Federal cooperative security defense method and system for industrial control network

Abstract

The invention provides a federal cooperative security defense method and system for an industrial control network, and relates to the technical field of terminal antivirus, and the method comprises the steps: carrying out the lightweight collection of a microsecond timestamp and a logic response, converting the complex calculation into the low-overhead measurement of an execution entropy and an echo vector, achieving the quantization of an execution state through nonlinear mapping, and achieving the real-time detection of the execution state. The real-time performance is ensured; meanwhile, the resource occupation and defense efficiency decoupling is realized; the core adopts a tensor integrating operator to fuse the characteristics of a computational domain and a communication domain, and the malicious load hidden in time sequence distortion is accurately identified by capturing the mode value variation under the resonance gain; triggering two-way linkage in combination with dynamic benchmark verification: executing micro-isolation blocking in a communication layer, implementing reputation descending right in a federal layer, and supporting self-adaptive defense switching under channel failure; a cross-layer depth defense system from a physical execution state to a model aggregation state is constructed, and the problem of balance between security and real-time control performance of the embedded terminal is solved.

Description

Technical Field

[0001] This invention relates to the field of terminal antivirus technology, specifically to a federated collaborative security defense method and system for industrial control networks. Background Technology

[0002] In industrial control network environments, terminal devices, including smart meters and sensor nodes, are highly vulnerable to attacks from targeted worms, logic variant viruses, and other covert malicious software.

[0003] The existing technology, with publication number CN120434054B, entitled "A Method for Defending Against Backdoor Attacks in Federated Learning Based on a Multi-Layer Collaborative Defense Strategy," addresses the shortcomings of existing technologies in federated learning, which often only cover single-point protection at a certain stage, lacking systematic and robust defense for the entire process, and exhibiting weak backdoor attack detection capabilities and low model recovery efficiency. It proposes a multi-layered defense framework that spans the entire federated learning lifecycle (training, aggregation, and deployment). This framework establishes special information flow channels, a global security assessment system, and an adaptive resource allocation strategy between each layer, organically combining the three defense layers into a collaborative whole. This collaborative mechanism not only improves the effectiveness of individual defense layers but also achieves a synergistic effect, providing a comprehensive and intelligent backdoor attack defense solution for federated learning systems.

[0004] However, existing technologies often suffer from technical drawbacks such as terminal computing overload and poor cross-layer correlation, as detailed below:

[0005] Regarding terminal computing overload, the aforementioned existing technologies require industrial terminals (such as low-power PLCs, smart meters, and sensor nodes) to perform complex "random disturbance" and "dynamic dropout" calculations and conduct real-time anomaly detection at the first defense layer. However, terminals in industrial control networks are typically embedded devices with extremely limited computing resources and memory. This high-intensity local defense computing can significantly increase processing latency and even interfere with the execution of real-time control commands, threatening deterministic communication on industrial production lines.

[0006] Regarding poor cross-layer correlation, existing solutions mainly target "model backdoor attacks (weight contamination)" in the federated learning process, but neglect the more prevalent "endpoint virus / worm attacks" in the Industrial Internet of Things (IIoT). Traditional industrial viruses (such as targeted viruses against instruments) exhibit abnormal protocol behavior, illegal command injection, or virus propagation between sensor networks. However, existing technologies only perform similarity detection at the mathematical vector level, which cannot effectively identify and block malicious virus payloads hidden in industrial control protocol data packets, resulting in superficial defenses against "endpoint viruses" and "IoT worms."

[0007] The information disclosed in the background section above is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0008] The purpose of this invention is to provide a federated collaborative security defense method and system for industrial control networks to solve the problems mentioned in the background art.

[0009] To achieve the above objectives, the present invention provides the following technical solution:

[0010] A federated collaborative security defense approach for industrial control networks includes the following steps:

[0011] S1. Obtain the micro-time sequence event stream data of the internal running tasks of the industrial terminal, and obtain the topology response delay data of the industrial terminal in response to the probe pulse;

[0012] S2. Perform ordered measurement on the micro-time-series event stream data to generate instruction stream execution entropy characterizing the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector characterizing the network logic impedance characteristics.

[0013] S3. Based on the execution state logic impedance calculation model, perform nonlinear correlation processing on the instruction flow execution entropy and the logic echo attenuation vector to generate an execution state logic impedance composite tensor for characterizing the resonance intensity of the global virus infection field.

[0014] S4. Based on the consistency verification between the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, output an indication signal for the terminal infection status;

[0015] S5. Based on the indicated signal, synchronously execute the adjustment of the communication access control policy for the industrial terminal, and the online correction of the industrial terminal weight coefficients during the aggregation of the federated learning global model.

[0016] Further, S1 includes:

[0017] Acquiring micro-time-series event stream data of tasks running inside the industrial terminal includes: real-time collection of microsecond-level timestamp sequences of task context switching and state transition frequency data of each task between running and suspended states through the scheduling and monitoring interface of the industrial terminal kernel layer;

[0018] The acquisition of topology response delay data of industrial terminal response probe pulses includes: during the idle period of the industrial control protocol's instruction cycle, injecting a probe pulse sequence that conforms to the protocol logic specification into the target industrial terminal, and recording the round-trip response delay of the probe pulse sequence from issuance to receipt of the feedback response.

[0019] Furthermore, in S2, the process of generating the instruction stream execution entropy that characterizes the terminal's computing behavior includes:

[0020] Obtain a pre-stored baseline state transition probability matrix under normal working conditions; use a Markov chain model to calculate the relative entropy of the real-time acquired task context switching sequence relative to the baseline state transition probability matrix, so as to quantify the statistical deviation of the current task execution sequence.

[0021] The relative entropy is standardized by applying a hyperbolic tangent nonlinear mapping function to generate an instruction flow execution entropy with a value range in the interval [0,1]. The closer the instruction flow execution entropy is to 1, the higher the disorder of the internal task scheduling logic of the industrial terminal is affected by malicious code interference.

[0022] Furthermore, in S2, the process of generating the logical echo attenuation vector includes:

[0023] Using a phase offset mapping algorithm, the external jitter component caused by network link fluctuations is separated from the round-trip response delay to extract the logical response delay component that reflects the internal protocol stack processing logic of the industrial terminal; the absolute value of the deviation of the logical response delay component relative to the preset standard processing cycle is calculated, and the absolute value of the deviation is determined as the distortion coefficient.

[0024] The distortion coefficients are normalized using an exponential decay function to generate a logical echo attenuation vector with a value range of [0,1]. The magnitude of the logical echo attenuation vector is positively correlated with the degree of computing resource occupation caused by malicious code in the industrial terminal.

[0025] Furthermore, in S3, the model construction process for the execution state logic impedance calculation model includes:

[0026] The instruction flow execution entropy is used as the first dimension vector characterizing the local computation behavior characteristics, and the logical echo attenuation vector is used as the second dimension vector characterizing the network topology response characteristics. The tensor product operator is used to perform an outer product operation on the first dimension vector and the second dimension vector to construct an execution state logic impedance basic tensor that can map the coupling relationship between computation domain anomalies and communication domain anomalies in a preset high-dimensional feature space.

[0027] Furthermore, the process of performing nonlinear correlation processing and generating the execution state logic impedance composite tensor in S3 includes: performing feature enhancement processing on the execution state logic impedance basic tensor using a nonlinear mapping function based on mutual information entropy, wherein the nonlinear mapping function is used to quantify and evaluate the spatiotemporal correlation between terminal computing behavior characteristics and network logic impedance characteristics by calculating the mutual information between the instruction flow execution entropy and the logic echo attenuation vector.

[0028] Calculate the magnitude of the execution-state logic impedance fundamental tensor after feature enhancement processing; when the rising slope of the instruction flow execution entropy and the topological deviation of the logic echo attenuation vector satisfy the preset resonance criterion within the sliding time window, the tensor magnitude generates a nonlinear gain, thus obtaining the execution-state logic impedance composite tensor used to characterize the resonance intensity of the global virus infection field.

[0029] Furthermore, S4 specifically includes:

[0030] A dynamic safety baseline spectrum is constructed from historical safe operation samples, wherein the dynamic safety baseline spectrum represents the probability distribution envelope of the execution state logic impedance under normal operating conditions; the magnitude of the execution state logic impedance composite tensor is calculated with respect to the dynamic safety baseline spectrum to obtain an offset measure value; if the offset measure value exceeds a preset confidence interval, the indication signal is mapped to discrete risk states corresponding to different defense levels according to the magnitude of the offset measure value, wherein the discrete risk states include: normal state, suspected infection state, and confirmed infection state.

[0031] Furthermore, S5 specifically includes:

[0032] When the indication signal is mapped to the confirmed infection state, a bidirectional synchronous linkage instruction is triggered; at the communication access control level, a preset micro-segmentation strategy model is invoked to generate a logical blocking instruction for the non-critical business protocol port of the industrial terminal, so as to cut off the lateral migration path of malicious code in the network topology; at the federated learning aggregation level, the reputation penalty factor for the industrial terminal is calculated in real time based on the offset metric value, and the reputation penalty factor is used to attenuate the model gradient vector uploaded by the industrial terminal until the aggregation weight of the industrial terminal is reduced to zero.

[0033] Furthermore, S5 specifically includes:

[0034] The system monitors the quality of the probe channel in real time to acquire the topology response delay data and calculates the probe confidence score. If the probe confidence score is lower than a preset quality threshold, the active probe dimension is deemed to have failed, and the system automatically switches from federated collaborative mode to local enhanced defense mode. In the local enhanced defense mode, the system increases the judgment threshold weight of the instruction stream execution entropy and introduces the historical execution trajectory benchmark of the industrial terminal for self-evolution feature comparison to maintain basic anti-virus capabilities in network interference environments.

[0035] A federalized collaborative security defense system for industrial control networks includes:

[0036] The dual-domain data acquisition module is used to acquire micro-time-series event stream data of the internal running tasks of the industrial terminal, and to acquire topological response delay data of the industrial terminal in response to the probe pulse;

[0037] The behavioral feature modeling module is used to perform ordered measurement on the micro-time-series event stream data, generate instruction stream execution entropy that characterizes the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector that characterizes the network logic impedance characteristics.

[0038] The correlation tensor mapping module, based on the execution state logic impedance calculation model, performs nonlinear correlation processing on the instruction stream execution entropy and the logic echo attenuation vector to generate an execution state logic impedance composite tensor that characterizes the resonance intensity of the global virus infection field.

[0039] The risk status verification module performs consistency verification based on the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, and outputs an indication signal for the terminal infection status.

[0040] The collaborative response control module is used to synchronously adjust the communication access control policy of the industrial terminal according to the indication signal, and to correct the weight coefficients of the industrial terminal online during the aggregation of the federated learning global model.

[0041] Compared with the prior art, the beneficial effects of the present invention are:

[0042] This invention achieves lightweight acquisition of microsecond-level timestamp sequences and state transition frequencies in the terminal kernel layer, and separates the logic response delay component by combining a probe pulse sequence that follows the protocol logic specification. This transforms complex defense calculations into low-overhead measurements of instruction stream execution entropy and logic echo attenuation vectors. By utilizing a Markov chain model and a hyperbolic tangent nonlinear mapping function, the execution state is quantified into a normalized index with a value range in the [0,1] interval. This avoids executing high-intensity local defense algorithms such as "random disturbance" and "dynamic dropout" on low-power PLCs or sensor nodes, thus ensuring the integrity of deterministic communication in industrial production lines and the low latency characteristics of system operation without interfering with the execution of real-time control instructions. By constructing a composite tensor of execution state logic impedance, the high-energy-consuming risk detection pressure is shifted from the terminal local layer to the federated coordination layer, achieving deep decoupling between embedded terminal computing resource consumption and security defense effectiveness.

[0043] This invention also constructs a fundamental tensor of execution-state logic impedance that can map the coupling relationship between computational anomalies and communication anomalies by using the tensor product operator to perform an outer product operation on the instruction flow execution entropy of the computational domain and the logic echo attenuation vector of the communication domain. It quantifies the spatiotemporal correlation probability between terminal behavior and network characteristics using a nonlinear mapping function based on mutual information entropy, and captures the nonlinear gain of the tensor magnitude that satisfies the resonance criterion within a sliding time window. This enables accurate identification of virus payloads and worm lateral migration behaviors hidden in industrial protocol logic and manifested as subtle temporal distortions. Combined with Euclidean distance verification using dynamic security benchmark spectra, it achieves micro-isolation logic blocking at the communication access layer and real-time weighting of reputation penalty factors at the federated learning layer through bidirectional synchronous linkage instructions. When the detection channel quality score decreases, it automatically switches to a local enhanced defense mode based on historical execution trajectory benchmarks, thus constructing a full-dimensional cross-layer defense system from the physical execution state to the model aggregation state. Attached Figure Description

[0044] Figure 1 This is a schematic diagram illustrating the overall application of the method of the present invention.

[0045] Figure 2 This is a schematic diagram of the overall method flow of the present invention.

[0046] Figure 3 This is a schematic diagram of the process framework for S3 and S4 of the present invention.

[0047] Figure 4 This is a schematic diagram of the system framework of the present invention. Detailed Implementation

[0048] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0049] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0050] Example 1:

[0051] Please see Figures 1 to 2 This invention provides a technical solution: a federated collaborative security defense method for industrial control networks, comprising the following steps:

[0052] S1. Obtain the micro-time sequence event stream data of the internal running tasks of the industrial terminal, and obtain the topology response delay data of the industrial terminal in response to the probe pulse;

[0053] S2. Perform ordered measurement on the micro-time sequence event stream data to generate instruction stream execution entropy characterizing the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector characterizing the network logic impedance characteristics.

[0054] S3. Based on the execution state logic impedance calculation model, the instruction flow execution entropy and the logic echo attenuation vector are subjected to nonlinear correlation processing to generate an execution state logic impedance composite tensor for characterizing the resonance intensity of the global virus infection field.

[0055] S4. Based on the consistency verification between the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, output an indication signal for the terminal infection status;

[0056] S5. Based on the indicated signal, synchronously execute the adjustment of the communication access control policy for the industrial terminal, and the online correction of the industrial terminal weight coefficients during the aggregation of the federated learning global model.

[0057] In this embodiment, Figure 1 The "terminal micro-timing and delay feature extraction" in the text corresponds to S1 and S2. Figure 1 The “execution-state logic impedance tensor” in the text corresponds to S3. Figure 1 The "Dynamic Benchmark Verification and Risk Mapping" in the text corresponds to S4. Figure 1 The “micro-isolation blocking and federal weighting adjustment” in the text corresponds to S5.

[0058] Example 2:

[0059] S1 includes:

[0060] Acquiring micro-time-series event stream data of tasks running inside the industrial terminal includes: real-time collection of microsecond-level timestamp sequences of task context switching and state transition frequency data of each task between running and suspended states through the scheduling and monitoring interface of the industrial terminal kernel layer;

[0061] The acquisition of topology response delay data of industrial terminal response probe pulses includes: during the idle period of the industrial control protocol's instruction cycle, injecting a probe pulse sequence that conforms to the protocol logic specification into the target industrial terminal, and recording the round-trip response delay of the probe pulse sequence from issuance to receipt of the feedback response.

[0062] In step S2, the process of generating the instruction stream execution entropy, which characterizes the terminal's computing behavior, includes:

[0063] Obtain a pre-stored baseline state transition probability matrix under normal working conditions; use a Markov chain model to calculate the relative entropy of the real-time acquired task context switching sequence relative to the baseline state transition probability matrix, so as to quantify the statistical deviation of the current task execution sequence.

[0064] The relative entropy is standardized by applying a hyperbolic tangent nonlinear mapping function to generate an instruction flow execution entropy with a value range in the interval [0,1]. The closer the instruction flow execution entropy is to 1, the higher the disorder of the internal task scheduling logic of the industrial terminal is affected by malicious code interference.

[0065] In step S2, the process of generating the logical echo attenuation vector includes:

[0066] Using a phase offset mapping algorithm, the external jitter component caused by network link fluctuations is separated from the round-trip response delay to extract the logical response delay component that reflects the internal protocol stack processing logic of the industrial terminal; the absolute value of the deviation of the logical response delay component relative to the preset standard processing cycle is calculated, and the absolute value of the deviation is determined as the distortion coefficient.

[0067] The distortion coefficients are normalized using an exponential decay function to generate a logical echo attenuation vector with a value range of [0,1]. The magnitude of the logical echo attenuation vector is positively correlated with the degree of computing resource occupation caused by malicious code in the industrial terminal.

[0068] Furthermore, as the value of the logical echo attenuation vector approaches the unit value of 1, it indicates that the impedance effect caused by the virus interference in the instruction processing logic of the industrial terminal becomes more and more significant.

[0069] Furthermore, the task context switching timestamp sequence (hereinafter referred to as Tseq) is used to characterize the precise instantaneous moment when CPU control is transferred between different processes or threads when the industrial terminal kernel executes different production control tasks. Tseq originates from the scheduling tracing module of the terminal operating system kernel layer, and in this embodiment, it is obtained by attaching a tracing hook function through the kernel layer's scheduling monitoring interface. The specific determination process is as follows: the task scheduling status is monitored in real time using the kernel tracing mechanism; whenever a scheduling switching event is triggered, the current count value of the high-precision timer is immediately read; multiple consecutively acquired count values ​​are arranged in chronological order to form a timestamp vector; in this embodiment, the sequence is recorded in microseconds, including the time series [1000.5, 1005.2, 1009.8] obtained by acquisition, providing a high-precision data source for subsequent calculation of instruction stream execution entropy.

[0070] Furthermore, in this embodiment, the baseline state transition probability matrix (hereinafter referred to as Mbase) is used to describe the statistical probability distribution of the transitions between the running, suspended, and ready states of each task executed by the industrial terminal under known safe production conditions without toxic interference. This matrix is ​​determined through offline experimental calibration. The specific steps include: placing the industrial terminal in a closed laboratory clean environment and running a standard control task program to eliminate external interference; continuously observing the terminal for no less than 48 hours and recording all state transition events; classifying and statistically analyzing the frequency of each type of state transition; calculating the proportion of each type of transition frequency to the total outflow frequency of that state, thereby constructing a probability matrix; the value in the i-th row and j-th column of the probability matrix represents the probability of transitioning from state i to state j, and its value range is limited to the interval [0,1], ensuring the mathematical rigor of the baseline spectrum construction.

[0071] Furthermore, in this embodiment, the logic response delay component (hereinafter referred to as Dlogic) is intended to characterize the internal logic calculation time consumed by the industrial terminal protocol stack in processing the probe pulse after eliminating network transmission jitter. It is the core basis for generating the logic echo attenuation vector. This embodiment uses a phase offset mapping algorithm as a preprocessing method. The specific calculation logic is as follows: obtain the total round-trip response delay data of the probe pulse from transmission to reception; obtain the link round-trip time fed back by the network interface controller and calculate its sliding average value within a set window to quantify the delay contributed by the basic network environment; subtract the sliding average value from the total round-trip response delay to achieve the initial separation of computational load and transmission load; perform low-pass filtering on the obtained difference to filter out instantaneous network burst jitter, thereby extracting the pure delay component that reflects the terminal processing logic state.

[0072] In this embodiment, the task context switching timestamp sequence Tseq, which is at the precise microsecond level at each time a scheduling switching event is triggered, is continuously collected and recorded. By performing differential operations on the time difference between adjacent scheduling switching events, a real-time transition sequence reflecting the current task flow characteristics is constructed. Based on the Markov chain model, the frequency of various state transitions in the sequence is statistically analyzed to generate a real-time state transition probability matrix (hereinafter referred to as Mreal).

[0073] To quantify the deviation of the current execution logic from the security benchmark, the relative entropy (i.e., KL divergence) algorithm from information theory is introduced for in-depth analysis. The specific calculation process is as follows:

[0074] Each element in the real-time state transition probability matrix Mreal is obtained one by one; the corresponding element in the pre-stored memory Mbase is obtained synchronously; the natural logarithm of Mreal and Mbase is calculated; Mreal and the logarithm result are multiplied; the product results of all positions are summed to obtain the relative entropy value reflecting the degree of behavioral disorder; the relative entropy value is standardized using the hyperbolic tangent function in mathematics to limit its output value range to the interval [0,1]. The specific calculation logic is as follows: obtain the relative entropy value and calculate twice the relative entropy power of the natural constant e; subtract 1 from the value of twice the relative entropy power as the numerator; add 1 to the value of twice the relative entropy power as the denominator; in the fifth step, the numerator is divided by the denominator to finally generate the instruction stream execution entropy (hereinafter referred to as Hisee). The higher the value of Hisee, the stronger the randomness of the internal task scheduling logic of the terminal is caused by the interference of the virus.

[0075] During the protocol stack logic impedance quantization stage, the system synchronously monitors the round-trip response delay of the industrial terminal to external probe pulses. A phase offset mapping algorithm is used to eliminate physical transmission noise in the network link, extracting the logic response delay component (hereinafter referred to as Dlogic) generated by the terminal protocol stack processing. This component is then compared with a preset standard processing cycle (hereinafter referred to as Tstd, representing the theoretical minimum processing time under no-load conditions). The specific logic for calculating the distortion coefficient (hereinafter referred to as Cdist) is as follows: obtain the absolute value of the difference between Dlogic and Tstd, divide the absolute value by Tstd to achieve dimensional normalization; apply the exponential decay model in physics to generate the logical echo attenuation vector (hereinafter referred to as Vleav) to characterize the impedance effect at the network layer; the calculation steps of Vleav include: setting the sensitivity adjustment constant a (in this embodiment, the value is 0.5 through offline experimental calibration, which aims to balance the tolerance of the industrial control system to a small delay and the sensitivity of virus detection); calculating the product of the negative a and the distortion coefficient of the natural constant e to the power of 1; subtracting the power value from the value of 1 to obtain the logical echo attenuation vector in the range of [0,1]. The closer the logical echo attenuation vector is to 1, the more severe the protocol stack logic response impedance caused by malicious load is.

[0076] Regarding the multi-parameter fusion mechanism, this embodiment employs a nonlinear resonance mapping algorithm based on physical resonance theory to fuse the instruction flow execution entropy (Hisee) and the logical echo attenuation vector (Vleav) through tensor product. The reason for choosing nonlinear fusion over nonlinear weighting is that industrial virus infection is often accompanied by concurrent characteristics of internal instruction flow distortion and external response lag. Nonlinear multiplicative fusion can produce a "synergistic gain" effect, causing the characteristic modulus value in the infected state to exhibit a nonlinear transition, thereby significantly improving the confidence of the safety judgment.

[0077] Please see Figure 3 In step S3, the model construction process for the execution state logic impedance calculation model includes:

[0078] The instruction flow execution entropy is used as the first dimension vector characterizing the local computation behavior characteristics, and the logical echo attenuation vector is used as the second dimension vector characterizing the network topology response characteristics. The tensor product operator is used to perform an outer product operation on the first dimension vector and the second dimension vector to construct an execution state logic impedance basic tensor that can map the coupling relationship between computation domain anomalies and communication domain anomalies in a preset high-dimensional feature space.

[0079] The process of performing nonlinear correlation processing and generating the execution state logic impedance composite tensor in S3 includes: performing feature enhancement processing on the execution state logic impedance basic tensor using a nonlinear mapping function based on mutual information entropy, wherein the nonlinear mapping function is used to quantify and evaluate the spatiotemporal correlation between terminal computing behavior characteristics and network logic impedance characteristics by calculating the mutual information between the instruction flow execution entropy and the logic echo attenuation vector.

[0080] Calculate the magnitude of the execution-state logic impedance fundamental tensor after feature enhancement processing; when the rising slope of the instruction flow execution entropy and the topological deviation of the logic echo attenuation vector satisfy the preset resonance criterion within the sliding time window, the tensor magnitude generates a nonlinear gain, thus obtaining the execution-state logic impedance composite tensor used to characterize the resonance intensity of the global virus infection field.

[0081] Furthermore, the execution-state logic impedance fundamental tensor (hereinafter referred to as Tbase) constructed in S3 originates from the tensor outer product theory in multilinear algebra, and is used to characterize the original interaction field between the entropy change of the internal instruction flow and the attenuation of the external logic response in a two-dimensional Cartesian product space; the specific generation logic is as follows:

[0082] Obtain the instruction stream execution entropy Hisee and the logical echo attenuation vector Vleav output by S2; map Hisee to the first row vector and Vleav to the first column vector; perform an outer product operation to generate a two-dimensional matrix describing all possible combinations of weights of the two parameters, i.e., the basic tensor Tbase. This process elevates the two independent scalar features to a high-dimensional space, preserving the nonlinear characteristics of the interaction between the computational domain and the communication domain. In this embodiment, if Hisee is 0.8 and Vleav is 0.7, the joint weight at the corresponding position of the basic tensor is initially reflected as 0.56.

[0083] By introducing a feature enhancement processing mechanism, the basic tensor Tbase is modified using a nonlinear mapping function based on the Shannon mutual information model in information theory. The specific process includes: calculating the mutual information value of the Hisee and Vleav sequences within the sampling period; using this mutual information value as the power of an exponential function to exponentially enhance each element in Tbase. By using mutual information to quantify the logical correlation between the two heterogeneous data sources, the highly correlated anomalous features are amplified, while suppressing random noise with low cross-correlation (i.e., disturbances caused solely by high system load). The sensitivity parameter of the mapping function is calibrated using offline simulated virus variant samples and a gradient boosting decision tree.

[0084] To capture the synchronous coupling effect of the internal and external domains during viral infection, S3 further introduces a spatiotemporal correlation resonance gain coefficient (hereinafter referred to as Gres). By setting a sliding time window Wtime with a length of 500 milliseconds, which is designed to cover a complete instruction cycle of a typical industrial control protocol, the system performs resonance criterion verification within the window, including: calculating the first-order time derivative of Hisee (i.e., the rising slope), calculating the variance change rate of Vleav, and comparing the time offset between the first-order time derivative and the variance change rate. If the time offset is less than 10 milliseconds, and the change amplitude of both exceeds the preset "minimum necessary" threshold, it is determined that field-state resonance has occurred, triggering nonlinear gain.

[0085] In the final generation stage, different branch paths are executed based on the verification results. If the resonance judgment condition is met (execution path A), the resonance gain coefficient Gres is applied to the mapped tensor, causing its magnitude to undergo a nonlinear transition. If the resonance condition is not met (execution path B), the linear evolution of the tensor magnitude is maintained. The magnitude of the final output execution state logic impedance composite tensor (hereinafter referred to as Teslit) represents the resonance intensity of the global virus infection field. The closer the magnitude of Teslit is to 1, the higher the certainty of the terminal being infected.

[0086] S4 specifically includes:

[0087] A dynamic safety baseline spectrum is constructed from historical safe operation samples, wherein the dynamic safety baseline spectrum represents the probability distribution envelope of the execution state logic impedance under normal operating conditions; the magnitude of the execution state logic impedance composite tensor is calculated with respect to the dynamic safety baseline spectrum to obtain an offset measure value; if the offset measure value exceeds a preset confidence interval, the indication signal is mapped to discrete risk states corresponding to different defense levels according to the magnitude of the offset measure value, wherein the discrete risk states include: normal state, suspected infection state, and confirmed infection state.

[0088] S5 specifically includes:

[0089] When the indication signal is mapped to the confirmed infection state, a bidirectional synchronous linkage instruction is triggered; at the communication access control level, a preset micro-segmentation strategy model is invoked to generate a logical blocking instruction for the non-critical business protocol port of the industrial terminal, so as to cut off the lateral migration path of malicious code in the network topology; at the federated learning aggregation level, the reputation penalty factor for the industrial terminal is calculated in real time based on the offset metric value, and the reputation penalty factor is used to attenuate the model gradient vector uploaded by the industrial terminal until the aggregation weight of the industrial terminal is reduced to zero.

[0090] Specifically, S5 also includes:

[0091] The system monitors the quality of the probe channel in real time to acquire the topology response delay data and calculates the probe confidence score. If the probe confidence score is lower than a preset quality threshold, the active probe dimension is deemed to have failed, and the system automatically switches from federated collaborative mode to local enhanced defense mode. In the local enhanced defense mode, the system increases the judgment threshold weight of the instruction stream execution entropy and introduces the historical execution trajectory benchmark of the industrial terminal for self-evolution feature comparison to maintain basic anti-virus capabilities in network interference environments.

[0092] Furthermore, the probe confidence score is calculated by performing multi-dimensional statistics on the physical characteristics of the probe channel. Specifically, within each sliding sampling window (in this embodiment, the period T = 500 ms), the packet loss rate Lr and the delay jitter variance Vj of the probe pulse are monitored in real time, and a scoring model is constructed using an exponential decay function. Where o is the channel sensitivity coefficient, with a value range of [0.1, 0.5]; the preset quality threshold is set to 0.65; once Sc falls below the quality threshold, the defense degradation strategy is automatically triggered, switching from the federated collaborative mode to the local enhanced defense mode; in the local enhanced defense mode, since the network-side active detection dimension (i.e., the logical echo attenuation vector) is ineffective due to interference, the judgment logic is adjusted to compensate for the information loss: the judgment threshold weight is redistributed, and the weight coefficient of the instruction flow execution entropy is increased from the initial 0.5 to 0.85 (i.e., the weight is increased), making it the dominant factor in anomaly judgment; at the same time, the following is introduced The historical execution trajectory benchmark is based on the instruction stream execution entropy time series generated by the terminal over the past N normal cycles. The dynamic time warping algorithm is used to calculate the morphological similarity between the current real-time execution entropy sequence and the historical benchmark sequence. By setting a dynamically sliding similarity boundary (i.e., 1.5 times the standard deviation of the historical mean) for self-evolving feature comparison, the aim is to identify minor instruction execution deviations caused by virus infection through temporal dimension consistency verification of the terminal's own behavior, even in the absence of external collaborative data, when real-time features deviate from the benchmark boundary, thereby maintaining basic anti-virus defense effectiveness.

[0093] By vectorizing the execution-state logic impedance composite tensor, the magnitude of the execution-state logic impedance composite tensor (hereinafter denoted as |Teslit|) is calculated to characterize the combined energy intensity of the current moment's terminal computing behavior and network response anomalies. Specifically, this is achieved by: extracting all feature components within the composite tensor; performing a squaring operation on each feature component; summing all squared values; and then taking the square root of the sum. This magnitude serves as the core input for subsequent consistency checks.

[0094] To define the boundaries of safe operation, a dynamic safety baseline spectral line (hereinafter referred to as Sline) is constructed. Sline is generated by fitting historical impedance data of the terminal within a safe period using a Gaussian mixture model. During the offline experimental calibration phase, impedance tensor data of the terminal under normal operation for 360 hours are continuously collected. The expected mean vector of the multidimensional feature space is calculated, and a confidence interval covering 99.7% of the distribution probability is set as the boundary range, thereby defining the "safe envelope". In this embodiment, the mean value of the spectral line center is set to 0.15, and the envelope width is set to 0.05.

[0095] In S4, the absolute value of the difference between |Teslit| and the center value of Sline is calculated and defined as the offset measure value. The discrete risk status is determined according to the interval in which the offset measure value is located. The specific mapping criterion is as follows: if the offset measure value is in the interval [0, 0.2], the output is normal; if it is in the interval (0.2, 0.6], the output is suspected infection; if it exceeds 0.6, it is determined to be confirmed infection.

[0096] Among them, the normalized value range of the composite tensor magnitude of the execution state logic impedance |Teslit| is [0,1], while the center mean of the dynamic safety reference spectrum Sline is fixed at 0.15. Since the offset measure is defined as the absolute value of the difference between the two, that is... Therefore, the theoretical range of the offset measure value is [0, 0.85]. The logic of dividing the offset measure value into intervals is rooted in the technical fact that the terminal's operating state evolves from "statistical determinism" to "physical instability". The setting of the interval [0, 0.2] is based on the confidence boundary after fitting the historical security samples with the Gaussian mixture model, which represents that the terminal behavior is within the 99.7% normal probability envelope. The division of the interval (0.2, 0.6) is based on the linear disturbance region where the first derivative of the offset measure value begins to rise, which represents that the system logic impedance has entered an uncertain state due to the influence of external noise or low-intensity detection interference. The threshold exceeding 0.6 is determined by the mutation point of the second derivative of the offset function curvature, which represents that the internal execution logic of the terminal has crossed the compensation critical point and irreversible nonlinear instability has occurred, that is, it has entered a deterministic virus infection state.

[0097] Furthermore, when the system outputs "confirmed infection status," a bidirectional synchronous linkage execution process is immediately triggered. On the network side, the instruction issuing module executes the micro-segmentation strategy, generates a blocking instruction carrying the target terminal's MAC address and a list of non-critical business ports, and immediately sends it to the IoT firewall interface. It then performs weight reduction processing, including: obtaining the current offset measure value and calculating the offset measure value raised to the power of the natural constant e; calculating the reciprocal of the power of the offset measure value to generate a reputation penalty factor; and multiplying the reputation penalty factor by the original gradient vector uploaded by the terminal to achieve gradient decay.

[0098] Furthermore, it features adaptive graceful degradation processing capabilities based on the probe channel quality score (hereinafter referred to as Qscore). Qscore is calculated using an exponentially weighted moving average method based on a packet loss rate and latency jitter variance model. The Qscore value is continuously monitored; if it falls below a preset threshold of 0.35 (this preset threshold is designed to avoid minor instantaneous jitter common in industrial control networks), the probe dimension is deemed to have failed, and it automatically switches to a self-evolutionary defense mode. In this mode, it stops receiving network response data and instead calls upon historical instruction stream evolution patterns stored in memory. Local security decisions are made by calculating the KL divergence between the real-time instruction stream execution entropy and the historical patterns. If the divergence continues to increase, emergency protection logic is triggered locally.

[0099] When |Teslit| approaches 0, it indicates that the entropy change of the internal instruction flow of the terminal is at a low level, and the logical response latency of the external protocol stack is extremely close to the theoretical standard period Tstd; this means that the cooperative relationship between the execution unit and the communication unit is in a highly deterministic and secure state, and no abnormal disturbances or logical blockages have been detected.

[0100] When |Teslit| approaches its maximum value, i.e., approaches 1, it indicates that a high frequency of task scheduling anomalies has occurred inside the terminal (corresponding to a surge in Hisee) and a severe nonlinear hysteresis has occurred in the external response (corresponding to a surge in Vleav). When the fluctuations of the two produce phase resonance on the time axis, the magnitude rapidly jumps to the maximum value through nonlinear gain, indicating that the certainty of the terminal being infected has reached the highest threshold, i.e., the resonance intensity of the global virus infection field has reached its peak.

[0101] In this embodiment, the offset measure value and the risk identification level have a positive step distribution relationship; the offset measure value is essentially the Euclidean distance of |Teslit| from the dynamic safety reference spectral line Sline, that is, the farther it deviates from the reference, the lower its probability density within the safety envelope, and thus the higher the probability of it being abnormal.

[0102] The reputation penalty factor is negatively exponentially correlated with the model weights. It is designed using a negative power function of the natural constant e. As the offset measure increases, the penalty factor decays rapidly at a non-linear rate.

[0103] Qscore is conditionally related to the switching of defense modes. Qscore combines packet loss rate and latency jitter variance. When the failure of the network physical link makes the probe data unreliable, it forcibly cuts off external dependencies and activates the self-evolutionary feature comparison based on historical execution trajectory.

[0104] The effectiveness of the proposed execution-state logic impedance quantization model and bidirectional linkage mechanism was verified by building a digital twin simulation platform. The digital twin simulation platform includes a simulated industrial control terminal running a real-time kernel, a network behavior generator, and a federated learning center node. The specific parameter settings of the simulation environment are as follows: the task scheduling cycle of the industrial control terminal is set to 1ms, the kernel sampling frequency is set to 1MHz, the center mean calibration of the dynamic security reference spectrum Sline is set to 0.15, and the Gaussian distribution envelope width is set to 0.05. The sampling sliding window of the probe channel quality score Qscore is set to 100 message cycles. See Table 1 for details.

[0105] Table 1: Simulation Experiment Data of Terminal Execution State Logic Impedance and Risk Linkage

[0106]

[0107] Table 1 shows the discrimination accuracy of the execution state logic impedance composite tensor in complex industrial control environments by setting two groups of normal operating condition control groups, namely static standby and high load operation, two groups of single dimensions, namely large-scale jitter and slow worm scanning, and two groups of extremely high risk groups, namely virus resonance infection and link denial of service.

[0108] Furthermore, in the "large-scale jitter" scenario, although the attenuation vector of the communication dimension increases significantly to 0.58, the instruction entropy of the computation dimension remains stable (0.16), the magnitude of the execution state logic impedance composite tensor is only 0.41, and the offset measure value of 0.26 is in the suspected range, thus avoiding the risk of false blocking due to instantaneous network congestion.

[0109] In the "virus resonance infection" scenario, the offset measure value is 0.80, and the reputation penalty factor is automatically calculated to be 0.45 according to the nonlinear algorithm. In the "link denial-of-service" scenario, the probe channel quality score drops to 0.21 (below the preset threshold of 0.35). At this time, even if the external probe data is completely distorted, the offset measure of 0.84 can still be maintained locally by executing |Teslit|, and the "local enhanced defense" command can be accurately issued.

[0110] Example 3

[0111] Please see Figure 4 A federally coordinated security defense system for industrial control networks, including:

[0112] The dual-domain data acquisition module is used to acquire micro-time-series event stream data of the internal running tasks of the industrial terminal, and to acquire topological response delay data of the industrial terminal in response to the probe pulse;

[0113] The behavioral feature modeling module is used to perform ordered measurement on the micro-time-series event stream data, generate instruction stream execution entropy that characterizes the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector that characterizes the network logic impedance characteristics.

[0114] The correlation tensor mapping module, based on the execution state logic impedance calculation model, performs nonlinear correlation processing on the instruction stream execution entropy and the logic echo attenuation vector to generate an execution state logic impedance composite tensor that characterizes the resonance intensity of the global virus infection field.

[0115] The risk status verification module performs consistency verification based on the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, and outputs an indication signal for the terminal infection status.

[0116] The collaborative response control module is used to synchronously adjust the communication access control policy of the industrial terminal according to the indication signal, and to correct the weight coefficients of the industrial terminal online during the aggregation of the federated learning global model.

[0117] It should be noted that all calculation formulas in this application employ regression analysis, including but not limited to machine learning algorithms, to deeply analyze the collected parameters and identify their natural trends and interrelationships. Specialized software, such as Python's Scikit-learn library or the R language, is used to automatically generate mathematical models that match the data. Then, cross-validation and other methods are used to objectively evaluate the model performance, and continuous feedback and optimization are combined to ensure that the created formulas truly reflect the inherent laws of the data, thereby guaranteeing their effectiveness and accuracy. In all calculation formulas in this application, the parameters in each formula undergo dimensionless processing within a consistent range to ensure that different physical quantities are compared on the same scale; dimensionless processing techniques include, but are not limited to, min-max-normalization and Z-score standardization.

[0118] The technical solution of this invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random-access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of this invention.

[0119] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0120] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A federated collaborative security defense method for industrial control networks, characterized in that, Includes the following steps: S1. Obtain the micro-time sequence event stream data of the internal running tasks of the industrial terminal, and obtain the topology response delay data of the industrial terminal in response to the probe pulse; S2. Perform ordered measurement on the micro-time sequence event stream data to generate instruction stream execution entropy characterizing the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector characterizing the network logic impedance characteristics. S3. Based on the execution state logic impedance calculation model, the instruction flow execution entropy and the logic echo attenuation vector are subjected to nonlinear correlation processing to generate an execution state logic impedance composite tensor for characterizing the resonance intensity of the global virus infection field. S4. Based on the consistency verification between the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, output an indication signal for the terminal infection status; S5. Based on the indicated signal, synchronously execute the adjustment of the communication access control policy for the industrial terminal, and the online correction of the industrial terminal weight coefficients during the aggregation of the federated learning global model.

2. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: S1 includes: Acquiring micro-time-series event stream data of tasks running inside the industrial terminal includes: real-time collection of microsecond-level timestamp sequences of task context switching and state transition frequency data of each task between running and suspended states through the scheduling and monitoring interface of the industrial terminal kernel layer; The acquisition of topology response delay data of industrial terminal response probe pulses includes: during the idle period of the industrial control protocol's instruction cycle, injecting a probe pulse sequence that conforms to the protocol logic specification into the target industrial terminal, and recording the round-trip response delay of the probe pulse sequence from issuance to receipt of the feedback response.

3. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: In step S2, the process of generating the instruction stream execution entropy, which characterizes the terminal's computing behavior, includes: Obtain a pre-stored baseline state transition probability matrix under normal working conditions; use a Markov chain model to calculate the relative entropy of the real-time acquired task context switching sequence relative to the baseline state transition probability matrix, so as to quantify the statistical deviation of the current task execution sequence. The relative entropy is standardized by applying a hyperbolic tangent nonlinear mapping function to generate an instruction flow execution entropy with a value range in the interval [0,1]. The closer the instruction flow execution entropy is to 1, the higher the disorder of the internal task scheduling logic of the industrial terminal is affected by malicious code interference.

4. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: In step S2, the process of generating the logical echo attenuation vector includes: Using a phase offset mapping algorithm, the external jitter component caused by network link fluctuations is separated from the round-trip response delay to extract the logical response delay component that reflects the internal protocol stack processing logic of the industrial terminal; the absolute value of the deviation of the logical response delay component relative to the preset standard processing cycle is calculated, and the absolute value of the deviation is determined as the distortion coefficient. The distortion coefficients are normalized using an exponential decay function to generate a logical echo attenuation vector with a value range of [0,1]. The magnitude of the logical echo attenuation vector is positively correlated with the degree of computing resource occupation caused by malicious code in the industrial terminal.

5. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: In S3, the model construction process for the execution state logic impedance calculation model includes: The instruction flow execution entropy is used as the first dimension vector characterizing the local computation behavior characteristics, and the logical echo attenuation vector is used as the second dimension vector characterizing the network topology response characteristics. The tensor product operator is used to perform an outer product operation on the first dimension vector and the second dimension vector to construct an execution state logic impedance basic tensor that can map the coupling relationship between computation domain anomalies and communication domain anomalies in a preset high-dimensional feature space.

6. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: The process of performing nonlinear correlation processing and generating the execution state logic impedance composite tensor in S3 includes: performing feature enhancement processing on the execution state logic impedance basic tensor using a nonlinear mapping function based on mutual information entropy, wherein the nonlinear mapping function is used to quantify and evaluate the spatiotemporal correlation between terminal computing behavior characteristics and network logic impedance characteristics by calculating the mutual information between the instruction flow execution entropy and the logic echo attenuation vector. The magnitude of the execution-state logic impedance fundamental tensor after feature enhancement processing is calculated, hereinafter referred to as the tensor magnitude. When the rising slope of the instruction flow execution entropy and the topological deviation of the logic echo attenuation vector satisfy the preset resonance criterion within the sliding time window, the tensor magnitude generates a nonlinear gain, thereby obtaining the execution-state logic impedance composite tensor used to characterize the resonance intensity of the global virus infection field.

7. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: S4 specifically includes: A dynamic safety baseline spectrum is constructed from historical safe operation samples, wherein the dynamic safety baseline spectrum represents the probability distribution envelope of the execution state logic impedance under normal operating conditions; the magnitude of the execution state logic impedance composite tensor is calculated with respect to the dynamic safety baseline spectrum to obtain an offset measure value; if the offset measure value exceeds a preset confidence interval, the indication signal is mapped to discrete risk states corresponding to different defense levels according to the magnitude of the offset measure value, wherein the discrete risk states include: normal state, suspected infection state, and confirmed infection state.

8. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: S5 specifically includes: When the indication signal is mapped to the confirmed infection state, a bidirectional synchronous linkage instruction is triggered; at the communication access control level, a preset micro-segmentation strategy model is invoked to generate a logical blocking instruction for the non-critical business protocol port of the industrial terminal, so as to cut off the lateral migration path of malicious code in the network topology; at the federated learning aggregation level, the reputation penalty factor for the industrial terminal is calculated in real time based on the offset metric value, and the reputation penalty factor is used to attenuate the model gradient vector uploaded by the industrial terminal until the aggregation weight of the industrial terminal is reduced to zero.

9. The federated collaborative security defense method for industrial control networks according to claim 1, characterized in that: Specifically, S5 also includes: The system monitors the quality of the probe channel in real time to acquire the topology response delay data and calculates the probe confidence score. If the probe confidence score is lower than a preset quality threshold, the active probe dimension is deemed to have failed, and the system automatically switches from federated collaborative mode to local enhanced defense mode. In the local enhanced defense mode, the system increases the judgment threshold weight of the instruction stream execution entropy and introduces the historical execution trajectory benchmark of the industrial terminal for self-evolution feature comparison to maintain basic anti-virus capabilities in network interference environments.

10. A federated collaborative security defense system for industrial control networks, comprising the federated collaborative security defense method for industrial control networks according to any one of claims 1-9, characterized in that, include: The dual-domain data acquisition module is used to acquire micro-time-series event stream data of the internal running tasks of the industrial terminal, and to acquire topological response delay data of the industrial terminal in response to the probe pulse. The behavioral feature modeling module is used to perform ordered measurement on the micro-time-series event stream data, generate instruction stream execution entropy that characterizes the terminal computing behavior characteristics, and perform distortion analysis on the topology response delay data to generate a logic echo attenuation vector that characterizes the network logic impedance characteristics. The correlation tensor mapping module, based on the execution state logic impedance calculation model, performs nonlinear correlation processing on the instruction stream execution entropy and the logic echo attenuation vector to generate an execution state logic impedance composite tensor that characterizes the resonance intensity of the global virus infection field. The risk status verification module performs consistency verification based on the magnitude of the execution state logic impedance composite tensor and the preset security reference spectrum, and outputs an indication signal for the terminal infection status. The collaborative response control module is used to synchronously adjust the communication access control policy of the industrial terminal according to the indication signal, and to correct the weight coefficients of the industrial terminal online during the aggregation of the federated learning global model.

Images