Multi-modal apt defense transmission system based on power line channel characteristics adaptation

Abstract

The application discloses a multi-modal APT defense transmission system based on power line channel feature adaptation, and belongs to the technical field of communication security, comprising a power line channel sensing unit, a transmission behavior sensing unit, a multi-modal fusion decision engine, a trust root and encryption module, and a dynamic response and traceability controller. The power line channel sensing unit collects physical layer core features and extracts transient signals. The transmission behavior sensing unit captures transmission layer abnormal behaviors. The multi-modal fusion decision engine realizes APT attack grading and scoring through a double model architecture. The trust root and encryption module adopts a layered encryption mechanism to ensure data security. The dynamic response and traceability controller executes graded defense and completes attack source positioning and attack chain reconstruction. The application realizes the identification, defense, secure transmission and traceability of APT attacks through multi-modal data fusion and full-process closed-loop protection, adapts to real-time transmission requirements of smart grids, industrial control and the like, and improves the security and resilience of power line communication.

Description

Technical Field

[0001] This invention relates to the field of communication security technology, and in particular to a multimodal APT defense transmission system based on power line channel characteristic adaptation. Background Technology

[0002] Currently, power line carrier communication (PLC) is widely used in critical infrastructure such as smart grids and industrial control. However, the channel has inherent characteristics such as high interference, low bandwidth, and complex topology. APT attacks, with their characteristics of long-term infiltration, multi-stage penetration, and covert transmission, often carry out damage by tampering with power line carrier signals, stealing transmitted data, and implanting malicious commands.

[0003] Existing protection technologies have significant shortcomings: they only focus on network layer traffic analysis or single encryption methods, lacking protection schemes that deeply integrate with the physical layer channel characteristics of power lines; they do not design a full-process defense mechanism for the APT attack lifecycle, making it difficult to distinguish between channel noise and attack signals; and they lack the integrated hardware and software linkage capabilities for perception, identification, defense, and tracing, resulting in low detection accuracy, delayed response, and inability to proactively block attacks. Summary of the Invention

[0004] The purpose of this invention is to provide a multi-modal APT defense transmission system based on power line channel characteristics, which makes up for the shortcomings of existing protection technologies such as lack of deep integration between the physical layer and the transmission layer, lack of a full-process defense mechanism, and insufficient hardware and software linkage. It enables accurate identification, rapid defense, secure transmission and source tracing of APT attacks, and provides a closed-loop security guarantee for power line communication of key infrastructure such as smart grids and industrial control.

[0005] To achieve the above objectives, the present invention provides a multimodal APT defense transmission system based on power line channel feature adaptation, including a power line channel sensing unit, a transmission behavior sensing unit, a multimodal fusion decision engine, a root of trust and encryption module, and a dynamic response and tracing controller; The power line channel sensing unit is deployed on the PLC modem to collect core characteristics of the power line physical layer; the transmission behavior sensing unit is used to collect transmission layer network traffic data and build a behavior baseline to identify abnormal transmission behavior; the multimodal fusion decision engine receives the feature data output by the power line channel sensing unit and the transmission behavior sensing unit, fuses the environmental context for attack analysis, and outputs an APT attack classification score; the root of trust and encryption module ensures data and policy integrity based on a hardware root of trust and uses a layered encryption mechanism to achieve secure signal and data transmission; the dynamic response and tracing controller performs graded defense operations according to the attack score and locates the attack source through tracing tags.

[0006] Preferably, the power line channel sensing unit integrates a channel parameter acquisition module, a low-noise amplifier (LNA), and a high-speed ADC. The core features of the physical layer include channel attenuation coefficient, signal-to-noise ratio, noise power spectral density, signal amplitude spectrum, signal phase transition, and data frame length variation coefficient.

[0007] Preferably, the high-speed ADC has a sampling rate ≥100MS / s and supports mixed narrowband and wideband sampling; the power line channel sensing unit achieves signal denoising and transient feature extraction through one of the short-time Fourier transform (STFT) and wavelet transform to capture APT covert transmission signals.

[0008] Preferably, the network traffic data collected by the transmission behavior sensing unit includes session duration, packet interval distribution, protocol field characteristics, and unauthorized node access fingerprints, and the abnormal transmission behaviors include burst bandwidth occupation, non-standard protocol communication, and lateral data flow.

[0009] Preferably, the input dimensions of the multimodal fusion decision engine include physical layer channel features, transport layer behavioral features, and environmental context, wherein the environmental context includes channel state and service priority; the decision engine adopts a dual-model fusion architecture of graph neural network (GNN) and temporal convolutional network (TCN), wherein GNN is used to model the correlation between transmission nodes, and TCN is used to process the time-frequency sequence of the signal.

[0010] Preferably, the multimodal fusion decision engine adopts a training method that combines semi-supervised learning and supervised learning, and the training samples include normal power line communication samples, channel interference samples, and simulated APT attack samples.

[0011] Preferably, the root of trust and encryption module includes a TPM / TEE hardware root of trust for storing model signatures, encryption keys and defense strategies; the layered encryption mechanism includes physical layer RC4 stream encryption and link layer RSA-2048 asymmetric encryption, the physical layer encryption uses dynamic keys, and the link layer distributes regional keys through asymmetric encryption.

[0012] Preferably, the hierarchical defense strategy of the dynamic response and tracing controller includes dynamic link disconnection, coding redundancy adjustment, hostile signal frequency band suppression, unauthorized node isolation, channel hopping, signal and noise injection, dynamic topology reconstruction, and decoy data injection.

[0013] Preferably, the dynamic response and tracing controller locates the attack source by embedding a lightweight tracing tag in the header of the signal frame. The tracing tag includes a terminal ID, a channel feature summary, and a timestamp. The controller combines transmission node logs and power line topology diagrams to reconstruct the attack chain and profile the attacker.

[0014] Therefore, this invention employs the aforementioned multimodal APT defense transmission system adapted to power line channel characteristics. It integrates the physical layer channel characteristics and transmission layer behavioral characteristics of power lines, utilizing a dual-model architecture of GNN and TCN, along with semi-supervised and supervised hybrid training, to accurately distinguish between channel noise and APT covert attack signals. A layered encryption mechanism, combined with a hardware root of trust, and the linkage of physical layer dynamic keys with link layer RSA-2048 asymmetric encryption, ensures end-to-end data transmission security and effectively resists attacks such as signal tampering and data theft. The tiered defense strategy adapts to the entire lifecycle of APT attacks, proactively blocking attacks through multi-dimensional operations such as link disconnection and topology reconstruction. Simultaneously, lightweight tracing tags enable precise location of the attack source and reconstruction of the attack chain, providing a complete basis for tracing and handling.

[0015] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0016] Figure 1 This is a system framework diagram of an embodiment of the present invention; Figure 2 This is a flowchart illustrating the process of an embodiment of the present invention. Detailed Implementation

[0017] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0018] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0019] Example 1 This invention provides a multimodal APT defense transmission system based on power line channel feature adaptation, the system architecture of which is as follows: Figure 1 As shown, it includes a power line channel sensing unit, a transmission behavior sensing unit, a multimodal fusion decision engine, a root of trust and encryption module, and a dynamic response and traceability controller; The Power Line Channel Sensing Unit (PLC-SZ) is deployed within a PLC modem to collect core physical layer features of power lines. The PLC-SZ integrates a channel parameter acquisition module, a low-noise amplifier (LNA), and a high-speed ADC. Core physical layer features include channel attenuation coefficient, signal-to-noise ratio (SNR), noise power spectral density, signal amplitude spectrum, signal phase transition, and data frame length variation coefficient. The high-speed ADC has a sampling rate ≥100 MS / s and supports mixed narrowband and wideband sampling. The PLC-SZ uses either Short-Time Fourier Transform (STFT) or Wavelet Transform to achieve signal denoising and transient feature extraction, capturing APT (Ambient Transmission Threat) covert transmission signals.

[0020] The transmission behavior perception unit is used to collect network traffic data at the transport layer and build a behavior baseline to identify abnormal transmission behavior. The network traffic data collected by the transmission behavior perception unit includes session duration, packet interval distribution, protocol field characteristics, and unauthorized node access fingerprints. Abnormal transmission behaviors include burst bandwidth occupation, non-standard protocol communication, and lateral data flow.

[0021] The multimodal fusion decision engine receives feature data from the power line channel sensing unit and the transmission behavior sensing unit, fuses the environmental context for attack analysis, and outputs an APT attack classification score. The input dimensions of the multimodal fusion decision engine include physical layer channel features, transmission layer behavior features, and environmental context, which includes channel state and service priority. The decision engine adopts a dual-model fusion architecture of Graph Neural Network (GNN) and Temporal Convolutional Network (TCN), where GNN is used to model the correlation between transmission nodes, and TCN is used to process the signal time-frequency sequence. The multimodal fusion decision engine uses a training method combining semi-supervised and supervised learning, with training samples including normal power line communication samples, channel interference samples, and simulated APT attack samples.

[0022] The root of trust and encryption module ensures data and policy integrity based on a hardware root of trust, and employs a layered encryption mechanism to achieve secure signal and data transmission. The root of trust and encryption module includes a TPM / TEE hardware root of trust, used to store model signatures, encryption keys, and defense policies. The layered encryption mechanism includes physical layer RC4 stream encryption and link layer RSA-2048 asymmetric encryption. Physical layer encryption uses dynamic keys, and the link layer distributes regional keys through asymmetric encryption. In this embodiment, the dynamic key = SHA-256 (channel attenuation coefficient × signal-to-noise ratio × timestamp × terminal MAC address), and the key update cycle is 100ms. The session key is updated immediately upon triggering a suspected attack.

[0023] The Dynamic Response and Source Tracing Controller executes tiered defense operations based on attack scores and locates the attack source through source tracing tags. The tiered defense strategies of the Dynamic Response and Source Tracing Controller include dynamic link disconnection, coding redundancy adjustment, suppression of hostile signal frequency bands, isolation of unauthorized nodes, channel hopping, signal and noise injection, dynamic topology reconstruction, and decoy data injection. The Dynamic Response and Source Tracing Controller locates the attack source by embedding lightweight source tracing tags in the signal frame header. These tags include the terminal ID, channel feature summary, and timestamp. The controller combines transmission node logs and power line topology maps to reconstruct the attack chain and profile the attacker.

[0024] The workflow of the system described in this embodiment is as follows: Figure 2 As shown, the details are as follows: S1. System Startup and Initialization: After the system is powered on, it automatically completes the initialization configuration, including hardware self-testing and software parameter loading of the power line channel sensing unit, transmission behavior sensing unit, multimodal fusion decision engine, root of trust and encryption module, dynamic response and traceability controller; the TPM / TEE hardware root of trust in the root of trust and encryption module is activated, generating the initial signature key and storing the model signature and basic defense strategy to ensure the initial security of the core link; at the same time, the preset security policy library, threat intelligence library and trained GNN+TCN dual model parameters are loaded, and the system enters the standby state.

[0025] S2. Continuous sensing and acquisition of multi-source data: S21, the power line channel sensing unit is deployed in the PLC modem. It collects the core features of the power line physical layer in real time through high-speed ADC and low-noise amplifier LNA, including channel attenuation coefficient, signal-to-noise ratio, noise power spectral density, signal amplitude spectrum, phase jump, data frame length variation coefficient, etc. It completes signal denoising and transient feature extraction through short-time Fourier transform (STFT) or wavelet transform, and near-end preprocessing reduces noise interference. S22. The transmission behavior sensing unit passively collects network layer traffic data (session duration, packet interval distribution, protocol field characteristics, unauthorized node access fingerprint, etc.) of power line carrier transmission, and at the same time constructs a transmission behavior baseline and monitors abnormal behaviors that deviate from the baseline in real time (burst bandwidth occupation, non-standard protocol communication, lateral data flow, etc.). S23. After the collected data is signed by the root of trust and the encryption module, it is synchronously uploaded to the multimodal fusion decision engine.

[0026] S3, Multimodal Fusion Analysis and Attack Identification: S31. The multimodal fusion decision engine receives physical layer channel characteristics, transport layer behavioral characteristics, and environmental context. The environmental context includes channel state and service priority. It first completes data cleaning, correlation, and normalization processing. S32. Based on GNN modeling of transmission node correlation, TCN processing of signal time-frequency sequence, and combining the model formed by semi-supervised learning and supervised learning training, deep correlation analysis of multidimensional data is performed. S33. Extract APT attack features specific to the power line scenario, including data frame length variation coefficient, number of abnormal modifications to protocol fields, signal strength of unauthorized nodes, etc., match them with the threat intelligence database and APT attack feature rules, and output an APT attack rating score of 0-10. If the score is ≥8, it is judged as a suspected APT attack and the subsequent response process is triggered; otherwise, it returns to the continuous awareness stage.

[0027] S4. Attack Assessment and Dynamic Defense Strategy Generation: S41. The dynamic response and tracing controller receives attack classification scores and fusion analysis results to determine the stage of the APT attack (reconnaissance, weaponization, delivery, exploitation, installation, command and control, target achievement), confidence level and scope of impact, and to distinguish between ordinary faults and APT attacks. S42. Combining the preset security policy library and environmental context, adaptively generate hierarchical defense strategies: activate camouflage and deception strategies for the reconnaissance phase, activate channel blocking strategies for the command and control phase, and activate node isolation and topology reconstruction strategies for the lateral movement phase, etc. S43. After the defense strategy is encrypted and signed by the root of trust and the encryption module, it enters the active collaborative defense phase and is simultaneously filed with the security operation and management center.

[0028] S5, Layered Encryption and Proactive Collaborative Defense Execution: S51, the root of trust and encryption module initiate a layered encryption mechanism: the physical layer generates a 128-bit RC4 stream encryption dynamic key using the formula "dynamic key = SHA-256 (channel attenuation coefficient × signal-to-noise ratio × timestamp × terminal MAC address)", which is updated every 100ms and immediately when an attack is suspected; the link layer distributes regional keys using RSA-2048 asymmetric encryption, and the session key is updated in conjunction with the attack detection result. S52, the dynamic response and tracing controller performs multi-dimensional defense operations according to the hierarchical defense strategy: initiating dynamic frequency hopping and noise injection; initiating node isolation, route switching, and dynamic topology reconstruction; injecting decoy data; and simultaneously adjusting coding redundancy, cutting off abnormal links, and suppressing hostile signal frequency bands. S53. During the defense process, the encryption logic is embedded in the LDPC error correction coding process to ensure that the bandwidth overhead and transmission delay are appropriate and to meet the real-time transmission requirements of power lines.

[0029] S6. Simultaneous attack forensics and source tracing: S61. While the defense is being executed, the dynamic response and source tracing controller starts full-process data recording, aggregating and solidifying high-fidelity logs, network traffic, attack characteristic data and defense operation records. S62. Embed a lightweight tracing tag containing terminal ID, channel feature summary, and timestamp in the signal frame header. Combine the transmission node logs and power line topology map to complete the attack chain reconstruction, attack tool identification, jump board analysis, and attacker profiling. S63. Accurately locate the attack source access location, generate an electronic evidence chain and evidence collection report that meet legal requirements, and synchronize them to the security operation and management center.

[0030] S7, Closed-loop feedback and system optimization updates: S71. Update information such as the characteristics of APT attack events, the effectiveness of defense strategies, and the results of forensic investigation to the system knowledge base and threat intelligence base, and optimize the parameters of the GNN+TCN dual model and attack feature rules. S72. The dynamic adaptation mechanism adaptively adjusts the encryption strength, coding redundancy, and attack detection threshold based on the channel noise intensity and attack level in this attack, balancing security and transmission efficiency. S73. The system returns to the continuous monitoring and perception phase, realizing a closed-loop operation of the entire process of perception-fusion-decision-defense-tracing-optimization.

[0031] S8. Security Operations and Auditing: The Security Operations and Management Center displays the system's operating status, attack alarm information, defense operation records, and source tracing reports in real time through a visual dashboard. It supports policy adjustments and the issuance of investigation instructions, while also completing full-process operation auditing and log retention to ensure traceability.

[0032] Therefore, this invention employs the aforementioned multimodal APT defense transmission system adapted to power line channel characteristics. It integrates the physical layer channel characteristics and transmission layer behavioral characteristics of power lines, utilizing a dual-model architecture of GNN and TCN, along with semi-supervised and supervised hybrid training, to accurately distinguish between channel noise and APT covert attack signals. A layered encryption mechanism, combined with a hardware root of trust, and the linkage of physical layer dynamic keys with link layer RSA-2048 asymmetric encryption, ensures end-to-end data transmission security and effectively resists attacks such as signal tampering and data theft. The tiered defense strategy adapts to the entire lifecycle of APT attacks, proactively blocking attacks through multi-dimensional operations such as link disconnection and topology reconstruction. Simultaneously, lightweight tracing tags enable precise location of the attack source and reconstruction of the attack chain, providing a complete basis for tracing and handling.

[0033] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A multimodal APT defense transmission system based on power line channel characteristic adaptation, characterized in that, It includes a power line channel sensing unit, a transmission behavior sensing unit, a multimodal fusion decision engine, a root of trust and encryption module, and a dynamic response and traceability controller; The power line channel sensing unit is deployed on the PLC modem and is used to collect core characteristics of the power line physical layer; the transmission behavior sensing unit is used to collect transmission layer network traffic data and build a behavior baseline to identify abnormal transmission behavior. The multimodal fusion decision engine receives feature data output from the front power line channel sensing unit and the transmission behavior sensing unit, fuses the environmental context to perform attack analysis and outputs an APT attack classification score; the root of trust and encryption module ensures data and policy integrity based on a hardware root of trust and uses a layered encryption mechanism to achieve secure signal and data transmission; the dynamic response and tracing controller performs graded defense operations according to the attack score and locates the attack source through tracing tags. The power line channel sensing unit integrates a channel parameter acquisition module, a low-noise amplifier (LNA), and a high-speed ADC. The core features of the physical layer include channel attenuation coefficient, signal-to-noise ratio, noise power spectral density, signal amplitude spectrum, signal phase transition, and data frame length variation coefficient. The high-speed ADC has a sampling rate of ≥100MS / s and supports mixed narrowband and wideband sampling. The power line channel sensing unit uses one of the short-time Fourier transform (STFT) and wavelet transform to achieve signal denoising and transient feature extraction, thereby capturing APT covert transmission signals. The root of trust and encryption module includes a TPM / TEE hardware root of trust, used to store model signatures, encryption keys and defense strategies; the layered encryption mechanism includes physical layer RC4 stream encryption and link layer RSA-2048 asymmetric encryption, the physical layer encryption uses dynamic keys, and the link layer distributes regional keys through asymmetric encryption. The hierarchical defense strategy of the dynamic response and tracing controller includes dynamic link disconnection, coding redundancy adjustment, suppression of hostile signal frequency bands, isolation of unauthorized nodes, channel hopping, signal noise injection, dynamic topology reconstruction, and decoy data injection. The dynamic response and tracing controller realizes attack source location by embedding a lightweight tracing tag in the signal frame header. The tracing tag includes terminal ID, channel feature summary, and timestamp. The controller combines transmission node logs with power line topology diagrams to reconstruct the attack chain and profile the attacker.

2. The multimodal APT defense transmission system based on power line channel feature adaptation according to claim 1, characterized in that, The network traffic data collected by the transmission behavior sensing unit includes session duration, packet interval distribution, protocol field characteristics, and unauthorized node access fingerprints. The abnormal transmission behaviors include burst bandwidth occupation, non-standard protocol communication, and lateral data flow.

3. The multimodal APT defense transmission system based on power line channel feature adaptation according to claim 1, characterized in that, The input dimensions of the multimodal fusion decision engine include physical layer channel features, transport layer behavioral features, and environmental context. The environmental context includes channel state and service priority. The decision engine adopts a dual-model fusion architecture of graph neural network (GNN) and temporal convolutional network (TCN), where GNN is used to model the correlation between transmission nodes and TCN is used to process the time-frequency sequence of the signal.

4. The multimodal APT defense transmission system based on power line channel feature adaptation according to claim 3, characterized in that, The multimodal fusion decision engine adopts a training method that combines semi-supervised learning and supervised learning. The training samples include normal power line communication samples, channel interference samples, and simulated APT attack samples.

Images