / T i The system satisfies ∑ui = 0.8. Subsequently, tasks are scheduled based on a fixed-priority preemptive scheduling strategy. Priorities are allocated from shortest to longest task cycle. PTP time synchronization tasks and security detection-related tasks are configured with high priority, while observation tasks are configured with the lowest priority to avoid interfering with business tasks. During system operation, the worst-case response time of each task is iteratively calculated using response time analysis. When all tasks meet the condition that their response time does not exceed their corresponding deadline, the current task set is deemed schedulable. For the very few unschedulable cases, the task set is regenerated by adjusting individual task cycle or deadline parameters until the schedulability requirements are met. Through the above implementation method, while ensuring that real-time tasks are completed on time, a system resource utilization rate of up to 80% is achieved, significantly reducing processor idle time and providing a stable operating environment for time delay attack detection algorithms.

Claims

1. A time delay attack detection method based on response time analysis, characterized in that, The method includes the following steps: Step 1: Deploy the lowest priority observation task in the client system and monitor its response time in real time; Step 2: Construct a system model and define arrival functions for non-nominal events affected by time delay attacks; Step 3: Based on the busy window response time analysis theory, derive the response time convergence characteristics; Step 4: Extract time delay attack parameters based on the deviation between the actual response time and the nominal response time of the observed task; Step 5: Input the attack parameters into the intrusion detection system to trigger the security protection mechanism.

2. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, In step 1, the observation task period is set to 1.2 times the synchronous task period, and its response time includes the interference effects of all high-priority tasks.

3. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, The non-nominal event arrival function in step 2 is defined as follows:

4. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, The attack parameters in step 4 include: periodic delay amount δ, attack event frequency ζ j , system total delay amount Ω.

5. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, Step 3 utilizes the convergence property of the busy window: define the calculation function f. i Convergence rate of (n): And through the boundary function F i (n)=ρ i n ·(w i 1 -w i 0 Limit the convergence range.

6. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, The system model includes: a trusted PTP server node, a protected client node (using MACsec / IPsec protocols), a PTP-enabled switch, and a man-in-the-middle node controlled by the attacker.

7. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, The intrusion detection mechanism in step 5 includes: when δ>4μs and ζ is detected... j If the value is greater than 3, it is considered a valid attack, and the response time deviation threshold is set to 92% of the nominal value.

8. The time delay attack detection method based on response time analysis as described in claim 1, characterized in that, The method is implemented in a 100Mbps Ethernet environment, with synchronization error controlled within ±19μs and attack detection rate ≥94%.

9. A time delay attack detection method based on response time analysis as described in claim 1, characterized in that, Through resource utilization optimization strategy: task cycles are generated uniformly in the [5, 2500] μs interval, and deadlines are generated according to [T]. i ,10·T i With evenly distributed configuration, system resource utilization is increased to 80%.

Images