Dcs controller security startup and whole-process authentication method based on trusted computing

Abstract

The application provides a DCS controller security startup and whole-process authentication method based on trusted computing, relates to the field of industrial control system security, and comprises the following steps: performing layer-by-layer integrity measurement on controller startup firmware and software components to generate a layered measurement value set, periodically performing memory checking during operation to generate running measurement values, then calculating deviation measurement and packaging into a dual-state credential. At the same time, the related measurement values are associated to generate an evidence chain through time stamp chain hashing. When communicating between controllers, the credentials and evidence chains are exchanged, the negotiation measurement and adaptive threshold are calculated, the resource allocation ratio is dynamically determined, and the processor time slice and memory space are allocated for the opposite end control instruction according to the ratio and then executed. The application realizes dynamic trusted authentication and resource isolation of the whole life cycle of the controller from startup to operation, and improves the overall security of the DCS system.

Description

Technical Field

[0001] This invention relates to industrial control system security technology, and more particularly to a method for secure startup and full authentication of a DCS controller based on trusted computing. Background Technology

[0002] This invention relates to the field of industrial control system security, specifically to a secure startup and operation authentication technology for controllers in a distributed control system (DCS).

[0003] In industrial control systems, ensuring the integrity and trustworthiness of the controller throughout its entire operation from startup to full operation is crucial for production safety. Existing technologies typically employ a static trusted boot scheme based on trusted computing modules. This scheme, during the controller startup phase, uses a pre-installed root of trust in the hardware to perform step-by-step integrity measurements and verifications on critical firmware and software components such as the bootloader and operating system kernel. Only when the measurement value of the current level meets expectations and passes verification will the next level of code be loaded and executed, thus constructing a static trust chain from the hardware root of trust to the upper-layer applications. This mechanism effectively prevents the loading of tampered malicious firmware or software during the startup phase, establishing an initial trusted execution environment for the system.

[0004] However, the aforementioned conventional approaches have significant limitations. Static trusted startup schemes primarily focus on the trustworthiness of the system at the moment of startup, lacking continuous monitoring and evaluation of the dynamic security status of the controller after it enters the long-term operation phase. Industrial control environments are complex, and controllers may face dynamic threats such as memory data tampering and runtime injection attacks during operation. These threats cannot be prevented through a one-time startup verification. Furthermore, in distributed control systems composed of multiple controllers, frequent communication and collaboration are required between them. Existing solutions lack the ability to establish dynamic, fine-grained trust relationships between controllers. The communicating parties typically rely on simple authentication or static integrity reports for judgment, failing to perceive abnormal fluctuations or potential risks in the internal operating status of the other controller in real time. This makes it difficult for the system to adjust the trust strategy and resource allocation for interaction with a controller in a timely manner when suspicious deviations in its operational behavior are detected, potentially allowing local risks to spread throughout the system and affecting the stability and security of the overall control logic. Summary of the Invention

[0005] This invention provides a method for secure startup and end-to-end authentication of a DCS controller based on trusted computing, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a method for secure startup and end-to-end authentication of a DCS controller based on trusted computing, comprising: The integrity of the controller's startup firmware and software components is measured layer by layer, generating a set of layered measurement values. During controller operation, memory integrity checks are periodically performed to generate operational metrics. The operational metrics are then compared with the hierarchical metric set to obtain deviation metrics. Finally, the hierarchical metric set and deviation metrics are encapsulated to generate bistate credentials. The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence. When communicating with each other, the controllers exchange bi-state credentials and evidence chains. The controller extracts the peer deviation metric from the received bi-state credentials and extracts its own deviation metric from its own evidence chain. The controller calculates the distribution distance between the peer deviation metric and its own deviation metric to obtain the negotiation metric. Calculate the adaptive threshold based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence; The controller determines the resource allocation ratio based on the negotiated metric and the adaptive threshold, allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio, and executes the control instructions within the allocated processor time slices and memory space.

[0007] Integrity measurements are performed layer by layer on the controller's boot firmware and software components, generating a set of layered measurement values, including: The integrity of the controller's startup firmware is measured to generate firmware measurement values. The firmware measurement values ​​are then compared with pre-stored firmware baseline values ​​to generate firmware verification results. When the firmware verification result is passed, the integrity of the controller's operating system kernel is measured to generate a kernel metric value, and the kernel metric value is compared with the pre-stored kernel baseline value to generate a kernel verification result. When the kernel verification result is passed, the integrity of the application on the controller is measured to generate an application metric value. The application metric value is then compared with the pre-stored application baseline value to generate an application verification result. The firmware metric value, kernel metric value, and application metric value are chained together in the boot order to generate a metric hash chain. The metric hash chain is bound and encapsulated with the firmware verification result, kernel verification result, and application verification result to generate a hierarchical metric value set.

[0008] During controller operation, periodic memory integrity checks are performed to generate operational metrics. The operational metrics are then compared with a hierarchical set of metrics to calculate a deviation metric. Finally, the hierarchical set of metrics and the deviation metric are encapsulated to generate a bistate certificate, including: The controller performs integrity checks on memory pages during operation within a preset time interval to generate a set of memory page hashes, performs integrity checks on process scheduling states during operation to generate a set of process scheduling states, associates the set of memory page hashes with the set of process scheduling states based on preset mapping rules, and performs vectorized operations on the association mapping results to generate operation metrics. The controller extracts the metric hash chain from the hierarchical metric set as the base vector, performs difference calculation between the running metric and the hierarchical metric set to generate a difference matrix, and calculates the difference feature vector and difference weight factor based on the eigenvalue decomposition of the difference matrix. The controller performs matrix transformation on the difference matrix according to the difference weight factor, performs dimension reduction projection operation on the transformed matrix, and normalizes the operation result to obtain the deviation metric. The controller constructs a composite data structure containing a hierarchical set of metrics and a deviation metric. It performs a hash chain signature operation on the composite data structure to generate a chain signature sequence. The chain signature sequence and timestamp are digitally signed to generate signature data. The signature data is hashed and then bound and encapsulated with the timestamp to generate a bi-state credential.

[0009] The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence, including: Obtain the metric hash chain in the hierarchical metric set and extract the hash root node. Extract the vector components of the running metric and compress the dimensions to generate a compressed vector. Obtain the numerical range of the deviation metric and calculate the numerical distribution entropy to generate the distribution entropy value. Sort the hierarchical metric set, running metric, and deviation metric in ascending order according to the generation timestamp and construct a time series data sequence. Double hashing is performed on the time-series data sequence to generate double hash pairs. The hash distance weight is calculated based on the difference in hash values ​​of the double hash pairs. The double hash pairs are then weighted and chained according to the hash distance weight to generate a weighted progressive hash sequence. A hash tree structure is constructed based on a weighted progressive hash sequence. Forward verification paths and backward tracing paths are assigned to the leaf nodes in the hash tree structure. Merkel proofs of the verification paths are calculated based on the forward verification paths and backward tracing paths to generate a set of verification credentials. The weighted progressive hash sequence is cryptographically bound to the set of verification credentials. The cryptographic binding result is constructed into a chain hash structure. The chain hash structure is then digitally signed and encapsulated with timestamp information to generate a chain of evidence.

[0010] During inter-controller communication, dual-state credentials and evidence chains are exchanged. Each controller extracts the peer deviation metric from the received dual-state credential and its own deviation metric from its own evidence chain. The distribution distance between the peer deviation metric and the controller's own deviation metric is calculated to obtain the negotiated metric, which includes: After establishing a communication connection with the peer controller, the controller exchanges bi-state credentials and evidence chains. Time correlation identifiers and metric confidence identifiers are embedded in the bi-state credentials. Based on the time correlation identifiers, the controller performs time sequence consistency verification on the received bi-state credentials and extracts the peer deviation metric from the received bi-state credentials. The controller extracts its own deviation metric from its own evidence chain, arranges the deviation metric of the other end and its own deviation metric in a time series to generate a deviation time series, calculates the difference between adjacent values ​​in the deviation time series to generate a rate of change vector, and performs linear correction on the deviation metric of the other end and its own deviation metric based on the rate of change vector to obtain a corrected deviation metric pair. The modified deviation metric pairs are converted into probability distributions. The cross-entropy and mutual information values ​​between the probability distributions are calculated. The ratio of the cross-entropy and mutual information values ​​is used as the correlation constraint parameter. The weighted Euclidean distance of the modified deviation metric pairs is calculated based on the correlation constraint parameter to obtain the constraint distribution distance. The constraint distribution distance and the confidence index of the metric are weighted by confidence. The weighted confidence result is adaptively adjusted based on historical negotiation data to generate an adjusted distance value, which is then used as the negotiation metric.

[0011] The adaptive threshold is calculated based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence, including: Historical deviation metrics are extracted from the evidence chain and sorted by timestamp to generate a time-series data chain. The negotiated metrics are matched in the time-series data chain. Based on the matching positions, the preceding and subsequent data segments are extracted. Trend fitting is performed on the preceding data segments to generate a predicted trajectory. The degree of deviation between the negotiated metrics and the predicted trajectory is used as an anomaly index. Based on the anomaly index, the historical deviation measure in the evidence chain is divided into a stable evolution segment and a fluctuating evolution segment. The gradient feature of the historical deviation measure change is extracted in the stable evolution segment, and the frequency feature of the historical deviation measure jump is extracted in the fluctuating evolution segment. The gradient feature and the frequency feature are fused to generate a descriptor of the change trend of the historical deviation measure. Based on the trend descriptor, search the evidence chain for historical deviation measurement segments that have the same trend as the current negotiated measurement, extract the subsequent evolution data of the historical deviation measurement segments as prediction reference samples, and perform cluster analysis on the prediction reference samples to identify the main evolution path and the secondary evolution path. The core threshold range is constructed based on the main evolution path, and the threshold expansion coefficient is calculated based on the data dispersion of the secondary evolution path. The core threshold range is then expanded according to the threshold expansion coefficient, and the upper boundary of the expanded range is extracted as the adaptive threshold.

[0012] The controller determines the resource allocation ratio based on the negotiated metric and adaptive threshold, and allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio. Executing the control instructions within the allocated processor time slice and memory space includes: The controller compares the negotiated metric with the adaptive threshold to generate a comparison result. Based on the comparison result, it queries the preset trust level table to obtain the trust level of the peer controller. According to the trust level, it extracts the corresponding processor time slice quota and memory space quota from the resource quota mapping table as the resource allocation ratio. The controller receives control commands from the peer controller and parses the resource requirement field in the control command. It then matches and verifies the resource requirement field with the resource allocation ratio. After passing the matching and verification, it reserves the corresponding number of processor time slices and memory space in the system resource pool for the control command. Create an independent execution container and bind the reserved processor time slice and memory space to the execution container. Establish a resource access boundary check mechanism in the execution container and load the control instructions of the peer controller into the execution container to generate an executable instance. The executable instance is launched to execute control instructions within the allocated processor time slice. The resource access boundary check mechanism restricts the control instructions to use only the allocated memory space. The actual resource consumption of the control instructions is monitored and a resource usage report is generated for subsequent resource allocation optimization.

[0013] A second aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0014] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0015] In this embodiment, by performing layered integrity measurements on the controller boot firmware, operating system kernel, and applications, and constructing a measurement hash chain, the layer-by-layer verification of the trusted state during the boot phase is achieved, enhancing the trustworthiness of the controller's basic operating environment. Through joint integrity detection of runtime memory pages and process scheduling states, and generating deviation measurements, dynamic integrity changes in the operating environment can be continuously perceived. By using bi-state credentials and a chained evidence structure, traceable verification and cross-controller sharing of the trusted state are achieved, strengthening the secure and trustworthy foundation for collaborative communication between controllers. By using distributed distance calculation and an adaptive threshold mechanism, dynamic evaluation of the trustworthiness of the peer is achieved, and resource isolation and quota control are performed based on trustworthiness differences, thereby reducing the impact of abnormal control nodes on system resources and control processes, and improving the security, stability, and anti-tampering capabilities of the industrial control system in collaborative operation scenarios. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the secure startup and end-to-end authentication method for a DCS controller based on trusted computing, as described in an embodiment of the present invention. Figure 2 This is a flowchart of the adaptive threshold generation process based on temporal features and evolution paths in an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0019] Figure 1 This is a flowchart illustrating the secure startup and end-to-end authentication method for a DCS controller based on trusted computing, as described in an embodiment of the present invention. Figure 1 As shown, the method includes: The integrity of the controller's startup firmware and software components is measured layer by layer, generating a set of layered measurement values. During controller operation, memory integrity checks are periodically performed to generate operational metrics. The operational metrics are then compared with the hierarchical metric set to obtain deviation metrics. Finally, the hierarchical metric set and deviation metrics are encapsulated to generate bistate credentials. The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence. When communicating with each other, the controllers exchange bi-state credentials and evidence chains. The controller extracts the peer deviation metric from the received bi-state credentials and extracts its own deviation metric from its own evidence chain. The controller calculates the distribution distance between the peer deviation metric and its own deviation metric to obtain the negotiation metric. Calculate the adaptive threshold based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence; The controller determines the resource allocation ratio based on the negotiated metric and the adaptive threshold, allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio, and executes the control instructions within the allocated processor time slices and memory space.

[0020] Integrity measurements are performed layer by layer on the controller's boot firmware and software components, generating a set of layered measurement values, including: The integrity of the controller's startup firmware is measured to generate firmware measurement values. The firmware measurement values ​​are then compared with pre-stored firmware baseline values ​​to generate firmware verification results. When the firmware verification result is passed, the integrity of the controller's operating system kernel is measured to generate a kernel metric value, and the kernel metric value is compared with the pre-stored kernel baseline value to generate a kernel verification result. When the kernel verification result is passed, the integrity of the application on the controller is measured to generate an application metric value. The application metric value is then compared with the pre-stored application baseline value to generate an application verification result. The firmware metric value, kernel metric value, and application metric value are chained together in the boot order to generate a metric hash chain. The metric hash chain is bound and encapsulated with the firmware verification result, kernel verification result, and application verification result to generate a hierarchical metric value set.

[0021] During the power-on startup phase, the lowest-level Boot ROM, acting as the root of trust, is activated first. The Boot ROM's code is permanently stored within the chip and cannot be tampered with. The Boot ROM reads the boot firmware code segment stored in the Flash chip and performs an integrity measurement on the byte sequence of this code segment using the SHA-256 hash algorithm, calculating a 256-bit firmware metric. This firmware metric is then compared bit-by-bit with the firmware baseline value pre-stored in the Trusted Platform Module (TPM) chip's platform configuration register PCR0. When both are completely identical, the firmware verification result is marked as successful, and the startup process continues. If any bit discrepancies exist, the firmware verification result is marked as unsuccessful, the controller immediately enters safe mode, and the subsequent startup process is stopped.

[0022] After firmware verification is successful, the boot firmware transfers control to the operating system loader. The loader reads the operating system kernel image file from the specified partition of the storage device. This image file contains the kernel code segment, data segment, and symbol table. A SHA-256 hash operation is performed on the complete binary content of the kernel image file to generate a kernel metric. The calculated kernel metric is compared with the kernel baseline value pre-stored in the PCR1 register of the TPM chip. The kernel baseline value is written to the TPM by a trusted administrator through a secure channel during system initialization. If the comparison results match, the kernel verification result is set to pass, the operating system kernel is loaded into the memory address space, and the initialization routine begins execution; if the comparison results do not match, the kernel verification result is set to fail, the system logs an exception, and triggers the emergency response mechanism.

[0023] After the kernel boots up, the controller begins loading the DCS control application. The application typically contains multiple executable files, dynamic link libraries, and configuration files. All files in the application directory are arranged lexicographically by filename. The contents of each file are read sequentially and concatenated into a unified byte stream. A SHA-256 hash calculation is performed on this byte stream to generate an application metric. This application metric is compared and verified against the application baseline value in the TPM chip's PCR2 register. If verification passes, the application verification result is marked as passed, and the application gains execution privileges; if verification fails, the application verification result is marked as failed, the controller refuses to start the application, and sends an alarm message to the monitoring center.

[0024] After completing the three-layer metric verification, the controller performs a chained hash operation on the firmware metric, kernel metric, and application metric in the order of startup time. The specific operation process is as follows: First, the firmware metric is used as the initial input to calculate H1 = SHA-256(firmware metric); then, H1 is concatenated with the kernel metric and hashed again to calculate H2 = SHA-256(H1||kernel metric); finally, H2 is concatenated with the application metric and hashed a third time to calculate H3 = SHA-256(H2||application metric), resulting in the final metric hash chain value H3.

[0025] The controller packages the final value H3 of the metric hash chain along with three verification result flags. The encapsulated data structure adopts TLV format: the type field identifies it as a hierarchical metric set, the length field records the total number of bytes, and the value fields sequentially store the metric hash chain, firmware verification result, kernel verification result, and application verification result. This encapsulated structure is digitally signed using the TPM's private key to generate the final hierarchical metric value set, which is stored in the controller's secure storage area for subsequent authentication.

[0026] During controller operation, periodic memory integrity checks are performed to generate operational metrics. The operational metrics are then compared with a hierarchical set of metrics to calculate a deviation metric. Finally, the hierarchical set of metrics and the deviation metric are encapsulated to generate a bistate certificate, including: The controller performs integrity checks on memory pages during operation within a preset time interval to generate a set of memory page hashes, performs integrity checks on process scheduling states during operation to generate a set of process scheduling states, associates the set of memory page hashes with the set of process scheduling states based on preset mapping rules, and performs vectorized operations on the association mapping results to generate operation metrics. The controller extracts the metric hash chain from the hierarchical metric set as the base vector, performs difference calculation between the running metric and the hierarchical metric set to generate a difference matrix, and calculates the difference feature vector and difference weight factor based on the eigenvalue decomposition of the difference matrix. The controller performs matrix transformation on the difference matrix according to the difference weight factor, performs dimension reduction projection operation on the transformed matrix, and normalizes the operation result to obtain the deviation metric. The controller constructs a composite data structure containing a hierarchical set of metrics and a deviation metric. It performs a hash chain signature operation on the composite data structure to generate a chain signature sequence. The chain signature sequence and timestamp are digitally signed to generate signature data. The signature data is hashed and then bound and encapsulated with the timestamp to generate a bi-state credential.

[0027] The controller initiates a memory integrity check task every 5-second interval. It iterates through all currently loaded memory pages, reading the physical address, page size, and stored content of each page. The SHA-256 algorithm is then used to hash the content of each page, and a mapping is established between the calculated hash value and the corresponding page physical address, forming a memory page hash set. This set is stored in key-value pairs, where the key is the page's physical address and the value is the SHA-256 hash value of that page.

[0028] At the same time, the controller reads the process control block information in the current process scheduler, extracts the process identifier, priority, processor time occupied, memory usage and process status flags of each process, organizes these scheduling parameters into structured data form, and generates a process scheduling status set.

[0029] Based on preset mapping rules, the set of memory page hashes is associated with the set of process scheduling states. Specifically, the range of physical addresses of memory pages actually occupied by each process is determined by the memory page table information recorded in the process control block, and a mapping table is established from process identifiers to physical addresses of memory pages. According to this mapping table, each process in the process scheduling state set is associated with the hash value of the memory page it occupies, forming process-level integrity association data. Vectorization operations are performed on the associated data structure, converting the numerical parameters of the process scheduling state and the hash values ​​of the corresponding memory pages into fixed-length numerical vectors. The vectors of each process are concatenated in the order of the process identifiers to generate a 512-dimensional runtime metric vector.

[0030] The controller extracts metric hash values ​​from the stored hierarchical metric value set, representing the BIOS firmware, bootloader, operating system kernel, and application software layers. These hash values ​​are then chained together in boot order to form a metric hash chain as a base vector. Each component of the running metric vector is compared with its corresponding component in the base vector to construct a 512×512 difference matrix. Eigenvalue decomposition is performed on this difference matrix, yielding 512 eigenvalues ​​and their corresponding eigenvectors. The top 64 eigenvalues ​​with the largest absolute values ​​are selected, normalized, and used as difference weight factors. The corresponding eigenvectors form a set of difference eigenvectors.

[0031] The difference matrix is ​​multiplied by a diagonal matrix composed of difference weighting factors to perform a weighted transformation. Principal component analysis is then performed on the transformed 512×512 matrix to reduce its dimensionality, projecting it onto a 64-dimensional subspace spanned by the set of difference eigenvectors, resulting in a 64-dimensional projection vector. The magnitude of each component of this vector is calculated, and the sum of all magnitudes is divided by 64 to obtain the average magnitude. Each component of the projection vector is then divided by this average magnitude to perform normalization, resulting in a 64-dimensional deviation metric vector.

[0032] The controller creates a composite data structure containing a metric hash chain of hierarchical metric sets, a deviation metric vector, and the current system clock timestamp. SHA-256 hashing is performed on the composite data structure field by field to generate the first hash value. This hash value is then concatenated with the next field and SHA-256 is performed again, iterating until all fields are processed, forming a chained signature sequence. An RSA digital signature is performed on the concatenated chained signature sequence and timestamp using the controller's built-in private key, generating signature data. SHA-256 hashing is performed on the signature data to obtain the signature hash value. The signature hash value and timestamp are then encapsulated into a byte stream according to a fixed format, with version number and length fields added, ultimately generating a bi-state credential data packet.

[0033] The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence, including: Obtain the metric hash chain in the hierarchical metric set and extract the hash root node. Extract the vector components of the running metric and compress the dimensions to generate a compressed vector. Obtain the numerical range of the deviation metric and calculate the numerical distribution entropy to generate the distribution entropy value. Sort the hierarchical metric set, running metric, and deviation metric in ascending order according to the generation timestamp and construct a time series data sequence. Double hashing is performed on the time-series data sequence to generate double hash pairs. The hash distance weight is calculated based on the difference in hash values ​​of the double hash pairs. The double hash pairs are then weighted and chained according to the hash distance weight to generate a weighted progressive hash sequence. A hash tree structure is constructed based on a weighted progressive hash sequence. Forward verification paths and backward tracing paths are assigned to the leaf nodes in the hash tree structure. Merkel proofs of the verification paths are calculated based on the forward verification paths and backward tracing paths to generate a set of verification credentials. The weighted progressive hash sequence is cryptographically bound to the set of verification credentials. The cryptographic binding result is constructed into a chain hash structure. The chain hash structure is then digitally signed and encapsulated with timestamp information to generate a chain of evidence.

[0034] Regarding the evidence chain generation process, the metric hash chain generated during the startup phase is first extracted from the hierarchical metric set. This metric hash chain is formed by cascading hash calculation of the metric values ​​at the firmware layer, bootloader layer, and operating system layer using the SHA-256 algorithm. The hash root node serves as the unique identifier of the integrity status during the startup phase. Running metrics are typically represented as multi-dimensional vectors, containing components such as memory image features, process state parameters, and register snapshots. Principal component analysis is performed on this vector to extract the first three principal components, compressing the original 128-dimensional vector into a 16-dimensional compressed vector, achieving a compression rate of 87.5% while retaining over 95% of the original information. The deviation metric, representing the Euclidean distance between running metrics and hierarchical metrics, reflects the degree of deviation from the system state. The distribution entropy value of the deviation metric is calculated using the Shannon entropy formula for its distribution interval. Where p i The distribution entropy value quantifies the degree of uncertainty in the system state, serving as a measure of the probability of falling into the i-th interval.

[0035] When constructing a time-series data sequence, the hash root node, compression vector, distribution entropy value, and their respective generation timestamps are combined into data tuples, which are then arranged in ascending order of timestamps to form a sequence of length n. Double hashing is performed on adjacent tuples in the sequence: first, a single SHA-256 hash value h1 is calculated, and then h1 is hashed a second time to obtain h2, forming a hash pair (h1, h2). The Hamming distance between the two hash values ​​in the hash pair is calculated as the hash distance weight. D(·) represents the Hamming distance, normalized to between 0 and 1. The hash pairs are then weighted and chained, meaning the value of the i-th hash block is the hash value. i =SHA256(Hash i-1 ||w i ||Data i ), where SHA256(·) represents the secure hash algorithm SHA-256, Hash i-1 The hash value of the previous hash block is represented by ||, which represents string concatenation. i Data represents the hash distance weight corresponding to the i-th data tuple. i : The data content of the i-th time-series data tuple, generating a weighted progressive hash sequence containing time-series dependencies.

[0036] A binary hash tree is constructed based on a weighted progressive hash sequence, with each hash value in the sequence as a leaf node. Nodes are merged upwards layer by layer until the root node is generated. A forward verification path from leaf to root is constructed for each leaf node, containing the hash values ​​of sibling nodes and the path direction identifier. A backward tracing path from root to leaf is also recorded for source tracing. A Merkle proof is computed for each path. The verifier, holding the root hash value, can recalculate and verify the validity of the leaf node using the hash values ​​of its sibling nodes along the path. The Merkle proofs for all paths constitute a set of verification credentials.

[0037] The root hash value of the weighted progressive hash sequence is XORed with the set hash value of the verification credential set to generate a binding key. This binding key is then used to perform an HMAC operation on the concatenated result to complete the cryptographic binding. The binding result is organized into a chained hash structure, with each block containing a previous block hash reference, the current block data, and a block index. Finally, the header hash value of the chained hash structure is concatenated with the current Unix timestamp. The controller's private key is then used to execute the ECDSA signature algorithm to generate a digital signature. The chained structure, timestamp, and signature are encapsulated in TLV encoding format to form the final evidence chain data structure. This evidence chain possesses tamper-proof, traceable, and temporally consistent verification capabilities.

[0038] During inter-controller communication, dual-state credentials and evidence chains are exchanged. Each controller extracts the peer deviation metric from the received dual-state credential and its own deviation metric from its own evidence chain. The distribution distance between the peer deviation metric and the controller's own deviation metric is calculated to obtain the negotiated metric, which includes: After establishing a communication connection with the peer controller, the controller exchanges bi-state credentials and evidence chains. Time correlation identifiers and metric confidence identifiers are embedded in the bi-state credentials. Based on the time correlation identifiers, the controller performs time sequence consistency verification on the received bi-state credentials and extracts the peer deviation metric from the received bi-state credentials. The controller extracts its own deviation metric from its own evidence chain, arranges the deviation metric of the other end and its own deviation metric in a time series to generate a deviation time series, calculates the difference between adjacent values ​​in the deviation time series to generate a rate of change vector, and performs linear correction on the deviation metric of the other end and its own deviation metric based on the rate of change vector to obtain a corrected deviation metric pair. The modified deviation metric pairs are converted into probability distributions. The cross-entropy and mutual information values ​​between the probability distributions are calculated. The ratio of the cross-entropy and mutual information values ​​is used as the correlation constraint parameter. The weighted Euclidean distance of the modified deviation metric pairs is calculated based on the correlation constraint parameter to obtain the constraint distribution distance. The constraint distribution distance and the confidence index of the metric are weighted by confidence. The weighted confidence result is adaptively adjusted based on historical negotiation data to generate an adjusted distance value, which is then used as the negotiation metric.

[0039] When establishing a communication connection with the DCS controller, both parties need to exchange bi-state credentials and a chain of evidence carrying complete measurement data. During the generation of the bi-state credentials, a time-related identifier is embedded in a specific field of the data structure. This identifier uses a combination of a UTC timestamp and a monotonically increasing counter to ensure that each measurement operation has a unique time sequence number. At the same time, a measurement confidence identifier is set in the header of the credentials. This identifier is calculated based on the hardware status, interruption interference level, and sampling integrity during measurement acquisition, and its value is a floating-point number between 0 and 1.

[0040] Upon receiving the bi-state credential from the peer controller, the time correlation identifier is first extracted and compared with the local system clock to calculate the absolute value of the time deviation. If the time deviation exceeds a preset synchronization window, a timing consistency verification failure flag is triggered. For credentials that pass timing verification, the peer deviation metric is parsed from their data payload area. This metric is a quantified representation of the difference between the peer controller's memory integrity check result at a specific sampling time and the baseline metric.

[0041] Simultaneously, the deviation metric is extracted from the latest node of the local evidence chain. The deviation metrics from both ends are arranged chronologically according to their respective timestamps, forming a time-aligned deviation time series. A difference operation is performed on this series to calculate the difference between adjacent time-series metrics, yielding the rate of change for each time interval. All rate of change values ​​are organized into a vector, with a dimension equal to the sequence length minus one. Based on the trend characteristics in the rate of change vector, a weighted moving average method is used to correct the original deviation metric. The correction formula is the current metric value plus the product of the corresponding component of the rate of change vector and the correction coefficient, which is adaptively determined based on the standard deviation of the rate of change. The corrected result is a pair of values, i.e., the corrected deviation metric pair.

[0042] Each value of the corrected bias metric pair is normalized to the interval between 0 and 1, and then converted into a continuous probability distribution function using kernel density estimation. Cross-entropy is calculated for the two probability distributions, specifically by substituting the probability values ​​of discretized sampling points into the cross-entropy formula and summing them. Mutual information is calculated using the expected logarithm of the ratio of the joint probability to the marginal probability of the two distributions. The ratio of the cross-entropy value to the mutual information value, reflecting the correlation between the two metric distributions, is taken as the correlation constraint parameter. When calculating the weighted Euclidean distance, the squared difference of each dimension of the corrected bias metric pair is multiplied by the result of the function transformation of the correlation constraint parameter. This transformation uses an exponential decay form to reduce the distance weight in highly correlated scenarios. The square root of the summed weighted squared differences of each dimension yields the constrained distribution distance.

[0043] The confidence level indicator read from the bi-state certificate is multiplied by the constraint distribution distance; the higher the confidence level, the greater the retention of the distance value. Adaptive adjustment is performed on the multiplication result. The most recent negotiation metric records are retrieved from the historical negotiation database, and the moving average and standard deviation of these historical values ​​are calculated. The currently calculated confidence-weighted result is compared with the historical moving average. If the deviation exceeds twice the standard deviation, it is pulled back proportionally towards the average, with the pullback magnitude determined by a non-linear function of the deviation. The adjusted value serves as the final negotiation metric output. This negotiation metric comprehensively reflects the trust level and operational consistency of both controllers at the current moment, providing a quantitative basis for subsequent resource allocation decisions.

[0044] like Figure 2 As shown, this embodiment demonstrates the adaptive threshold generation process based on temporal features and evolution paths.

[0045] The adaptive threshold is calculated based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence, including: Historical deviation metrics are extracted from the evidence chain and sorted by timestamp to generate a time-series data chain. The negotiated metrics are matched in the time-series data chain. Based on the matching positions, the preceding and subsequent data segments are extracted. Trend fitting is performed on the preceding data segments to generate a predicted trajectory. The degree of deviation between the negotiated metrics and the predicted trajectory is used as an anomaly index. Based on the anomaly index, the historical deviation measure in the evidence chain is divided into a stable evolution segment and a fluctuating evolution segment. The gradient feature of the historical deviation measure change is extracted in the stable evolution segment, and the frequency feature of the historical deviation measure jump is extracted in the fluctuating evolution segment. The gradient feature and the frequency feature are fused to generate a descriptor of the change trend of the historical deviation measure. Based on the trend descriptor, search the evidence chain for historical deviation measurement segments that have the same trend as the current negotiated measurement, extract the subsequent evolution data of the historical deviation measurement segments as prediction reference samples, and perform cluster analysis on the prediction reference samples to identify the main evolution path and the secondary evolution path. The core threshold range is constructed based on the main evolution path, and the threshold expansion coefficient is calculated based on the data dispersion of the secondary evolution path. The core threshold range is then expanded according to the threshold expansion coefficient, and the upper boundary of the expanded range is extracted as the adaptive threshold.

[0046] Deviation metrics are extracted from the historical record area of ​​the evidence chain according to the ascending order of the timestamp field. These extracted deviation metrics are then organized into a one-dimensional array-like time-series data chain. Each element of the time-series data chain carries two attributes: a timestamp identifier and a metric value. The difference between the current negotiated metric and each historical deviation metric in the time-series data chain is calculated, and the position of the historical deviation metric with the smallest difference is selected as the matching position. Using the matching position as the dividing point, deviation metrics for 20 consecutive time steps forward are extracted to form the preceding data segment, and deviation metrics for 10 consecutive time steps backward are extracted to form the succeeding data segment.

[0047] A least-squares linear fitting method is used to establish a functional relationship between the metric and time for the preceding data segment. The predicted value of the fitted function at the corresponding time of the matching position is used as the reference point for the predicted trajectory. The absolute deviation between the negotiated metric and the reference point for the predicted trajectory is calculated. This absolute deviation is normalized by dividing it by the standard deviation of the preceding data segment. The normalized deviation is the anomaly index. When the anomaly index is less than 0.5, the historical deviation metric corresponding to the time window is considered to be in a stable evolutionary segment; when the anomaly index is greater than or equal to 0.5, the historical deviation metric corresponding to the time window is classified as a fluctuating evolutionary segment.

[0048] Within the identified stable evolutionary segment, the deviation metric values ​​of adjacent time steps are differentially analyzed to calculate the change in the metric value per unit time as the local gradient. The arithmetic mean of five consecutive local gradients is used to obtain the gradient feature of that segment. Within the fluctuating evolutionary segment, the number of times the adjacent changes in the deviation metric exceed 1.5 times the segment mean is counted, and this number is divided by the total time step of the segment to obtain the jump frequency feature. The gradient feature and the frequency feature are weighted and summed with a weighting coefficient of 3:7 to generate a binary tuple containing trend strength and fluctuation frequency as a trend descriptor.

[0049] A sliding window mechanism is used to sequentially extract historical deviation metric subsequences of 15 time steps in length from the evidence chain. For each subsequence, its trend descriptor is calculated, and Euclidean distance is calculated between it and the trend descriptor corresponding to the current negotiated metric. Subsequences with an Euclidean distance less than a set distance threshold of 0.3 are selected as historical deviation metric segments with the same trend. Starting from the end time of these matching segments, deviation metric values ​​for the next 8 consecutive time steps are extracted, and these subsequent evolutionary data are aggregated into a prediction reference sample.

[0050] K-means clustering was performed on the prediction reference samples, with the number of clusters set to 3. Clusters comprising more than 60% of the samples were identified as primary evolutionary paths, and the remaining clusters were classified as secondary evolutionary paths. The 25th and 75th percentiles of all samples in the primary evolutionary path were calculated, and the interval formed by these two percentile values ​​was used as the core threshold range. The variance of the samples in the secondary evolutionary paths was calculated, and the variance ratio was obtained by dividing the variance by the variance of the samples in the primary evolutionary path. The square root of the variance ratio was used as the threshold expansion coefficient. The upper and lower boundaries of the core threshold range were widened by multiplying them by 1 and adding the threshold expansion coefficient, and the upper boundary value of the widened interval was extracted as the final adaptive threshold output.

[0051] The controller determines the resource allocation ratio based on the negotiated metric and adaptive threshold, and allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio. Executing the control instructions within the allocated processor time slice and memory space includes: The controller compares the negotiated metric with the adaptive threshold to generate a comparison result. Based on the comparison result, it queries the preset trust level table to obtain the trust level of the peer controller. According to the trust level, it extracts the corresponding processor time slice quota and memory space quota from the resource quota mapping table as the resource allocation ratio. The controller receives control commands from the peer controller and parses the resource requirement field in the control command. It then matches and verifies the resource requirement field with the resource allocation ratio. After passing the matching and verification, it reserves the corresponding number of processor time slices and memory space in the system resource pool for the control command. Create an independent execution container and bind the reserved processor time slice and memory space to the execution container. Establish a resource access boundary check mechanism in the execution container and load the control instructions of the peer controller into the execution container to generate an executable instance. The executable instance is launched to execute control instructions within the allocated processor time slice. The resource access boundary check mechanism restricts the control instructions to use only the allocated memory space. The actual resource consumption of the control instructions is monitored and a resource usage report is generated for subsequent resource allocation optimization.

[0052] In the specific implementation of determining the resource allocation ratio, the controller first compares the current negotiated metric with an adaptive threshold. During the comparison, the difference between the negotiated metric and the threshold is calculated. A difference less than 0.1 indicates a high trust state, a difference between 0.1 and 0.3 indicates a medium trust state, and a difference greater than 0.3 indicates a low trust state. The controller maintains a preset trust level table, which contains high, medium, and low trust levels and their corresponding numerical ranges. Based on the comparison result, the controller queries the trust level table to obtain the current trust level of the peer controller. The controller also maintains a resource quota mapping table. This table allocates 80% processor time slice quota and 75% memory space quota for high trust levels, 50% time slice quota and 45% memory quota for medium trust levels, and 20% time slice quota and 15% memory quota for low trust levels. Based on the retrieved trust level, the corresponding quota value is extracted from the mapping table as the resource allocation ratio.

[0053] After receiving control commands from the peer controller, the controller parses the commands according to the protocol. The control commands are encapsulated in a fixed format, containing information such as command type, priority, and resource requirement fields. The resource requirement field explicitly indicates the number of processor time slices and the amount of memory space required to execute the command. The controller matches and verifies the parsed resource requirements against the previously obtained resource allocation ratio. During the verification process, it calculates whether the required value exceeds the absolute resource amount corresponding to the allocation ratio. For example, when the allocation ratio is 50%, if the total system processor time slice is 100 milliseconds, then 50 milliseconds are allowed. After successful matching and verification, the controller performs a resource reservation operation in the system resource pool, marking the corresponding number of processor time slices and memory space as occupied.

[0054] When creating an independent execution container, the controller invokes the operating system's namespace isolation mechanism. The execution container has its own independent process space and memory address space, physically isolated from the main control system. The controller binds reserved processor time slices to the container using CPU affinity settings and allocates reserved memory space to the container through a memory control group mechanism. A resource access boundary checking mechanism is established within the container, which includes a memory access monitoring module and a time slice usage monitoring module. The memory access monitoring module sets access boundary registers in the container's memory management unit; any access exceeding the allocated memory range triggers an exception interrupt. The time slice usage monitoring module tracks processor usage time through timer interrupts. The controller loads the executable code of the peer control instructions into the container's code segment and loads the instruction parameters into the data segment, completing the binding of instructions to the container environment and generating an executable instance.

[0055] When an executable instance is launched, the controller sets a timer to allocate a time slice period for that instance. The instance then begins executing control instructions, and all memory access requests during instruction execution are verified by a resource access boundary check mechanism. When an instruction attempts to access an address outside the allocated memory range, the boundary check mechanism intercepts the access and returns an error. The time slice monitoring module continuously accumulates the instance's processor usage time; when the accumulated time reaches the allocated time slice limit, the instance is forcibly suspended. During instruction execution, the controller records the actual processor time consumed and peak memory usage, generating a resource usage report containing resource type, consumption value, and execution duration. This report is stored in a historical record database for subsequent analysis of the peer controller's actual resource demand patterns and dynamic optimization of the allocation strategy in the resource quota mapping table.

[0056] A second aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0057] A third aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0058] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0059] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for secure startup and end-to-end authentication of a DCS controller based on trusted computing, characterized in that, include: The integrity of the controller's startup firmware and software components is measured layer by layer, generating a set of layered measurement values. During controller operation, memory integrity checks are periodically performed to generate operational metrics. The operational metrics are then compared with the hierarchical metric set to obtain deviation metrics. Finally, the hierarchical metric set and deviation metrics are encapsulated to generate bistate credentials. The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence. When communicating with each other, the controllers exchange bi-state credentials and evidence chains. The controller extracts the peer deviation metric from the received bi-state credentials and extracts its own deviation metric from its own evidence chain. The controller calculates the distribution distance between the peer deviation metric and its own deviation metric to obtain the negotiation metric. Calculate the adaptive threshold based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence; The controller determines the resource allocation ratio based on the negotiated metric and the adaptive threshold, allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio, and executes the control instructions within the allocated processor time slices and memory space. Integrity measurements are performed layer by layer on the controller's boot firmware and software components, generating a set of layered measurement values, including: The integrity of the controller's startup firmware is measured to generate firmware measurement values. The firmware measurement values ​​are then compared with pre-stored firmware baseline values ​​to generate firmware verification results. When the firmware verification result is passed, the integrity of the controller's operating system kernel is measured to generate a kernel metric value, and the kernel metric value is compared with the pre-stored kernel baseline value to generate a kernel verification result. When the kernel verification result is passed, the integrity of the application on the controller is measured to generate an application metric value. The application metric value is then compared with the pre-stored application baseline value to generate an application verification result. The firmware metric value, kernel metric value, and application metric value are chained together in the boot order to generate a metric hash chain. The metric hash chain is bound and encapsulated with the firmware verification result, kernel verification result, and application verification result to generate a hierarchical metric value set. During controller operation, periodic memory integrity checks are performed to generate operational metrics. The operational metrics are then compared with a hierarchical set of metrics to calculate a deviation metric. Finally, the hierarchical set of metrics and the deviation metric are encapsulated to generate a bistate certificate, including: The controller performs integrity checks on memory pages during operation within a preset time interval to generate a set of memory page hashes, performs integrity checks on process scheduling states during operation to generate a set of process scheduling states, associates the set of memory page hashes with the set of process scheduling states based on preset mapping rules, and performs vectorized operations on the association mapping results to generate operation metrics. The controller extracts the metric hash chain from the hierarchical metric set as the base vector, performs difference calculation between the running metric and the hierarchical metric set to generate a difference matrix, and calculates the difference feature vector and difference weight factor based on the eigenvalue decomposition of the difference matrix. The controller performs matrix transformation on the difference matrix according to the difference weight factor, performs dimension reduction projection operation on the transformed matrix, and normalizes the operation result to obtain the deviation metric. The controller constructs a composite data structure containing a hierarchical set of metrics and a deviation metric. It performs a hash chain signature operation on the composite data structure to generate a chain signature sequence. The chain signature sequence and the timestamp are digitally signed to generate signature data. The signature data is hashed and then bound and encapsulated with the timestamp to generate a bi-state credential. The controller determines the resource allocation ratio based on the negotiated metric and adaptive threshold, and allocates processor time slices and memory space to the control instructions of the peer controller according to the resource allocation ratio. Executing the control instructions within the allocated processor time slice and memory space includes: The controller compares the negotiated metric with the adaptive threshold to generate a comparison result. Based on the comparison result, it queries the preset trust level table to obtain the trust level of the peer controller. According to the trust level, it extracts the corresponding processor time slice quota and memory space quota from the resource quota mapping table as the resource allocation ratio. The controller receives control commands from the peer controller and parses the resource requirement field in the control command. It then matches and verifies the resource requirement field with the resource allocation ratio. After passing the matching and verification, it reserves the corresponding number of processor time slices and memory space in the system resource pool for the control command. Create an independent execution container and bind the reserved processor time slice and memory space to the execution container. Establish a resource access boundary check mechanism in the execution container and load the control instructions of the peer controller into the execution container to generate an executable instance. The executable instance is launched to execute control instructions within the allocated processor time slice. The resource access boundary check mechanism restricts the control instructions to use only the allocated memory space. The actual resource consumption of the control instructions is monitored and a resource usage report is generated for subsequent resource allocation optimization.

2. The method according to claim 1, characterized in that, The hierarchical metric set, the running metric, and the deviation metric are linked by chain hashing in timestamp order to generate a chain of evidence, including: Obtain the metric hash chain in the hierarchical metric set and extract the hash root node. Extract the vector components of the running metric and compress the dimensions to generate a compressed vector. Obtain the numerical range of the deviation metric and calculate the numerical distribution entropy to generate the distribution entropy value. Sort the hierarchical metric set, running metric, and deviation metric in ascending order according to the generation timestamp and construct a time series data sequence. Double hashing is performed on the time-series data sequence to generate double hash pairs. The hash distance weight is calculated based on the difference in hash values ​​of the double hash pairs. The double hash pairs are then weighted and chained according to the hash distance weight to generate a weighted progressive hash sequence. A hash tree structure is constructed based on a weighted progressive hash sequence. Forward verification paths and backward tracing paths are assigned to the leaf nodes in the hash tree structure. Merkel proofs of the verification paths are calculated based on the forward verification paths and backward tracing paths to generate a set of verification credentials. The weighted progressive hash sequence is cryptographically bound to the set of verification credentials. The cryptographic binding result is constructed into a chain hash structure. The chain hash structure is then digitally signed and encapsulated with timestamp information to generate a chain of evidence.

3. The method according to claim 1, characterized in that, During inter-controller communication, dual-state credentials and evidence chains are exchanged. Each controller extracts the peer deviation metric from the received dual-state credential and its own deviation metric from its own evidence chain. The distribution distance between the peer deviation metric and the controller's own deviation metric is calculated to obtain the negotiated metric, which includes: After establishing a communication connection with the peer controller, the controller exchanges bi-state credentials and evidence chains. Time correlation identifiers and metric confidence identifiers are embedded in the bi-state credentials. Based on the time correlation identifiers, the controller performs time sequence consistency verification on the received bi-state credentials and extracts the peer deviation metric from the received bi-state credentials. The controller extracts its own deviation metric from its own evidence chain, arranges the deviation metric of the other end and its own deviation metric in a time series to generate a deviation time series, calculates the difference between adjacent values ​​in the deviation time series to generate a rate of change vector, and performs linear correction on the deviation metric of the other end and its own deviation metric based on the rate of change vector to obtain a corrected deviation metric pair. The modified deviation metric pairs are converted into probability distributions. The cross-entropy and mutual information values ​​between the probability distributions are calculated. The ratio of the cross-entropy and mutual information values ​​is used as the correlation constraint parameter. The weighted Euclidean distance of the modified deviation metric pairs is calculated based on the correlation constraint parameter to obtain the constraint distribution distance. The constraint distribution distance and the confidence index of the metric are weighted by confidence. The weighted confidence result is adaptively adjusted based on historical negotiation data to generate an adjusted distance value, which is then used as the negotiation metric.

4. The method according to claim 1, characterized in that, The adaptive threshold is calculated based on the changing trends of the negotiation metric and the historical deviation metric in the chain of evidence, including: Historical deviation metrics are extracted from the evidence chain and sorted by timestamp to generate a time-series data chain. The negotiated metrics are matched in the time-series data chain. Based on the matching positions, the preceding and subsequent data segments are extracted. Trend fitting is performed on the preceding data segments to generate a predicted trajectory. The degree of deviation between the negotiated metrics and the predicted trajectory is used as an anomaly index. Based on the anomaly index, the historical deviation measure in the evidence chain is divided into a stable evolution segment and a fluctuating evolution segment. The gradient feature of the historical deviation measure change is extracted in the stable evolution segment, and the frequency feature of the historical deviation measure jump is extracted in the fluctuating evolution segment. The gradient feature and the frequency feature are fused to generate a descriptor of the change trend of the historical deviation measure. Based on the trend descriptor, search the evidence chain for historical deviation measurement segments that have the same trend as the current negotiated measurement, extract the subsequent evolution data of the historical deviation measurement segments as prediction reference samples, and perform cluster analysis on the prediction reference samples to identify the main evolution path and the secondary evolution path. The core threshold range is constructed based on the main evolution path, and the threshold expansion coefficient is calculated based on the data dispersion of the secondary evolution path. The core threshold range is then expanded according to the threshold expansion coefficient, and the upper boundary of the expanded range is extracted as the adaptive threshold.

5. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 4.

6. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 4.

Images