Dynamic network anomaly detection method and system based on behavior baseline

Abstract

The invention provides a dynamic network anomaly detection method and system based on a behavior baseline, and relates to the technical field of network information security, and the method comprises the steps: collecting multi-source heterogeneous operation data of a liquefied natural gas receiving wharf, and carrying out the fusion to generate a multi-modal feature set; constructing a layered deterministic behavior contour; generating an anomaly suspicion score sequence arranged in a descending order according to the anomaly probability; performing tight coupling alignment on the timelines of the candidate abnormal behavior clusters and the key process time sequence data to generate a process risk mapping relation table; and calling an incremental learning algorithm to update behavior mode parameters and judgment thresholds of corresponding process stages in the dynamic baseline template library, and outputting a baseline self-optimization parameter set. According to the invention, the network access authority of the unshipping arm, the storage tank and the gasifier key equipment is effectively controlled, the issuing of malicious instructions is blocked, and the requirements of high reliability, low false alarm and self-adaptive protection of the LNG receiving wharf on the safety of the industrial control network are met.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and more specifically, to a dynamic network anomaly detection method and system based on behavioral baselines. Background Technology

[0002] Currently, as critical information infrastructure, the industrial control network security protection of LNG receiving terminals mainly relies on traditional static rule matching and preset threshold alarm mechanisms. Because the industrial control network of an LNG receiving terminal is physically isolated from the office network and operates as an isolated network, the behavior patterns of internal users and equipment are relatively simple. Existing technologies typically employ whitelist-based access control and simple statistical baselines for anomaly detection. Specifically, existing systems collect network traffic data, extract surface statistical features such as traffic volume and connection frequency, set fixed thresholds or construct static behavioral baselines, and trigger alarms when real-time monitored values ​​deviate from the baseline by more than the threshold.

[0003] However, this approach has significant drawbacks: First, static baselines cannot adapt to the dynamic changes in different process stages such as LNG terminal unloading, storage, and gasification and export, leading to a significant increase in false alarm rates during process switching. Second, existing technologies only focus on single-point anomalies and lack the ability to perform temporal causal analysis on the behavioral chains of cross-network entities, making it difficult to detect carefully disguised lateral movement attacks. Third, traditional methods fail to deeply integrate process parameters and network behavior, making it impossible to verify whether network anomalies truly threaten core process safety such as tank overpressure or accidental triggering of emergency shut-off valves, easily generating a large number of irrelevant alarms that drown out real threats. Finally, existing systems lack adaptive optimization mechanisms, and baseline updates rely on manual intervention, making it difficult to maintain a high detection rate while keeping the false alarm rate extremely low. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamic network anomaly detection method and system based on behavioral baselines to improve the aforementioned problems. To achieve this objective, the technical solution adopted by this invention is as follows: Firstly, this application provides a dynamic network anomaly detection method based on behavioral baselines, comprising: Collect multi-source heterogeneous operational data from the liquefied natural gas receiving terminal, including raw traffic mirrors of the industrial control network and office network, operation logs, control equipment status messages, work plan data, and key process timing data; Industrial protocol deep parsing and operational semantic disambiguation are performed on multi-source heterogeneous operational data to output cleaned structured data with unified spatiotemporal labels. The cleaned structured data is input into a dedicated feature operator to extract the frequency and periodic features of the network session layer quintuple and the modal and parameter range features of the instruction sequence in the operation log, and then fused to generate a multimodal feature set. Based on the multimodal feature set, the operation process is segmented into stages and context labeled by combining the operation plan data and key process time series data. A hierarchical deterministic behavior profile composed of individual behavior vectors, group collaboration vectors and network situation vectors is constructed and merged according to the process stage. Based on long-term historical normal data, the statistical distribution of the hierarchical deterministic behavior profile within each process stage is learned and stored as a dynamic baseline template library. The hierarchical deterministic behavioral profile and dynamic baseline template library are input into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the context index of the real-time process stage, the statistical distance between the current behavioral profile and the baseline pattern is calculated to output a micro-deviation metric. Multi-scale fusion is performed on the micro-deviation metric to calculate the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly. This index is organized into a behavioral deviation matrix of all network entities on continuous time slices. Based on the behavioral deviation matrix and combined with the requirement of extremely low false alarm rate in a static whitelist environment, adaptive threshold technology is used for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability. Extract the set of highly suspicious entities corresponding to the abnormal suspicion score sequence from the behavior deviation matrix, call the time series correlation analysis engine to reconstruct the network access relationship between entities, operation command flow and alarm event time series causal chain, and output candidate abnormal behavior clusters; tightly couple and align the timeline of the candidate abnormal behavior clusters with the key process time series data to verify the spatiotemporal correlation between abnormal network behavior and tank overpressure and emergency shut-off valve abnormal triggering of unexpected disturbances in key process parameters, and generate a process risk mapping relationship table; The candidate abnormal behavior clusters and the process risk mapping table are input into the scenario-based security protection strategy library. Based on the process risk level, the handling priority and response strategy weight are assigned to each abnormal behavior cluster. A dynamic network anomaly detection report containing severity level classification and handling guidance is generated through multi-attribute decision fusion. Based on the false alarm and false negative data fed back by the dynamic network anomaly detection report, the incremental learning algorithm is called to update the behavior pattern parameters and judgment thresholds of the corresponding process stage in the dynamic baseline template library, and the baseline self-optimization parameter set is output.

[0005] Secondly, this application also provides a dynamic network anomaly detection system based on behavioral baselines, comprising: Acquisition module: Used to collect multi-source heterogeneous operational data of the liquefied natural gas receiving terminal, including raw traffic mirrors of the industrial control network and office network, operation logs and control equipment status messages, as well as work plan data and key process timing data; Extraction and Fusion Module: This module performs deep parsing of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operational data, outputting cleaned structured data with unified spatiotemporal labels. The cleaned structured data is then input into a dedicated feature operator to extract the frequency and periodic features of the network session layer's five-tuples and the modal and parameter range features of the instruction sequence in the operation log, fusing them to generate a multimodal feature set. Based on this multimodal feature set, and combined with work plan data and key process time series data, the module performs work process stage segmentation and context labeling, constructing a hierarchical deterministic behavior profile merged by process stage, consisting of individual behavior vectors, group collaboration vectors, and network situation vectors. Based on long-term historical normal data, the module learns the statistical distribution of the hierarchical deterministic behavior profile within each process stage and stores it as a dynamic baseline template library. The calculation module is used to input the hierarchical deterministic behavior profile and the dynamic baseline template library into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the context index of the real-time process stage, it calculates the statistical distance between the current behavior profile and the baseline pattern to output a micro-deviation metric. It performs multi-scale fusion on the micro-deviation metric, calculates the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly, and organizes it into a behavior deviation matrix of all network entities on continuous time slices. Based on the behavior deviation matrix and combined with the requirement of extremely low false alarm rate in the static whitelist environment, it uses adaptive threshold technology for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability. The generation module is called to extract the set of highly suspicious entities corresponding to the abnormal suspicion score sequence from the behavior deviation matrix. It calls the time series correlation analysis engine to reconstruct the network access relationship between entities, the operation command flow and the time series causal chain of alarm events, and outputs a cluster of candidate abnormal behaviors. The timeline of the candidate abnormal behavior clusters is tightly coupled and aligned with the key process time series data to verify the spatiotemporal correlation between abnormal network behavior and the unexpected disturbance of key process parameters triggered by tank overpressure and emergency shut-off valve, and to generate a process risk mapping relationship table. The anomaly detection module is used to input the mapping table between candidate abnormal behavior clusters and process risks into the scenario-based safety protection strategy library. Based on the process risk level, it assigns handling priorities and response strategy weights to each abnormal behavior cluster. Through multi-attribute decision fusion, it generates a dynamic network anomaly detection report containing severity level classification and handling guidelines. Based on the false alarm and false negative data fed back from the dynamic network anomaly detection report, it calls the incremental learning algorithm to update the behavior pattern parameters and judgment thresholds of the corresponding process stages in the dynamic baseline template library, and outputs the baseline self-optimization parameter set.

[0006] The beneficial effects of this invention are as follows: This invention utilizes deep parsing of industrial protocols and operational semantic disambiguation technology to extract function code-level behavioral features from industrial control protocol messages such as Modbus TCP, OPC UA, and PROFINET. Combined with the time-series data of unloading, storage, and gasification export processes, it constructs a hierarchical deterministic behavioral profile for process stage awareness. This effectively overcomes the shortcomings of traditional static baselines in adapting to dynamic process changes, significantly reduces the false alarm rate during process switching stages such as unloading and gasification export, and achieves accurate detection with an extremely low false alarm rate in a whitelist environment.

[0007] This invention uses Mahalanobis distance to calculate the statistical distance between the current behavior vector and the process stage index pattern in the dynamic baseline template library. By multi-scale weighted fusion of composite deviation indices from three levels—single-point deviation, group collaborative disruption, and network communication paradigm anomalies—it solves the problem that existing technologies only focus on single-point anomalies while ignoring cross-entity related behavior chains. This invention can accurately identify lateral movement attacks disguised as normal operations and improve the detection capability of advanced threats such as APTs.

[0008] This invention reconstructs the causal chain of operations of highly suspicious entities through a time-series correlation analysis engine, and performs time-series tight coupling and alignment verification of candidate abnormal behavior clusters with key process parameters such as tank overpressure and abnormal triggering of emergency shut-off valves. This achieves accurate mapping between network abnormal behavior and LNG process safety risks, avoids irrelevant alarms from drowning out real threats, and ensures that the generated dynamic network anomaly detection report has clear severity classifications of process interruption level, equipment damage level, and violation operation level, providing actionable blocking and isolation guidelines for emergency response.

[0009] This invention utilizes an incremental learning algorithm to automatically correct the behavioral pattern parameters and judgment thresholds of each process stage in the dynamic baseline template library based on the false alarm and false alarm data from the detection feedback. This enables the baseline template to evolve adaptively, solving the shortcomings of traditional methods that rely on manual baseline updates and cannot continuously adapt to behavioral evolution. It ensures that the detection system maintains a balance between high detection rate and low false alarm rate during long-term operation, guaranteeing the safe and stable operation of the LNG receiving terminal's industrial control network. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a schematic diagram of the dynamic network anomaly detection method based on behavioral baseline described in this embodiment of the invention; Figure 2This is a schematic diagram of the structure of the dynamic network anomaly detection system based on behavioral baseline described in this embodiment of the invention; In the diagram: 701, Acquisition Module; 702, Extraction and Fusion Module; 703, Calculation Module; 704, Call and Generation Module; 705, Anomaly Detection Module. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0013] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this invention, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance. Example 1:

[0014] This embodiment provides a dynamic network anomaly detection method based on behavioral baselines.

[0015] See Figure 1 The figure shows that the method includes steps S100, S200, S300, S400 and S500.

[0016] S100: Collect multi-source heterogeneous operation data of the liquefied natural gas receiving terminal, including raw traffic mirrors of the industrial control network and office network, operation logs and control equipment status messages, as well as work plan data and key process timing data.

[0017] It is understood that step S100 includes S101, S102, and S103, wherein: S101. Deploy traffic mirroring probes on the core switches of the industrial control network to capture Modbus TCP, OPCUA, and PROFINET industrial protocol messages in real time, and extract the source IP address, destination IP address, source port, destination port, protocol type five-tuple information, as well as message direction, payload length, and sending timestamp sequence to form a network flow metadata queue. It's important to note that LNG terminal industrial control networks typically employ a layered architecture. The core switch sits at the hub between the process control layer and the monitoring layer. Deploying traffic mirroring probes here enables visibility capture of all cross-layer communications, avoiding traffic loss issues that can occur when deployed at edge switches. The probes utilize zero-copy packet capture technology and a kernel bypass mechanism to ensure no packet loss and no introduced latency in a 10Gbps industrial ring network environment, which is crucial for maintaining deterministic communication in the industrial control system. Among the captured protocol types, Modbus TCP is primarily used for data acquisition between the PLC and remote I / O stations, OPC UA is used for vertical communication between the DCS and MES systems, and PROFINET is responsible for real-time control of field devices such as drive motors and valve positioners. These three protocols each play a specific role in key process stages such as precise control of the LNG unloading arm, tank pressure interlocking, and vaporizer temperature regulation. Five-tuple extraction is not simply header parsing, but involves in-depth processing tailored to the characteristics of industrial control protocols: for Modbus TCP, transaction identifier and function code fields need to be extracted to distinguish different control tasks; for OPC UA, session ID and node ID need to be parsed to identify specific operation objects; and for PROFINET, frame ID needs to be extracted to associate periodic and non-periodic communication. The message direction field distinguishes between commands issued by the host computer and upload status by the slave computer. In LNG scenarios, abnormal direction (such as when the slave computer actively initiates a request) is often an early sign of illegal intrusion. The payload length and timestamp sequence constitute a length-time two-dimensional feature used to characterize the periodic stability of industrial control communication. Under normal operating conditions at LNG terminals, the command transmission interval jitter is typically less than 1 millisecond; any deviation indicates a potential threat. The constructed network flow metadata queue adopts a hybrid storage strategy of circular buffer and file mapping. The most recent 5 minutes of hot data are retained in memory for real-time analysis, while historical data is compressed and written to disk in Parquet columnar format, balancing query efficiency and storage cost.

[0018] S102. Read the second-level process timing data of tank liquid level, pressure and temperature from the distributed control system through the OPC interface, read the unloading plan and gasification export scheduling data from the production execution system through the REST API, and read the operation log containing operator number, operation time, operation object and parameter value from the operator workstation through the Syslog protocol to build a process operation fusion data block. It should be noted that this step, which achieves data fusion between network behavior and process procedures, is a core innovation that breaks through the traditional separation between network security and process security. The OPC interface uses an OPC UA protocol subscription-publish mechanism, rather than the traditional OPC DA synchronous reading, ensuring proactive push notifications when process data changes, avoiding control lag caused by polling delays. The read tank level data is not a simple numerical value, but a three-tuple structure containing level value, rate of change, and high-high / low-low alarm status. Pressure data includes safety valve interlock status bits, and temperature data is associated with heater start / stop status. This structured information provides a basis for subsequent process risk verification. The unloading plan data obtained from the MES via the REST API includes fields such as vessel name, expected arrival time, planned unloading volume, and unloading rate curve. The gasification export scheduling data includes export flow setpoints, pressure ramp-up curves, and equipment start / stop sequences. This data is not only used for stage segmentation, but the comparison between planned values ​​and actual control commands can detect parameter tampering attacks. The operation logs collected by the Syslog protocol adopt the RFC5424 format, but with dedicated fields extended for the LNG scenario: operator ID is associated with the job role and permission database, the operation object is accurate to the specific equipment tag number (such as TK-001 storage tank, VB-101 valve), and parameter value records compare the values ​​before and after the instruction is issued. This fine-grained recording supports accurate identification of "operations outside the authorized scope". The process operation fusion data block adopts a wide table model design, with the primary key being a nanosecond-level timestamp. Column families are stored in partitions according to the data source. Network flow records, process parameters, and operation events at the same time are aligned to form wide row records through timestamp alignment. During the data fusion process, to address the issue of clock asynchrony between different systems, a strategy combining PTP clock synchronization and linear interpolation is adopted: the OPC UA server serves as the master clock source, and timestamp correction is triggered when the time deviation between MES and the operator station exceeds 1 millisecond. Missing data is filled forward using the inertia characteristics of the process, ensuring the density and consistency of the fusion data block in terms of time sequence.

[0019] S103. The PTP precise time protocol is used to perform nanosecond-level time synchronization between the network stream metadata queue and the process operation fusion data block. The two types of data are spliced ​​together into an LNG terminal operation data body with spatiotemporal consistency using a unified timestamp as the key. Each record in this data body contains four fields: timestamp, network characteristics, process parameters, and operation events.

[0020] It is important to note that this step is crucial for eliminating data silos and building a unified analytical view. The PTP (Precise Time Protocol) is deployed in a boundary clock mode in the isolated LNG terminal environment. The core switch acts as the master clock source, and each probe and interface server acts as a slave clock. Sub-microsecond synchronization accuracy is achieved through hardware timestamps and the BMC (Browser Control Center) algorithm. This accuracy is critical for analyzing the causal relationship between network attacks and process disturbances, as the execution of industrial control commands and changes in process parameters typically occur within milliseconds. Time synchronization not only corrects clock deviations but also calibrates data acquisition latency: network flow probes record message arrival times, while OPC interfaces record sensor sampling times, resulting in differences in transmission and processing latency. This step ensures the accuracy of cross-system event timing relationships by measuring and compensating for fixed path delays. Simultaneously, a columnar time-series database is used for physical storage, with different compression algorithms tailored to the hot and cold characteristics of LNG terminal industrial data: Gorilla compression is used for hot data to ensure write performance, Delta-RLE compression is used for warm data to balance query efficiency, and ZSTD compression is used for cold data to maximize storage utilization. The data body also incorporates a data quality scoring mechanism, which automatically marks the quality level for anomalies such as timestamp jumps, missing feature values, and process parameters exceeding the range, providing data credibility weights for subsequent baseline learning.

[0021] S200 performs deep parsing of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operational data, outputting cleaned structured data with unified spatiotemporal labels; inputs the cleaned structured data into a dedicated feature operator to extract the frequency and periodic features of the network session layer quintuple and the modal and parameter range features of the instruction sequence in the operation log, and fuses them to generate a multimodal feature set; based on the multimodal feature set, combined with the work plan data and key process time series data, the work process is segmented into stages and context labeled, and a hierarchical deterministic behavior profile composed of individual behavior vectors, group collaboration vectors and network situation vectors is constructed and merged according to the process stage; based on long-term historical normal data, the statistical distribution of the hierarchical deterministic behavior profile within each process stage is learned and stored as a dynamic baseline template library.

[0022] It is understood that step S200 includes S201, S202, and S203, wherein: S201. Input the LNG terminal operation data into the industrial protocol deep parsing engine, identify the industrial control instruction function code and operation semantics, clean up the repeatedly collected and misaligned protocol fields, and output cleaned structured data containing instruction type and parameter legality labels. It should be noted that the core of this step lies in penetrating the industrial protocol encapsulation to restore the operational intent. The parsing engine is deeply customized for typical LNG terminal protocols: for Modbus TCP, it identifies and marks the 0x10 write multi-register function code as a high-risk operation. In the unloading scenario, this function code directly controls the frequency of the unloading pump, and if it occurs outside the unloading period, it triggers an anomaly warning; for OPCUA, it parses the mapping relationship between session ID and node ID to identify write requests for the storage tank level setpoint node, preventing forged clients from tampering with process parameters; for PROFINET, it distinguishes between real-time data frames and non-real-time configuration frames to avoid misjudging normal equipment polling as a scanning attack. Duplicate acquisition processing uses 5-tuple and net load hash deduplication within a 5-second window to solve the duplicate counting problem caused by redundant communication architecture. Protocol field misalignment is checked using a state machine, isolating and storing defective messages such as function code and data length mismatch and transaction identifier jumps, and triggering quality alarms, preserving clues for equipment anomaly analysis. Parameter validity labels are generated based on the LNG process knowledge base. For example, during the unloading period, the unloading arm flow valve opening command is only marked as valid within the 30%-80% range; commands exceeding this range are directly marked as non-compliant, thus screening for obvious violations in advance and reducing subsequent computational load. The cleaned data uses a nested dictionary structure, with the top-level key being the timestamp. The second-level structure contains arrays of key-value pairs for protocol type, function code, register address, and validity labels, preserving protocol hierarchy while facilitating vectorization. This engine is deployed as a lightweight container on edge nodes, employing a streaming processing framework to achieve microsecond-level latency, ensuring no interference with control loop timing.

[0023] In practical applications, this step transforms the original bitstream into a semantic event stream, freeing subsequent feature extraction from direct dependence on the payload and meeting the confidentiality requirements of industrial control networks. At the same time, by pre-judging the legality of operations, the filtering rate of obvious violations is increased to over 95%, significantly reducing the load on subsequent analysis modules.

[0024] S202. Call the dedicated feature operator to calculate the message length entropy, command frequency fluctuation rate and operation interval periodicity index of each network session from the purified structured data, generate a multimodal feature set, and divide the terminal operation into unloading period, storage period, gasification and export period and standby maintenance period according to the unloading plan and process time series data, and label each data with a process stage. It should be noted that this step quantifies semantic events into behavioral fingerprints. Message length entropy is calculated using a sliding window to determine the Shannon entropy value. Under normal operating conditions, the LNG control command length distribution is stable, with an entropy value below 1.5. However, if random length probing or padding attacks occur, the entropy value spikes, effectively detecting unknown malformed messages. Command frequency volatility is obtained by calculating the coefficient of variation of the number of occurrences of function codes in adjacent windows. LNG periodic control tasks, such as PID regulation of tank pressure, produce stable frequency patterns with volatility approaching zero. Attack scans, however, cause drastic frequency fluctuations, a characteristic particularly sensitive to worm propagation. The operation interval periodicity index is analyzed using Fourier transform to determine the spectral energy concentration of the command time series. Normal process operations, such as hourly tank sampling, have a significant 24-hour period, with an index close to 1. Manual random operations or intrusion attempts disrupt this periodicity, causing the index to decrease, demonstrating a significant effect on detecting internal violations.

[0025] The process phase division integrates unloading plans with real-time parameter dynamic judgment: the unloading period is determined when the unloading arm docking signal is activated and the tank liquid level rise rate is greater than 0.5 m / h; the storage period is determined when the liquid level change rate is less than 0.01 m / h and the pressure is stable within ±5% of the set value; the vaporizer outlet flow rate is determined when it is continuously greater than 10 tons / h and shows an upward trend; the rest are standby maintenance periods. This mechanism adaptively handles abnormal scenarios such as unplanned shutdowns and emergency shutdowns. Phase labels are appended to records with integer codes, serving as key values ​​for subsequent clustering and baseline indexing, ensuring that heterogeneous behavioral patterns in different phases do not interfere with each other. The multimodal feature set is stored in sparse matrix blocks, isolating behavioral features from process features, supporting efficient parallel computing. In the actual system, feature operators are implemented using CUDA-accelerated GPU operators, processing 100,000 structured data points per second, meeting the real-time analysis requirements of tens of thousands of measurement points. This step compresses high-dimensional time-series data into low-dimensional fingerprints, retaining key distinguishing information while reducing storage space by 90%. The introduction of process stage labels enables the detection model to have context-aware capabilities, preventing tank pressure regulation commands from being misjudged as abnormal during the unloading period.

[0026] S203. Cluster the multimodal feature set according to the process stage label, construct individual behavior vectors to represent the deterministic behavior patterns of a single operator or device, group collaboration vectors to represent the operational sequence dependencies between multiple entities, and network situation vectors to represent the network traffic topology structure, forming a hierarchical deterministic behavior profile, and statistically analyze the hierarchical behavior profile mean vector and covariance matrix of historical normal data in each process stage, and store them as a dynamic baseline template library.

[0027] It should be noted that this step, which achieves an abstract leap from features to behavioral patterns, is the core of the detection method's interpretability. The construction of individual behavioral vectors employs a temporal convolutional network encoder, mapping the multimodal feature sequence of a single operator or device within a fixed time window into a fixed-dimensional vector. In the LNG scenario, a specific operator responsible for unloading the unloading arm will exhibit a stable command sequence pattern during the unloading period, such as first opening the shore valve, then starting the unloading pump, and finally adjusting the flow rate. This pattern, encoded as a vector, exhibits high cohesion; the distance between different operator vectors in the feature space reflects differences in operating habits. The construction of group collaborative vectors uses an attention mechanism to identify the temporal relationships of operational dependencies between multiple entities. For example, when a tank pressure over-limit alarm is triggered, the pressure control system first starts the BOG compressor, then closes the feed valve after a 2-second delay. This causal temporal sequence is encoded as a group vector. If an attacker forges an alarm and immediately closes the valve, skipping the compressor startup, the group vector will deviate significantly. The network situation vector uses graph embedding technology to construct a directed graph of communication connections between all network devices, with nodes representing devices and edges representing command flows. The low-dimensional representation of nodes is learned through the Node2Vec algorithm. Under normal operating conditions, the graph structure is stable and the vector changes smoothly. However, if an illegal device accesses the network or an abnormal command is broadcast, the graph structure changes abruptly, causing the vector to drift.

[0028] The clustering process employs density peak clustering instead of the traditional K-means algorithm because the density distribution of behavioral patterns varies across different process stages at the LNG terminal. Density peak clustering can automatically identify high-density core areas during unloading and low-density exploration areas during standby maintenance, without requiring a pre-defined number of clusters. A dynamic baseline template library is stored in a time-series database. The primary key is the process stage code, and the values ​​are the mean vector and covariance matrix of all normal historical data for that stage. The mean vector characterizes the center of normal behavior, and the covariance matrix characterizes the range of behavioral fluctuations; together, they constitute a multivariate Gaussian distribution model. The template library uses an incremental update mechanism, automatically merging confirmed normal data into the historical database during off-peak hours each day and recalculating statistical parameters to ensure the baseline evolves slowly with equipment aging and process fine-tuning. The technical effect of this step is to elevate the raw data to a semantically layered behavioral profile, upgrading anomaly detection from single-point alarms to pattern recognition, enabling the discovery of advanced attack techniques such as "correct command sequence but abnormal timing."

[0029] S300: Input the hierarchical deterministic behavioral profile and dynamic baseline template library into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the context index of the real-time process stage, calculate the statistical distance between the current behavioral profile and the baseline pattern to output a micro-deviation metric. Perform multi-scale fusion on the micro-deviation metric, calculate the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly, and organize it into a behavioral deviation matrix of all network entities on continuous time slices. Based on the behavioral deviation matrix and combined with the requirement of extremely low false alarm rate in the static whitelist environment, use adaptive threshold technology for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability.

[0030] It is understood that step S300 includes S301, S302, and S303, wherein: S301. Input the hierarchical deterministic behavior profile and dynamic baseline template library into the adaptive threshold calculation engine, and calculate the Mahalanobis distance between the current behavior vector and the baseline vector based on the mean vector and covariance matrix of the baseline pattern corresponding to the real-time process stage label index. Understandably, in LNG terminal scenarios, there are strong correlations between behavioral characteristics across different process stages: the rate of increase in tank level during unloading is positively correlated with the frequency of feed valve opening commands; the outlet flow rate during the gasification and export stage changes in tandem with compressor speed commands. Euclidean distance cannot characterize this correlation, easily leading to false alarms. Mahalanobis distance introduces the inverse of the covariance matrix, essentially performing a linear transformation in the feature space, stretching the original space into a standard normal space where each dimension is independent. This automatically eliminates dimensional differences and correlation interference between features when calculating distance. In specific implementation, the adaptive threshold calculation engine maintains a process stage index table, with each stage corresponding to a baseline pattern entry containing a mean vector and a covariance matrix. When real-time data arrives, the engine first extracts its process stage label, directly locating the corresponding entry and avoiding global search overhead. The inversion of the covariance matrix is ​​accelerated using Cholesky decomposition, with the decomposed matrix cached in memory to ensure that the time for a single distance calculation is less than 10 microseconds.

[0031] In practical applications, the construction of the hierarchical deterministic behavior profile vector x adopts an incremental update strategy. Each time new data is received, only 20% of the old data within the sliding window is updated, reducing the computational load. For sensor jump noise common in LNG terminals, the x vector is preprocessed using median filtering before calculation to avoid false alarms caused by sudden changes in distance due to instantaneous outliers. The micro-deviation metric d output in this step not only includes the global distance value but also the local contribution of each feature dimension. This step achieves precise alignment of behavioral patterns within the process stages. While the normal behaviors during unloading and gasification / export are close in distance in the standard space, they are significantly separated in their respective process subspaces, solving the problem of high false alarm rates across stages in traditional methods.

[0032] S302. Perform multi-scale fusion on the micro-deviation measurement sequence, weight and superimpose the deviation of individual behavior vector, the deviation of group collaboration vector, and the deviation of network situation vector, calculate the composite deviation index, and organize the composite deviation index of all network entities in continuous time slices into a behavior deviation matrix. Understandably, this step achieves a dimensional shift from single-point anomalies to a global situation, and its innovation lies in the adaptive allocation mechanism of weight coefficients across process stages. During the LNG terminal unloading period, individual operational deviations pose the highest risk. This design retains basic information on individual deviations while highlighting incremental risks at the group and network levels. The behavioral deviation matrix is ​​constructed using sparse matrix storage, with rows representing network entities (operators, PLCs, sensors) and columns representing time slices (one slice per second). Only elements with C values ​​greater than a pre-screening threshold are stored, resulting in improved compression and significantly enhanced computational efficiency. Matrix updates employ incremental appending; when a new time slice arrives, the oldest column is removed and a new column is added, maintaining a fixed matrix width of 3600 columns, thus preserving the behavioral trajectory of the most recent hour. In practical applications, this matrix supports cross-entity correlation queries, linking isolated entity deviations to a global situation profile. It can identify advanced attacks such as "individual operations are normal, but group coordination is disordered," where attackers control different devices to execute legitimate instructions, but the combination leads to process fluctuations.

[0033] S303. Based on the behavior deviation matrix and considering the requirement of extremely low false alarm rate in the static whitelist network environment, a deviation index threshold is set, and deviation indices exceeding the threshold are binarized, weighted, and accumulated to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability.

[0034] It should be noted that the core challenge of this step lies in the extremely limited number of learnable samples in a static whitelist environment, making it difficult for traditional statistical thresholding methods to balance the detection rate and false alarm rate. This method innovatively introduces the concept of process noise modeling, treating the fluctuation of the C value under normal operating conditions as a composite noise process composed of sensor accuracy and communication jitter. The threshold setting formula is not based on historical global statistics, but rather uses a moving exponential weighted average for real-time updates, giving higher weight to recent data so that the threshold can track the slow behavioral drift caused by equipment aging. The confidence coefficient k breaks away from the traditional fixed empirical value model, designed as a two-dimensional function of process stage and safety level: k is set to 3.0 during the unloading period to tolerate higher fluctuations and avoid interfering with normal unloading; k is set to 2.0 during the storage period to strictly monitor and ensure static stability; k is set to 2.5 during the gasification and export period to balance the flexibility and safety of flow regulation; if currently under government regulatory inspection, k is automatically increased by 0.5 to enhance sensitivity. The binarization label uses a hysteresis mechanism, only marking it as 1 when C exceeds θ three consecutive times, preventing instantaneous overshoot from triggering false alarms. The weighted accumulation process incorporates a time decay factor, increasing the weight of an anomaly marker by 0.1 for every second it persists, up to a maximum of 1.0. If no new anomalies appear within 10 seconds, the weight decays exponentially. This design creates a scoring mechanism of "high scores for sustained anomalies and low scores for momentary anomalies," aligning with the characteristic of industrial control system attacks typically lasting several seconds or more. The anomaly suspicion score sequence generation employs a Top-K sorting strategy, retaining only the top 200 entities for downstream analysis, while marking the rest as normal, thus focusing computational resources on high-risk targets. In practical applications, this step achieves a false alarm rate of less than 0.1% in a static whitelist environment at LNG terminals, while maintaining a 100% detection rate for known attack patterns, reducing the false alarm rate by an order of magnitude compared to traditional fixed threshold methods. The technical effect is the construction of an intelligent threshold mechanism with noise adaptation, process awareness, and time memory capabilities, solving the model degradation problem caused by sample scarcity in whitelist scenarios, and ensuring that the detection system maintains high sensitivity even under extremely stringent false alarm requirements.

[0035] S400: Extract the set of highly suspicious entities corresponding to the abnormal suspicion score sequence from the behavior deviation matrix, call the time series correlation analysis engine to reconstruct the network access relationship between entities, the operation command flow and the time series causal chain of alarm events, and output the candidate abnormal behavior cluster; tightly couple and align the timeline of the candidate abnormal behavior cluster with the key process time series data, verify the spatiotemporal correlation between abnormal network behavior and the unexpected disturbance of key process parameters triggered by the overpressure of the storage tank and the emergency shut-off valve, and generate a process risk mapping relationship table.

[0036] It is understood that step S400 includes S401, S402, and S403, wherein: S401. Extract a set of highly suspicious entities with scores higher than the alarm threshold from the abnormal suspiciousness score sequence, call the time series correlation analysis engine, capture the order of operation command flow and network access relationship between these entities in the form of a sliding time window, and construct a time series causal graph containing operation nodes, command edges and timestamps. It's important to note that this step addresses the core issue of transforming isolated anomaly scores into correlated attack paths. The alarm threshold setting abandons the traditional fixed threshold method, adopting an adaptive quantile mechanism based on the characteristics of a static whitelist environment. In isolated network environments like LNG receiving terminals, normal behavior is highly convergent, while anomaly behavior is sparsely distributed. The threshold is set at the top 0.1% quantile of the daily score sequence, ensuring a false alarm rate of less than 1 per day, meeting the stringent requirements for alarm reliability in critical infrastructure. The high-suspicious entity set not only includes nodes with high absolute score values ​​but also introduces relative jump detection; that is, an entity whose score increases by more than 50% within 10 seconds is also included in the set, which can capture slow penetration behavior in the early stages of an attack. The sliding window parameter design of the time-series correlation analysis engine is deeply integrated with the time-series characteristics of LNG processes: the 30-second window length covers the complete cycle of typical process operations, such as the approximately 25-second emergency disengagement process of the unloading arm, ensuring the capture of cross-device coordinated attack sequences; the 1-second step size enables fine-grained tracking, avoiding missed detections of rapid lateral movements. The command stream capture within the window employs protocol-aware causal pair matching, associating transaction identifiers with Modbus protocols, session IDs and request IDs with OPC UAs, and frame IDs with PROFINETs to ensure strict request-response pairing. Command edge weights are designed to reflect LNG process knowledge: a normal response latency of 10 milliseconds results in a weight of 1.0; the weight decreases by 0.1 for every additional 10 milliseconds of latency; a response timeout resets to zero and marks the chain as broken. This mechanism can detect slow denial-of-service attacks or equipment anomalies. The time-series causal graph is stored as a directed weighted graph. Node attributes include entity ID, role type, current rating, and associated process equipment tag number; edge attributes include source and target nodes, function code, timestamp, weight, and command hazard level. The hazard level is predefined based on LNG process knowledge; for example, "writing multiple registers" is marked as high-risk. In practical applications, the graph structure supports incremental updates; new time slices only append nodes and edges, expired nodes are deleted after a 30-second delay, and memory usage remains stable at the hundred-megabyte level. The technical effect of this step is to transform the scattered scores into a visual attack path graph, which can identify "slow" attacks, such as when the attacker sends only 1-2 probe commands per minute. The single-point score does not trigger an alarm, but the temporal correlation reveals its intention to continuously scan the valve controller, increasing the detection rate by more than 40%. At the same time, the graph structure retains a complete chain of attack evidence, which meets the requirements of Level Protection 2.0 for audit traceability.

[0037] S402. Perform connected subgraph detection on the temporal causal graph, aggregate strongly correlated operation sequences into candidate abnormal behavior clusters, and label each cluster with the pattern type of intrusion lateral movement chain or malicious operation sequence. Understandably, strong association determination requires not only a connected graph structure but also that the cumulative weight of the instructions on the edges exceeds a stage-adaptive threshold. Connected subgraph detection employs an improved label propagation algorithm. Each highly suspicious node is assigned a unique label during initialization. During iteration, nodes propagate the label to their neighbors, with the propagation probability proportional to the product of the edge weight and the node score. After five iterations, nodes with the same label form a candidate cluster. This algorithm has linear time complexity and can handle tens of thousands of nodes, meeting real-time analysis requirements. Cluster labeling uses a pattern matching rule base. Lateral movement chain patterns are identified as chained accesses of "operator → HMI → PLC → different tank sensors," consistent with the path used by APT attacks to expand control scope. Malicious operation sequence patterns are identified as sequences of "parameter over-limit write → alarm masking → abnormal status confirmation," consistent with the characteristics of internal sabotage attacks. Each cluster is assigned a risk score upon generation, calculated as the weighted sum of the average suspiciousness score of nodes within the cluster and the longest and shortest path length. Path length reflects the attack span; clusters spanning multiple subnets are of higher risk. In the actual system, the rule base supports online updates. When a new type of attack emerges, security experts can add pattern rules in real time, such as the "shore valve opening → shipside pressure anomaly → emergency cut-off trigger" pattern for attacks on LNG ship-shore matching systems. The system can complete rule hot loading within 1 minute. The technical effect of this step is to aggregate massive alarms into interpretable clusters, avoiding alarm storms. For example, a complete APT attack may generate 200 single-point alarms. After aggregation, they form 3 clusters, allowing maintenance personnel to focus on handling them, improving response efficiency by more than 60%. At the same time, pattern tagging provides handling guidance, such as suggesting immediate isolation of the source operator account for lateral movement chains, and suggesting suspending network access to the target device for malicious sequences.

[0038] S403. Tightly couple and align the trigger timestamps of candidate abnormal behavior clusters with the time points of process timing data for tank overpressure and emergency shut-off valve abnormal triggers. If the time difference is less than 5 seconds and the fluctuation range of process parameters exceeds the safety limit, then map the process risk level according to the process safety impact matrix and generate a process risk mapping relationship table that records the correspondence between abnormal behavior clusters and process risk levels.

[0039] It should be noted that tight coupling alignment is not a simple timestamp comparison, but rather an event-driven timeline alignment mechanism: when process timing data detects a tank overpressure alarm, it automatically triggers a time-series search of all candidate clusters within the past 10 seconds and the next 5 seconds window. This bidirectional tracing ensures that no pre-attack actions are missed. The 5-second time difference threshold is designed based on the LNG process response characteristics. There is typically a 2-3 second communication and execution delay from the issuance of network commands to changes in process parameters. The 5-second window covers more than 95% of the causal links. The determination of process parameter fluctuation amplitude adopts dual verification of gradient and amplitude: for tank overpressure, the pressure rise rate must be greater than 0.1 MPa / second and the absolute value must exceed the high-level alarm value. For emergency shut-off valve anomalies, the valve state transition time from open to closed must deviate from the network command timestamp by less than 1 second, avoiding misjudgments caused by normal process fluctuations or sensor noise.

[0040] Understandably, the process safety impact matrix is ​​constructed based on the LNG terminal's HAZOP analysis results. Lateral movement chains that only access monitoring data are mapped to low risk, while those that touch the safety instrumented system are mapped to extremely high risk. Malicious operation sequences involving parameter tampering are mapped to medium risk, alarm masking to high risk, and accidental emergency shutdowns to extremely high risk. Matrix element values ​​are not static and are dynamically adjusted based on real-time process stages; for example, the risk weight for feed valve operations during unloading is twice that during storage. The process risk mapping table uses a wide table design with the cluster ID as the primary key. It includes fields such as trigger time, involved equipment, network attack type, process hazard type, risk level, and handling recommendations. This table is directly output to the LNG terminal's emergency command center to trigger corresponding contingency plans. In practical application, this step successfully identified a man-in-the-middle attack targeting the tank pressure controller: the attacker forged normal pressure commands while simultaneously masking real alarms, creating a cluster of malicious operation sequences on the network side. This triggered an overpressure alarm on the process side. Timing alignment revealed a 2.3-second time difference between the two alarms, with process parameter fluctuations exceeding safety limits by 15%. The system was mapped to an extremely high process risk, triggering an emergency shutdown and isolating the attack source, thus preventing a major accident. This step transforms network threats into quantifiable process risks, elevating safety decisions from "network anomalies" to "process hazards," resulting in more precise prioritization and response strategies. It truly achieves "network serving process safety," rather than viewing network security in isolation.

[0041] S500: Input the candidate abnormal behavior clusters and process risk mapping table into the scenario-based security protection strategy library. Assign handling priorities and response strategy weights to each abnormal behavior cluster according to the process risk level. Generate a dynamic network anomaly detection report containing severity level classification and handling guidelines through multi-attribute decision fusion. Based on the false alarm and false negative data fed back by the dynamic network anomaly detection report, call the incremental learning algorithm to update the behavior pattern parameters and judgment thresholds of the corresponding process stage in the dynamic baseline template library, and output the baseline self-optimization parameter set.

[0042] It is understood that step S500 includes S501, S502, and S503, wherein: S501. Input the candidate abnormal behavior clusters and process risk mapping relationship table into the scenario-based security protection strategy library. Assign threat weight coefficients to each abnormal behavior cluster according to the process risk level. Set the weight of process interruption level to 0.9, equipment damage level to 0.7, and violation operation level to 0.3. It should be noted that this step achieves a crucial mapping from risk identification to the quantification of response priorities. Its core technology lies in the hierarchical architecture design of a scenario-based security protection strategy library. This strategy library is not a simple key-value pair storage system, but rather constructed using an attack tree model based on process topology: the top layer represents the overall security objective of the LNG terminal; the middle layer contains sub-strategies for four scenarios: unloading, storage, gasification and export, and standby; and the bottom layer contains fine-grained rules for specific equipment tag numbers (such as TK-001 storage tank and VB-101 shut-off valve). The process risk level classification is strictly based on the LNG process safety integrity level assessment results. Process interruption level corresponds to SIL-3 hazard, such as a malfunctioning gasifier shutdown during the gasification and export period leading to a downstream pipeline supply disruption; this cluster has a weight of 0.9, ensuring the highest priority for handling such clusters. Equipment damage level corresponds to SIL-2 hazard, such as overpressure in a storage tank causing a safety valve to trip and resulting in physical damage; this has a weight of 0.7. Violation of operating procedures level corresponds to SIL-1 hazard, such as an operator unauthorized access to historical curves; this has a weight of 0.3. The weighting allocation also incorporates a dynamic adjustment factor for each process stage. The weight for process interruptions during unloading is increased to 0.95, as this stage involves ship-shore safety and has a lower tolerance. Threat weight coefficients are not only used for ranking but also directly participate in subsequent risk scoring calculations. The coefficient values ​​are solidified through LNG industry expert knowledge and verified through historical attack case backtesting, forming an immutable weighting benchmark table. In practical applications, the strategy library supports hot updates. When a new process unit is added to the terminal, the strategy can be expanded within one minute by dragging and dropping equipment nodes through a graphical interface and inheriting parent weight rules. This invention transforms abstract process risks into calculable quantitative weights, avoiding subjective biases in manual assessments, enabling resources to be precisely targeted at real high-risk threats, improving response decision-making efficiency. Simultaneously, the weighting layering mechanism ensures that low-weight clusters are not ignored, preventing "slow" attacks from being missed due to excessively low weights.

[0043] S502. Based on the threat weight coefficient, a multi-attribute decision fusion is used to calculate the comprehensive risk score. The clusters are divided into four severity levels: emergency, high, medium and low through a decision tree classifier, and a dynamic network anomaly detection report containing level classification and blocking and isolation handling guidelines is generated. It should be noted that the comprehensive risk scoring formula is determined based on the functional importance of equipment in the LNG process and the consequences of failure. The unloading arm main controller has a weight of 0.9, the storage tank level monitoring PLC has a weight of 0.8, and the office network printer has a weight of 0.1. The asset weight library is synchronized with the terminal equipment ledger in real time. S is the anomaly suspicion score, and A is the asset criticality score, both of which are normalized to an interval. The decision tree classifier is trained using a lightweight gradient boosting tree. The training samples come from historical alarm data of the LNG terminal and red-blue team exercise data. The feature dimensions include 12 attributes such as risk score R, number of clustered entities, cross-subnet marker, and process stage type. The tree depth is limited to 5 layers to ensure an inference speed of less than 1 millisecond. The classifier output includes not only the severity level but also the confidence probability. When the emergency level confidence exceeds 0.9, automatic blocking is triggered; between 0.7 and 0.9, manual confirmation is triggered; and below 0.7, only logs are recorded. This graded handling mechanism balances automation and safety. The dynamic network anomaly detection report uses a structured JSON format. The top-level fields include report ID, generation time, process stage, and total number of clusters. Each cluster substructure includes cluster ID, severity level, risk score, list of involved entities, process risk mapping, and handling guidelines. The handling guidelines detail specific actions: for emergency levels, execute "immediately block entity network access and notify the emergency center"; for high levels, execute "restrict entity write permissions and generate a work order"; for medium levels, execute "increase audit frequency and notify via email"; and for low levels, execute "record to the knowledge base for periodic review." The report also includes an attack attribution subgraph, visualizing the temporal causal chain of clusters in Graphviz format, facilitating rapid understanding of attack paths by security experts. In actual projects, the report is pushed to the LNG terminal SOC platform and emergency command dashboard via a message queue. Emergency level reports trigger audible and visual alarms and automatically initiate video conferences, achieving minute-level emergency response. This step encapsulates the complex, multi-attribute decision-making process into an interpretable grading system, avoiding misjudgments caused by a single rating, while providing precise actionable actions for different grades, reducing the burden of manual analysis, and upgrading security operations from "alarm response" to "risk decision-making".

[0044] S503. Extract the false alarm and missed alarm feedback data confirmed in the dynamic network anomaly detection report, call the incremental learning algorithm, perform mean drift correction on the false alarm samples for the mean values ​​of the corresponding process stages in the baseline template library, perform sensitivity reduction correction on the judgment threshold for the missed alarm samples, output the updated baseline self-optimization parameter set, and send it to the industrial control network firewall to implement access control policy blocking, thereby realizing network access control and malicious command interception for key equipment such as unloading arms, storage tanks, and gasifiers.

[0045] It should be noted that false alarm samples are confirmed after manual review of reports and marked as "normal but false alarms." These samples are usually due to a slow drift in normal behavior patterns caused by process upgrades and modifications. For example, after the pressure control parameters of a storage tank are readjusted, the original baseline judges the new parameters as abnormal. The incremental learning algorithm performs mean drift correction on false alarm samples to ensure that the baseline drift is smooth rather than abrupt, preventing attackers from polluting the baseline by continuously injecting pseudo-normal samples. False alarm samples originate from attackers using unknown methods to evade detection. They are manually traced, confirmed, and marked. The algorithm lowers the threshold sensitivity for false alarm samples to prevent oversensitivity and a false alarm storm. The baseline self-optimization parameter set includes the updated mean vector, covariance matrix, and threshold coefficients, managed by version number. After the new parameter set is generated, it is first run in shadow mode for 24 hours. The alarm differences between the old and new parameter sets are compared. If the difference rate is less than 5%, a formal switch is performed; otherwise, a rollback is initiated and manual analysis is triggered to ensure the security of the update. The parameter set is sent to the industrial control network firewall via a secure channel. The firewall's built-in policy engine converts the parameter set into an access control list, adding highly suspicious entity IPs and malicious command function codes to the blacklist. Simultaneously, it generates micro-isolation policies for critical equipment such as unloading arms, storage tanks, and vaporizers, allowing only communication between specific PLCs and HMIs and blocking lateral movement. In practical applications, after three months of operation, an LNG terminal experienced changes in operating parameters due to the replacement of a new vaporizer. The system automatically adjusted its baseline through three false alarm samples, reducing the false alarm rate from an initial 0.1% to 0.05% without manual intervention. The technical effect lies in achieving self-evolution and attack adaptation of the detection system, solving the problem of detection rate decay caused by baseline rigidity in traditional methods. Simultaneously, the closed-loop feedback mechanism ensures continuous optimization of false alarms and false negatives, enabling the system to maintain high detection performance throughout its entire lifecycle and truly meeting the 24 / 7 uninterrupted security protection requirements of LNG receiving terminals. Example 2:

[0046] like Figure 2 As shown, this embodiment provides a dynamic network anomaly detection system based on behavioral baselines. See [link to documentation]. Figure 2 The system includes: Acquisition module 701: Used to collect multi-source heterogeneous operation data of liquefied natural gas receiving terminal, including raw traffic mirrors of industrial control network and office network, operation logs and control equipment status messages, as well as work plan data and key process timing data; Extraction and Fusion Module 702: This module performs deep parsing of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operational data, outputting cleaned structured data with unified spatiotemporal labels. The cleaned structured data is input into a dedicated feature operator to extract the frequency and periodic features of the network session layer's five-tuples and the modal and parameter range features of the instruction sequence in the operation log, fusing them to generate a multimodal feature set. Based on the multimodal feature set, and combined with work plan data and key process time series data, the module performs work process stage segmentation and context labeling, constructing a hierarchical deterministic behavior profile merged by process stage, consisting of individual behavior vectors, group collaboration vectors, and network situation vectors. Based on long-term historical normal data, the module learns the statistical distribution of the hierarchical deterministic behavior profile within each process stage and stores it as a dynamic baseline template library. Calculation module 703: This module inputs the hierarchical deterministic behavior profile and dynamic baseline template library into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the context index of the real-time process stage, it calculates the statistical distance between the current behavior profile and the baseline pattern to output a micro-deviation metric. It performs multi-scale fusion on the micro-deviation metric, calculates the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly, and organizes it into a behavior deviation matrix of all network entities on continuous time slices. Based on the behavior deviation matrix and combined with the requirement of extremely low false alarm rate in a static whitelist environment, it uses adaptive threshold technology for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability. Call generation module 704: used to extract the set of highly suspicious entities corresponding to the abnormal suspicion score sequence from the behavior deviation matrix, call the time series correlation analysis engine to reconstruct the network access relationship between entities, operation command flow and alarm event time series causal chain, and output candidate abnormal behavior clusters; tightly couple and align the timeline of the candidate abnormal behavior clusters with the key process time series data, verify the spatiotemporal correlation between abnormal network behavior and tank overpressure, emergency shut-off valve abnormal triggering of unexpected disturbances in key process parameters, and generate a process risk mapping relationship table; Anomaly Detection Module 705: Inputs the candidate abnormal behavior clusters and process risk mapping table into the scenario-based safety protection strategy library, assigns handling priorities and response strategy weights to each abnormal behavior cluster according to the process risk level, and generates a dynamic network anomaly detection report containing severity level classification and handling guidelines through multi-attribute decision fusion; based on the false alarm and false negative data fed back by the dynamic network anomaly detection report, it calls the incremental learning algorithm to update the behavior pattern parameters and judgment thresholds of the corresponding process stage in the dynamic baseline template library, and outputs the baseline self-optimization parameter set.

[0047] In summary, this invention constructs a hierarchical deterministic behavioral profile perceived at each process stage, enabling multi-scale dynamic deviation quantification and associated risk verification. This method innovatively integrates the entire process time-series data of LNG terminal unloading, storage, and gasification with network traffic and operation logs. It employs deep parsing of industrial protocols and operational semantic disambiguation techniques to extract protocol function code-level behavioral features, establishing behavioral vectors at three levels: individual, group, and network. Furthermore, it combines long-term historical normal data statistical learning to generate a dynamic baseline template library indexed by process stage.

[0048] Based on this, Mahalanobis distance is used to calculate the micro-deviation measure between the behavior vector and the baseline pattern. A composite deviation index is obtained through multi-scale weighted fusion. Based on the behavior deviation matrix and adaptive threshold technology, an anomaly suspicion score sequence with low false alarms is generated.

[0049] Furthermore, by reconstructing the causal behavior chain of highly suspicious entities through a time-series correlation analysis engine, a cluster of candidate abnormal behaviors is formed. The triggering time of the cluster is then tightly coupled and aligned with the fluctuations of key process parameters such as tank overpressure and emergency shut-off valve anomalies for verification, thereby achieving a precise mapping between network attacks and process risks.

[0050] Finally, a severity classification report is generated by multi-attribute decision fusion based on a scenario-specific security policy library. An incremental learning algorithm is used to dynamically optimize baseline parameters based on false alarm and missed alarm feedback. This effectively controls network access permissions for key equipment such as unloading arms, storage tanks, and gasifiers and blocks the issuance of malicious commands, meeting the high reliability, low false alarm, and adaptive protection requirements of LNG receiving terminals for industrial control network security.

[0051] It should be noted that the specific methods by which each module performs operations in the system described in the above embodiments have been described in detail in the embodiments related to the method, and will not be elaborated here. Example 3:

[0052] Corresponding to the above method embodiments, this embodiment also provides a dynamic network anomaly detection device based on behavioral baselines. The dynamic network anomaly detection device based on behavioral baselines described below and the dynamic network anomaly detection method based on behavioral baselines described above can be referred to in correspondence.

[0053] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A dynamic network anomaly detection method based on behavioral baselines, characterized in that, include: Collect multi-source heterogeneous operational data from the liquefied natural gas receiving terminal, including raw traffic mirrors of the industrial control network and office network, operation logs, control equipment status messages, work plan data, and key process timing data; Perform deep parsing of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operational data, and output clean structured data with unified spatiotemporal labels; input the clean structured data into a dedicated feature operator to extract the frequency and periodic features of the network session layer quintuple and the modal and parameter range features of the instruction sequence in the operation log, and fuse them to generate a multimodal feature set; Based on multimodal feature sets, and combined with work plan data and key process time sequence data, the work process is segmented into stages and context labeled, and a hierarchical deterministic behavior profile composed of individual behavior vectors, group collaboration vectors and network situation vectors is constructed and merged according to process stages. Based on long-term historical normal data, we learn the statistical distribution of the hierarchical deterministic behavior profiles within each process stage and store them as a dynamic baseline template library. The hierarchical deterministic behavior profile and the dynamic baseline template library are input into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the real-time process stage context index, the statistical distance between the current behavior profile and the baseline pattern is calculated to output a micro deviation metric. Multi-scale fusion is performed on the micro-deviation metric to calculate the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly. The index is then organized into a behavioral deviation matrix of all network entities on continuous time slices. Based on the behavioral deviation matrix and combined with the requirement of extremely low false alarm rate in a static whitelist environment, an adaptive threshold technique is used for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability. Extract the set of highly suspicious entities corresponding to the abnormal suspiciousness score sequence from the behavior deviation matrix, call the time series correlation analysis engine to reconstruct the network access relationship between entities, operation command flow and alarm event time series causal chain, and output candidate abnormal behavior clusters; By tightly coupling and aligning the timelines of candidate abnormal behavior clusters with key process time series data, the spatiotemporal correlation between abnormal network behavior and unexpected disturbances in key process parameters triggered by tank overpressure and emergency shut-off valve abnormalities is verified, and a process risk mapping table is generated. The candidate abnormal behavior clusters and the process risk mapping table are input into the scenario-based security protection strategy library. Based on the process risk level, the handling priority and response strategy weight are assigned to each abnormal behavior cluster. A dynamic network anomaly detection report containing severity level classification and handling guidance is generated through multi-attribute decision fusion. Based on the false alarm and false negative data fed back by the dynamic network anomaly detection report, the incremental learning algorithm is called to update the behavior pattern parameters and judgment thresholds of the corresponding process stage in the dynamic baseline template library, and the baseline self-optimization parameter set is output.

2. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The collected multi-source heterogeneous operational data of the liquefied natural gas receiving terminal includes raw traffic mirrors of the industrial control network and office network, operation logs and control equipment status messages, as well as work plan data and key process timing data, including: Deploy traffic mirroring probes on the core switches of the industrial control network to capture Modbus TCP, OPC UA, and PROFINET industrial protocol messages in real time, and extract the source IP address, destination IP address, source port, destination port, protocol type five-tuple information, as well as message direction, payload length, and sending timestamp sequence to form a network flow metadata queue. The process operation fusion data block is constructed by reading second-level process timing data of tank liquid level, pressure and temperature from the distributed control system through the OPC interface, reading unloading plan and gasification export scheduling data from the production execution system through the REST API, and reading operation logs containing operator number, operation time, operation object and parameter value from the operator workstation through the Syslog protocol. The PTP precise time protocol is used to synchronize the network stream metadata queue and the process operation fusion data block at the nanosecond level. The two types of data are spliced ​​together with a unified timestamp as the key to form an LNG terminal operation data body with spatiotemporal consistency. Each record in this data body contains four fields: timestamp, network characteristics, process parameters, and operation events.

3. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The process involves performing deep analysis of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operational data, outputting purified structured data with unified spatiotemporal labels; inputting the purified structured data into a dedicated feature operator, extracting the frequency and periodic features of the network session layer quintuple and the modal and parameter range features of the instruction sequence in the operation log, and fusing them to generate a multimodal feature set; Based on multimodal feature sets, and combined with work plan data and key process time sequence data, the work process is segmented into stages and context labeled, and a hierarchical deterministic behavior profile composed of individual behavior vectors, group collaboration vectors and network situation vectors is constructed and merged according to process stages. Based on long-term historical normal data, the statistical distribution of the hierarchical deterministic behavior profiles within each process stage is learned and stored as a dynamic baseline template library, including: The LNG terminal operation data is input into the industrial protocol deep parsing engine to identify the industrial control command function code and operation semantics, clean up the duplicated data and misaligned protocol fields, and output cleaned structured data containing command type and parameter legality labels. The dedicated feature operator is invoked to calculate the message length entropy, command frequency fluctuation rate and operation interval periodicity index of each network session from the purified structured data, generating a multimodal feature set. At the same time, based on the unloading plan and process time series data, the terminal operation is divided into unloading period, storage period, gasification and export period and standby maintenance period, and each data is labeled with a process stage. Cluster the multimodal feature set according to the process stage label, construct individual behavior vectors to represent the deterministic behavior patterns of a single operator or device, group collaboration vectors to represent the operational sequence dependencies between multiple entities, and network situation vectors to represent the network traffic topology structure, forming a hierarchical deterministic behavior profile. The mean vector and covariance matrix of the hierarchical behavior profile of historical normal data in each process stage are statistically analyzed and stored as a dynamic baseline template library.

4. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The hierarchical deterministic behavior profile and dynamic baseline template library are input into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the real-time process stage context index, the statistical distance between the current behavior profile and the baseline pattern is calculated to output a micro deviation metric. Multi-scale fusion is performed on the micro-deviation metric to calculate the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly. The index is then organized into a behavioral deviation matrix of all network entities on continuous time slices. Based on the behavioral deviation matrix and considering the requirement of extremely low false alarm rate in a static whitelist environment, an adaptive threshold technique is used for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability, including: The hierarchical deterministic behavior profile and dynamic baseline template library are input into the adaptive threshold calculation engine. Based on the mean vector and covariance matrix of the baseline pattern corresponding to the real-time process stage label index, the Mahalanobis distance between the current behavior vector and the baseline vector is calculated. Multi-scale fusion is performed on the micro-deviation measurement sequence, and the deviation of individual behavior vector, group cooperation vector, and network situation vector are weighted and superimposed to calculate the composite deviation index. The composite deviation index of all network entities on continuous time slices is then organized into a behavior deviation matrix. Based on the behavioral deviation matrix and considering the requirement of extremely low false alarm rate in a static whitelist network environment, a deviation index threshold is set. Deviation indices exceeding the threshold are then binarized, weighted, and accumulated to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability.

5. The dynamic network anomaly detection method based on behavioral baselines according to claim 4, characterized in that, The formula for calculating the Mahalanobis distance is as follows: In the formula, d is the Mahalanobis distance. is the inverse of the covariance matrix, x is the hierarchical deterministic behavior profile vector at the current time, μ is the mean vector of the corresponding process stage in the dynamic baseline template library, and T is the matrix transpose operator.

6. The dynamic network anomaly detection method based on behavioral baselines according to claim 4, characterized in that, The formula for calculating the composite deviation index is as follows: In the formula, C is the composite deviation index, which comprehensively reflects the overall degree of deviation at the individual, group, and network scales. This is a microscopic deviation measure for individual behavior vectors. For individual scale weighting coefficients, Group-scale weighting coefficients This is a micro-deviation measure of the group's collaborative vector. These are network-scale weight coefficients. This is a micro-deviation measure of the network situation vector.

7. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The process involves extracting a set of highly suspicious entities corresponding to the abnormal suspiciousness score sequence from the behavior deviation matrix, calling the time-series correlation analysis engine to reconstruct the network access relationship between entities, the operation command flow, and the time-series causal chain of alarm events, and outputting a cluster of candidate abnormal behaviors. By tightly coupling and aligning the timelines of candidate anomalous behavior clusters with key process time-series data, the spatiotemporal correlation between anomalous network behavior and unexpected disturbances in key process parameters triggered by tank overpressure and emergency shut-off valve anomalies is verified, generating a process risk mapping table, which includes: Extract a set of highly suspicious entities whose scores are higher than the alarm threshold from the abnormal suspiciousness score sequence, call the time series correlation analysis engine, capture the order of operation command flow and network access relationship between these entities in the form of a sliding time window, and construct a time series causal graph containing operation nodes, command edges and timestamps; Perform connected subgraph detection on the temporal causal graph, aggregate strongly correlated operation sequences into candidate anomalous behavior clusters, and label each cluster with the pattern type of intrusion lateral movement chain or malicious operation sequence; The trigger timestamps of candidate abnormal behavior clusters are tightly coupled and aligned with the time points of process timing data for tank overpressure and emergency shut-off valve abnormal triggers. If the time difference is less than 5 seconds and the fluctuation range of process parameters exceeds the safety limit, the process risk level is mapped according to the process safety impact matrix, and a process risk mapping relationship table that records the correspondence between abnormal behavior clusters and process risk levels is generated.

8. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The process involves inputting a mapping table between candidate abnormal behavior clusters and process risks into a scenario-based security protection strategy library. Based on the process risk level, each abnormal behavior cluster is assigned a handling priority and response strategy weight. A dynamic network anomaly detection report, including severity level classification and handling guidelines, is generated through multi-attribute decision fusion. Based on the false positive and false negative data from the dynamic network anomaly detection report, an incremental learning algorithm is used to update the behavior pattern parameters and judgment thresholds for the corresponding process stage in the dynamic baseline template library. The result is an output baseline self-optimization parameter set, which includes: Input the candidate abnormal behavior clusters and process risk mapping relationship table into the scenario-based security protection strategy library, and assign threat weight coefficients to each abnormal behavior cluster according to the process risk level. The weight of process interruption level is set to 0.9, the weight of equipment damage level is set to 0.7, and the weight of violation operation level is set to 0.

3. Based on the threat weight coefficient, a multi-attribute decision fusion calculation is used to calculate the comprehensive risk score. The clusters are divided into four severity levels: emergency, high, medium and low through a decision tree classifier, and a dynamic network anomaly detection report containing level classification and blocking and isolation handling guidelines is generated. The system extracts the false alarm and missed alarm feedback data confirmed in the dynamic network anomaly detection report, calls the incremental learning algorithm, performs mean drift correction on the false alarm samples for the mean values ​​of the corresponding process stages in the baseline template library, performs sensitivity reduction correction on the judgment threshold for the missed alarm samples, outputs the updated baseline self-optimization parameter set, and sends it to the industrial control network firewall to implement access control policies to block access, thereby realizing network access control and malicious command interception for key equipment such as unloading arms, storage tanks, and gasifiers.

9. The dynamic network anomaly detection method based on behavioral baselines according to claim 1, characterized in that, The formula for calculating the comprehensive risk score is as follows: In the formula, R is the comprehensive risk score. Here, S represents the threat weight coefficient corresponding to the process risk level, S is the anomaly suspicion score, and A represents the asset criticality score determined based on the asset value of key equipment such as the unloading arm, storage tank, and gasifier. This represents the asset weighting coefficient.

10. A dynamic network anomaly detection system based on behavioral baselines, based on the dynamic network anomaly detection method based on behavioral baselines as described in claim 1, characterized in that, include: Acquisition module: Used to collect multi-source heterogeneous operational data of the liquefied natural gas receiving terminal, including raw traffic mirrors of the industrial control network and office network, operation logs and control equipment status messages, as well as work plan data and key process timing data; Extraction and fusion module: used to perform deep parsing of industrial protocols and disambiguation of operational semantics on multi-source heterogeneous operation data, and output clean structured data with unified spatiotemporal labels; input the clean structured data into a dedicated feature operator to extract the frequency and periodic features of the network session layer five-tuple and the modal and parameter range features of the instruction sequence in the operation log, and fuse them to generate a multimodal feature set; Based on multimodal feature sets, and combined with work plan data and key process time sequence data, the work process is segmented into stages and context labeled, and a hierarchical deterministic behavior profile composed of individual behavior vectors, group collaboration vectors and network situation vectors is constructed and merged according to process stages. Based on long-term historical normal data, we learn the statistical distribution of the hierarchical deterministic behavior profiles within each process stage and store them as a dynamic baseline template library. The calculation module is used to input the hierarchical deterministic behavior profile and the dynamic baseline template library into the adaptive threshold calculation engine. Based on the baseline pattern corresponding to the real-time process stage context index, it calculates the statistical distance between the current behavior profile and the baseline pattern to output a micro deviation metric. Multi-scale fusion is performed on the micro-deviation metric to calculate the composite deviation index from three levels: individual deviation, group collaborative disruption, and network communication paradigm anomaly. The index is then organized into a behavioral deviation matrix of all network entities on continuous time slices. Based on the behavioral deviation matrix and combined with the requirement of extremely low false alarm rate in a static whitelist environment, an adaptive threshold technique is used for binarization and severity weighting to generate an anomaly suspicion score sequence arranged in descending order of anomaly probability. Call the generation module: It is used to extract the set of highly suspicious entities corresponding to the abnormal suspicion score sequence from the behavior deviation matrix, call the time series correlation analysis engine to reconstruct the network access relationship between entities, operation command flow and alarm event time series causal chain, and output candidate abnormal behavior clusters; By tightly coupling and aligning the timelines of candidate abnormal behavior clusters with key process time series data, the spatiotemporal correlation between abnormal network behavior and unexpected disturbances in key process parameters triggered by tank overpressure and emergency shut-off valve abnormalities is verified, and a process risk mapping table is generated. The anomaly detection module is used to input the mapping table between candidate abnormal behavior clusters and process risks into the scenario-based safety protection strategy library. Based on the process risk level, it assigns handling priorities and response strategy weights to each abnormal behavior cluster. Through multi-attribute decision fusion, it generates a dynamic network anomaly detection report containing severity level classification and handling guidelines. Based on the false alarm and false negative data fed back from the dynamic network anomaly detection report, it calls the incremental learning algorithm to update the behavior pattern parameters and judgment thresholds of the corresponding process stages in the dynamic baseline template library, and outputs the baseline self-optimization parameter set.

Images