A network topology inference method for multi-source passive evidence fusion of industrial control systems

Abstract

The application discloses a kind of network topology inference methods of multi-source passive evidence fusion for industrial control system, the method is not injected any probe request message, control instruction or management query message to industrial control network under the premise, communication data generated naturally in industrial control network is collected by bypass monitoring mode;After pre-processing collected data, two-layer evidence and three-layer evidence are extracted from link layer and network layer respectively, while identifying industrial control protocol and parsing relevant fields to extract business semantic evidence;Further, the consistency analysis and conflict resolution of the candidate relationship generated by multi-source evidence are carried out to build basic communication topology;Finally, based on business semantic evidence, the connection relationship between node roles and nodes is semantically annotated, and the topology model for industrial control business semantics is output.The application improves the accuracy and business relevance of network topology inference under the premise of ensuring the safe and stable operation of industrial control system.

Description

Technical Field

[0001] This invention belongs to the field of application technology of network topology perception and security situation analysis of industrial control systems, and relates to a network topology inference method, specifically a network topology inference method for multi-source passive evidence fusion for industrial control systems. Background Technology

[0002] With the widespread application of industrial control systems in critical infrastructure sectors such as power, energy, chemical industry, and rail transportation, industrial control systems are gradually evolving from closed, dedicated control networks towards openness, networking, and informatization. A large number of control devices, monitoring devices, and management nodes in industrial control networks are interconnected via Ethernet and industrial protocols. While this improves automation and operational efficiency, it also makes the network structure increasingly complex and significantly increases security risks.

[0003] Network topology is crucial foundational information for the operation and security analysis of industrial control systems (ICS). Accurately understanding the connections and communication structures between devices in an ICS network provides support for system operation and maintenance management, fault location, security protection, and attack attribution. Therefore, accurately acquiring the ICS network topology without affecting the normal operation of the ICS has become a significant research challenge in the field of ICS security and situational awareness.

[0004] Existing industrial control network topology discovery technologies primarily rely on active probing methods, such as sending probe messages, management query messages, or scanning commands to obtain network configuration information and connectivity relationships of devices. These methods are typically based on mechanisms like SNMP, ICMP, or link discovery protocols, and can acquire network topology information to a certain extent. However, in real-world industrial control environments, active probing methods often have the following shortcomings: Firstly, some industrial control devices have limited computing resources or incomplete protocol implementations, making it difficult to support complex management queries; secondly, active probing may introduce additional network load and even affect the real-time performance and stability of industrial control system communication, posing potential production risks. Therefore, in many critical industrial control scenarios, active probing methods are severely limited or difficult to deploy.

[0005] To reduce the impact on industrial control system (ICS) operation, some network topology inference methods based on passive monitoring have emerged in recent years. These methods bypass the network by collecting naturally generated communication data, analyzing the communication relationships between devices, and thus inferring the network structure. However, most existing passive topology inference techniques rely on a single type of communication characteristic or a single-level information source, such as inference based solely on link-layer address relationships or network-layer communication sessions. This makes it difficult to simultaneously ensure topology integrity and inference accuracy in complex ICS network environments. Furthermore, existing methods typically treat network communication as equivalent data interaction, lacking in-depth utilization of the business semantics of ICS protocols, and failing to reflect the actual master-slave control relationships and business structure characteristics existing in ICS systems.

[0006] Therefore, existing technologies still lack a method that, tailored to the characteristics of industrial control systems, can accurately infer the topology of industrial control networks by integrating multi-source passive communication evidence and combining it with industrial control service semantics without active probing. How to improve the accuracy and practicality of network topology awareness while ensuring the safe and stable operation of industrial control systems remains a pressing technical problem to be solved in this field. Summary of the Invention

[0007] To address the challenges of complex network structures, diverse device types, and stable communication relationships in industrial control systems (ICS), which are highly sensitive to active probing, existing network topology discovery methods generally rely on active scanning or management queries, potentially impacting ICS operational security and real-time performance. Furthermore, existing passive topology inference methods suffer from limited evidence sources and difficulty in reflecting ICS business relationships. This invention provides a multi-source passive evidence fusion network topology inference method for ICS. Without injecting any active probing packets into the ICS network, this method passively collects naturally generated communication data from the ICS network and fuses multi-source passive evidence, including link layer, network layer, and ICS protocol business semantics, to jointly infer the connection relationships between devices in the ICS network. Based on this, a topology model oriented towards ICS business semantics is constructed, achieving accurate perception of the ICS network structure and business relationships. This provides a reliable foundation for ICS operation monitoring, security analysis, and situational awareness. This invention improves the accuracy and business relevance of network topology inference while ensuring the operational security and stability of the ICS, making it suitable for topology perception and security situational analysis in complex ICS network environments.

[0008] The objective of this invention is achieved through the following technical solution:

[0009] A network topology inference method based on multi-source passive evidence fusion for industrial control systems includes the following steps:

[0010] Step S1: Passively collect industrial control network communication data:

[0011] Without injecting any probe request messages, control commands, or management query messages into the industrial control network, the communication data naturally generated in the industrial control network is passively collected through bypass listening.

[0012] Step S2, Communication Data Preprocessing:

[0013] The communication data collected in step S1 is preprocessed, including time synchronization, data organization, and filtering of communication data that is not related to industrial control business.

[0014] Step S3: Second-level evidence extraction and generation of the second-level adjacency candidate set:

[0015] Based on the communication data preprocessed in step S2, second-level evidence representing the link-layer connectivity of network nodes is extracted, and a candidate set of second-level adjacency relationships is generated based on the second-level evidence. ;

[0016] Step S4: Three-layer evidence extraction and generation of the three-layer logical connection candidate set:

[0017] Based on the communication data preprocessed in step S2, three layers of evidence characterizing the network layer communication relationships of network nodes are extracted, and a candidate set of three-layer logical connection relationships is generated based on the three layers of evidence. ;

[0018] Step S5: Industrial Control Protocol Identification and Business Semantic Evidence Extraction:

[0019] The preprocessed communication data from step S2 is subjected to industrial control protocol identification, and the identified industrial control protocol messages are parsed for protocol fields. Protocol identification is achieved based on at least one of port features, message structure features, or session behavior features. By parsing fields such as transaction identifiers, function codes, sequence numbers, or call numbers in the industrial control protocol messages, business semantic evidence related to industrial control services is extracted, and a candidate set of business semantic relationships is generated based on this evidence. ;

[0020] Step S6: Multi-source evidence fusion and basic communication topology construction:

[0021] The candidate sets of Layer 2 adjacency relationships, Layer 3 logical connection relationships, and business semantic relationships are fused together. Through consistency analysis and conflict resolution mechanisms, the basic communication topology is obtained. ;

[0022] Step S7: Topology modeling oriented towards industrial control business semantics:

[0023] The basic communication topology constructed in step S6 Based on business semantic evidence, industrial control business semantic modeling is performed on network nodes and inter-node connections in the basic communication topology. Roles are labeled for network nodes, and business relationship types are labeled for inter-node connections, generating a topology model oriented towards industrial control business semantics. ;

[0024] Step S8: Output the topology representation result:

[0025] Output the topology representation results oriented towards industrial control business semantics.

[0026] Compared with the prior art, the present invention has the following advantages:

[0027] 1. This invention completes network topology inference without injecting any active probe messages into the industrial control network, avoiding the potential impact of active scanning and management queries on the real-time performance and stability of the industrial control system. It is suitable for industrial control environments with high requirements for continuous operation and security.

[0028] 2. This invention overcomes the problems of incomplete information and insufficient inference accuracy of a single passive evidence source by integrating multiple passive evidence sources such as link layer, network layer and industrial control protocol business semantics, and improves the reliability of topology inference results.

[0029] 3. This invention introduces a modeling mechanism oriented towards industrial control business semantics on the basis of basic communication topology, so that the generated topology model can reflect the real master-slave control relationship and business interaction relationship in the industrial control system, thereby improving the business relevance and practicality of the topology expression.

[0030] 4. This invention does not rely on specific manufacturer equipment or specific industrial control protocols, and can be applied to different types of industrial control systems and network structures, and has good versatility and promotional value.

[0031] 5. The topology model generated by this invention, which is oriented towards industrial control business semantics, can provide reliable basic data support for subsequent industrial control security monitoring, anomaly analysis, risk assessment and attack tracing, thereby improving the overall security protection capability of the industrial control system. Attached Figure Description

[0032] Figure 1 A block diagram of a network topology inference method for multi-source passive evidence fusion in industrial control systems;

[0033] Figure 2 This is a flowchart of a network topology inference method for multi-source passive evidence fusion in industrial control systems. Detailed Implementation

[0034] The technical solution of the present invention will be further described below with reference to the accompanying drawings, but it is not limited thereto. Any modifications or equivalent substitutions to the technical solution of the present invention that do not depart from the spirit and scope of the technical solution of the present invention should be covered within the protection scope of the present invention.

[0035] This invention provides a network topology inference method for multi-source passive evidence fusion in industrial control systems, such as... Figure 1 As shown, the method collects naturally generated communication data in the industrial control network (ICS) through bypass monitoring without injecting any probe request messages, control commands, or management query messages into the ICS. After preprocessing the collected data, it extracts Layer 2 and Layer 3 evidence from the link layer and network layer, respectively. Simultaneously, it identifies and parses relevant fields of the ICS protocol to extract business semantic evidence. Furthermore, it performs consistency analysis and conflict resolution on candidate relationships generated from multi-source evidence to construct a basic communication topology. Finally, based on the business semantic evidence, it semantically annotates node roles and inter-node connections, and outputs a topology model oriented towards ICS business semantics. This ensures that the topology results not only reflect communication relationships but also embody the master-slave control relationship and data interaction relationship within the ICS system. Figure 2 As shown, the specific implementation steps are as follows:

[0036] Step S1: Passively collect industrial control network communication data:

[0037] Without sending any probe request messages, control commands, or management query messages to the industrial control network, the communication data generated naturally in the industrial control network can be obtained through bypass listening.

[0038] In this step, bypass monitoring can be achieved through the switch's mirror port (SPAN / mirror interface) or an equivalent bypass acquisition point. The acquisition process does not change the original communication path and network topology of the industrial control network.

[0039] In this step, the bypass monitoring method includes: obtaining communication data from the data mirror interface of the network forwarding device or an equivalent bypass acquisition point without changing the original communication path and network topology of the industrial control network.

[0040] In this step, the collected industrial control network communication data includes at least: link layer data frames: Ethernet frame header (source MAC address, destination MAC address, VLAN tag) and payload; network layer data packets: IP header information (source / destination IP, protocol number, TTL) and transport layer information (TCP / UDP port); communication timestamps and ingress / egress interface identifiers can also be collected to support more granular stability determination.

[0041] Step S2, Communication Data Preprocessing:

[0042] The communication data collected in step S1 is preprocessed.

[0043] In this step, to ensure the consistency and comparability of subsequent multi-source evidence, the collected data undergoes preprocessing, including but not limited to:

[0044] (1) Time alignment and windowing:

[0045] The continuous flow rate is divided into fixed time windows, with the time window length set as follows: , No. Each window is .

[0046] (2) Data integration and session reconstruction:

[0047] According to the five-tuple Aggregate data packets to form a session collection. ,in, These are the source IP, destination IP, source port, destination port, and protocol type, respectively.

[0048] (3) Irrelevant communication filtering:

[0049] Filter background communications unrelated to industrial control operations (such as non-production-related internet access, non-business broadcast probes, etc.) to reduce the impact of noise on communication frequency and periodicity. This filtering strategy can be implemented based on port whitelists, network segment ranges, protocol types, or traffic directions.

[0050] Step S3: Second-level evidence extraction and generation of the second-level adjacency candidate set:

[0051] Based on the communication data preprocessed in step S2, second-level evidence representing the link-layer connectivity of network nodes is extracted, and a candidate set of second-level adjacency relationships is generated based on the second-level evidence. The generation of the Layer 2 adjacency candidate set is based on the address mapping relationship in ARP request and response packets. By analyzing the source MAC address, destination MAC address, and corresponding IP address information in the ARP packets, an IP-MAC mapping relationship between nodes is established, thereby determining the Layer 2 adjacency candidate relationships between network nodes. The specific steps are as follows:

[0052] (1) Extraction of ARP mapping evidence

[0053] Parse the ARP message to extract the MAC addresses of the ARP requester and responder. Build IP-MAC mapping set within a time window And generate second-level adjacency candidate relationships, preferably including "terminal-gateway" candidates: if a node If multiple ARP requests are initiated against different destination IPs within a window, and the target MAC addresses in their ARP responses show a stable and concentrated pattern, then the node corresponding to that MAC address is recorded as a potential gateway node. Forming two layers of candidate edges .

[0054] (2) Evidence of co-occurrence in broadcast domain

[0055] The reception / visibility characteristics of the same broadcast message type are statistically analyzed to form a "co-occurrence" relationship, which is used to help determine the set of nodes within the same Layer 2 domain.

[0056] Step S4: Three-layer evidence extraction and generation of the three-layer logical connection candidate set:

[0057] Based on the communication data preprocessed in step S2, three layers of evidence characterizing the network layer communication relationships of network nodes are extracted, and a candidate set of three-layer logical connection relationships is generated based on the three layers of evidence. The generation of the candidate set of the three-layer logical connection relationship is based on the communication behavior characteristics in network layer communication messages. By statistically analyzing the communication direction and frequency between network nodes, the communication relationships between node pairs are filtered, and the candidate relationships of the three-layer logical connection relationship are generated accordingly. The specific steps are as follows:

[0058] (1) Conversation direction and frequency statistics

[0059] For each node In the time window Internal statistical communication direction and frequency:

[0060] (1)

[0061] (2)

[0062] in, Represents nodes in the network. Indicates the time window number;

[0063] Define the strength of bidirectional communication:

[0064] (3)

[0065] in, Represents a node With nodes In the time window The bidirectional communication strength within the node is used to measure the overall communication activity between two nodes. This represents the communication strength threshold, used to determine whether there are candidate connections between nodes. At that time, candidate connection relationships are generated. .

[0066] (2) Directional indicators

[0067] To assist in subsequent master-slave determination and control relationship identification, directionality is defined:

[0068] (4)

[0069] in, Represents a node With nodes In the time window The communication directionality index within the node is used to characterize the degree of directional bias in communication traffic between two nodes. To prevent zero constants, directionality does not directly determine the existence of topology, but serves as an auxiliary quantity for subsequent semantic evidence.

[0070] Step S5: Industrial Control Protocol Identification and Business Semantic Evidence Extraction:

[0071] The preprocessed communication data from step S2 is subjected to industrial control protocol identification, and the identified industrial control protocol messages are parsed for protocol fields. Protocol identification is achieved based on at least one of port features, message structure features, or session behavior features. By parsing fields such as transaction identifiers, function codes, sequence numbers, or call numbers in the industrial control protocol messages, business semantic evidence related to industrial control services is extracted, and a candidate set of business semantic relationships is generated based on this evidence. The extraction of the business semantic evidence is based on the communication behavior characteristics of industrial control protocols. It identifies the master and slave roles of communication nodes by analyzing the sending direction of request and response messages, and identifies node relationships with periodic communication characteristics by statistically analyzing the request time intervals between communication nodes. The specific steps are as follows:

[0072] (1) Industrial control protocol identification

[0073] Industrial control protocol identification can employ one or more of the following features in combination: port features, message format features, and session behavior features.

[0074] (2) Request-response matching and master-slave role identification

[0075] For the identified industrial control protocol flow, extract the transaction association fields (such as transaction identifier, sequence number, call number, or equivalent matching key) according to the "request-response" structure, and pair the request with the response. For a pair of nodes... At the window Internal statistics:

[0076] (5)

[0077] (6)

[0078] in, Indicates the first Nodes within a time window To the node The number of industrial control protocol request messages sent. Indicates the first Nodes within a time window To the node The number of industrial control protocol request messages sent. If a stable [system / mechanism] exists... Send a request The structure of the response will then Mark as a candidate for main site Label them as candidate slave stations and generate semantic candidate edges. .

[0079] Define master-slave confidence:

[0080] (7)

[0081] in, Represents a node Relative to node Master-slave confidence index To prevent the denominator from being zero, a zero constant is used. This indicates the threshold for determining master-slave relationships. When... Furthermore, when the success rate of request-response pairing reaches a threshold, the master-slave relationship is considered to be established within that window.

[0082] (3) Periodic evidence extraction

[0083] For the same master-slave candidate pair Request timestamp sequence Calculate adjacent intervals Define periodic stability:

[0084] (8)

[0085] in, Represents a node With nodes The coefficient of variation of the communication time interval is used to measure the stability of the communication cycle. The mean, Standard deviation This indicates a periodic threshold for judgment. If so, the relationship is considered to have periodic communication characteristics and is used as an enhancement of business semantic features.

[0086] Step S6: Multi-source evidence fusion and basic communication topology construction:

[0087] The candidate sets of Layer 2 adjacency relationships, Layer 3 logical connection relationships, and business semantic relationships are fused together. Through consistency analysis and conflict resolution mechanisms, the basic communication topology is obtained. When second-level evidence, third-level evidence, and business semantic evidence give inconsistent conclusions regarding the same node relationship, the node relationship is confirmed or excluded based on the stability of each type of evidence across multiple time windows. The confirmation condition is: only when the same node relationship is repeatedly observed within multiple time windows is the node relationship confirmed as a connection relationship in the basic communication topology. The specific steps are as follows:

[0088] (1) Multi-window stability statistics

[0089] In continuous Define relationships within a time window. The appearance indication:

[0090] (9)

[0091] in, Indicate the type of evidence. These represent second-level evidence, third-level evidence, and business semantic evidence, respectively. Indicates the first Within a time window, the evidence type The inferred set of candidate connections Representing relations In the time window The presence of the indicator variable in the text.

[0092] Define the stability of each source of evidence:

[0093] (10)

[0094] in, This represents the total number of time windows for the statistics. Indicate the type of evidence Relationship between nodes The stability of the relationship is used to measure how frequently the relationship persists across multiple time windows.

[0095] (2) Calculation of fusion confidence

[0096] The fusion confidence level can be calculated:

[0097] (11)

[0098] in, Represents a node With nodes The fusion confidence of the connections between them. This indicates that the second layer of evidence relates to the relationship. stability, This indicates three layers of evidence regarding the relationship. stability, Represents business semantic evidence pairs of relations stability, These represent the weighting coefficients of different evidence sources, used to reflect the importance of different pieces of evidence in the fusion calculation. and , This represents the fusion confidence threshold, when At that time, Confirm the connection relationship in the basic communication topology; otherwise, exclude it.

[0099] (3) Conflict resolution rules

[0100] When the Layer 2 and Layer 3 candidates do not agree on the same relationship, one of the following processing methods is preferred: if the business semantic evidence exists stably, it is retained and enters the basic topology; if only Layer 3 exists but Layer 2 does not exist for a long time, and the relationship shows cross-network segment characteristics, it is retained as a Layer 3 logical connection; if only Layer 2 exists but Layer 3 does not exist for a long time, and the communication strength is extremely low, it is regarded as a candidate of the same domain but does not enter the basic communication topology.

[0101] Step S7: Topology modeling oriented towards industrial control business semantics:

[0102] The basic communication topology constructed in step S6 Based on business semantic evidence, industrial control business semantic modeling is performed on network nodes and inter-node connections in the basic communication topology. Roles are labeled for network nodes, and business relationship types are labeled for inter-node connections, generating a topology model oriented towards industrial control business semantics. , used to characterize the control structure relationship in the industrial control system; the industrial control business semantic modeling includes the following: (1) based on communication direction and business semantic evidence, determine the role of network nodes and label them as master nodes or slave nodes; (2) based on the communication behavior characteristics between nodes, semantically label the connection relationship between network nodes and label the connection relationship as a control relationship or a data interaction relationship. The specific steps are as follows:

[0103] (1) Node role labeling

[0104] For nodes Define the main site score:

[0105] (12)

[0106] in, Represents a node The set of adjacent nodes, that is, the nodes in the basic communication topology. A set of nodes that are connected. and Represents the nodes under business semantic evidence Pointing to node With nodes Pointing to node Relationship stability Represents a node Master-slave role score, used to measure the node The degree of dominance in communication relationships This indicates the threshold for determining the role of a node. Then the node Mark the main site node; If it is, then it is marked as a slave node; otherwise, it is an undefined role node, which can be further corrected in subsequent windows.

[0107] (2) Semantic annotation of connection relationship

[0108] For basic topological edges If a stable request-response structure exists and Main site, If it is a slave station, then it will If the communication is mainly in the form of data reporting / publish / subscribe (which can be determined by protocol semantics or directional indicators), then it is marked as a data interaction relationship.

[0109] Step S8: Output the topology representation result:

[0110] Output topology representation results oriented towards industrial control business semantics. Output content includes, but is not limited to: node set. Edge set Control relationship subgraph and data interaction subgraph.

Claims

1. A network topology inference method based on multi-source passive evidence fusion for industrial control systems, characterized in that... The method includes the following steps: Step S1: Passively collect industrial control network communication data: Without injecting any probe request messages, control commands, or management query messages into the industrial control network, the communication data naturally generated in the industrial control network is passively collected through bypass listening. Step S2, Communication Data Preprocessing: The communication data collected in step S1 is preprocessed; Step S3: Second-level evidence extraction and generation of the second-level adjacency candidate set: Based on the communication data preprocessed in step S2, second-level evidence representing the link-layer connectivity of network nodes is extracted, and a candidate set of second-level adjacency relationships is generated based on the second-level evidence. ; Step S4: Three-layer evidence extraction and generation of the three-layer logical connection candidate set: Based on the communication data preprocessed in step S2, three layers of evidence characterizing the network layer communication relationships of network nodes are extracted, and a candidate set of three-layer logical connection relationships is generated based on the three layers of evidence. ; Step S5: Industrial Control Protocol Identification and Business Semantic Evidence Extraction: The preprocessed communication data from step S2 is subjected to industrial control protocol identification, and the identified industrial control protocol messages are parsed. By parsing the transaction identifier, function code, sequence number, or call number fields in the industrial control protocol messages, business semantic evidence related to industrial control services is extracted, and a candidate set of business semantic relationships is generated based on the business semantic evidence. ; Step S6: Multi-source evidence fusion and basic communication topology construction: The candidate sets of Layer 2 adjacency relationships, Layer 3 logical connection relationships, and business semantic relationships are fused together, and the basic communication topology is obtained through consistency analysis and conflict resolution mechanisms. ; Step S7: Topology modeling oriented towards industrial control business semantics: The basic communication topology constructed in step S6 Based on business semantic evidence, industrial control business semantic modeling is performed on network nodes and inter-node connections in the basic communication topology. Roles are labeled for network nodes, and business relationship types are labeled for inter-node connections, generating a topology model oriented towards industrial control business semantics. ; Step S8: Output the topology representation result: Output the topology representation results oriented towards industrial control business semantics.

2. The network topology inference method for multi-source passive evidence fusion in industrial control systems according to claim 1, characterized in that... In step S1, bypass monitoring is achieved through the mirror port of the switch or an equivalent bypass acquisition point, and the industrial control network communication data includes at least link layer data frames and network layer data packets.

3. The network topology inference method for multi-source passive evidence fusion in industrial control systems according to claim 1, characterized in that... In step S2, preprocessing includes time synchronization of communication data, data organization, and filtering of communication data unrelated to industrial control services. The specific steps are as follows: (1) Time alignment and windowing: The continuous flow rate is divided into fixed time windows, with the time window length set as follows: , No. Each window is ; (2) Data integration and session reconstruction: According to the five-tuple Aggregate data packets to form a session collection. ,in, These are the source IP, destination IP, source port, destination port, and protocol type, respectively. (3) Irrelevant communication filtering: Filter background communications that are irrelevant to industrial control operations to reduce the impact of noise on communication frequency and periodicity.

4. The network topology inference method for multi-source passive evidence fusion in industrial control systems according to claim 1, characterized in that... The specific steps of step S3 are as follows: (1) Extraction of ARP mapping evidence Parse the ARP message to extract the MAC addresses of the ARP requester and responder. Build IP-MAC mapping set within a time window And generate second-level adjacency candidate relationships, preferably including "terminal-gateway" candidates: if a node If multiple ARP requests are initiated against different destination IPs within a window, and the target MAC addresses in their ARP responses show a stable and concentrated pattern, then the node corresponding to that MAC address is recorded as a potential gateway node. Forming two layers of candidate edges ; (2) Evidence of co-occurrence in broadcast domain The reception / visibility characteristics of the same broadcast message type are statistically analyzed to form a "co-occurrence" relationship, which is used to help determine the set of nodes within the same Layer 2 domain.

5. The network topology inference method for multi-source passive evidence fusion in industrial control systems according to claim 1, characterized in that... The specific steps of step S4 are as follows: (1) Conversation direction and frequency statistics For each node In the time window Internal statistical communication direction and frequency: （1） （2） in, Represents nodes in the network. Indicates the time window number; Define the strength of bidirectional communication: （3） in, Represents a node With nodes In the time window The bidirectional communication strength within the node is used to measure the overall communication activity between two nodes. This represents the communication strength threshold, used to determine whether there are candidate connections between nodes. At that time, candidate connection relationships are generated. ; (2) Directional indicators To assist in subsequent master-slave determination and control relationship identification, directionality is defined: （4） in, Represents a node With nodes In the time window The communication directionality index within the node is used to characterize the degree of directional bias in communication traffic between two nodes. To prevent zero constant.

6. The network topology inference method for multi-source passive evidence fusion for industrial control systems according to claim 1, characterized in that... The specific steps of step S5 are as follows: (1) Industrial control protocol identification Industrial control protocol identification uses one or more of the following features in combination: port features, message format features, and session behavior features; (2) Request-response matching and master-slave role identification For the identified industrial control protocol flow, extract the transaction association fields according to the "request-response" structure, and for a pair of nodes... At the window Internal statistics: （5） （6） in, Indicates the first Nodes within a time window To the node The number of industrial control protocol request messages sent. Indicates the first Nodes within a time window To the node The number of industrial control protocol request messages sent, if there is a stable Send a request The structure of the response will then Mark as a candidate for main site Label them as candidate slave stations and generate semantic candidate edges. ; Define master-slave confidence: （7） in, Represents a node Relative to node Master-slave confidence index To prevent zero constant, This indicates the threshold for determining the master-slave relationship. Furthermore, when the request-response pairing success rate reaches the threshold, the master-slave relationship is considered to be established within that window. (3) Periodic evidence extraction For the same master-slave candidate pair Request timestamp sequence Calculate adjacent intervals Define periodic stability: （8） in, Represents a node With nodes The coefficient of variation of the communication time interval is used to measure the stability of the communication cycle. The mean, Standard deviation, This indicates a periodic threshold for judgment. If so, the relationship is considered to have periodic communication characteristics and is used as an enhancement of business semantic features.

7. The network topology inference method for multi-source passive evidence fusion for industrial control systems according to claim 1, characterized in that... In step S6, when the second-level evidence, third-level evidence, and business semantic evidence give inconsistent conclusions about the same node relationship, the node relationship is confirmed or excluded based on the stability of each type of evidence in multiple time windows. The confirmation condition is: the node relationship is confirmed as a connection relationship in the basic communication topology only when the same node relationship is repeatedly observed in multiple time windows.

8. The network topology inference method for multi-source passive evidence fusion for industrial control systems according to claim 1, characterized in that... The specific steps of step S6 are as follows: (1) Multi-window stability statistics In continuous Define relationships within a time window. The appearance indication: （9） in, Indicate the type of evidence. These represent second-level evidence, third-level evidence, and business semantic evidence, respectively. Indicates the first Within a time window, the evidence type The inferred set of candidate connections Representing relations In the time window The presence of indicator variables in; Define the stability of each source of evidence: （10） in, This represents the total number of time windows for the statistics. Indicate the type of evidence Relationship between nodes The stability of the relationship is used to measure how frequently the relationship persists across multiple time windows; (2) Calculation of fusion confidence Calculate the fusion confidence score: （11） in, Represents a node With nodes The fusion confidence of the connections between them. This indicates that the second layer of evidence relates to the relationship. stability, This indicates three layers of evidence regarding the relationship. stability, Represents business semantic evidence pairs of relations stability, These represent the weighting coefficients of different evidence sources, used to reflect the importance of different pieces of evidence in the fusion calculation. and , This represents the fusion confidence threshold, when At that time, Confirm the connection relationships within the basic communication topology; otherwise, exclude them. (3) Conflict resolution rules When the Layer 2 and Layer 3 candidates do not agree on the same relationship, one of the following approaches shall be adopted: if the business semantic evidence is stable, it shall be retained and included in the basic topology; if only Layer 3 exists but Layer 2 does not exist for a long time, and the relationship exhibits cross-network segment characteristics, it shall be retained as a Layer 3 logical connection; if only Layer 2 exists but Layer 3 does not exist for a long time, and the communication strength is extremely low, it shall be regarded as a candidate of the same domain but not included in the basic communication topology.

9. The network topology inference method for multi-source passive evidence fusion in industrial control systems according to claim 1, characterized in that... The specific steps of step S7 are as follows: (1) Node role labeling For nodes Define the main site score: （12） in, Represents a node The set of adjacent nodes, that is, the nodes in the basic communication topology. A set of nodes that are connected. and Represents the nodes under business semantic evidence Pointing to node With nodes Pointing to node Relationship stability Represents a node Master-slave role score, used to measure the node The degree of dominance in communication relationships This indicates the threshold for determining the role of a node. Then the node Mark the main site node; If it is, then it is marked as a slave node; otherwise, it is an undetermined role node, which can be further corrected in subsequent windows. (2) Semantic annotation of connection relationship For basic topological edges If a stable request-response structure exists and Main site, If it is a slave station, then it will If the communication is mainly in the form of data reporting / publish / subscribe, it is marked as a data interaction relationship.

Images