An industrial control network security protection system

Abstract

This invention discloses an industrial control network security protection system. In the field of network security technology, by extracting the continuous change characteristics of control state variables in industrial control communication and analyzing the sparse distribution trend of state mutations on the time axis, it dynamically determines the length of the observation time window matching the evolution characteristics of the current control behavior, thereby achieving effective identification of low-frequency, dispersed abnormal control behaviors embedded in normal communication. This method avoids the behavior fragmentation problem caused by fixed windows, enabling abnormal instructions that are originally distributed across cycles to be identified and associated within the same analytical field. It improves the detection capability of slow-paced, state-gradually shifting attacks without relying on complex rule bases or prior models, significantly enhancing the security awareness of industrial systems in covert control hijacking scenarios.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to an industrial control network security protection system. Background Technology

[0002] In existing industrial control systems, network security protection typically relies on a multi-layered defense system built using technologies such as firewalls, intrusion detection systems (IDS), industrial protocol filtering, host whitelists, remote operation and maintenance isolation, and security auditing. Among these, intrusion detection systems, as an important layer of defense, mainly monitor communication behavior in the control network in real time through rule matching, abnormal behavior identification, and short-term communication pattern analysis. This allows for the timely identification of unauthorized access, abnormal commands, or protocol-level tampering, thereby ensuring the operational security and command reliability of the control system.

[0003] However, as attack methods become increasingly sophisticated, more and more slow-cycle and cross-cycle attacks targeting industrial control protocols are emerging. These attacks are characterized by attackers breaking down abnormal behavior into multiple small instructions that are legal in format and parameters, and embedding them into normal communication processes in a low-frequency, intermittent manner, thereby circumventing existing IDS rules for identifying short-term communication patterns. Faced with this type of attack pattern characterized by gradual state shifts and long-term evolution of the control chain, existing intrusion detection systems based on fixed time windows or short-term behavior analysis often struggle to respond effectively, leaving the overall control system vulnerable to the risk of subtle control hijacking without its awareness.

[0004] Therefore, there is an urgent need for a dynamic analysis mechanism that can infer the length of the observation time window based on the attack evolution behavior, in order to break through the perception blind spot of existing technologies in dealing with slow-changing and covert attacks. Summary of the Invention

[0005] The purpose of this invention is to address the problem mentioned in the background art that existing intrusion detection systems based on fixed time windows or short-term behavior analysis often fail to form an effective response, resulting in the overall control system facing the risk of subtle control hijacking without being detected. Therefore, this invention proposes an industrial control network security protection system.

[0006] This invention provides an industrial control network security protection system, the system comprising: State mutation module: Extracts state variables related to control behavior from industrial control communication data, and determines the state mutation distribution results based on the change information of state variables at adjacent time points; The mutation sparsity module divides the continuous running time into multiple adjacent time periods based on the state mutation distribution results, counts the number of state variables that undergo state mutations in each time period, and calculates the local mutation sparsity results. State Change Value Module: Analyzes the trend of local mutation sparsity results on the time axis, calculates the state change value, and determines the length of the observation time window based on the state change value; Security Protection Module: The observation time window length is applied to the industrial intrusion detection process to analyze the industrial control communication behavior within the observation time window and determine whether network security issues have occurred.

[0007] Optionally, the state mutation module extracts state variables related to control behavior from industrial control communication data, and determines the state mutation distribution results based on the change information of state variables at adjacent time points, including: The control command messages are parsed from the industrial control communication data to extract the set of state variables that directly correspond to the equipment control behavior. The state variables include register values, actuator switch status, control flag bits or operating mode identifiers. Each state variable is then time-sequenced according to the communication timestamp to form a state variable time series. In a state variable time series, the difference between two adjacent time points of the same state variable is calculated using a fixed sampling interval to obtain the magnitude of the change in the state variable between adjacent time points. The calculation formula is as follows: ΔSᵢ(t) = |Sᵢ(t) - Sᵢ(t-1)|; where Sᵢ(t) represents the value of the i-th state variable at time t; Sᵢ(t-1) represents the value of the i-th state variable at the previous sampling time point at time t; ΔSᵢ(t) represents the magnitude of the state change of the i-th state variable between adjacent time points; i represents the number of the state variable; t represents the current sampling time point; The magnitude of the state change is compared with the preset state change judgment threshold. When the magnitude of the state change is not less than the state change judgment threshold, the state variable is judged to have a state change at time point t, and the corresponding time point and state variable number are recorded as a state change event. The state mutation events obtained for all state variables within a continuous time range are summarized, and a set of state mutation events is constructed in chronological order. The state mutation distribution result is then formed based on the time axis, reflecting the distribution of state variable mutations in the time dimension.

[0008] Optionally, the mutation sparsity module: based on the state mutation distribution results, divides the continuous running time into multiple adjacent time periods, counts the number of state variables that undergo state mutations in each time period, and calculates the local mutation sparsity results, including: The time series of state variables is divided into multiple consecutive time periods of fixed length, each time period having a length of T, forming the time period series T1, T2, T3, T4. k ; For each state variable i, in each time interval T kWithin this time period, it is determined whether the state variable shows a change in magnitude between adjacent sampling points that is not less than a preset mutation threshold ΔS at least once during this time period. t This is to determine whether a state change occurs during that time period, where the magnitude of the change in the state variable is calculated using the following formula: ΔSᵢ(t) = |Sᵢ(t) - Sᵢ(t-1)|, where Sᵢ(t) represents the value of the state variable i at sampling time t; Sᵢ(t-1) represents the value of the state variable at the sampling point before time t; ΔSᵢ(t) represents the magnitude of the change of state variable i at the current sampling time; ΔS t The threshold for mutation determination is a preset constant; t represents the value falling within the current time period T. k At any sampling time within; when ΔSᵢ(t) ≥ ΔS t The condition in time period T k When any pair of adjacent sampling points within a time period satisfies the condition, record that the state variable i undergoes a state change during that time period. Statistical analysis of each time period T k The number of state variables that undergo a state change within a given period, denoted as N. a (T k ), and calculate the local mutation sparsity result LMSR(T) for this time period. k The calculation formula is as follows: LMSR(T k )=N a (T k ) / N t , among which, LMSR(T k ) represents the time period T k Sparse results of local mutations within; N a (T k ) indicates that during the time period T k The number of state variables that undergo a state change within the range; N t This represents the total number of monitored state variables; it is a fixed value. All time periods corresponding to LMSR(T) k Arranged in chronological order, they form a sparse sequence of local mutations, which is used to determine the length of the subsequent observation time window.

[0009] Optionally, the state change value module analyzes the trend of local mutation sparsity results over time, calculates the state change value, and determines the length of the observation time window based on the state change value. The steps include: The calculation module calculates the state mutation time stretching index, state mutation inflection point density index, and state mutation trend pullback index based on the changing trend of the local mutation sparsity results on the time axis. The state mutation time stretching index, state mutation inflection point density index, and state mutation trend pullback index are added together to obtain the state change value. The observation time window length is determined based on the state change value.

[0010] Optionally, the computing module also includes: Mutation active time period sequence module: After completing the calculation of local mutation sparsity results, the time period numbers with local mutation sparsity values ​​greater than or equal to the preset sparsity activation threshold are selected, and the time period numbers are arranged in chronological order to form a mutation active time period sequence. Spacing sequence module: For each pair of adjacent time periods in the sequence of active mutation time periods, calculate the difference in their numbering on the time axis to form a spacing sequence of adjacent mutation time periods; Spacing Range Ratio Module: In the spacing sequence, extract the maximum and minimum values ​​of all spacings, and calculate the ratio of the difference between the maximum and minimum values ​​to their sum as the spacing range ratio; the ratio is used to characterize the degree of stretching in the distribution between abrupt change points; The perturbation density factor module determines the direction of change in magnitude between two adjacent intervals in the interval sequence, records the number of times the direction of change reverses, and calculates the ratio between the number of reversals and the logarithm of the comparable intervals as the perturbation density factor; it is used to reflect the stability of the change in the rhythm of abrupt changes. Original Intensity Value Module: The interval range ratio is multiplied and divided by the perturbation density factor. Specifically, the interval range ratio is multiplied by one and the perturbation density factor is subtracted to obtain the original intensity value that reflects the stretching trend of the abrupt change rhythm. State change time stretching module: The original strength value is used as the numerator, and one is added to it to form a ratio structure. The ratio is then used as the input value of the base exponent term of the negative exponent. After calculating the value of the exponent term, the value of the exponent term is subtracted from the constant one. The result is the state change time stretching exponent.

[0011] Optionally, the computing module further includes: Mutation Intensity Sequence Module: Based on the time-ordered local mutation sparse values, a mutation intensity sequence is constructed, where each item corresponds to the local mutation sparse result within a time period; Mutation Intensity Value Module: Group the mutation intensities of every three consecutive time periods into a set, and determine whether the mutation intensity value of the middle time period is simultaneously greater than or less than the mutation intensity values ​​of the preceding and following time periods. If the condition is met, mark the middle time period as an inflection point, and determine the direction of the inflection point based on its relative magnitude relationship. If it is a local maximum, mark it as a positive inflection point; if it is a local minimum, mark it as a negative inflection point. Direction Sequence Module: Arranges the directions of all inflection points into a direction sequence in chronological order, where positive inflection points are denoted as positive one and negative inflection points are denoted as negative one; Reversal module: In the inflection point direction sequence, compare whether the directions of two adjacent inflection points are different. If the direction of an adjacent inflection point changes from positive to negative or from negative to positive, it is considered as a direction reversal, and the total number of direction reversals is counted. Fluctuation frequency module: Divide the number of direction reversals by the total number of inflection points minus one to obtain the direction reversal density value, which is used to characterize the fluctuation frequency of the direction of change in the intensity of abrupt change; The abrupt change inflection point density module: The absolute value of the difference between the direction reversal density value and the constant 0.5 is taken to obtain the symmetry offset; the square of the offset is used as a perturbation penalty term, and the result of subtracting the penalty term from the constant is taken as the final state abrupt change inflection point density exponent. The state abrupt change inflection point density exponent is a dimensionless quantity ranging from zero to one.

[0012] Optionally, the computing module further includes: First identification module: In the mutation intensity sequence, identify the time period with the largest mutation intensity value, and record the maximum value and its corresponding time period position number; The second identification module: In all time periods following the maximum mutation intensity value, find the minimum mutation intensity and record the minimum value and its corresponding position; Trend retracement strength module: Calculates the difference between the maximum value and the subsequent minimum value, divides the difference by the maximum value and adds a constant value. The constant value is a preset non-zero positive value to avoid the denominator being zero. The calculation result is used as the trend retracement strength value; used to reflect the retracement magnitude of the sudden change. Relative position factor module: Calculates the relative position of the time period containing the maximum value in the overall mutation intensity sequence, divides the time period number by the total number of time periods, and obtains the relative position factor of the maximum value; Trend retracement raw value module: Nonlinearly combines the trend retracement strength value with the relative position factor of the maximum value. Specifically, the trend retracement strength value is multiplied by one and the absolute value of its deviation from the center position of the sequence is subtracted. The deviation is calculated by the difference between the relative position factor of the maximum value and the constant 0.5. The result is the trend retracement raw value. The mutation trend retracement module: It uses the original trend retracement value as the numerator and the original trend retracement value plus one as the denominator to form a fractional structure. The final result of this fractional structure is used as the state mutation trend retracement index. The state mutation trend retracement index is a dimensionless quantity ranging from zero to one.

[0013] Optionally, the security protection module includes: Comparison module: Compares the state change value with the first threshold and the second threshold. The first threshold is less than the second threshold. All three are preset constants, used to distinguish different intensity ranges of abrupt state changes. First window module: When the state change value is less than the first threshold, it is determined that the current control process is in a low-activity range, and the observation time window length is set to the maximum window length to expand the behavior capture range; Second window module: When the state change value is greater than or equal to the first threshold and less than the second threshold, it is determined that the current control process is in the rhythm fluctuation range, and the observation time window length is set to the default window length to maintain a balance between recognition accuracy and computational cost; The third window module: When the state change value is greater than or equal to the second threshold, it is determined that there may be a trend of hidden abnormal behavior clustering. The observation time window length is shortened to the minimum window length to enhance the response capability to rapid evolution process. The settings module includes three preset values ​​for maximum window length, default window length, and minimum window length, ensuring that the maximum window length is greater than the default window length and the default window length is greater than the minimum window length. The module used is to use the selected observation time window length as the sliding window length parameter used by the subsequent intrusion detection module when analyzing communication behavior, and it is also used in the current round of industrial control behavior aggregation and anomaly identification operations.

[0014] The beneficial effects of this invention are: This invention proposes an industrial control network security protection system. By extracting the continuous change characteristics of control state variables during industrial control communication and analyzing the evolution process of state changes holistically based on the sparse distribution of state mutations over time, it can identify abnormal control behaviors embedded in normal communication in a low-frequency, dispersed manner. Furthermore, instead of using a fixed or preset observation time window, this invention dynamically determines the length of the observation time window that matches the evolution characteristics of the current control behavior based on the changing trend of the sparse results of state mutations over time. This allows abnormal instructions that were originally fragmented and distributed across cycles to be identified and associated within the same analytical field, effectively avoiding the problem of existing intrusion detection systems fragmenting related control behaviors into independent normal events due to excessively short observation windows. Therefore, this invention can significantly improve the perception capability of slow-paced, cross-cycle, and state-gradually shifting industrial control attacks without relying on complex rule bases or prior attack models. It overcomes the detection blind spots of existing technologies in long-term control chain evolution analysis and reduces the security risks faced by industrial control systems in covert control hijacking scenarios. Attached Figure Description

[0015] Figure 1This is a framework diagram of an industrial control network security protection system; Figure 2 This is a flowchart illustrating the implementation method of an industrial control network security protection system. Detailed Implementation

[0016] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description is provided in conjunction with the accompanying drawings and preferred embodiments, based on the specific implementation methods, structure, features, and effects of the present invention.

[0017] This invention provides an industrial control network security protection system. See also... Figure 1 , Figure 1 A flowchart illustrating an industrial control network security protection system provided in an embodiment of the present invention. The system includes: State mutation module: Extracts state variables related to control behavior from industrial control communication data, determines the state mutation distribution results based on the change information of state variables at adjacent time points, and forms a state mutation distribution result that reflects the distribution of state changes; The mutation sparsity module divides the continuous running time into multiple adjacent time periods based on the state mutation distribution results. It counts the number of state variables that undergo state mutations in each time period and calculates the local mutation sparsity results. The local mutation sparsity results are calculated to characterize the degree of sparsity of the state mutation distribution in the time dimension. State Change Value Module: Analyzes the trend of local mutation sparsity results on the time axis, calculates the state change value, and determines the length of the observation time window based on the state change value; Security Protection Module: The observation time window length is applied to the industrial intrusion detection process to analyze the industrial control communication behavior within the observation time window and determine whether network security issues have occurred.

[0018] An industrial control network security protection system based on embodiments of the present invention extracts the continuous change characteristics of control state variables during industrial control communication and analyzes the evolution process of state changes holistically by starting with the sparse distribution characteristics of state mutations in the time dimension. This enables the identification of abnormal control behaviors embedded in normal communication in a low-frequency, dispersed manner. Furthermore, instead of using a fixed or preset observation time window, the present invention dynamically determines the length of the observation time window that matches the evolution characteristics of the current control behavior based on the changing trend of the sparse results of state mutations on the time axis. This allows abnormal instructions that were originally fragmented and distributed across cycles to be associated and identified within the same analytical field, effectively avoiding the problem of existing intrusion detection systems separating related control behaviors into independent normal events due to excessively short observation windows. Therefore, the present invention can significantly improve the perception capability of slow-paced, cross-cycle, and state-gradually shifting industrial control attacks without relying on complex rule bases or prior attack models. It overcomes the detection blind spots of existing technologies in long-term control chain evolution analysis and reduces the security risks faced by industrial control systems in covert control hijacking scenarios.

[0019] In one implementation, see [link to implementation details]. Figure 2 , Figure 2 A flowchart illustrating the implementation method of an industrial control network security protection system is provided: S1: Extract state variables related to control behavior from industrial control communication data, determine the state change distribution results based on the change information of state variables at adjacent time points, and form a state change distribution result that reflects the distribution of state changes; S2: Based on the state mutation distribution results, the continuous running time is divided into multiple adjacent time periods, and the number of state variables that undergo state mutations is counted in each time period to calculate the local mutation sparsity results; the local mutation sparsity results used to characterize the degree of sparsity of state mutation distribution in the time dimension are calculated. S3: Analyze the trend of local mutation sparsity results on the time axis, calculate the state change value, and determine the length of the observation time window based on the state change value; S4: Apply the observation time window length to the industrial intrusion detection process, analyze the industrial control communication behavior within the observation time window, and determine whether network security issues have occurred.

[0020] In one embodiment, it should be noted that in industrial control systems, industrial control communication data is typically exchanged periodically between devices such as PLCs, RTUs, and DCSs and a host computer (such as a SCADA system) via protocols (e.g., Modbus, S7Comm, DNP3, etc.). These messages contain device status information. Register values ​​typically refer to data units in the control device used to store current measured or set values. For example, the register corresponding to a temperature sensor might be 40001, with a value of 68.7, indicating a current temperature of 68.7°C. Actuator switch status indicates whether devices such as electric valves, water pumps, and relays are in a start / stop state, typically 0 or 1 indicating off or on. For example, a switch status register value of 1 for a water pump indicates that the pump is running. Control flags typically refer to identifiers in the system used to indicate whether a certain control logic is enabled, such as an automatic control enable flag, where a value of 1 indicates that the automatic control logic is activated. Operating mode identifiers refer to the current operating mode of the device, such as 0 for standby mode, 1 for manual mode, and 2 for automatic operation mode. The aforementioned state variables are typically read actively by the acquisition system at set intervals (e.g., every second, every minute) via a communication protocol, and their value changes are recorded chronologically. By parsing the protocol frame content (e.g., Modbus function codes, addresses, and data segments) in this communication data, the values ​​of the corresponding state variables can be extracted, and a complete time series can be formed according to the communication timestamps for subsequent analysis. For example, the system reads register number 40002 every 10 seconds. This register corresponds to the device's operating frequency. If its value jumps from 50 to 65, it can be determined that a state change has occurred.

[0021] It should be noted that in industrial control networks, the process begins by acquiring control command messages (such as Modbus messages or S7 commands) sent by devices like PLCs and DCSs during communication. By parsing the message structure fields, a set of state variables directly corresponding to the device's control behavior is extracted. These state variables include, for example, register values ​​corresponding to temperature sensor or frequency setpoints, actuator on / off states indicating device operation (e.g., pump on = 1, off = 0), control flags indicating control flow status (e.g., whether automatic control has been entered), and operating mode identifiers indicating the device's current operating logic (e.g., manual / automatic / standby mode values). Each state variable is then arranged according to the timestamp in the communication data packet, forming a time sequence of state variables. Next, within these time sequences, at a predetermined fixed sampling interval (e.g., every 10 seconds), the absolute difference between the current and previous time points for the same state variable is calculated, yielding the magnitude of the change in the state variable between two adjacent time points, denoted as ΔSᵢ(t). For example, if the frequency register of a certain wind turbine is 45Hz at t=60 seconds and 65Hz at t=70 seconds, the change range is ΔS=|65-45|=20Hz. Then, the change range of each variable is compared with a preset mutation judgment threshold, for example, a threshold of 15Hz. If ΔS≥15Hz, it is considered that the variable has undergone a state mutation at that time point, and the state variable number and time point of the event are recorded, for example, recorded as variable #3, 70 seconds. All mutation events of state variables within a certain time range (e.g., the past 1 hour) are summarized and a complete set of state mutation events is constructed in chronological order. Finally, using the time axis as a reference, the distribution pattern of mutation events over time is plotted to form the state mutation distribution result.

[0022] In one embodiment, it should be noted that after constructing the state variable time series, in order to identify the distribution characteristics of state changes in the time dimension, the state variable time series is first divided according to a set time interval to form a series of continuous time periods. The length of each time period is a fixed value T, and the time periods are numbered sequentially as T1, T2, ... T. k This ensures that all sampling points strictly belong to a specific time period. For each state variable i, in each time period T... k Within each sample point, the difference between adjacent sampling points is compared one by one. The magnitude of the change ΔSᵢ(t) = |Sᵢ(t) - Sᵢ(t-1)| is calculated, where Sᵢ(t) represents the value of the variable at time point t, and Sᵢ(t-1) is the value of the previous sampling point. If the difference is greater than or equal to the preset abrupt change threshold ΔS, the change is considered complete. t (e.g., set to 10, 100, etc.), then determine the variable in the time period T. kThere is a sudden change in the state variable. If a state variable satisfies this change condition between any two sampling points within the current time period, it can be considered that a state change has occurred within that period. For example, if the on / off state variable of an electric valve is 0 (closed) at t=20 seconds and 1 (open) at t=30 seconds, and a threshold ΔS is set... t If the value is 1, it is considered that the variable has undergone a sudden change during this time period. After evaluating all state variables, the statistics for the current time period T are calculated. k Within this context, how many state variables underwent abrupt changes? Let N be the total number of such changes. a (T k Subsequently, the local mutation sparsity result for this time period is calculated, i.e., LMSR(T). k )=N a (T k ) / N t , where N t This indicates the total number of monitored state variables; this value is a preset constant, for example, 100. LMSR(T k The smaller the value of ), the more sparse the mutation behavior is in the global variable space, indicating that it is more likely to be a low-frequency, targeted intervention operation. The above judgment and calculation are performed sequentially on all time periods to obtain a time-ordered LMSR sequence, which is used to subsequently determine the temporal distribution pattern of overall state mutation behavior and to determine the optimal observation time window length for intrusion detection.

[0023] In one embodiment, it should be noted that the state mutation time stretching index is a quantitative indicator used to measure whether state mutation events in industrial control exhibit a stretching distribution trend over a period of time. A stretching distribution trend refers to whether the time intervals between mutation events are becoming longer, and whether mutations are becoming sparser but lasting longer. This index analyzes the interval sequence of mutation events, extracts the maximum difference in its distribution (interval range ratio), and combines it with the stability of changes in the interval direction (perturbation density factor) to obtain a raw strength value that comprehensively reflects the evolution of the mutation rhythm. This value is then normalized to the 0-1 range using a nonlinear compression function. The core function of this index is to capture the characteristic trajectory of low-frequency, delayed, and distributed attacks. In many modern industrial control attacks, attackers do not inject multiple abnormal instructions in a short period of time, but rather employ a slow injection strategy, breaking each attack into multiple seemingly legitimate micro-operations and slowly advancing over a longer period to evade intrusion detection mechanisms based on short time windows. In this case, although each state mutation appears fragmented, their time distribution exhibits a stretching characteristic of becoming increasingly slower and with increasingly longer intervals.

[0024] A larger index indicates a more uneven time interval between mutation events, more drastic rhythm changes, and a more stable direction—this usually means that the attacker is continuously applying potential interference with rhythmic control. For example, writing a fine-tuning value to a pump station's frequency register every 15 minutes, causing a false alarm after several hours; or gradually lowering a sensor threshold to bypass alarms. For instance, if mutation events are distributed at minutes 5, 10, 15, 45, and 59 within an hour, this temporal density suggests that the attack may be gradually coming to an end after initial deployment. The state mutation time stretching index will increase significantly in this case. Therefore, the state mutation time stretching index can dynamically determine whether there is a rhythmic hidden attack, thereby adjusting the detection strategy in a timely manner and improving the identification effect.

[0025] The advantage of calculating the state mutation time stretching index in the above way is that it does not simply count the number of mutations or mutation frequency, but comprehensively measures the stretching trend of state changes on the time axis from two dimensions: the difference in the interval between mutation time points and the stability of rhythm changes. This allows for the accurate identification of slow-rhythm control injection behaviors that are deliberately stretched and sparsely distributed by attackers. It is suitable for detecting cross-cycle, low-frequency, and highly concealed attack patterns, avoiding misjudgments and missed detections caused by the non-dense distribution of mutations in conventional methods.

[0026] It's important to note that the State Transition Inflection Point Density Index is an indicator used to measure the frequency and rhythmicity of changes in the intensity of state transitions over time. Its core purpose is to identify abnormal control rhythms in industrial control, such as alternating fluctuations, repeated probing, and back-and-forth disturbances. It focuses on whether the frequency of directional changes in the transition rhythm is abnormally dense, especially whether there are obvious rhythmic reversals between repeated strengthening and weakening of local sparse states. A higher index value indicates more frequent switching between positive (transition enhancement) and negative (transition decay) states during the transition process, suggesting the behavior is more likely to be in an unstable but controllable disturbance probing mode. This is often a direct signal of intelligent attackers using back-and-forth testing combined with local triggering techniques to bypass fixed-strategy detection. For example, in an industrial process, an attacker might periodically lower the temperature threshold, then quickly raise it, then finely lower it again, repeating this several times, each time affecting only 1-2 time periods, making traditional short-window detection ineffective. Under inflection point density analysis, these behaviors will exhibit high-frequency positive and negative directional jumps, significantly increasing the index value. Therefore, the larger the index, the higher the probability of an anomaly in alternating trial-and-error control.

[0027] The advantage of calculating the state mutation inflection point density index in the above way is that it can accurately identify the behavior pattern of repeated alternation of mutation intensity on the time axis and capture covert control attacks with rhythmic perturbation characteristics. By constructing a local ternary structure to identify inflection points and then normalizing based on the direction switching frequency, it avoids misjudgment caused by factors such as isolated extreme values ​​and violent fluctuations in conventional statistics, and can effectively improve the sensitivity to slow-frequency, multiple-switching attacks.

[0028] It should be noted that the State Mutation Trend Retreat Index is an indicator used to measure whether the intensity of a mutation shows a significant decline or trend retreat after reaching its peak. Its core function is to identify the typical asymmetric abnormal rhythmic structure in industrial control networks—a mutation that first intensifies and then rapidly declines. This reflects whether an attacker injects a series of commands in a short period and then quickly stops or withdraws, attempting to avoid detection by continuous monitoring mechanisms. By identifying the maximum value and its subsequent minimum value in the mutation intensity sequence, and considering whether the maximum value occurs at the beginning, middle, or end of the sequence, it can determine whether a concentrated pressure-rapid withdrawal control interference pattern exists. The larger the index, the stronger the influence of the mutation. This means that the mutation behavior not only underwent a strong change, but also showed a significant decline afterward. Moreover, this process was not accidental, but occurred in the later part of the sequence, and was highly purposeful and organized. For example, the attacker wrote high-frequency start instructions three times in a row to make the executor run to its limit, and then immediately stopped writing or injected a frequency reduction instruction, causing the mutation sequence to shrink rapidly. This behavior can be clearly captured by the pullback structure. Conventional analysis methods based on mean, frequency, and amplitude often fail to detect the risk in time because it looks like it has returned to normal. Therefore, the larger the state mutation trend pullback index, the more likely it is that it has just experienced a strong control behavior and entered a short period of dormancy. It is an important structural indicator for identifying fast-attack and fast-retreat high-intensity covert attacks.

[0029] The advantage of calculating the state mutation trend retracement index in the above way is that it not only focuses on the numerical fluctuation of mutation intensity, but also clearly extracts the asymmetric evolution structure of mutation behavior in the time series, which first rises sharply and then falls rapidly. At the same time, it combines the location of the maximum value to suppress or strengthen the rhythm of abnormal behavior, avoiding the misleading effect of early sporadic high points on the results. Compared with conventional average trend analysis, sliding window statistics or threshold judgment methods, this method can effectively identify the rapid attack and retreat operation trajectory of attackers who inject intervention commands in a short period of time and then quickly withdraw.

[0030] In one embodiment, it should be noted that in actual execution, the calculated state change value is first compared with a preset first threshold and second threshold in a continuous interval to classify the behavioral evolution intensity level of the current state. The first threshold is less than the second threshold, and all three are explicitly configured constants that do not depend on calculations during runtime, thus ensuring the stability and adjustability of the strategy logic. When the state change value is less than the first threshold, the current state mutation behavior is determined to be in a low-activity stage, indicating that the mutation events are sparse and scattered, which may be normal fluctuations. At this time, to avoid prematurely triggering alarms or wasting resources, the observation time window length is set to the maximum window length, for example, 90 time periods, to expand the aggregation analysis capability of sparse behavior over a longer period. When the state change value is between the first threshold and the second threshold, it indicates that the behavior has a certain degree of volatility but has not yet formed a clear trend cluster or attack structure. At this time, it enters the rhythm fluctuation range, and the observation time window length is set to the default length, for example, 60 time periods, to maintain the monitoring of normal rhythm fluctuations. The system monitors sensitivity while controlling computational resource consumption. If the state change value is greater than or equal to the second threshold, it is determined that there is a possibility of mutation clustering, trend evolution, or potential concentrated injection of attacks. At this time, the window length is immediately shortened to the minimum value, such as 30 time periods, to ensure that it can respond quickly to high-density behavioral evolution structures with finer time granularity. The above three window length values ​​need to be set in advance in the configuration file and satisfy the decreasing relationship that the maximum window is greater than the default window and the default window is greater than the minimum window, to ensure that different interval mappings have clear response differences. The final selected observation time window length will be written into the sliding window parameters of the behavior detection module in real time and used as the boundary length for the current round of data processing, communication behavior aggregation, and intrusion judgment. For example, if the current state change value is 0.78, which is higher than the preset second threshold of 0.6, the minimum window length is immediately selected for the sequence analysis of subsequent control commands to ensure that high-frequency anomalies are quickly captured, rather than being diluted and not identified in an excessively long time period, thereby achieving dynamic adaptive window control and behavior perception capability enhancement.

[0031] In one embodiment, the observation time window length is applied to the industrial intrusion detection process. The steps for analyzing industrial control communication behavior within the observation time window and determining whether a network security issue has occurred are as follows: After determining the observation time window length, this window length is used as the analysis time range parameter for the current intrusion detection module. It is applied to the dynamic interception and aggregation analysis of continuous communication behavior in industrial control networks. Specifically, based on a sliding window mechanism, a communication data subsequence with a length equal to the observation time window length is extracted in each detection cycle. All data packets in this subsequence are arranged in chronological order and maintain the context information of the complete control chain. Then, it enters the multi-dimensional behavior analysis process. In this process, protocol type identification and field parsing are first performed on all packets within the window to extract the target device, function code, data segment, and execution parameters of the control command. Based on historical command sequences, a device state evolution trajectory is constructed. Then, combined with the set protocol state model, it is determined whether typical abnormal patterns such as cross-command conflicts, illegal sequential execution, and state reversal behavior occur. For example, if an actuator receives three consecutive write-open commands at the beginning of the window, and then receives a close command at the end of the window with the parameter field set to empty, this behavior combination may constitute a pseudo-close operation. This system is designed to detect hidden command deception attacks. Furthermore, it constructs a control behavior graph within the window, modeling the interaction objects, control logic paths, and execution time relationships between commands. If short-duration, high-density multi-source writes to the same target, cross-cycle write-backs, or low-frequency parameter drifts are detected within the window, a deep verification mechanism is triggered. Throughout the analysis, all communication behaviors within the window are analyzed using sequence integrity as the unit, ensuring multi-dimensional judgment is completed without truncation of the behavior chain. Therefore, the length of the observation window directly affects the granularity and contextual integrity of the control behavior perception. A window that is too short may cause behavior chain breaks, while a window that is too long may dilute the mutation density and cause feature ambiguity. By dynamically adjusting the observation window length and strictly executing structured analysis under that length in each round of detection, adaptive detection capabilities can be maintained for communication behaviors under different attack rhythms. This improves the accuracy of identifying slow-paced attacks, cross-cycle state manipulation, and distributed abnormal behaviors, achieving more context-aware and control logic-perceived industrial network intrusion detection.

[0032] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention should still fall within the scope of the claims of the present invention.

Claims

1. An industrial control network security protection system, characterized in that, Includes the following steps: State mutation module: Extracts state variables related to control behavior from industrial control communication data, and determines the state mutation distribution results based on the change information of state variables at adjacent time points; The mutation sparsity module divides the continuous running time into multiple adjacent time periods based on the state mutation distribution results, counts the number of state variables that undergo state mutations in each time period, and calculates the local mutation sparsity results. State Change Value Module: Analyzes the trend of local mutation sparsity results on the time axis, calculates the state change value, and determines the length of the observation time window based on the state change value; Security Protection Module: The observation time window length is applied to the industrial intrusion detection process to analyze the industrial control communication behavior within the observation time window and determine whether network security issues have occurred.

2. The industrial control network security protection system according to claim 1, characterized in that, The state change module includes: Status variable module: Parses control command messages from industrial control communication data, extracts a set of status variables that directly correspond to the equipment control behavior, including register values, actuator switch status, control flag bits or operating mode identifiers, and serializes each status variable according to the communication timestamp to form a status variable time series; First variation amplitude module: In the time series of state variables, the difference between the same state variable at two adjacent time points is calculated at a fixed sampling interval to obtain the variation amplitude of the state variable between adjacent time points. The calculation formula is as follows: ΔSᵢ(t) = |Sᵢ(t) - Sᵢ(t-1)|; where Sᵢ(t) represents the value of the i-th state variable at time t; Sᵢ(t-1) represents the value of the i-th state variable at the previous sampling time point at time t; ΔSᵢ(t) represents the magnitude of the state change of the i-th state variable between adjacent time points; i represents the number of the state variable; t represents the current sampling time point; Judgment module: compares the magnitude of the state change with the preset state change judgment threshold. When the magnitude of the state change is not less than the state change judgment threshold, it determines that the state variable has undergone a state change at time point t, and records the corresponding time point and the state variable number as a state change event. State mutation distribution results module: It summarizes the state mutation events obtained by all state variables in a continuous time range, constructs a set of state mutation events in chronological order, and forms a state mutation distribution result that reflects the distribution of state variable mutations in the time dimension based on the time axis.

3. The industrial control network security protection system according to claim 1, characterized in that, The mutation sparse module includes: State mutation distribution results module: This module divides the time series of state variables into multiple consecutive time periods of fixed length, each time period having a length of T, forming time period sequences T1, T2, T3, T4, T5, T6, T7, T8, T9, T1, T1, T2, T3, T4, T5, T6, T7, T8, T9, T1, T1, T2, T3, T1, T2, T3, T4 ... k ; Second variation magnitude module: For each state variable i, in each time period T k Within a given time period, it is determined whether the state variable exhibits at least one instance where the change in amplitude between adjacent sampling points is not less than a preset abrupt change threshold ΔS. t This is to determine whether a state change occurs within a time period, where the magnitude of the change in the state variable is calculated using the following formula: ΔSᵢ(t) = |Sᵢ(t) - Sᵢ(t-1)|, where Sᵢ(t) represents the value of the state variable i at sampling time t; Sᵢ(t-1) represents the value of the state variable at the sampling point before time t; ΔSᵢ(t) represents the magnitude of the change of state variable i at the current sampling time; ΔS t The threshold for mutation determination is a preset constant; t represents the value falling within the current time period T. k At any sampling time within; when ΔSᵢ(t) ≥ ΔS t The condition in time period T k When any pair of adjacent sampling points within the time frame satisfies the condition, the state variable i is recorded to undergo a state change within the time period; Local mutation sparse results module: Statistical analysis for each time period T k The number of state variables that undergo a state change within a given period, denoted as N. a (T k ), and calculate the local mutation sparsity result LMSR(T) for the time period. k The calculation formula is as follows: LMSR(T k )=N a (T k ) / N t , among which, LMSR(T k ) represents the time period T k Sparse results of local mutations within; N a (T k ) indicates that during the time period T k The number of state variables that undergo a state change within the range; N t This indicates the total number of monitored state variables.

4. The industrial control network security protection system according to claim 1, characterized in that, The state change value module includes: The calculation module calculates the state mutation time stretching index, state mutation inflection point density index, and state mutation trend pullback index based on the changing trend of the local mutation sparsity results on the time axis. The state mutation time stretching index, state mutation inflection point density index, and state mutation trend pullback index are added together to obtain the state change value. The observation time window length is determined based on the state change value.

5. The industrial control network security protection system according to claim 4, characterized in that, The computing module includes: Mutation active time period sequence module: After completing the calculation of local mutation sparsity results, the time period numbers with local mutation sparsity values ​​greater than or equal to the preset sparsity activation threshold are selected, and the time period numbers are arranged in chronological order to form a mutation active time period sequence. Spacing sequence module: For each pair of adjacent time periods in the sequence of active mutation time periods, calculate the difference in their numbering on the time axis to form a spacing sequence of adjacent mutation time periods; Spacing Range Ratio Module: In the spacing sequence, extract the maximum and minimum values ​​of all spacings, and calculate the ratio of the difference between the maximum and minimum values ​​to their sum, as the spacing range ratio; The perturbation density factor module determines the direction of change in magnitude between two adjacent spacings in the spacing sequence, records the number of times the direction of change reverses, and calculates the ratio between the number of reversals and the logarithm of the comparable spacings, which is used as the perturbation density factor.

6. The industrial control network security protection system according to claim 5, characterized in that, The computing module also includes: Original Intensity Value Module: The interval range ratio is multiplied and divided by the perturbation density factor. Specifically, the interval range ratio is multiplied by one and the perturbation density factor is subtracted to obtain the original intensity value that reflects the stretching trend of the abrupt change rhythm. State change time stretching module: The original strength value is used as the numerator, and one is added to it to form a ratio structure. The ratio is then used as the input value of the base exponent term of the negative exponent. After calculating the value of the exponent term, the value of the exponent term is subtracted from the constant one. The result is the state change time stretching exponent.

7. The industrial control network security protection system according to claim 4, characterized in that, The computing module also includes: Mutation Intensity Sequence Module: Based on the time-ordered local mutation sparse values, a mutation intensity sequence is constructed, where each item corresponds to the local mutation sparse result within a time period; Mutation Intensity Value Module: Group the mutation intensities of every three consecutive time periods into a set, and determine whether the mutation intensity value of the middle time period is simultaneously greater than or less than the mutation intensity values ​​of the preceding and following time periods. If the condition is met, mark the middle time period as an inflection point, and determine the direction of the inflection point based on its relative magnitude relationship. If it is a local maximum, mark it as a positive inflection point; if it is a local minimum, mark it as a negative inflection point. Direction Sequence Module: Arranges the directions of all inflection points into a direction sequence in chronological order, where positive inflection points are denoted as positive one and negative inflection points are denoted as negative one; Reversal module: In the inflection point direction sequence, compare whether the directions of two adjacent inflection points are different. If the direction of an adjacent inflection point changes from positive to negative or from negative to positive, it is considered as a direction reversal, and the total number of direction reversals is counted. Fluctuation frequency module: Divide the number of direction reversals by the total number of inflection points minus one to obtain the direction reversal density value, which is used to characterize the fluctuation frequency of the direction of change in the intensity of abrupt change; The mutation inflection point density module: The absolute value of the difference between the direction reversal density value and the constant 0.5 is taken to obtain the symmetry offset; the square of the offset is used as the perturbation penalty term, and the result of subtracting the penalty term from the constant is used as the final state mutation inflection point density index.

8. An industrial control network security protection system according to claim 4, characterized in that, The computing module also includes: First identification module: In the mutation intensity sequence, identify the time period with the largest mutation intensity value, and record the maximum value and its corresponding time period position number; The second identification module: In all time periods following the maximum mutation intensity value, find the minimum mutation intensity and record the minimum value and its corresponding position; Trend retracement strength value module: Calculates the difference between the maximum value and the subsequent minimum value, divides the difference by the maximum value and adds a constant value. The constant value is a preset non-zero positive value to avoid the denominator being zero. The calculation result is used as the trend retracement strength value.

9. An industrial control network security protection system according to claim 8, characterized in that, The computing module also includes: Relative position factor module: Calculates the relative position of the time period containing the maximum value in the overall mutation intensity sequence, divides the time period number by the total number of time periods, and obtains the relative position factor of the maximum value; Trend retracement raw value module: Nonlinearly combines the trend retracement strength value with the relative position factor of the maximum value. Specifically, the trend retracement strength value is multiplied by one and the absolute value of its deviation from the center position of the sequence is subtracted. The deviation is calculated by the difference between the relative position factor of the maximum value and the constant 0.

5. The result is the trend retracement raw value. The mutation trend retracement module: It uses the original trend retracement value as the numerator and the original trend retracement value plus one as the denominator to form a fractional structure. Finally, it uses the result of the fractional structure as the state mutation trend retracement index.

10. An industrial control network security protection system according to claim 1, characterized in that, The security protection module includes: Comparison module: Compares the state change value with a first threshold and a second threshold, where the first threshold is less than the second threshold; First window module: When the state change value is less than the first threshold, it is determined that the current control process is in a low-activity range, and the observation time window length is set to the maximum window length; Second window module: When the state change value is greater than or equal to the first threshold and less than the second threshold, it is determined that the current control process is in the rhythm fluctuation range, and the observation time window length is set to the default window length. The third window module: When the state change value is greater than or equal to the second threshold, the observation time window length is shortened to the minimum window length.

Images