Automatic wharf network attack detection method based on attack chain and three-domain white baseline

Abstract

The application discloses an automatic wharf network attack detection method based on an attack chain and a three-domain white baseline, and relates to the technical field of network security. The method comprises the following steps: constructing a cross-domain asset-business association graph; generating an attack chain candidate set based on a vulnerability exploitation link and extracting black features of information domains, control domains and physical domains through attack simulation; establishing a three-domain white baseline model and cross-domain consistency rules; performing black-white fusion detection on real-time data to obtain a comprehensive abnormal score; distinguishing attack anomalies from functional failures through cross-domain causal order and abnormal propagation range; realizing abnormal device positioning based on graph propagation inversion; and generating a collaborative response action according to a risk level, a device security level and a business stage. The application can improve the detection precision of high-concealment attacks in the complex network scene of an automated container wharf, reduce false positives and false negatives, realize rapid positioning of abnormal devices and a collaborative defense closed loop.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an automated dock network attack detection method based on attack chains and three-domain white baselines. Background Technology

[0002] With the rapid development of automated container terminals, the network coupling between terminal operating systems, equipment control systems, and physical equipment has become increasingly tight, forming a complex cross-domain heterogeneous network with a high degree of integration of information, control, and physical domains. However, this deep integration also brings severe cybersecurity challenges. Once attackers breach information domain protection, they can move laterally to the control domain, tamper with control commands or parameters, and thus damage critical physical equipment such as quay cranes, yard cranes, and automated guided vehicles.

[0003] Highly stealthy attacks often cause only slight parameter drift or contextual inconsistencies during the symptom phase, making them prone to being missed by threshold or single-domain anomaly detection alone. Furthermore, equipment malfunctions, sensor distortions, and network attacks can all manifest as anomalies in the physical domain, and current technologies lack cross-domain causal and business semantic support, making accurate differentiation difficult. Most solutions stop at detecting anomalies, failing to answer further questions such as which device has been compromised, which operational nodes are affected, and what response actions should be taken.

[0004] Therefore, there is an urgent need for a method that can adapt to the complex cross-domain heterogeneous network scenarios of automated container terminals and achieve accurate detection of highly covert attacks, attack / fault differentiation, abnormal device location, and collaborative response closed loop. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to address the shortcomings of the prior art by providing an automated dock network attack detection method based on attack chain and three-domain white baseline.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: An automated dock network attack detection method based on attack chains and three-domain white baselines includes the following steps: Step S1: Obtain multi-source data from the information domain, control domain, and physical domain in the automated container terminal, and combine it with asset information, vulnerability information, network topology information, and business process information to construct a cross-domain asset-business association graph; the cross-domain asset-business association graph includes information domain nodes, control domain nodes, physical domain nodes, and task nodes, as well as network communication edges, control dependency edges, physical coupling edges, and business process edges; Step S2: Based on the cross-domain asset-business association graph, and considering the exploitability of node vulnerabilities, edge reachability, propagation concealment, and physical influence of nodes, generate a candidate set of attack chains and filter out a set of target attack chains; perform attack simulation or attack replay on the set of target attack chains in a simulation environment or digital twin environment, extract black features of the information domain, black features of the control domain, and black features of the physical domain, and construct an attack black feature library; Step S3: Based on historical normal operation data, establish information domain white baseline model, control domain white baseline model, and physical domain white baseline model, and construct task-control consistency rules, control-physical consistency rules, and task-physical consistency rules; Step S4: For real-time running data, calculate the black feature matching score, information domain anomaly score, control domain anomaly score, physical domain anomaly score, and cross-domain consistency deviation score respectively, and obtain the comprehensive anomaly score based on dynamic weight fusion. Step S5: When the comprehensive anomaly score exceeds a preset threshold, calculate the attack / fault discrimination score based on the cross-domain causal order index, anomaly propagation coverage index, maintenance context indicator, and anomaly self-recovery degree to distinguish between attack anomalies and functional faults. Step S6: When the attack is determined to be abnormal or a high-risk fault, a location optimization objective function is constructed based on the cross-domain asset-business association graph and node anomaly scores. The set of abnormal source devices corresponding to the minimum of the location optimization objective function is solved by graph propagation attenuation inversion optimization to obtain the abnormal device location result. Step S7: Based on the comprehensive anomaly score, the attack / fault discrimination score, the abnormal device location result, the device security level, and the business stage, construct a response optimization objective function. Under the premise of satisfying physical security constraints and key business constraints, solve for the optimal collaborative response action that minimizes the response optimization objective function and execute it to form a detection-location-response closed loop.

[0007] Further, in step S1, the information domain nodes include the terminal operating system, equipment control system, human-machine interface, scheduling database, operation and maintenance terminal, account and session nodes; the control domain nodes include programmable logic controllers, industrial control hosts, I / O modules and controller nodes; the physical domain nodes include quay cranes, yard cranes, automated guided vehicles, sensor and actuator nodes; the task nodes include loading and unloading tasks, routing tasks and yard operation stage nodes; the node attributes include node type, domain, communication protocol, equipment role, equipment criticality, associated vulnerability set and current status; the edge attributes include communication latency, trust level, reachability, bandwidth and direction.

[0008] Further, in step S2, the attack chain candidate set is selected using an attack chain scoring function, which is a weighted sum of the vulnerability exploitability score, reachability score, propagation concealment score, and node physical influence score on each edge; the black feature vector in the attack black feature library is formed by concatenating the information domain observation sequence, control domain observation sequence, and physical domain observation sequence with the attack chain structure embedding vector after feature encoding.

[0009] Further, in step S3, the information domain white baseline model is a conditional probability model based on historical information domain event sequences, task context, and role context; the control domain white baseline model is a legal control sequence automaton for each type of task; the physical domain white baseline model is a prediction model that predicts the physical state at the next moment based on the current physical state, control command, and task context; the task-control consistency rule defines the mapping from information domain events and task context to the expected control command; the control-physical consistency rule defines the mapping from control command and current physical state to the expected physical state at the next moment; and the task-physical consistency rule defines the mapping from information domain events and task context to the expected physical state at the next moment.

[0010] Further, in step S4, the information domain anomaly score is equal to 1 minus the probability value of the current information domain event in the conditional probability model; the control domain anomaly score is equal to the minimum edit distance between the real-time control sequence and the legal command language accepted by the legal control sequence automaton divided by the sequence length; the physical domain anomaly score is equal to the Mahalanobis distance of the residuals between the actual physical state and the predicted physical state; the cross-domain consistency deviation score is the weighted sum of task-control consistency deviation, control-physical consistency deviation, and task-physical consistency deviation; the dynamic weight vector includes black feature weight, information domain weight, control domain weight, physical domain weight, cross-domain consistency weight, and risk context weight, and the sum of each weight is 1.

[0011] Further, in step S5, the cross-domain causal order index is equal to the causal strength of the information domain anomaly leading the control domain anomaly plus the causal strength of the control domain anomaly leading the physical domain anomaly, minus the causal strength of the physical domain anomaly leading the information domain anomaly; the anomaly propagation coverage index is equal to the total number of nodes marked as anomaly at the current moment divided by the total number of nodes in the cross-domain asset-business association graph; the maintenance context indicator indicates whether there is a maintenance work order or maintenance window; the anomaly self-recovery degree indicates whether the anomaly can disappear on its own without manual intervention; the attack / fault discrimination score is the weighted sum of the black feature matching score, cross-domain consistency deviation score, cross-domain causal order index, and anomaly propagation coverage index minus the weighted sum of the maintenance context indicator and the anomaly self-recovery degree; if the attack / fault discrimination score is greater than or equal to the attack threshold, it is determined to be an attack anomaly; otherwise, if the physical domain anomaly score is greater than the preset physical domain threshold and the black feature matching score is less than the preset black feature threshold, it is determined to be a functional fault.

[0012] Further, in step S6, the node anomaly score is determined comprehensively based on the degree of anomaly of the node in the information domain, control domain, and physical domain; the set of anomaly source devices is a subset of nodes initially identified as attack sources in the cross-domain asset-business association graph; the localization optimization objective function is the sum of the squares of the differences between the node anomaly scores of all nodes and the predicted values ​​of the graph propagation attenuation model based on the set of anomaly source devices, plus a penalty coefficient multiplied by the number of nodes in the set of anomaly source devices, where the predicted value of the graph propagation attenuation model is the maximum anomaly contribution of each anomaly source node to the current node, and the anomaly contribution is the shortest path distance between nodes raised to the power of the attenuation coefficient; the set of anomaly source devices that minimizes the localization optimization objective function is obtained as the localization result, and the set of most suspicious penetrated devices, the set of affected links, the set of affected business nodes, and the recommended isolation boundary are output.

[0013] Further, in step S7, the set of collaborative response actions includes alarm uploading, evidence consolidation, account access restriction, session blocking, northbound interface freezing, control command interception, device isolation, manual switching, partial shutdown, and service degradation; the response optimization objective function is the weighted sum of the remaining risk, service loss, response delay, and recovery cost after taking the action; the physical security constraint requires that the physical security margin after taking the action be greater than or equal to a preset security threshold; the critical business constraint requires that the critical business retention rate after taking the action be greater than or equal to a preset business threshold; under the premise of satisfying the physical security constraint and the critical business constraint, the action that minimizes the response optimization objective function is selected as the optimal response action; the response level is divided according to the comprehensive anomaly score and the attack / fault discrimination score, the optimal response action is executed, and the handling result is fed back into the case library, rule library, and threshold library.

[0014] An automated port network attack detection, localization, and response system based on attack chains and three-domain white baselines is provided to implement any of the aforementioned automated port network attack detection methods based on attack chains and three-domain white baselines, including: The cross-domain association graph construction module is used to acquire multi-source data and construct a cross-domain asset-business association graph that includes information domain, control domain, physical domain nodes, and task nodes; The attack chain black feature generation module is used to generate a set of target attack chains and extract three-domain black features through attack simulation or replay to build an attack black feature library. The three-domain white baseline modeling module is used to establish white baseline models for the information domain, control domain, and physical domain, as well as three types of cross-domain consistency rules. The black-and-white fusion detection module is used to calculate the black feature matching score, three-domain anomaly score, and cross-domain consistency deviation score of real-time data, and fuse them to obtain a comprehensive anomaly score. The attack / failure differentiation module is used to calculate attack / failure discrimination scores based on cross-domain causal order, anomaly propagation coverage, maintenance context, and self-recovery level. The abnormal device location module is used to solve for the set of abnormal source devices based on node anomaly scores and graph propagation attenuation inversion. The hierarchical collaborative response module is used to solve for and execute the optimal response action under physical security constraints and critical business constraints.

[0015] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods for automated dock network attack detection based on attack chains and three-domain white baselines.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention constructs a cross-domain asset-business association graph, which unifies the modeling of information domain, control domain, physical domain and task nodes, providing a unified analysis space for attack chain generation, white baseline verification and device location, and solving the problem that existing technologies are difficult to adapt to cross-domain heterogeneous and complex network scenarios.

[0017] 2. This invention is based on vulnerability exploitation link-driven attack chain generation and simulation. It extracts black features in the information domain, control domain, and physical domain through attack replay. It does not rely on a large number of real attack samples and can actively discover the potential features of unknown or variant attacks, overcoming the limitations of traditional methods that rely on historical attack samples.

[0018] 3. This invention establishes white baselines for the information domain, control domain, and physical domain, and explicitly constructs three types of cross-domain consistency rules: task-control consistency, control-physical consistency, and task-physical consistency. This can effectively detect highly covert attacks that bypass detection by exploiting minor anomalies in a single domain, thereby improving detection accuracy and reducing the false negative rate.

[0019] 4. This invention constructs an attack / fault discrimination score by using cross-domain causal order indicators, anomaly propagation coverage indicators, maintenance context, and self-recovery degree. This score can accurately distinguish between network attack anomalies and device functional failures, solving the problems of high false alarm rate and difficulty in distinguishing anomaly types in existing technologies.

[0020] 5. This invention uses a graph propagation inversion model to locate abnormal devices, outputs the set of penetrated devices, the set of affected links, and recommended isolation boundaries, and generates hierarchical collaborative response actions through an optimized model that satisfies physical security constraints and critical business constraints, forming a complete closed loop of detection-location-response, thus achieving a balance between precise defense and business continuity. Attached Figure Description

[0021] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating black-and-white fusion scoring, attack / fault differentiation, and location decision-making in an embodiment of the present invention. Figure 3 This is a schematic diagram of the physical trajectory offset of the operation and maintenance terminal → ECS → AGV controller in an embodiment of the present invention. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] like Figure 1 As shown, the automated dock network attack detection method based on attack chain and three-domain white baseline includes the following steps: Step S1: Obtain multi-source data from the information domain, control domain, and physical domain in the automated container terminal, and combine it with asset information, vulnerability information, network topology information, and business process information to construct a cross-domain asset-business association graph; the cross-domain asset-business association graph includes information domain nodes, control domain nodes, physical domain nodes, and task nodes, as well as network communication edges, control dependency edges, physical coupling edges, and business process edges; Step S2: Based on the cross-domain asset-business association graph, and considering the exploitability of node vulnerabilities, edge reachability, propagation concealment, and physical influence of nodes, generate a candidate set of attack chains and filter out a set of target attack chains; perform attack simulation or attack replay on the set of target attack chains in a simulation environment or digital twin environment, extract black features of the information domain, black features of the control domain, and black features of the physical domain, and construct an attack black feature library; Step S3: Based on historical normal operation data, establish information domain white baseline model, control domain white baseline model, and physical domain white baseline model, and construct task-control consistency rules, control-physical consistency rules, and task-physical consistency rules; Step S4: For real-time running data, calculate the black feature matching score, information domain anomaly score, control domain anomaly score, physical domain anomaly score, and cross-domain consistency deviation score respectively, and obtain the comprehensive anomaly score based on dynamic weight fusion. Step S5: When the comprehensive anomaly score exceeds a preset threshold, calculate the attack / fault discrimination score based on the cross-domain causal order index, anomaly propagation coverage index, maintenance context indicator, and anomaly self-recovery degree to distinguish between attack anomalies and functional faults. Step S6: When the attack is determined to be abnormal or a high-risk fault, a location optimization objective function is constructed based on the cross-domain asset-business association graph and node anomaly scores. The set of abnormal source devices corresponding to the minimum of the location optimization objective function is solved by graph propagation attenuation inversion optimization to obtain the abnormal device location result. Step S7: Based on the comprehensive anomaly score, the attack / fault discrimination score, the abnormal device location result, the device security level, and the business stage, construct a response optimization objective function. Under the premise of satisfying physical security constraints and key business constraints, solve for the optimal collaborative response action that minimizes the response optimization objective function and execute it to form a detection-location-response closed loop.

[0024] Obtain a set of information domain nodes, including the terminal operating system, equipment control system, human-machine interface, scheduling database, operation and maintenance terminal, account and session nodes; Obtain a set of control domain nodes, wherein the control domain nodes include programmable logic controllers, industrial control hosts, I / O modules, and controller nodes; Obtain a set of physical domain nodes, including quay cranes, yard cranes, automated guided vehicles, sensor and actuator nodes; Obtain a set of task nodes, which includes loading and unloading tasks, routing tasks, and yard operation stage nodes; Construct an edge set, which includes network communication edges describing network communication within the information domain and between the information domain and the control domain, control dependency edges describing control dependencies within the control domain and between the control domain and the physical domain, physical coupling edges describing the coupling relationship between devices within the physical domain, and business process edges describing the business process relationship between task nodes and each domain node. For each node and each edge, attribute information is associated. The node attributes include node type, domain, communication protocol, device role, device criticality, associated vulnerability set, and current status. The edge attributes include communication latency, trust level, reachability, bandwidth, and direction.

[0025] Define the cross-domain heterogeneous relationship diagram of the automated terminal as follows: in, This represents a cross-domain asset-business relationship diagram. Represents a set of nodes. Denotes the set of edges. This represents a set of attributes, including node-related attributes and edge-related attributes. The node set consists of information domain nodes, control domain nodes, physical domain nodes, and task nodes. in, This represents a set of information domain nodes, including TOS, ECS, HMI, databases, maintenance hosts, user accounts, etc. This represents a set of control domain nodes, including PLCs, industrial control hosts, controllers, I / O modules, etc. This represents a set of physical domain nodes, including quay cranes, yard cranes, AGVs, sensors, actuators, etc. This represents a set of task nodes, including container tasks, path tasks, loading and unloading operation stages, etc.

[0026] The edge set is defined as: in, Indicates a network communication edge; Indicates control dependency edges; Indicates a physical coupling edge; Indicates a business process edge; Each node's associated attributes include: node type; domain; communication protocol; device role; device criticality; associated vulnerability set; and current status. Each edge's associated attributes include: communication latency; trust level; reachability; bandwidth; and direction.

[0027] In step S2, the attack chain candidate set is selected using an attack chain scoring function, which is a weighted sum of the vulnerability exploitability score, reachability score, propagation concealment score, and node physical influence score on each edge. The black feature vector in the attack black feature library is formed by concatenating the information domain observation sequence, control domain observation sequence, and physical domain observation sequence with the attack chain structure embedding vector after feature encoding.

[0028] Define an attack chain, which is a directed path consisting of an attack entry node, an attack target node, and intermediate nodes and edges. Construct an attack chain scoring function, which is used to calculate the comprehensive score of each candidate attack chain; Based on the cross-domain asset-business relationship graph, generate all candidate attack chains from all possible attack entry nodes to all possible attack target nodes; Using a beam search or dynamic programming algorithm, the attack chain score function value of each candidate attack chain is calculated, and the top K attack chains with the highest scores are selected as the target attack chain set.

[0029] For any candidate attack chain Defined as: in, This represents the k-th candidate attack chain. Indicates the entry point for the attack. Indicates the target of the attack or the node that has a physical effect. Indicates the length of the attack chain. Indicates the j-th edge; Given the exploitability, edge reachability, concealment, and physical impact of a node vulnerability, define an attack chain scoring function: in, This indicates the exploitability of a node vulnerability, which can be obtained by CVSS normalization. This indicates the reachability propagated through this edge; This indicates the covert nature of its spread; This indicates the operational or physical safety impacts after reaching this node. , , and These represent the weighting coefficients, and their sum is 1. Let j be the j-th node; use beam search or dynamic programming to select the highest-scoring attack path from all candidate attack paths. Let the set of target attack chains be denoted as _ . ,but .

[0030] In a simulation environment or a digital twin playback environment, the attack sequence is replayed for each attack chain in the target attack chain set; During the attack sequence replay process, information domain observation sequences are collected, including login logs, process calls, file operations, database queries, session status, and policy change records. During the attack sequence replay, a control domain observation sequence is collected, which includes control commands, register write values, I / O module changes, and programmable logic controller status. During the replay of the attack sequence, a physical domain observation sequence is collected, which includes equipment position, operating speed, load weight, lifting angle, motor current and limit status. The information domain observation sequence is encoded using an information domain feature encoding function to generate an information domain black feature vector; the control domain observation sequence is encoded using a control domain feature encoding function to generate a control domain black feature vector; the physical domain observation sequence is encoded using a physical domain feature encoding function to generate a physical domain black feature vector; and the attack chain structure embedding function is used to encode the topology of the attack chain to generate an attack chain structure embedding vector. The black feature vectors of the information domain, the control domain, the physical domain, and the attack chain structure embedding vector are concatenated to construct a black feature vector. The black feature vectors of all attack chains constitute the attack black feature library.

[0031] For each optimal attack chain Execute the attack sequence in a simulation environment or a digital twin playback environment to obtain three-domain observations: Information domain sequence : Login, processes, files, databases, sessions, policy changes, etc.; Control domain sequence Control commands, register writes, I / O changes, PLC status, etc. Physical domain sequence : Position, speed, load, angle, current, limit status, etc.

[0032] The corresponding black feature vector is defined as: in, Indicates the feature encoding function within the domain. This represents the attack chain structure embedding function, which maps the topology of the attack chain to a vector. A graph neural network can be used to encode the node and edge sequences of the attack chain, where t represents the time index. This represents the black feature vector extracted from the attack chain at time t; The black feature matching score is defined as: in, This represents the Sigmoid function. This represents the black feature matching score at time t. This represents the black feature weight vector, which has the same dimension as the black feature vector. It is used to calculate the matching degree and can be learned through training.

[0033] In step S3, the information domain white baseline model is a conditional probability model based on historical information domain event sequences, task context, and role context; the control domain white baseline model is a legal control sequence automaton for each type of task; the physical domain white baseline model is a prediction model that predicts the physical state at the next moment based on the current physical state, control commands, and task context; the task-control consistency rule defines the mapping from information domain events and task context to the desired control commands; the control-physical consistency rule defines the mapping from control commands and the current physical state to the desired physical state at the next moment; and the task-physical consistency rule defines the mapping from information domain events and task context to the desired physical state at the next moment.

[0034] In step S4, the information domain anomaly score is equal to 1 minus the probability value of the current information domain event in the conditional probability model; the control domain anomaly score is equal to the minimum edit distance between the real-time control sequence and the legal command language accepted by the legal control sequence automaton divided by the sequence length; the physical domain anomaly score is equal to the Mahalanobis distance of the residuals between the actual physical state and the predicted physical state; the cross-domain consistency deviation score is the weighted sum of the task-control consistency deviation, the control-physical consistency deviation, and the task-physical consistency deviation; the dynamic weight vector includes black feature weights, information domain weights, control domain weights, physical domain weights, cross-domain consistency weights, and risk context weights, and the sum of each weight is 1.

[0035] The information domain anomaly score is calculated based on the information domain white baseline model. The information domain anomaly score is equal to 1 minus the probability value of the current information domain event in the conditional probability model. The control domain anomaly score is calculated based on the control domain white baseline model. The control domain anomaly score is equal to the minimum edit distance between the real-time control sequence and the legal command language accepted by the legal control sequence automaton divided by the sequence length. The physical domain anomaly score is calculated based on the physical domain white baseline model. The physical domain anomaly score is equal to the Mahalanobis distance between the residuals of the actual physical state at the next time step and the physical state predicted by the physical state prediction model. The cross-domain consistency deviation score is calculated based on the cross-domain consistency rule. The cross-domain consistency deviation score is equal to the weighted sum of the task-control consistency deviation, control-physical consistency deviation, and task-physical consistency deviation. The black feature matching score is calculated based on the attack black feature library. The black feature matching score is equal to the value of the maximum matching degree between each black feature vector in the attack black feature library and the current real-time feature vector after normalization by the Sigmoid function. A dynamic weight vector is constructed, which includes black feature weight, information domain weight, control domain weight, physical domain weight, cross-domain consistency weight, and risk context weight. Calculate the risk context score, which is obtained by weighted summation of asset importance, vulnerability priority, and operational phase sensitivity; The comprehensive anomaly score is obtained by multiplying the black feature matching score, the information domain anomaly score, the control domain anomaly score, the physical domain anomaly score, the cross-domain consistency deviation score, and the risk context score by the corresponding weights in the dynamic weight vector and then summing them. The comprehensive anomaly score is compared with a preset threshold. If the comprehensive anomaly score is greater than or equal to the preset threshold, an anomaly event is triggered.

[0036] like Figure 2 As shown, for information domain event sequences Establish a conditional probability model: in, This represents the information domain event at time t. Indicates the current task context. Indicates the role / account / terminal context. Indicates the length of the context window. This represents the sequence of L information domain events prior to time t; Information domain anomaly score: in, This represents the anomaly score in the information domain, with a value range of 0-1. A higher score indicates a more abnormal current event.

[0037] Control domain white baselines are applied to each type of task. Constructing a legal control sequence automaton For real-time control sequences Define control domain exception scores: in, Indicates the score for anomalies in the control domain. Indicates the task Constructed legal control sequence automaton, Represents the edit distance, calculating the minimum number of edit operations required between two sequences. This indicates the legal command language accepted by the automaton. This represents a specific sequence in a legal command language. This represents the sequence of control commands at time t and the L times preceding it.

[0038] Physical domain white baseline given physical state vector Control commands and task context Establish a physical prediction model: in, Let represent the physical state vector at time t. This represents the control command at time t. Represents a physical prediction model. This represents the predicted physical state vector at time t+1. The physical residual is: in, This represents the actual physical state at time t+1. Represents the physical residual vector; The physical domain anomaly score is: in, Indicates anomaly scores in the physical domain. The normal residual covariance matrix, This represents the inverse of the covariance matrix.

[0039] Define three cross-domain mapping functions: in, This represents a mapping function from tasks to control commands. This represents the mapping function from control commands to physical states. A mapping function representing the task to its physical state; The cross-domain consistency deviation is defined as: in, Indicates the cross-domain consistency deviation score. , and These represent the weighting coefficients, and their sum is 1.

[0040] Define a dynamic weight vector: in, This represents the dynamic weight vector at time t. Indicates the weight of the black feature. Represents the information domain weights. Indicates the control domain weights. Represents the physical domain weights. Indicates cross-domain consistency weight. Indicates risk context weights; satisfy: The comprehensive anomaly score is defined as follows: in, The risk context score is determined by the asset importance, vulnerability priority, and sensitivity of the operational phase. This indicates the overall abnormal score.

[0041] when When this happens, an abnormal event is triggered, in which... This indicates a preset threshold.

[0042] In step S5, the cross-domain causal order index equals the causal strength of the information domain anomaly leading the control domain anomaly plus the causal strength of the control domain anomaly leading the physical domain anomaly, minus the causal strength of the physical domain anomaly leading the information domain anomaly; the anomaly propagation coverage index equals the total number of nodes marked as anomaly at the current moment divided by the total number of nodes in the cross-domain asset-business association graph; the maintenance context indicator indicates whether there is a maintenance work order or maintenance window; the anomaly self-recovery degree indicates whether the anomaly can disappear on its own without manual intervention; the attack / fault discrimination score is the weighted sum of the black feature matching score, cross-domain consistency deviation score, cross-domain causal order index, and anomaly propagation coverage index minus the weighted sum of the maintenance context indicator and the anomaly self-recovery degree; if the attack / fault discrimination score is greater than or equal to the attack threshold, it is determined to be an attack anomaly; otherwise, if the physical domain anomaly score is greater than the preset physical domain threshold and the black feature matching score is less than the preset black feature threshold, it is determined to be a functional fault.

[0043] Define cross-domain causal order index : in, This indicates the causal strength of an anomaly in the information domain leading an anomaly in the control domain. This indicates the causal strength of the difference between anomalies in the control domain and those in the physical domain. This indicates the causal strength of the physical domain anomaly leading the information domain anomaly; Define propagation coverage metrics : in, This represents the set of nodes marked as abnormal in the information domain at the current moment. This represents the set of nodes marked as abnormal in the control domain at the current moment. This represents the set of nodes in the physical domain that are currently marked as anomalous. Indicates the number of nodes; Define attack / fault discrimination score : in, This indicates a maintenance context instruction value; a higher value is taken when a maintenance work order / maintenance window exists. Indicates the degree of abnormal self-recovery. , , , , and These represent the weighting coefficients, and their sum is 1; The specific discrimination rules include: If the attack / fault discrimination score Greater than or equal to the attack threshold If the attack / fault discrimination score is not met, it is considered an attack anomaly; Less than the attack threshold And the physical domain scored abnormally. The score is greater than the preset physical domain threshold and the black feature matching score is greater than the preset physical domain threshold. If the value is less than the preset black feature threshold, it is determined to be a functional failure; The preset physical domain threshold and preset black feature threshold are set based on the statistical distribution of historical normal operation data.

[0044] In step S6, the node anomaly score is determined based on the degree of anomaly of the node in the information domain, control domain, and physical domain; the set of anomaly source devices is a subset of nodes initially identified as attack sources in the cross-domain asset-business association graph; the localization optimization objective function is the sum of the squares of the differences between the node anomaly scores of all nodes and the predicted values ​​of the graph propagation attenuation model based on the set of anomaly source devices, plus a penalty coefficient multiplied by the number of nodes in the set of anomaly source devices, where the predicted value of the graph propagation attenuation model is the maximum anomaly contribution of each anomaly source node to the current node, and the anomaly contribution is the shortest path distance between nodes raised to the power of the attenuation coefficient; the set of anomaly source devices that minimizes the localization optimization objective function is used as the localization result, and the set of most suspicious penetrated devices, the set of affected links, the set of affected business nodes, and the recommended isolation boundary are output.

[0045] For each node Calculate node anomaly scores Let the set of source devices be Define the positioning optimization objective: in, This represents the shortest path distance from node u to node v on the graph. Indicates the attenuation coefficient of abnormal propagation; This represents a constraint on the minimum number of anomaly sources. Indicates the penalty coefficient. This indicates the location result.

[0046] The output includes: the set of most suspected compromised devices; the set of affected links; the set of affected service nodes; and the recommended isolation boundary.

[0047] In step S7, the set of collaborative response actions includes alarm uploading, evidence consolidation, account access restriction, session blocking, northbound interface freezing, control command interception, device isolation, manual switching, partial shutdown, and service degradation. The response optimization objective function is the weighted sum of the remaining risk, service loss, response delay, and recovery cost after taking the action. The physical security constraint requires that the physical security margin after taking the action be greater than or equal to a preset security threshold. The critical business constraint requires that the critical business retention rate after taking the action be greater than or equal to a preset business threshold. Under the premise of satisfying the physical security constraint and the critical business constraint, the action that minimizes the response optimization objective function is selected as the optimal response action. The response level is divided according to the comprehensive anomaly score and the attack / fault discrimination score. The optimal response action is executed, and the handling results are fed back into the case library, rule library, and threshold library.

[0048] The defined set of response actions includes: alarm transmission, evidence preservation, session blocking, account access restriction, control command freezing, device isolation, switching to manual mode, partial shutdown, and service degradation. Define the response optimization objective: Satisfy constraints: in, Indicates the remaining risk after taking action; Indicates business loss; Indicates a response delay; Indicates the cost of recovery; Indicates physical security margin; Indicates the retention rate of key business operations. , , and These represent the weighting coefficients, The optimal response action is the action that minimizes the objective function. Indicates the physical security threshold. This indicates the threshold for maintaining business operations.

[0049] Based on the comprehensive anomaly score Attack / Fault Discrimination Score The events are divided into the following four levels: Level I: Alarms and evidence collection only; Level II: Restriction of privileges, blocking, and freezing of instructions; Level III: Local isolation, switch to manual operation; Level IV: Forced shutdown, regional network outage, emergency response.

[0050] when When it is low, such as <0.5, it is Level I; when Medium, such as those within the range of [0.5~0.6) and A higher value, such as within the range of [0.6~0.8), is classified as Level II; when... Higher values, such as those within the range of [0.6~0.8) and A higher value, such as within the range of [0.6~0.8), is classified as Level III; when... Very high, such as ≥0.8 and Level IV is defined as a very high level, such as ≥0.8, or when it involves critical equipment.

[0051] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods for automated dock network attack detection based on attack chains and three-domain white baselines.

[0052] like Figure 3As shown, after receiving loading and unloading tasks at the automated terminal, the TOS generates a task order and sends it to the ECS. The ECS then breaks down the task into quay crane loading and unloading tasks, AGV routing tasks, and yard crane storage tasks. The PLCs and industrial control hosts in the control domain execute specific control commands, while the quay cranes, AGVs, and yard cranes in the physical domain complete their operations according to a predetermined sequence.

[0053] Attackers penetrate the ECS through the maintenance terminal, move laterally to the AGV task allocation interface, and tamper with the target path parameters of a single AGV, causing it to gradually deviate from the allowed trajectory without immediately triggering a hard threshold alarm.

[0054] The attack chain simulation module identified the path as: Operation and Maintenance Terminal → ECS Task Allocation Module → AGV Controller → AGV Physical Trajectory; the Black Feature Module detected abnormal interface access, parameter rewriting, and slight abrupt changes in control commands; the White Baseline Module found that the task sheet remained unchanged, but the path parameters differed significantly from similar historical tasks, and the residual between the AGV trajectory and the predicted trajectory continued to increase; because the anomaly propagated in the order of information domain → control domain → physical domain and lacked self-recovery characteristics, therefore... If the attack threshold is reached, it is determined to be an attack anomaly.

[0055] The positioning module outputs a set of abnormal sources; the response module chooses to freeze the current task of the current AGV, switch to manual takeover, isolate the northbound write control interface from the ECS to the AGV controller, solidify logs and trajectory evidence, while keeping other AGVs running.

[0056] An automated port network attack detection, localization, and response system based on attack chains and three-domain white baselines is provided to implement the automated port network attack detection method based on attack chains and three-domain white baselines as described in any one of the claims, including: The cross-domain association graph construction module is used to acquire multi-source data and construct a cross-domain asset-business association graph that includes information domain, control domain, physical domain nodes, and task nodes; The attack chain black feature generation module is used to generate a set of target attack chains and extract three-domain black features through attack simulation or replay to build an attack black feature library. The three-domain white baseline modeling module is used to establish white baseline models for the information domain, control domain, and physical domain, as well as three types of cross-domain consistency rules. The black-and-white fusion detection module is used to calculate the black feature matching score, three-domain anomaly score, and cross-domain consistency deviation score of real-time data, and fuse them to obtain a comprehensive anomaly score. The attack / failure differentiation module is used to calculate attack / failure discrimination scores based on cross-domain causal order, anomaly propagation coverage, maintenance context, and self-recovery level. The abnormal device location module is used to solve for the set of abnormal source devices based on node anomaly scores and graph propagation attenuation inversion. The hierarchical collaborative response module is used to solve for and execute the optimal response action under physical security constraints and critical business constraints.

[0057] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0058] The examples described herein are merely preferred embodiments of the invention and are not intended to limit the concept and scope of the invention. Any modifications and improvements made by those skilled in the art to the technical solutions of the invention without departing from the design concept of the invention should fall within the protection scope of the invention.

Claims

1. An automated port network attack detection method based on attack chain and three-domain white baseline, characterized in that, Includes the following steps: Step S1: Obtain multi-source data from the information domain, control domain, and physical domain in the automated container terminal, and combine it with asset information, vulnerability information, network topology information, and business process information to construct a cross-domain asset-business association graph; the cross-domain asset-business association graph includes information domain nodes, control domain nodes, physical domain nodes, and task nodes, as well as network communication edges, control dependency edges, physical coupling edges, and business process edges; Step S2: Based on the cross-domain asset-business association graph, and considering the exploitability of node vulnerabilities, edge reachability, propagation concealment, and physical influence of nodes, generate a candidate set of attack chains and filter out a set of target attack chains; perform attack simulation or attack replay on the set of target attack chains in a simulation environment or digital twin environment, extract black features of the information domain, black features of the control domain, and black features of the physical domain, and construct an attack black feature library; Step S3: Based on historical normal operation data, establish information domain white baseline model, control domain white baseline model, and physical domain white baseline model, and construct task-control consistency rules, control-physical consistency rules, and task-physical consistency rules; Step S4: For real-time running data, calculate the black feature matching score, information domain anomaly score, control domain anomaly score, physical domain anomaly score, and cross-domain consistency deviation score respectively, and obtain the comprehensive anomaly score based on dynamic weight fusion. Step S5: When the comprehensive anomaly score exceeds a preset threshold, calculate the attack / fault discrimination score based on the cross-domain causal order index, anomaly propagation coverage index, maintenance context indicator, and anomaly self-recovery degree to distinguish between attack anomalies and functional faults. Step S6: When the attack is determined to be abnormal or a high-risk fault, a location optimization objective function is constructed based on the cross-domain asset-business association graph and node anomaly scores. The set of abnormal source devices corresponding to the minimum of the location optimization objective function is solved by graph propagation attenuation inversion optimization to obtain the abnormal device location result. Step S7: Based on the comprehensive anomaly score, the attack / fault discrimination score, the abnormal device location result, the device security level, and the business stage, construct a response optimization objective function. Under the premise of satisfying physical security constraints and key business constraints, solve for the optimal collaborative response action that minimizes the response optimization objective function and execute it to form a detection-location-response closed loop.

2. The method according to claim 1, characterized in that, In step S1, the information domain nodes include the terminal operating system, equipment control system, human-machine interface, scheduling database, operation and maintenance terminal, account and session nodes; the control domain nodes include programmable logic controllers, industrial control hosts, I / O modules and controller nodes; the physical domain nodes include quay cranes, yard cranes, automated guided vehicles, sensor and actuator nodes; the task nodes include loading and unloading tasks, routing tasks and yard operation stage nodes; the node attributes include node type, domain, communication protocol, equipment role, equipment criticality, associated vulnerability set and current status; the edge attributes include communication latency, trust level, reachability, bandwidth and direction.

3. The method according to claim 2, characterized in that, In step S2, the attack chain candidate set is selected using an attack chain scoring function, which is a weighted sum of the vulnerability exploitability score, reachability score, propagation concealment score, and node physical influence score on each edge. The black feature vector in the attack black feature library is formed by concatenating the information domain observation sequence, control domain observation sequence, and physical domain observation sequence with the attack chain structure embedding vector after feature encoding.

4. The method according to claim 3, characterized in that, In step S3, the information domain white baseline model is a conditional probability model based on historical information domain event sequences, task context, and role context; the control domain white baseline model is a legal control sequence automaton for each type of task; the physical domain white baseline model is a prediction model that predicts the physical state at the next moment based on the current physical state, control commands, and task context; the task-control consistency rule defines the mapping from information domain events and task context to the desired control commands; the control-physical consistency rule defines the mapping from control commands and the current physical state to the desired physical state at the next moment; and the task-physical consistency rule defines the mapping from information domain events and task context to the desired physical state at the next moment.

5. The method according to claim 4, characterized in that, In step S4, the information domain anomaly score is equal to 1 minus the probability value of the current information domain event in the conditional probability model; the control domain anomaly score is equal to the minimum edit distance between the real-time control sequence and the legal command language accepted by the legal control sequence automaton divided by the sequence length; the physical domain anomaly score is equal to the Mahalanobis distance of the residuals between the actual physical state and the predicted physical state; the cross-domain consistency deviation score is the weighted sum of the task-control consistency deviation, the control-physical consistency deviation, and the task-physical consistency deviation; the dynamic weight vector includes black feature weights, information domain weights, control domain weights, physical domain weights, cross-domain consistency weights, and risk context weights, and the sum of each weight is 1.

6. The method according to claim 5, characterized in that, In step S5, the cross-domain causal order index equals the causal strength of the information domain anomaly leading the control domain anomaly plus the causal strength of the control domain anomaly leading the physical domain anomaly, minus the causal strength of the physical domain anomaly leading the information domain anomaly; the anomaly propagation coverage index equals the total number of nodes marked as anomaly at the current moment divided by the total number of nodes in the cross-domain asset-business association graph; the maintenance context indicator indicates whether there is a maintenance work order or maintenance window; the anomaly self-recovery degree indicates whether the anomaly can disappear on its own without manual intervention; the attack / fault discrimination score is the weighted sum of the black feature matching score, cross-domain consistency deviation score, cross-domain causal order index, and anomaly propagation coverage index minus the weighted sum of the maintenance context indicator and the anomaly self-recovery degree; if the attack / fault discrimination score is greater than or equal to the attack threshold, it is determined to be an attack anomaly; otherwise, if the physical domain anomaly score is greater than the preset physical domain threshold and the black feature matching score is less than the preset black feature threshold, it is determined to be a functional fault.

7. The method according to claim 6, characterized in that, In step S6, the node anomaly score is determined based on the degree of anomaly of the node in the information domain, control domain, and physical domain; the set of anomaly source devices is a subset of nodes initially identified as attack sources in the cross-domain asset-business association graph; the localization optimization objective function is the sum of the squares of the differences between the node anomaly scores of all nodes and the predicted values ​​of the graph propagation attenuation model based on the set of anomaly source devices, plus a penalty coefficient multiplied by the number of nodes in the set of anomaly source devices, where the predicted value of the graph propagation attenuation model is the maximum anomaly contribution of each anomaly source node to the current node, and the anomaly contribution is the shortest path distance between nodes raised to the power of the attenuation coefficient; the set of anomaly source devices that minimizes the localization optimization objective function is used as the localization result, and the set of most suspicious penetrated devices, the set of affected links, the set of affected business nodes, and the recommended isolation boundary are output.

8. The method according to claim 7, characterized in that, In step S7, the set of coordinated response actions includes alarm uploading, evidence preservation, account access restriction, session blocking, northbound interface freezing, control command interception, device isolation, manual switching, partial shutdown, and service degradation. The response optimization objective function is the weighted sum of residual risk, service loss, response delay, and recovery cost after taking the action. The physical security constraint requires that the physical security margin after taking the action be greater than or equal to a preset security threshold. The critical service constraint requires that the critical service retention rate after taking the action be greater than or equal to a preset service threshold. Under the premise of satisfying the physical security constraint and the critical service constraint, the action that minimizes the response optimization objective function is selected as the optimal response action. The response level is determined based on the comprehensive anomaly score and the attack / fault discrimination score. The optimal response action is executed and the results are fed back into the case library, rule library, and threshold library.

9. An automated port network attack detection, localization, and response system based on attack chains and three-domain white baselines, used to implement the automated port network attack detection method based on attack chains and three-domain white baselines as described in any one of claims 1 to 8, characterized in that, include: The cross-domain association graph construction module is used to acquire multi-source data and construct a cross-domain asset-business association graph that includes information domain, control domain, physical domain nodes, and task nodes; The attack chain black feature generation module is used to generate a set of target attack chains and extract three-domain black features through attack simulation or replay to build an attack black feature library. The three-domain white baseline modeling module is used to establish white baseline models for the information domain, control domain, and physical domain, as well as three types of cross-domain consistency rules. The black-and-white fusion detection module is used to calculate the black feature matching score, three-domain anomaly score, and cross-domain consistency deviation score of real-time data, and fuse them to obtain a comprehensive anomaly score. The attack / failure differentiation module is used to calculate attack / failure discrimination scores based on cross-domain causal order, anomaly propagation coverage, maintenance context, and self-recovery level. The abnormal device location module is used to solve for the set of abnormal source devices based on node anomaly scores and graph propagation attenuation inversion. The hierarchical collaborative response module is used to solve for and execute the optimal response action under physical security constraints and critical business constraints.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the automated dock network attack detection method based on attack chain and three-domain white baseline as described in any one of claims 1 to 8.

Images