Abnormal intelligent detection method based on electronic information control link

Abstract

This invention discloses an intelligent anomaly detection method based on electronic information control links, belonging to the field of electronic information control link detection technology. It includes constructing a dynamic information entropy field for the entire network based on the control command sequence by fusing semantic, temporal, and topological three-dimensional entropy values. This invention achieves comprehensive detection from single-point anomalies to coordinated attacks through a complete process system including constructing a multi-dimensional dynamic information entropy field, establishing an entropy decay benchmark model, mining cross-link entropy oscillation coupling correlation graphs, extracting abnormal oscillation modes, calculating entropy trajectory deviation, generating comprehensive anomaly confidence and root cause hypotheses, and implementing closed-loop optimization strategies. Through innovative methods such as multi-dimensional entropy value fusion, dynamic benchmark modeling, cross-link correlation analysis, and intent-execution trajectory comparison, it significantly improves the accuracy of anomaly detection, reduces the false alarm rate, and can proactively adapt to new attack patterns.

Description

Technical Field

[0001] This invention belongs to the field of electronic information control link detection technology, specifically referring to an intelligent anomaly detection method based on electronic information control links. Background Technology

[0002] With the deep evolution of key cyber-physical systems such as the Industrial Internet, smart grids, rail transit, and aerospace, electronic information control links have become the core neural network of modern complex control systems. Their typical architecture consists of application layer instruction generation, communication layer protocol scheduling, and physical layer node execution, exhibiting characteristics such as strong temporality, high coupling, multi-hop topology, and semantic drive. In this type of system, control instructions are transmitted hop by hop in the form of opcode sequences, and closed-loop control is completed through routing, node parsing, and action execution.

[0003] However, existing intelligent detection methods for anomalies in electronic information control links still have certain shortcomings. Existing technologies rely on static thresholds or simple rules, which cannot adapt to dynamic changes in network load, leading to a large number of normal fluctuations being misjudged as anomalies. They only analyze the entropy value of a single link, ignoring the oscillation coupling relationship between links, and cannot detect the covert attack patterns of attackers coordinating multiple links. They only monitor the physical layer execution status and do not associate it with the application layer control intent, resulting in the inability to accurately identify attacks such as malicious command injection. They use fixed benchmark models, which cannot be dynamically adjusted with changes in network topology or traffic, causing the detection sensitivity to decrease with environmental changes. Therefore, an intelligent detection method for anomalies based on electronic information control links is proposed. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent anomaly detection method based on electronic information control links to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: an intelligent anomaly detection method based on electronic information control links, comprising the following steps:

[0006] S1. Based on the sequence of control commands, construct the dynamic information entropy field of the entire network by fusing semantic, temporal, and topological three-dimensional entropy values;

[0007] S2. Based on the dynamic information entropy field, an entropy decay benchmark model for a single link is established by analyzing historical normal data.

[0008] S3. Combining the dynamic information entropy field and the entropy decay benchmark model, the cross-link entropy oscillation coupling correlation diagram is mined by calculating the time-frequency coherence of the entropy sequence.

[0009] S4. Based on the cross-link entropy oscillation coupling correlation graph, abnormal oscillation patterns are extracted by defining and searching for specific patterns;

[0010] S5. By integrating the entropy decay benchmark model and the extracted abnormal oscillation mode, the deviation of the entropy trajectory between the application layer intent and the physical layer execution is calculated by comparing the reverse entropy trajectory of the application layer intent and the physical layer execution.

[0011] S6. Integrate the single-link entropy propagation distortion index, abnormal oscillation mode and entropy trajectory deviation to generate a comprehensive anomaly confidence and root cause hypothesis.

[0012] S7. Optimize based on the generated anomaly confidence and confirmed anomaly events.

[0013] Preferably, in step S1, a complete control command sequence is extracted from the control system, including the opcode, timestamp, source node identifier, and destination node identifier for each command. The command sequence is then time-aligned and its integrity is checked. Based on the network topology, all nodes participating in the control and their interactions are identified. The distribution of opcodes in the command sequence is extracted, the frequency of each opcode within a time window is statistically analyzed, and the relative frequency P(op) of each opcode within the window is calculated. The semantic dimension entropy value is then calculated using information entropy. Extract the time intervals between consecutive instructions in the instruction sequence, construct the time interval distribution, calculate the relative frequency P(t) of each time interval, and calculate the temporal dimension entropy value through information entropy. By fusing semantic entropy and temporal entropy, the following can be achieved:

[0014] ,

[0015] In the formula, Let represent the semantic-temporal coupling entropy, e represent the base of the natural logarithm, and k represent the temporal sensitivity coefficient. This indicates the time interval between the current instruction and the previous instruction. This represents the normal timing reference value.

[0016] Preferably, in step S1, the interaction pairs between the source node and the destination node are extracted from the instruction sequence, a node interaction relationship matrix is ​​constructed, the relative frequency of interaction between each pair of nodes is calculated, and the topological entropy is calculated using information entropy, thus achieving the following:

[0017] ,

[0018] In the formula, This represents the decaying topological entropy, specifically the decaying topological entropy of the nth hop node. Let represent the original topological entropy of the nth hop node, where n represents the number of network hops. Indicates the distance attenuation coefficient. This represents the distance from the i-th hop node to the source node. Indicates the maximum number of hops in the network. This represents the multiplication of decay factors from the 1st hop to the nth hop;

[0019] Arrange the dynamic information entropy vectors of all time windows in chronological order to form a time series, and construct the dynamic information entropy field of the entire control network, as follows:

[0020] ,

[0021] In the formula, This represents the dynamic information entropy field, where i represents the time dimension index, j represents the node dimension index, and k represents the hop count dimension index. This represents the penalty coefficient for the difference in rate of change. The temporal derivative of semantic-temporal coupling entropy. This represents the time derivative of the decaying topological entropy, which is the rate of change of the topological entropy.

[0022] Preferably, in step S2, a large amount of normally operating control link data is extracted from the historical database of the control system, the control command sequence of each link is time-aligned, and the entropy value sequence of the link at different time points is extracted from the dynamic information entropy field. Let the distance attenuation factor be... Construct an entropy decay baseline model, which is implemented as follows:

[0023] ,

[0024] In the formula, This represents the baseline entropy value of the nth hop node in the entropy decay baseline model. This represents the distance from the nth hop node to the source node. Maximum number of hops in the network This represents the distance attenuation coefficient, and T represents the number of time windows.

[0025] Preferably, in step S3, a dynamic information entropy field is obtained, and from the dynamic information entropy field, the entropy value sequence of each independent control link is extracted. The reference entropy sequence of the link is obtained from the entropy decay reference model. For each pair of control links, the time-frequency coherence is calculated, and the result is implemented as follows:

[0026] ,

[0027] In the formula, This represents the time-frequency coherence between link i and link j at frequency f and time t. Indicates Fourier transform, This represents the sequence of deviations between the actual entropy value and the reference entropy value of the link. for .

[0028] Preferably, in step S3, time-frequency coherence is obtained, each control link is a node in the cross-link entropy oscillation coupling correlation graph, an initial cross-link entropy oscillation coupling correlation graph is constructed, and a comprehensive correlation weight is calculated for each pair of links, as follows:

[0029] ,

[0030] In the formula, This represents the coupling weight between link i and link j. These represent the minimum and maximum frequencies, respectively. This represents the phase difference between link i and link j at frequency f and time t. The time window length is represented by df, the frequency derivative element is represented by dt, and the time derivative element is represented by dt. A preset coherence threshold is used to filter weakly correlated link pairs.

[0031] Preferably, in step S4, based on the cross-link entropy oscillation coupling correlation diagram, three core anomaly modes are pre-defined with quantification standards:

[0032] Entropy-locked oscillation: requires inter-link coupling weights The phase difference is greater than the preset threshold, and the oscillation frequency continues to exceed the preset period within the typical control frequency range.

[0033] Entropy reflection oscillation: requires inter-link coupling weights The difference is greater than the preset threshold and the phase difference is reversed;

[0034] Entropy attractor mutation: requires that the connectivity of a node suddenly increases beyond a preset value within a time window, and its oscillation mode dominates the phase change of surrounding nodes;

[0035] Traverse all possible subsets of nodes in the association graph and apply pattern feature matching:

[0036] For entropy-locked oscillations: detect fully connected subgraphs where all edges satisfy the in-phase condition;

[0037] For entropy reflection oscillations: detect link pairs containing "mirror pairs";

[0038] For entropy attractor mutations: identify the central node of the connectivity mutation and analyze its phase propagation path with neighboring nodes;

[0039] A sliding window is used on the time series to detect the persistence and evolution trend of the pattern, check whether the matching pattern is consistent with the entropy decay benchmark model, and extract the abnormal oscillation pattern for each detected pattern, and assign a unique identifier to each abnormal oscillation pattern.

[0040] Preferably, in step S5, core intent information is extracted from the application layer control instruction sequence; a semantic entropy sequence is calculated based on the opcode distribution; an intent entropy trajectory is constructed using semantic dimension entropy values ​​to reflect the entropy state of the expected control behavior; actual execution information is extracted from physical layer feedback data; and the execution entropy trajectory is inferred based on a dynamic information entropy field to reflect the entropy state of the actual control link. The inferred results are calibrated using an entropy decay benchmark model to eliminate interference from normal entropy decay; and the extracted abnormal oscillation mode is used as a correction factor for trajectory matching, providing adjustment strategies for different modes.

[0041] If entropy reflection oscillation is detected: during trajectory alignment, the trajectory will be shifted by phase lag time to match the expected timing of the intended trajectory;

[0042] If entropy-locked oscillations are detected: when comparing trajectories, increase the weight of in-phase oscillation regions to avoid misjudging them as anomalies;

[0043] If an entropy attractor mutation is detected: focus on the entropy oscillation of the core node and adjust the local weights of trajectory matching;

[0044] By dynamically warping the intended trajectory and the adjusted execution trajectory, and then weighting and calculating the overall deviation, the following is achieved:

[0045] ,

[0046] In the formula, Indicates the deviation of the entropy trajectory. This indicates the application layer intent entropy deviation. This indicates the physical layer execution entropy deviation. This represents the standard deviation of the fluctuation in the entropy decay benchmark model. Indicates the amplitude intensity of the abnormal oscillation mode. This represents the sensitivity coefficient for abnormal patterns.

[0047] Preferably, in step S6, the entropy propagation distortion index of each control link is obtained, the confirmed abnormal oscillation modes and their key parameters are extracted, the entropy trajectory deviation and time series are obtained, all data are aligned by timestamp, weights are dynamically allocated based on the historical abnormal case library, the comprehensive abnormal confidence level is calculated for each time point, and the root cause hypothesis is generated based on the input pattern.

[0048] High-entropy propagation distortion, no abnormal oscillation, and high-entropy trajectory deviation: assumed to be a single-link configuration error;

[0049] High-entropy propagation distortion, entropy reflection oscillation, and high-entropy trajectory deviation: these are assumed to be malicious instruction injection.

[0050] Low-entropy propagation distortion, entropy lockout oscillation, and low-entropy trajectory deviation: assumed to be network congestion;

[0051] High-entropy propagation distortion, entropy attractor mutation, and high-entropy trajectory deviation: assumed to be due to the hijacking of core nodes;

[0052] Sort by similarity to historical case studies.

[0053] Preferably, in step S7, events with a confidence level greater than or equal to a preset threshold are selected from the output root cause hypotheses. A predefined optimization strategy library is established, corresponding to the root cause hypotheses. For high-impact events, a minimum impact strategy is adopted. If the entropy propagation distortion index decreases more than the preset threshold after optimization, the current strategy is retained. If the effect is not significant, the backup scheme in the strategy library is triggered. If the entropy decay benchmark model in step S2 undergoes a systematic change after optimization, the entropy decay benchmark model is retrained. The optimized new data is input into step S1 in real time to generate an updated dynamic information entropy field.

[0054] Compared with the prior art, the beneficial effects of the present invention are:

[0055] 1. This invention achieves comprehensive detection from single-point anomalies to collaborative attacks by constructing a multi-dimensional dynamic information entropy field, establishing an entropy decay benchmark model, mining cross-link entropy oscillation coupling correlation graphs, extracting abnormal oscillation modes, calculating entropy trajectory deviation, generating comprehensive anomaly confidence and root cause hypothesis, and implementing a closed-loop optimization strategy throughout the entire process. Through innovative methods such as multi-dimensional entropy value fusion, dynamic benchmark modeling, cross-link correlation analysis, and intent-execution trajectory comparison, it significantly improves the accuracy of anomaly detection, reduces the false alarm rate, and can proactively adapt to new attack modes.

[0056] 2. This invention calculates the time-frequency coherence of link entropy deviation using Fourier transform to accurately capture cross-link oscillation modes; it distinguishes between in-phase and out-of-phase oscillations by calculating phase difference, revealing the coordinated patterns manipulated by attackers rather than simple strength correlations; it constructs an association graph with links as nodes and coherence as edges to visualize cross-link oscillation coupling relationships; and it eliminates weakly correlated links by setting pre-defined coherence thresholds and phase relationship annotations, ensuring that the association graph focuses on real abnormal modes and reducing the risk of false alarms.

[0057] 3. This invention defines and searches for specific abnormal oscillation patterns, clarifies the quantification conditions of three core patterns—entropy lock-up, entropy reflection, and entropy attractor mutation—and makes pattern detection computable; by traversing subsets of the association graph and a time sliding window, it detects the persistence and evolution trend of patterns in real time, avoiding the lag of static rule matching; and by combining an entropy decay benchmark model to exclude normal coupling patterns, it ensures that only real attack features are retained, thus improving the reliability of pattern detection.

[0058] 4. This invention generates an intent entropy trajectory by distributing the opcodes of application layer instructions, reflecting the expected control behavior and providing a benchmark for physical layer execution; it calibrates the execution entropy trajectory by combining a dynamic information entropy field and an entropy decay benchmark model, eliminating normal decay interference and accurately locating abnormal execution points; it adjusts the trajectory alignment strategy for different abnormal oscillation modes to avoid misjudging them as normal fluctuations; and it aligns the intent and execution trajectory through a dynamic time warping algorithm, comprehensively evaluating amplitude, phase, and time consistency, significantly improving the accuracy of deviation calculation. Attached Figure Description

[0059] Figure 1 The following is the operation flow of the intelligent anomaly detection method based on electronic information control link of the present invention. Figure 1 ;

[0060] Figure 2 The following is the operation flow of the intelligent anomaly detection method based on electronic information control link of the present invention. Figure 2 ;

[0061] Figure 3 The following is the operation flow of the intelligent anomaly detection method based on electronic information control link of the present invention. Figure 3 ;

[0062] Figure 4 The following is the operation flow of the intelligent anomaly detection method based on electronic information control link of the present invention. Figure 4 . Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] Example

[0065] Please see Figures 1-4 As shown, the present invention provides a technical solution comprising the following steps:

[0066] S1. Based on the sequence of control commands, construct the dynamic information entropy field of the entire network by fusing semantic, temporal, and topological three-dimensional entropy values;

[0067] S2. Based on the dynamic information entropy field, an entropy decay benchmark model for a single link is established by analyzing historical normal data.

[0068] S3. Combining the dynamic information entropy field and the entropy decay benchmark model, the cross-link entropy oscillation coupling correlation diagram is mined by calculating the time-frequency coherence of the entropy sequence.

[0069] S4. Based on the cross-link entropy oscillation coupling correlation graph, abnormal oscillation patterns are extracted by defining and searching for specific patterns;

[0070] S5. By integrating the entropy decay benchmark model and the extracted abnormal oscillation mode, the deviation of the entropy trajectory between the application layer intent and the physical layer execution is calculated by comparing the reverse entropy trajectory of the application layer intent and the physical layer execution.

[0071] S6. Integrate the single-link entropy propagation distortion index, abnormal oscillation mode and entropy trajectory deviation to generate a comprehensive anomaly confidence and root cause hypothesis.

[0072] S7. Optimize based on the generated anomaly confidence and confirmed anomaly events.

[0073] In this embodiment, in step S1, a complete control instruction sequence is extracted from the control system, including the opcode, timestamp, source node identifier, and destination node identifier for each instruction. The instruction sequence is time-aligned and its integrity is checked. Based on the network topology, all nodes involved in the control and their interaction relationships are identified. The distribution of opcodes in the instruction sequence is extracted, the frequency of each opcode within the time window is counted, and the relative frequency P(op) of each opcode within the window is calculated, where P(op) = number of opcode occurrences / total number of instructions within the window.

[0074] Specifically, semantic dimension entropy is calculated using information entropy. , for Extract the time intervals between consecutive instructions in the instruction sequence, construct the time interval distribution, and calculate the relative frequency P(t) of each time interval. P(t) = number of interval occurrences / total number of instruction intervals within the window. Calculate the temporal dimension entropy value using information entropy. , for , Represents the logarithm to the base 2; by fusing semantic entropy and temporal entropy, it is achieved as follows:

[0075] ,

[0076] In the formula, Let represent the semantic-temporal coupling entropy, e represent the base of the natural logarithm, and k represent the temporal sensitivity coefficient. This indicates the time interval between the current instruction and the previous instruction. This represents the normal timing reference value.

[0077] In this embodiment, in step S1, the interaction pairs between the source node and the destination node are extracted from the instruction sequence, a node interaction relationship matrix is ​​constructed, the relative frequency of interaction between each pair of nodes is calculated, and the topological entropy is calculated using information entropy. This is achieved as follows:

[0078] ,

[0079] In the formula, This represents the decaying topological entropy, specifically the decaying topological entropy of the nth hop node. Let represent the original topological entropy of the nth hop node, represent the uncertainty of interactions between nodes, and n represent the number of network hops. Indicates the distance attenuation coefficient. This represents the distance from the i-th hop node to the source node. Represents the maximum number of hops in the network, and represents the farthest distance in the entire network. This indicates the multiplication of attenuation factors from the 1st hop to the nth hop, represented by the multiplication symbol.

[0080] Specifically, the dynamic information entropy vectors of all time windows are arranged in chronological order to form a time series, and the dynamic information entropy field of the entire control network is constructed as follows:

[0081] ,

[0082] In the formula, This represents the dynamic information entropy field, where i represents the time dimension index, j represents the node dimension index, and k represents the hop count dimension index. This represents the penalty coefficient for the difference in rate of change. The temporal derivative of semantic-temporal coupling entropy, and the rate of change of semantic-temporal entropy. This represents the time derivative of the decaying topological entropy, which is the rate of change of the topological entropy.

[0083] In this embodiment, in step S2, a large amount of normally operating control link data is extracted from the historical database of the control system, the control command sequence of each link is time-aligned, and the entropy value sequence of the link at different time points is extracted from the dynamic information entropy field.

[0084] Specifically, as the number of hops in the link increases, the entropy value should exhibit a natural decay trend. Let the distance decay factor be... Construct an entropy decay baseline model, which is implemented as follows:

[0085] ,

[0086] In the formula, This represents the baseline entropy value of the nth hop node in the entropy decay baseline model. This represents the distance from the nth hop node to the source node. Maximum number of hops in the network This represents the distance attenuation coefficient, and T represents the number of time windows.

[0087] In this embodiment, in step S3, a dynamic information entropy field is obtained, and from the dynamic information entropy field, the entropy value sequence of each independent control link is extracted. The reference entropy sequence of the link is obtained from the entropy decay reference model. For each pair of control links, the time-frequency coherence is calculated, and the result is implemented as follows:

[0088] ,

[0089] In the formula, This represents the time-frequency coherence between link i and link j at frequency f and time t. Indicates Fourier transform, This represents the sequence of deviations between the actual entropy value and the reference entropy value of the link. for .

[0090] In this embodiment, in step S3, time-frequency coherence is obtained, each control link is a node in the cross-link entropy oscillation coupling correlation graph, an initial cross-link entropy oscillation coupling correlation graph is constructed, and a comprehensive correlation weight is calculated for each pair of links, which is implemented as follows:

[0091] ,

[0092] In the formula, This represents the coupling weight between link i and link j. These represent the minimum and maximum frequencies, respectively. This represents the phase difference between link i and link j at frequency f and time t. The time window length is represented by df, the frequency differential element is represented by dt, and the time differential element is represented by dt. A coherence threshold is preset to filter weakly correlated link pairs and to add phase relationship information to each edge to represent the synchronization phase of the oscillation between links.

[0093] In this embodiment, in step S4, based on the cross-link entropy oscillation coupling correlation graph, three core anomaly modes are pre-defined with quantification standards:

[0094] Entropy-locked oscillation: requires inter-link coupling weights The phase difference is greater than the preset threshold, and the oscillation frequency continues to exceed the preset period within the typical control frequency range.

[0095] Entropy reflection oscillation: requires inter-link coupling weights The difference is greater than the preset threshold and the phase difference is reversed;

[0096] Entropy attractor mutation: requires that the connectivity of a node suddenly increases beyond a preset value within a time window, and its oscillation mode dominates the phase change of surrounding nodes;

[0097] Traverse all possible subsets of nodes in the association graph and apply pattern feature matching:

[0098] For entropy-locked oscillations: detect fully connected subgraphs where all edges satisfy the in-phase condition;

[0099] For entropy reflection oscillations: detect link pairs containing "mirror pairs";

[0100] For entropy attractor mutations: identify the central node of the connectivity mutation and analyze its phase propagation path with neighboring nodes;

[0101] Specifically, a sliding window is used on the time series to detect the persistence and evolution trend of the pattern, check whether the matching pattern is consistent with the entropy decay benchmark model, and extract the abnormal oscillation pattern for each detected pattern, assigning a unique identifier to each abnormal oscillation pattern.

[0102] In this embodiment, in step S5, core intent information is extracted from the application layer control instruction sequence, semantic entropy sequence is calculated based on opcode distribution, and intent entropy trajectory is constructed through semantic dimension entropy value to reflect the entropy state of expected control behavior. Actual execution information is extracted from physical layer feedback data.

[0103] Specifically, based on the dynamic information entropy field, the execution entropy trajectory is inferred to reflect the entropy state of the actual control link. The inferred results are calibrated using an entropy decay benchmark model to eliminate interference from normal entropy decay. Extracted abnormal oscillation modes are used as correction factors for trajectory matching, and adjustment strategies are applied to different modes.

[0104] If entropy reflection oscillation is detected: during trajectory alignment, the trajectory will be shifted by phase lag time to match the expected timing of the intended trajectory;

[0105] If entropy-locked oscillations are detected: when comparing trajectories, increase the weight of in-phase oscillation regions to avoid misjudging them as anomalies;

[0106] If an entropy attractor mutation is detected: focus on the entropy oscillation of the core node and adjust the local weights of trajectory matching;

[0107] Specifically, by dynamically warping the intended trajectory and the adjusted execution trajectory, and then calculating the weighted overall deviation, the following is achieved:

[0108] ,

[0109] In the formula, Indicates the deviation of the entropy trajectory. This indicates the application layer intent entropy deviation. for The deviation between the intended entropy value of the application layer and the entropy decay baseline model. This indicates the physical layer execution entropy deviation. for The deviation between the physical layer execution entropy value and the entropy decay baseline model. This represents the standard deviation of the fluctuation in the entropy decay benchmark model. Indicates the amplitude intensity of the abnormal oscillation mode. This represents the sensitivity coefficient for abnormal patterns.

[0110] In this embodiment, in step S6, the entropy propagation distortion index of each control link is obtained, the confirmed abnormal oscillation modes and their key parameters, such as frequency, amplitude, phase difference, and confidence level, are extracted, the entropy trajectory deviation and time series are obtained, all data are aligned by timestamp, weights are dynamically allocated based on the historical abnormal case library, and the comprehensive abnormal confidence level is calculated for each time point.

[0111] Specifically, root cause hypotheses are generated based on input patterns:

[0112] High-entropy propagation distortion, no abnormal oscillation, and high-entropy trajectory deviation: these are assumed to be due to single-link configuration errors, such as improper setting of node timeout thresholds;

[0113] High-entropy propagation distortion, entropy reflection oscillation, and high-entropy trajectory deviation: these are assumed to be malicious instruction injections, such as attackers forging instruction sequences to trigger reflection oscillations.

[0114] Low-entropy propagation distortion, entropy lockout oscillation, and low-entropy trajectory deviation: these are assumed to be caused by network congestion, such as insufficient bandwidth leading to abnormal instruction synchronization.

[0115] High-entropy propagation distortion, entropy attractor mutation, and high-entropy trajectory deviation: assumed to be due to the hijacking of core nodes;

[0116] Sort by similarity to historical case studies.

[0117] In this embodiment, in step S7, events with confidence levels greater than or equal to a preset threshold are selected from the output root cause hypotheses. A predefined optimization strategy library is established, corresponding to the root cause hypotheses. For high-impact events, a minimum impact strategy is adopted. If the entropy propagation distortion index decreases more than the preset threshold after optimization, the current strategy is retained. If the effect is not significant, the backup scheme in the strategy library is triggered. If the entropy decay benchmark model in step S2 undergoes a systematic change after optimization, the entropy decay benchmark model is retrained. The optimized new data is input into step S1 in real time to generate an updated dynamic information entropy field.

[0118] Working principle: By analyzing the opcodes, timestamps, and node interaction relationships in the control instruction sequence, entropy values ​​in three dimensions—semantic, temporal, and topological—are extracted to construct a dynamic information entropy field. The semantic dimension calculates entropy values ​​through the distribution of opcodes to capture semantic anomalies in the instruction sequence. The temporal dimension quantifies the execution rhythm through the frequency distribution of instruction intervals. The topological dimension measures the uncertainty of the network structure through the node interaction relationship matrix. Finally, the three are integrated into a dynamic information entropy field, forming three-dimensional data that changes with time, nodes, and hop count.

[0119] By analyzing historical normal operation data, the entropy decay pattern of a single control link with hop count is analyzed, and an entropy decay benchmark model is established. This model dynamically adapts to changes in the network environment, eliminates interference from normal decay, and accurately identifies entropy distortions caused by abnormal operations or attacks in the link. Combining the dynamic information entropy field and the entropy decay benchmark model, the time-frequency coherence of entropy deviations between links is calculated, revealing cross-link entropy oscillation coupling relationships. Frequency characteristics of link entropy deviations are extracted using Fourier transform, and the synchronization between links is analyzed using phase difference, constructing a cross-link entropy oscillation coupling correlation graph. This graph, with links as nodes and coherence as edges, reveals multi-link cooperative oscillation modes. By comparing the entropy trajectories of application layer intent and physical layer execution, anomalies of intent-execution inconsistency are quantified. Semantic entropy trajectories are extracted from application layer instructions, and execution entropy trajectories are inferred from physical layer feedback, then calibrated using the entropy decay benchmark model. Results: For the extracted abnormal oscillation patterns, the trajectory alignment strategy was adjusted, the trajectory was aligned using a dynamic time warping algorithm, and the deviation was calculated with weights to accurately locate execution anomalies; the single-link entropy propagation distortion index, abnormal oscillation patterns, and entropy trajectory deviation were integrated, and a comprehensive anomaly confidence score was generated through dynamic weight allocation; the input patterns were matched with root cause hypotheses by combining historical anomaly case libraries; the root cause hypotheses were ranked by impact range and historical success rate to provide priority guidance for operation and maintenance decisions, while timestamp alignment ensured the consistency of multi-source data; optimization measures were selected from a predefined strategy library based on the generated high-confidence anomaly events, and the least impact strategy was implemented step by step; the effect was evaluated by monitoring indicators such as the decrease rate of the entropy propagation distortion index, and if the optimization was successful, the strategy was retained; otherwise, a backup plan was triggered; the optimized new data was fed back to S1 in real time to update the dynamic information entropy field and the entropy decay benchmark model.

[0120] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their likenesses.

[0121] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. An intelligent anomaly detection method based on electronic information control links, characterized in that, Includes the following steps: S1. Based on the sequence of control commands, construct the dynamic information entropy field of the entire network by fusing semantic, temporal, and topological three-dimensional entropy values; S2. Based on the dynamic information entropy field, an entropy decay benchmark model for a single link is established by analyzing historical normal data. S3. Combining the dynamic information entropy field and the entropy decay benchmark model, the cross-link entropy oscillation coupling correlation diagram is mined by calculating the time-frequency coherence of the entropy sequence. S4. Based on the cross-link entropy oscillation coupling correlation graph, abnormal oscillation patterns are extracted by defining and searching for specific patterns; S5. By integrating the entropy decay benchmark model and the extracted abnormal oscillation mode, the deviation of the entropy trajectory between the application layer intent and the physical layer execution is calculated by comparing the reverse entropy trajectory of the application layer intent and the physical layer execution. S6. Integrate the single-link entropy propagation distortion index, abnormal oscillation mode and entropy trajectory deviation to generate a comprehensive anomaly confidence and root cause hypothesis. S7. Optimize based on the generated anomaly confidence and confirmed anomaly events.

2. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S1, a complete control command sequence is extracted from the control system. The command sequence undergoes time alignment and integrity checks. Based on the network topology, all nodes involved in the control and their interactions are identified. The distribution of opcodes in the command sequence is extracted, the frequency of each opcode within a time window is statistically analyzed, and the relative frequency P(op) of each opcode within the window is calculated. The semantic dimension entropy value is then calculated using information entropy. Extract the time intervals between consecutive instructions in the instruction sequence, construct the time interval distribution, calculate the relative frequency P(t) of each time interval, and calculate the temporal dimension entropy value through information entropy. By fusing semantic entropy and temporal entropy, the following can be achieved: ， In the formula, Let represent the semantic-temporal coupling entropy, e represent the base of the natural logarithm, and k represent the temporal sensitivity coefficient. This indicates the time interval between the current instruction and the previous instruction. This represents the normal timing reference value.

3. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S1, interaction pairs between the source and destination nodes are extracted from the instruction sequence, a node interaction relationship matrix is ​​constructed, the relative frequency of interaction between each pair of nodes is calculated, and the topological entropy is calculated using information entropy. This process is as follows: ， In the formula, This represents the decaying topological entropy, specifically the decaying topological entropy of the nth hop node. Let represent the original topological entropy of the nth hop node, where n represents the number of network hops. Indicates the distance attenuation coefficient. This represents the distance from the i-th hop node to the source node. Indicates the maximum number of hops in the network. This represents the multiplication of decay factors from the 1st hop to the nth hop; Arrange the dynamic information entropy vectors of all time windows in chronological order to form a time series, and construct the dynamic information entropy field of the entire control network, as follows: ， In the formula, This represents the dynamic information entropy field, where i represents the time dimension index, j represents the node dimension index, and k represents the hop count dimension index. This represents the penalty coefficient for the difference in rate of change. The temporal derivative of semantic-temporal coupling entropy. This represents the time derivative of the decaying topological entropy.

4. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S2, a large amount of normally operating control link data is extracted from the historical database of the control system. The control command sequence of each link is time-aligned, and the entropy value sequence of the link at different time points is extracted from the dynamic information entropy field. The distance attenuation factor is set to... Construct an entropy decay baseline model, which is implemented as follows: ， In the formula, This represents the baseline entropy value of the nth hop node in the entropy decay baseline model. This represents the distance from the nth hop node to the source node. Maximum number of hops in the network This represents the distance attenuation coefficient, and T represents the number of time windows.

5. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S3, a dynamic information entropy field is obtained, and from the dynamic information entropy field, the entropy value sequence of each independent control link is extracted. ; The reference entropy sequence of the link is obtained from the entropy decay reference model. For each pair of control links, the time-frequency coherence is calculated, and the result is implemented as follows: ， In the formula, This represents the time-frequency coherence between link i and link j at frequency f and time t. Indicates Fourier transform, This represents the deviation sequence between the actual entropy value and the reference entropy value of the link.

6. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S3, time-frequency coherence is obtained, each control link is a node in the cross-link entropy oscillation coupling correlation graph, an initial cross-link entropy oscillation coupling correlation graph is constructed, and a comprehensive correlation weight is calculated for each pair of links, as follows: ， In the formula, This represents the coupling weight between link i and link j. These represent the minimum and maximum frequencies, respectively. This represents the phase difference between link i and link j at frequency f and time t. The time window length is represented by df, the frequency derivative element is represented by dt, and the time derivative element is represented by dt. A preset coherence threshold is used to filter weakly correlated link pairs.

7. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In S4, based on the cross-link entropy oscillation coupling correlation diagram, three core abnormal modes are pre-defined with quantification standards, including entropy lock-up oscillation, entropy reflection oscillation, and entropy attractor mutation. Traverse all possible subsets of nodes in the association graph and apply pattern feature matching; A sliding window is used on the time series to detect the persistence and evolution trend of the pattern, check whether the matching pattern is consistent with the entropy decay benchmark model, and extract the abnormal oscillation pattern for each detected pattern, and assign a unique identifier to each abnormal oscillation pattern.

8. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In S5, core intent information is extracted from the application layer control instruction sequence, semantic entropy sequence is calculated based on opcode distribution, intent entropy trajectory is constructed through semantic dimension entropy value, actual execution information is extracted from physical layer feedback data, execution entropy trajectory is inferred based on dynamic information entropy field, inferred result is calibrated through entropy decay benchmark model to eliminate interference from normal entropy decay, and extracted abnormal oscillation mode is called as correction factor for trajectory matching, and adjustment strategy for different modes is applied. By dynamically warping the intended trajectory and the adjusted execution trajectory, and then weighting and calculating the overall deviation, the following is achieved: ， In the formula, Indicates the deviation of the entropy trajectory. This indicates the application layer intent entropy deviation. This represents the standard deviation of the fluctuation in the entropy decay benchmark model. Indicates the amplitude intensity of the abnormal oscillation mode. This represents the sensitivity coefficient for abnormal patterns.

9. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In step S6, the entropy propagation distortion index of each control link is obtained, the confirmed abnormal oscillation modes and their key parameters are extracted, the entropy trajectory deviation and time series are obtained, all data are aligned by timestamp, weights are dynamically allocated based on the historical abnormal case library, the comprehensive abnormal confidence level is calculated for each time point, and the root cause hypothesis is generated based on the input pattern. High-entropy propagation distortion, no abnormal oscillation, and high-entropy trajectory deviation: assumed to be a single-link configuration error; High-entropy propagation distortion, entropy reflection oscillation, and high-entropy trajectory deviation: these are assumed to be malicious instruction injection. Low-entropy propagation distortion, entropy lockout oscillation, and low-entropy trajectory deviation: assumed to be network congestion; High-entropy propagation distortion, entropy attractor mutation, and high-entropy trajectory deviation: assumed to be due to the hijacking of core nodes; Sort by similarity to historical case studies.

10. The anomaly intelligent detection method based on electronic information control link according to claim 1, characterized in that: In S7, among the output root cause hypotheses, events with confidence levels greater than or equal to a preset threshold are selected, and a predefined optimization strategy library is established. Corresponding to the root cause hypotheses, the minimum impact strategy is adopted for high-impact events. If the entropy propagation distortion index decreases more than the preset threshold after optimization, the current strategy is retained. If the effect is not significant, the backup plan in the strategy library is triggered; if the entropy decay benchmark model of S2 changes systematically after optimization, the entropy decay benchmark model is retrained; the optimized new data is input into S1 in real time to generate an updated dynamic information entropy field.

Images