Industrial control network security arrangement semantic reasoning method based on large model and related device

Abstract

The invention discloses an industrial control network security arrangement semantic reasoning method based on a large model and a related device, and belongs to the technical field of industrial control network security. The method comprises the following steps: collecting multi-source heterogeneous data in an industrial control network, and converting the multi-source heterogeneous data into semantic data; inputting the semantic data into a pre-established domain expert large model, and outputting a security risk identification result; based on a security risk identification result, semantic reasoning is carried out in combination with a real-time network context, and a security arrangement strategy sequence is dynamically generated; and performing deterministic scheduling and strategy execution on the security arrangement strategy sequence. Aiming at the problems of poor semantic comprehension capability, poor dynamic adaptability and the like in an industrial control network security arrangement technology, deep semantic comprehension, dynamic self-adaption and active defense are realized based on a large model realization stage, the automation degree and efficiency are improved, the heterogeneous environment adaptability is enhanced, and the industrial control network security is further improved.

Description

Technical Field

[0001] This invention belongs to the field of industrial control network security technology, and relates to a semantic reasoning method and related devices for industrial control network security orchestration based on a large model. Background Technology

[0002] Industrial Control Networks (ICNs) are core components of critical national infrastructure such as power, water conservancy, and manufacturing, and their security directly impacts the stable operation of the social economy. With the deepening of the Industrial Internet, traditional ICNs are shifting from a closed, isolated "automation pyramid" model to an open, interconnected cloud-edge-device collaborative architecture. While this transformation improves production efficiency, it also exposes ICNs to more severe cybersecurity threats. Attackers may exploit vulnerabilities in ICN protocols (such as Modbus plaintext transmission and unauthorized MMS services) to launch attacks such as PLC command injection, leading to production interruptions or even physical equipment damage.

[0003] Currently, some industrial control system (ICS) network security protection methods mainly rely on security orchestration and response technologies to automate threat handling through predefined rules. However, existing methods have the following significant limitations when addressing the unique challenges of ICS networks: First, there is a lack of semantic understanding capabilities; traditional systems cannot comprehend the deep semantics of security events and network policies. Industrial control networks involve multi-source heterogeneous data such as device logs, traffic packets, vulnerability information, and asset lists. Traditional rule engines based on keyword matching or regular expressions struggle to connect the attack chains behind fragmented information.

[0004] Secondly, there is insufficient detection of protocol and logic vulnerabilities. Industrial control protocols (such as S7Comm and Ethernet / IP) are highly structured, state-dependent, and vendor-customized, while PLC and other controller programs (such as IEC 61131-3 structured text) harbor logic vulnerabilities that are difficult to detect with traditional tools. While existing fuzzing or static analysis tools can detect some memory corruption or syntax errors, their identification rate for business logic vulnerabilities requiring domain knowledge is low, and they heavily rely on expert experience.

[0005] Furthermore, these systems suffer from poor dynamic adaptability and rigid response. Orchestration systems based on hard-coded policies lack the ability to proactively reason and make decisions in dynamic threat environments. When new attack methods or unknown communication protocols emerge, the system cannot perform contextual reasoning and policy adjustments like human experts. Existing automated handling scripts lack flexibility, making it difficult to achieve collaborative orchestration and optimization of policies across devices.

[0006] Finally, there is a weakness in knowledge integration and decision support. Industrial control system security operations and maintenance heavily rely on expert experience, but traditional systems lack effective knowledge accumulation and reuse mechanisms. Although some research has attempted to build cybersecurity knowledge graphs to integrate multi-source threat data, knowledge acquisition still relies on traditional relation extraction models, which face problems such as noise data interference and insufficient extraction of deep semantic features, resulting in lagging knowledge updates and an inability to support complex analysis.

[0007] In recent years, Large Language Models (LLMs) have demonstrated strong potential in natural language understanding, logical reasoning, and other fields, and have begun to be applied to threat detection and risk assessment in industrial control network security. For example, multi-agent LLM frameworks have been used for fuzz testing of industrial protocols, and fine-tuned LLMs can effectively detect PLC code vulnerabilities. Large security models have also made progress in scenarios such as alarm analysis and compliance checks. However, these applications are mostly single-point solutions and have not yet formed a closed-loop system integrating semantic understanding, dynamic reasoning, policy generation, and automated orchestration. In particular, in dealing with heterogeneous data, protocol semantic parsing, and business logic associations in industrial control networks, there is still a lack of collaborative defense solutions that deeply integrate LLM semantic reasoning capabilities.

[0008] Therefore, there is an urgent need for an innovative method that can deeply understand the semantics of industrial control networks, dynamically reason about measures containing expert knowledge and intent, and automatically generate precise orchestration strategies in order to break through the bottlenecks of existing technologies and improve the proactive defense and adaptive capabilities of industrial control networks. Summary of the Invention

[0009] The purpose of this invention is to provide a semantic reasoning method and related apparatus for industrial control network security orchestration based on a large model, so as to solve the technical problems of weak semantic understanding ability, poor dynamic adaptability, insufficient protocol vulnerability detection, and lack of deep knowledge integration and reasoning ability in existing industrial control network security orchestration technologies.

[0010] To achieve the above objectives, the present invention employs the following technical solution: In a first aspect, the present invention provides a semantic reasoning method for industrial control network security orchestration based on a large model, comprising the following steps: Collect multi-source heterogeneous data from industrial control networks and convert the multi-source heterogeneous data into semantic data; Semantic data is input into a pre-built domain expert model, and the output is a security risk identification result; Based on the security risk identification results, semantic reasoning is performed in conjunction with the real-time network context to dynamically generate a security orchestration strategy sequence; The secure orchestration strategy sequence is deterministically scheduled and the strategy is executed.

[0011] Furthermore, the step of collecting multi-source heterogeneous data from the industrial control network and converting the multi-source heterogeneous data into semantic data specifically includes: Collect multi-source heterogeneous data from the industrial control network. The multi-source heterogeneous data includes at least network traffic, security device alarm logs, asset attribute information, and ladder diagrams or structured text programs from the PLC. The multi-source heterogeneous data is uniformly abstracted into semantic data that can be processed by machines.

[0012] Furthermore, the step of inputting semantic data into a pre-established domain expert model and outputting security risk identification results specifically includes: Build a knowledge base for industrial control network security; The general large language model is enhanced based on the aforementioned domain knowledge base to form a domain expert large model; The semantic data is input into the domain expert big model for deep semantic association analysis to identify potential attack patterns and security risks, and output security risk identification results.

[0013] Furthermore, the domain knowledge base covers industrial control protocol specifications, equipment vulnerability databases, attack tactical chains, normal process flow models, and historical handling cases.

[0014] Furthermore, the step of dynamically generating a security orchestration strategy sequence based on the security risk identification results and semantic reasoning in conjunction with the real-time network context specifically includes: Causal reasoning; analyzing the root causes of security incidents; Impact analysis; inferring affected assets, businesses, and potential diffusion paths; Strategy derivation: Based on the causal reasoning results and the impact analysis results, generate a sequence of safe orchestration strategies.

[0015] Furthermore, the steps of deterministic scheduling and policy execution of the secure orchestration policy sequence specifically include: Input the security orchestration strategy sequence into the strategy execution engine; Prioritize and allocate resources based on the urgency of the strategies and their scope of business impact to complete the reintegration of the strategies; The reorganized policy is converted into configuration instructions for the underlying network devices and then issued for execution.

[0016] Furthermore, the step of deterministically scheduling and executing the security orchestration strategy sequence further includes: The system continuously collects the results of strategy execution and new network states, feeding them back to the domain expert big model to form a closed-loop optimization mechanism.

[0017] Secondly, this invention provides a large-model-based industrial control network security orchestration semantic reasoning system, comprising: The data acquisition and semantic abstraction module is used to acquire multi-source heterogeneous data in the industrial control network and convert the multi-source heterogeneous data into semantic data; The large model data processing module is used to input semantic data into a pre-built domain expert large model and output security risk identification results. The policy generation module is used to dynamically generate a security orchestration policy sequence based on the security risk identification results and semantic reasoning combined with the real-time network context. The scheduling and execution module is used to perform deterministic scheduling and strategy execution on the security orchestration strategy sequence.

[0018] Thirdly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for semantic reasoning of industrial control network orchestration based on a large model.

[0019] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for semantic reasoning orchestration of industrial control network security based on a large model.

[0020] Compared with the prior art, the present invention has the following beneficial effects: This invention discloses a semantic reasoning method and related apparatus for industrial control network security orchestration based on a large model. By collecting multi-source heterogeneous data from the industrial control network and transforming it into semantic data, the system inputs this semantic data into a large model enhanced with domain knowledge. The system can understand the deep semantics of industrial control protocols, business logic relationships, and complex attack intentions like a human expert, overcoming the limitations of traditional rule engines and achieving a leap from "pattern matching" to "cognitive intelligence." Furthermore, by combining real-time network context for semantic reasoning, a security orchestration strategy sequence is dynamically generated. This enables the system to cope with new and unknown threats, achieving a shift from "static protection" to "dynamic adaptation," significantly improving the proactive defense level of the industrial control network. This invention achieves full-process intelligence and automation from security event perception, analysis, decision-making to execution, greatly shortening the threat response time (MTTR), reducing reliance on senior security analysts, and lowering operational costs. Moreover, it can quickly adapt to complex industrial control environments with different vendors and protocols, possessing good universality and application value. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of a semantic reasoning method for industrial control network security orchestration based on a large model, according to the present invention. Figure 2 This is a schematic diagram of a semantic reasoning system for industrial control network security orchestration based on a large model, according to the present invention. Detailed Implementation

[0023] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0024] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0025] See Figure 1 This invention discloses a semantic reasoning method for industrial control network security orchestration based on a large model, comprising the following steps: S1 collects multi-source heterogeneous data from the industrial control network and converts the multi-source heterogeneous data into semantic data; Collect multi-source heterogeneous data from industrial control networks, including but not limited to: network traffic (including various industrial control protocol messages), security device alarm logs, asset attribute information, and ladder diagrams or structured text programs from PLCs. Abstract this unstructured or semi-structured data into machine-processable semantic data units.

[0026] S2 inputs semantic data into a pre-built domain expert model and outputs security risk identification results; S201, Construct a knowledge base for industrial control network security; the content of the knowledge base covers industrial control protocol specifications, device vulnerability databases, attack tactic chains (such as MITRE ATT&CK for ICS), normal process flow models, and historical handling cases.

[0027] S202, based on the domain knowledge base, the general large language model is fine-tuned or enhanced with prompting engineering to form a domain expert large model; when receiving natural language instructions from the operator (such as "isolate the infected HMI device"), the model can parse the core intent of the instruction and output a structured list of safety handling intentions (including actions, objectives, constraints, etc.).

[0028] S203, input the semantic data into the domain expert big model, perform deep semantic association analysis and context understanding, identify potential attack patterns and security risks, and output security risk identification results.

[0029] S3, based on the security risk identification results and combined with real-time network context, performs semantic reasoning to dynamically generate a security orchestration strategy sequence; The reasoning process includes: Causal reasoning: Analyze the root cause of a safety incident, for example, determine that the "abnormal water pump pressure" was caused by a malicious Modbus write command, rather than a sensor malfunction.

[0030] Impact analysis: Inferring the affected assets, businesses, and potential diffusion paths.

[0031] Policy derivation: Based on the reasoning results, specific and actionable security orchestration policy sequences are automatically generated. For example, the generated policy is: "First, block the source IP from accessing the target HMI on the SDN controller; second, issue rules on the industrial firewall to isolate the network segment where the HMI is located; finally, generate a work order to notify the administrator to conduct forensics." S4, perform deterministic scheduling and policy execution on the secure orchestration strategy sequence.

[0032] The security orchestration policy sequence generated by S3 is input into a policy execution engine with deterministic scheduling capabilities. This engine prioritizes and allocates resources based on the urgency and impact of the policies, ensuring that high-priority blocking and isolation actions are executed reliably and in real time. The execution engine translates the policies into specific configuration instructions for underlying network devices (such as SDN controllers, industrial firewalls, and NAC systems) and distributes them. Simultaneously, the system continuously collects policy execution results and new network states, forming a feedback loop for model self-optimization.

[0033] See Figure 2This invention discloses a semantic reasoning system for industrial control system (ICS) network security orchestration based on a large model, comprising a data acquisition and semantic abstraction module, a large model data processing module, a policy generation module, and a scheduling and execution module. The data acquisition and semantic abstraction module collects multi-source heterogeneous data from the ICS network and converts it into semantic data. The large model data processing module inputs the semantic data into a pre-established domain expert large model and outputs security risk identification results. The policy generation module performs semantic reasoning based on the security risk identification results and the real-time network context to dynamically generate a security orchestration policy sequence. The scheduling and execution module performs deterministic scheduling and policy execution on the security orchestration policy sequence. This invention addresses the problems of poor semantic understanding and dynamic adaptability in ICS network security orchestration technology by achieving deep semantic understanding and dynamic adaptation and proactive defense based on a large model implementation stage, improving automation and efficiency, enhancing adaptability to heterogeneous environments, and further improving the security of ICS networks.

[0034] In one embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a semantic reasoning method for industrial control network security orchestration based on a large model.

[0035] This invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the semantic reasoning method for industrial control network orchestration based on a large model in the above embodiments.

[0036] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0037] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0038] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0039] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0040] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A semantic reasoning method for industrial control network security orchestration based on a large model, characterized in that, Includes the following steps: Collect multi-source heterogeneous data from industrial control networks and convert the multi-source heterogeneous data into semantic data; Semantic data is input into a pre-built domain expert model, and the output is a security risk identification result; Based on the security risk identification results, semantic reasoning is performed in conjunction with the real-time network context to dynamically generate a security orchestration strategy sequence; The secure orchestration strategy sequence is deterministically scheduled and the strategy is executed.

2. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 1, characterized in that, The step of collecting multi-source heterogeneous data from the industrial control network and converting the multi-source heterogeneous data into semantic data specifically includes: Collect multi-source heterogeneous data from the industrial control network. The multi-source heterogeneous data includes at least network traffic, security device alarm logs, asset attribute information, and ladder diagrams or structured text programs from the PLC. The multi-source heterogeneous data is uniformly abstracted into semantic data that can be processed by machines.

3. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 1, characterized in that, The step of inputting semantic data into a pre-established domain expert model and outputting security risk identification results specifically includes: Build a knowledge base for industrial control network security; The general large language model is enhanced based on the aforementioned domain knowledge base to form a domain expert large model; The semantic data is input into the domain expert big model for deep semantic association analysis to identify potential attack patterns and security risks, and output security risk identification results.

4. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 3, characterized in that, The domain knowledge base covers industrial control protocol specifications, equipment vulnerability databases, attack tactical chains, normal process flow models, and historical handling cases.

5. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 1, characterized in that, The step of dynamically generating a security orchestration strategy sequence based on the security risk identification result and semantic reasoning combined with the real-time network context specifically includes: Causal reasoning; analyzing the root causes of security incidents; Impact analysis; inferring affected assets, businesses, and potential diffusion paths; Strategy derivation: Based on the causal reasoning results and the impact analysis results, generate a sequence of safe orchestration strategies.

6. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 1, characterized in that, The steps of deterministic scheduling and policy execution of the secure orchestration policy sequence specifically include: Input the security orchestration strategy sequence into the strategy execution engine; Prioritize and allocate resources based on the urgency of the strategies and their scope of business impact to complete the reintegration of the strategies; The reorganized policy is converted into configuration instructions for the underlying network devices and then issued for execution.

7. The semantic reasoning method for industrial control network security orchestration based on a large model according to claim 1, characterized in that, The steps of deterministically scheduling and executing the secure orchestration strategy sequence further include: The system continuously collects the results of strategy execution and new network states, feeding them back to the domain expert big model to form a closed-loop optimization mechanism.

8. A semantic reasoning system for industrial control network security orchestration based on a large model, characterized in that, include: The data acquisition and semantic abstraction module is used to acquire multi-source heterogeneous data in the industrial control network and convert the multi-source heterogeneous data into semantic data; The large model data processing module is used to input semantic data into a pre-built domain expert large model and output security risk identification results. The policy generation module is used to dynamically generate a security orchestration policy sequence based on the security risk identification results and semantic reasoning combined with the real-time network context. The scheduling and execution module is used to perform deterministic scheduling and strategy execution on the security orchestration strategy sequence.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the semantic reasoning method for industrial control network security orchestration based on a large model as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the industrial control network security orchestration semantic reasoning method as described in any one of claims 1-7.

Images