Industrial control network intrusion detection method based on large language model

Abstract

This invention relates to the field of industrial control network detection technology, and more particularly to an industrial control network intrusion detection method based on a large language model. This invention constructs a joint analysis engine of process semantics and physical constraints based on a large language model, performing time-series prediction of the compliance of operational intentions and their physical consequences, thereby identifying the threat level of abnormal intentions. Combining operational instruction data and physical process state data, it identifies abnormal operational behaviors caused by identity impersonation, internal unauthorized access, or operating condition conflicts, and performs process context mismatch risk analysis on operational instructions. Based on the results of abnormal intention threat level identification and process context mismatch risk analysis, it predicts the intrusion threat level of the industrial control network, thereby executing an adaptive response control scheme. This method can detect complex attacks that are formally legitimate but semantically dangerous, effectively identifying abnormal operations caused by identity impersonation, internal unauthorized access, and operating condition conflicts, thus improving the overall security resilience of the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of industrial control network detection technology, and in particular to an industrial control network intrusion detection method based on a large language model. Background Technology

[0002] With the deepening of the Industrial Internet and intelligent manufacturing strategies, traditionally relatively closed industrial control networks are increasingly interconnected with open information networks, leading to a dramatic expansion of the attack surface and an explosive growth in cyberattacks targeting industrial control systems. Attackers exploit vulnerabilities in industrial control protocols and known vulnerabilities in industrial software through identity impersonation, internal privilege escalation, and supply chain infiltration. This allows them to tamper with operating instructions and falsify physical state data, causing equipment malfunctions, process disruptions, and even major safety incidents. Traditional industrial control intrusion detection methods often rely on static rule matching or simple statistical anomaly detection. These methods suffer from lagging rule base updates and are ill-equipped to handle zero-day attacks. Feature engineering-based machine learning methods require large amounts of labeled data and have limited generalization capabilities. In recent years, deep learning-based temporal anomaly detection methods have been introduced into the field of industrial control security. These methods identify anomalies that deviate from normal patterns by learning the statistical distribution patterns of historical data. However, these methods are essentially data-driven pattern recognition or curve fitting. Their judgment is based solely on whether the data deviates from historical statistical norms. They cannot understand the deep process semantics and physical constraints of industrial processes, nor can they distinguish between statistically abnormal but process-reasonable scenarios and statistically normal but semantically non-compliant scenarios.

[0003] However, existing technologies still have fundamental shortcomings in the field of intrusion detection for industrial control networks. First, existing methods treat operational command sequences and physical process state data in isolation, failing to establish a causal reasoning chain from operational actions to changes in physical state. For example, when detecting the operational command "close the pressure relief valve," existing methods can only determine whether the command is statistically rare, but cannot infer, in the context of the continuously rising reactor pressure, the physical consequence that the operation is highly likely to lead to an overpressure explosion, thus failing to identify this "formally legitimate but semantically dangerous" anomalous intent. Second, existing methods lack the ability to jointly model operator behavior patterns and process condition constraints. Under identity spoofing attacks, attackers may execute commands according to a completely normal operational sequence, but due to a lack of awareness of current special conditions (such as equipment aging or raw material batch differences), their operations are statistically indistinguishable from historical normal behavior, yet are missed by existing methods. In cases of internal unauthorized actions, although the operator possesses legitimate permissions, their command parameters exceed safety boundaries under specific process conditions, which existing methods cannot detect due to the lack of embedded physical constraints. Summary of the Invention

[0004] To overcome the shortcomings and deficiencies of existing technologies, this invention provides an industrial control network intrusion detection method based on a large language model. By collecting industrial control network operation instructions and physical state data, a joint analysis engine for process semantics and physical constraints is constructed using a large language model finely tuned in the field of industrial security. This engine enables compliance reasoning of operation intentions and time-series prediction of physical consequences, outputting the threat level of abnormal intentions. Simultaneously, identity behavior modeling, access control violation detection, and fuzzy operating condition rules are combined to assess the risk of process context mismatch. Finally, the two types of results are fused to predict the degree of intrusion threat and execute an adaptive response.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, embodiments of the present invention provide an industrial control network intrusion detection method based on a large language model, comprising the following steps: Step S1: Synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network; Step S2: Combining operation instruction data, control behavior logs, and physical process status data, a joint analysis engine for process semantics and physical constraints is constructed based on a large language model to perform time-series prediction of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat of abnormal intentions. Step S3: Combining operation instruction data and physical process status data, identify abnormal operation behaviors caused by identity theft, internal unauthorization, or operating condition conflicts, and conduct process context mismatch risk analysis on operation instructions. Step S4: Based on the results of identifying the degree of threat from abnormal intent and the results of the risk analysis of process context mismatch, predict the degree of intrusion threat to the industrial control network; Step S5: Based on the predicted intrusion threat level of the industrial control network, execute an adaptive response control scheme.

[0006] In one implementation of the present invention, step S2 involves constructing a joint analysis engine for process semantics and physical constraints based on a large language model to perform time-series prediction of the compliance of operational intentions and their physical consequences, thereby identifying the degree of threat posed by abnormal intentions; specifically, this includes the following: S21. Align the operation instruction data with the control behavior log by timestamp to generate an operation event description sequence of the current operation instruction sequence in natural language form; aggregate the physical process state data by the same time window to generate a physical state numerical description sequence of the current operation instruction sequence. S22. Input the operation event description sequence and the physical state numerical description sequence into a pre-built process semantics and physical constraint joint analysis engine; the core of the joint analysis engine is a large language model fine-tuned in the field of industrial safety, which has built-in process specification knowledge, physical causal chain and safety constraints; S23. The large language model, based on built-in knowledge, performs cross-modal attention calculation on the input sequence, establishes a causal reasoning chain from operation action to physical state change, predicts the physical state trend within a preset time step in the future, and evaluates whether the corresponding physical state trend violates the preset safety threshold, thereby obtaining the probability of violation and the severity of physical consequences of the operation intention of the current operation instruction sequence. S24. Construct a threat assessment head network on top of the output layer of the large language model. The threat assessment head network is a two-layer fully connected network with the Sigmoid function as the activation function of the output layer. Input the latent space representation of the violation probability and the severity of the physical consequences of the operation intention into the threat assessment head network, and output the abnormal intent threat level of the current operation instruction sequence.

[0007] In one implementation of the present invention, step S3 identifies abnormal operational behaviors caused by identity impersonation, internal unauthorized access, or operating condition conflicts, and performs a process context mismatch risk analysis on the operation instructions; specifically, it includes the following steps: S31. Extract the operator identity, operation role, instruction code, and instruction parameters of the current operation instruction sequence from the operation instruction data; extract the current values ​​of key physical quantities related to process safety from the physical process status data; S32. Based on the historical operation instruction sequence of the operator's identity, construct a first-order Markov behavior model corresponding to the identity, and record the transition probability between normal operation instructions; calculate the average log-likelihood probability of the current operation instruction sequence under the corresponding first-order Markov behavior model, and perform negative normalization on the corresponding average log-likelihood probability to obtain the identity behavior deviation degree of the current operation instruction sequence. S33. Based on the preset access control matrix, check whether the current operator role has the permission to execute the instruction code; if not, the basic unauthorized access level is set to 1; if so, further check whether the instruction parameters exceed the upper limit of the parameter range of the corresponding operator role for the corresponding instruction; if so, calculate the parameter excess ratio and normalize the parameter excess ratio using the preset maximum unauthorized access parameter range to obtain the unauthorized access level of the current operation instruction sequence. S34. Construct a fuzzy rule knowledge base, which contains multiple process prohibition rules. Each process prohibition rule includes a physical quantity state condition, an instruction action condition, and a conflict weight. Calculate the membership degree of the current value of the key physical quantity to each physical quantity state condition, and match the current operation instruction with each instruction action condition. Calculate the working condition conflict degree of the current operation instruction sequence based on the conflict weights corresponding to all process prohibition rules that simultaneously satisfy both the physical quantity state condition and the instruction action condition.

[0008] In one implementation of the present invention, step S3 identifies abnormal operational behaviors caused by identity impersonation, internal unauthorized access, or operational condition conflicts, and performs a process context mismatch risk analysis on the operation instructions; it also specifically includes: S35. The identity behavior deviation degree, the authority overreach degree, and the working condition conflict degree calculated from the current operation instruction sequence are combined into a three-dimensional feature vector, which is then input into a pre-trained logistic regression model. The logistic regression model learns the feature distribution of historical attack samples and normal operation samples and outputs the process context mismatch risk of the current operation instruction sequence.

[0009] In one implementation of the present invention, step S4 predicts the intrusion threat level of the industrial control network based on the results of abnormal intent threat level identification and process context mismatch risk analysis; this includes the following specific steps: S41. Synchronize the threat level of abnormal intent and the risk of process context mismatch in the current operation instruction sequence to a unified time axis; S42. Set a fixed monitoring time window. At the end of each monitoring time window, obtain the degree of abnormal intent threat and the risk of process context mismatch corresponding to the window, and record them as sequence A and sequence B respectively. S43. If there is a new sequence of operation instructions in the current time window, take the degree of threat of abnormal intent and the risk of process context mismatch of the corresponding new sequence of operation instructions. S44. If there is no new operation instruction sequence in the current time window, the abnormal intent threat level and process context mismatch risk of the corresponding operation instruction sequence in the previous time window are inherited. S45. Within a sliding time window, extract the abnormal intent threat level of the current time window, the process context mismatch risk of the current time window, the exponentially weighted moving average of sequence A within the past first preset duration, the exponentially weighted moving average of sequence B within the past first preset duration, the maximum value and variance of sequence A within the past second preset duration, and the maximum value and variance of sequence B within the past second preset duration from sequence A and sequence B, and construct a six-dimensional feature vector as input to the intrusion threat level prediction model; wherein, the second preset duration is longer than the first preset duration.

[0010] In one implementation of the present invention, step S4 predicts the intrusion threat level of the industrial control network based on the results of abnormal intent threat level identification and process context mismatch risk analysis; it also includes the following specific content: The extracted six-dimensional feature vector is input into a pre-trained multilayer perceptron model; the multilayer perceptron model includes an input layer, at least one hidden layer and an output layer, and the activation function of the output layer is the sigmoid function; the output value of the multilayer perceptron model is used as the prediction result of the intrusion threat level of the industrial control network within the current time window.

[0011] In one implementation of the present invention, step S5 involves executing an adaptive response control scheme based on the predicted intrusion threat level of the industrial control network; this includes the following specific steps: S51. Extract the predicted intrusion threat level of the industrial control network within the current time window; S52. Preset response threshold: When the predicted intrusion threat level of the industrial control network within the current time window is greater than the response threshold, the current industrial control network is determined to be in an intruded state, and a blocking command is immediately issued to the corresponding controller; when the predicted intrusion threat level of the industrial control network within the current time window is less than or equal to the response threshold, the current industrial control network is determined to be in a normal state, the default sampling frequency of the current acquisition probe is maintained, and the operation events of the current time window and the corresponding predicted intrusion threat level are recorded to the security audit log without triggering real-time alarms.

[0012] Secondly, embodiments of the present invention also provide an industrial control network intrusion detection system based on a large language model, comprising: The data acquisition module is used to synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network. The operation detection module combines operation instruction data, control behavior logs, and physical process status data to build a joint analysis engine for process semantics and physical constraints based on a large language model. This engine performs time-series predictions of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat from abnormal intentions. The process risk detection module is used to combine operation instruction data and physical process status data to identify abnormal operation behaviors caused by identity impersonation, internal unauthorization, or operating condition conflicts, and to perform process context mismatch risk analysis on operation instructions. The intrusion threat prediction module is used to predict the intrusion threat level of industrial control networks based on the results of abnormal intent threat level identification and process context mismatch risk analysis. The response control module is used to execute adaptive response control schemes based on the predicted intrusion threat level of the industrial control network.

[0013] Compared with the prior art, the present invention has the following advantages and beneficial effects: 1. This invention constructs a joint analysis engine for process semantics and physical constraints, internalizing industrial procedure knowledge and physical causal chains into a large language model, which can detect complex attacks that are formally legal but have dangerous process semantics. 2. This invention effectively identifies abnormal operations caused by identity impersonation, internal unauthorized access, and work condition conflicts by integrating multi-dimensional evaluation of identity behavior deviation, degree of unauthorized access, and degree of work condition conflict, and combines exponential weighted moving average and time series feature extraction, significantly reducing false alarm rate and improving detection coverage. 3. This invention dynamically adjusts the sampling frequency and blocking strategy according to the degree of intrusion threat, achieving millisecond-level security protection while ensuring production continuity, thus improving the overall security resilience of the industrial control system. Attached Figure Description

[0014] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram of the overall process of the industrial control network intrusion detection method based on a large language model according to the present invention. Figure 2 This is an analysis flowchart of step S2 in the industrial control network intrusion detection method based on a large language model of the present invention; Figure 3 This is an analysis flowchart of step S3 in the industrial control network intrusion detection method based on a large language model of the present invention; Figure 4 This is an analysis flowchart of step S4 in the industrial control network intrusion detection method based on a large language model of the present invention; Figure 5 This is a schematic diagram of the structure of the industrial control network intrusion detection system based on a large language model according to the present invention. Detailed Implementation

[0015] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0016] Example 1

[0017] Intrusion detection in industrial control networks is a core technology for ensuring the security of critical infrastructure. Traditional intrusion detection methods are mainly divided into three categories: rule-based detection methods match known attack patterns through predefined security policies, but they cannot detect unknown or variant attacks; statistical analysis-based anomaly detection methods establish a baseline of normal behavior and identify anomalies through deviations, but they are not sensitive enough to complex coordinated attacks and slow penetration attacks; machine learning-based detection methods, including support vector machines, decision trees, and early neural networks, can automatically extract features, but they heavily rely on feature engineering and are difficult to capture long-term temporal dependencies.

[0018] In recent years, deep learning-based methods such as LSTM and Transformer have been introduced into the field of industrial time series anomaly detection. These methods model the statistical regularity of time series data, learn the data distribution under normal patterns, and identify data points that deviate from the predicted distribution as anomalies.

[0019] However, these methods are essentially data-driven pattern recognition or curve fitting, which only judge whether the current data deviates from the historical norm from the numerical level. They lack a deep understanding of the semantics of industrial processes, cannot distinguish between complex scenarios where statistics are abnormal but the process is reasonable and statistics are normal but semantics are violated, and cannot reason about the causal chain between operational intentions and physical consequences, resulting in a high false alarm rate and low threat assessment capability.

[0020] In view of the above-mentioned technical limitations, such as Figure 1 As shown, this embodiment provides an industrial control network intrusion detection method based on a large language model. By constructing a joint analysis engine of process semantics and physical constraints, industrial knowledge is internalized into the reasoning ability of the large language model, achieving a paradigm shift from data fitting to knowledge reasoning. Specifically, it includes the following steps: Step S1: Synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network; Industrial control networks are characterized by distinct hierarchies, diverse protocols, and heterogeneous data. Traditional single-data-source acquisition methods cannot simultaneously acquire operational semantic information and physical process state information, making it difficult for subsequent analysis models to establish causal relationships between operational commands and physical responses.

[0021] In a specific embodiment, lightweight acquisition probes are deployed at the field layer, control layer, and monitoring layer. The field layer probes collect physical process state data from sensors and actuators, such as analog quantities like pressure, temperature, flow rate, and liquid level, and digital quantities like valve opening / closing and motor starting / stopping. The sampling frequency is dynamically set according to the rate of change of the physical quantity; for slow variables like tank liquid level, the sampling frequency is set to 1Hz, and for fast variables like pipeline pressure, the sampling frequency is set to 10Hz. The control layer probes collect operation command data between the programmable logic controller (PLC) and the host computer via a mirror port, including command codes, command parameters, timestamps, and source / destination addresses. The monitoring layer probes collect control behavior logs from the human-machine interface system, including operator login / logout records, interface operation events, parameter modification records, and alarm confirmation records. The three layers of probes use a network time protocol for nanosecond-level clock synchronization to ensure that data from different layers can be aligned on a unified time axis. The acquisition probes have a built-in circular buffer; when network congestion is detected, an exponentially weighted moving average algorithm is used to adaptively downsample the physical process state data to avoid data loss.

[0022] Step S2: Combining operation instruction data, control behavior logs, and physical process status data, a joint analysis engine for process semantics and physical constraints is constructed based on a large language model to perform time-series prediction of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat of abnormal intentions. Step S3: Combining operation instruction data and physical process status data, identify abnormal operation behaviors caused by identity theft, internal unauthorization, or operating condition conflicts, and conduct process context mismatch risk analysis on operation instructions. Step S4: Based on the results of identifying the degree of threat from abnormal intent and the results of the risk analysis of process context mismatch, predict the degree of intrusion threat to the industrial control network; Step S5: Based on the predicted intrusion threat level of the industrial control network, execute an adaptive response control scheme.

[0023] In one specific embodiment, unlike existing anomaly detection methods based on statistical regularities or time-series predictions, this embodiment introduces a large language model into the field of industrial control security. By internalizing process specification knowledge, physical causal chains, and safety constraints, it achieves a fundamental leap from data fitting to knowledge reasoning. For example... Figure 2 As shown, step S2 involves constructing a joint analysis engine for process semantics and physical constraints based on a large language model. This engine performs time-series predictions of the compliance of operational intentions and their physical consequences, thereby identifying the threat level of abnormal intentions. Specifically, this includes the following: S21. Align the operation instruction data with the control behavior log by timestamp to generate an operation event description sequence of the current operation instruction sequence in natural language form. For example, parse "MODBUS function code 0x10 write holding register address 40101 value 75" as "operator writes the set value 75 degrees Celsius to the reactor temperature controller"; aggregate the physical process state data according to the same time window to generate a physical state value description sequence of the current operation instruction sequence. S22. Input the operation event description sequence and the physical state numerical description sequence into a pre-built process semantics and physical constraint joint analysis engine; the core of the joint analysis engine is a large language model fine-tuned in the field of industrial safety, which has built-in process specification knowledge, physical causal chain and safety constraints; S23. The large language model, based on its built-in knowledge, performs cross-modal attention calculation on the input sequence. Specifically, the cross-modal attention calculation enables the large language model to learn the dynamic correlation weights between semantic units in the operation event description sequence and numerical changes in the physical state numerical description sequence; establish a causal reasoning chain from operation action to physical state change, predict the physical state trend within a preset time step in the future, and evaluate whether the corresponding physical state trend violates a preset safety threshold, thereby obtaining the probability of violation and the severity of physical consequences of the operation intent of the current operation instruction sequence. S24. Construct a threat assessment head network on top of the output layer of the large language model. The threat assessment head network is a two-layer fully connected network with the Sigmoid function as the activation function of the output layer. Input the latent space representation of the violation probability and the severity of the physical consequences of the operation intention into the threat assessment head network, and output the abnormal intent threat level of the current operation instruction sequence.

[0024] In one specific embodiment, to achieve joint understanding of operation instructions (text sequences) and physical states (numerical sequences), the large language model employs an autoregressive model based on a Transformer decoder architecture as its backbone network. This backbone network comprises 12 decoder layers, each containing a masked multi-head self-attention mechanism, a cross-attention mechanism, and a feedforward neural network. The model has a dimension of 768, with 12 attention heads, and the intermediate layers of the feedforward neural network have a dimension of 3072. To further achieve joint understanding of the operation instruction text sequences and physical state numerical sequences, this embodiment designs a multimodal embedding layer, which includes a text embedding module, a physical state embedding module, and a position and modality encoding module. The text embedding module segments the operation event description sequence generated in step S1 into words using a word segmenter pre-trained on an industrial corpus, and maps it into text token embedding vectors. The vocabulary size is 50,000 of the most frequent tokens. The operation event description sequence is an operation description in natural language form. The physical state embedding module encodes the sequence of physical state values ​​within a time window to generate a physical state embedding vector. In a specific embodiment, the physical state embedding module can be implemented in one of the following two ways: For each key physical quantity, a set of physically meaningful interval states are defined, and an embedding vector is learned for each interval state. When the current value of the physical quantity is input, the membership degree of the current value of the physical quantity to each interval state is calculated, and a soft embedding vector is obtained by weighted summation. Design a small neural network and construct a three-layer fully connected network containing an input layer, a 16-dimensional hidden layer, and a 768-dimensional output layer. The current value of a physical quantity is directly mapped to a dense vector of fixed dimensions. This small neural network is used as part of the skeleton network for end-to-end training. The position and modality encoding module adds position encoding to each embedding vector and a learnable modality encoding to distinguish whether the current embedding vector belongs to the operational semantic modality or the physical state modality. The operational semantic modality encoding vector has a dimension of 768, and the physical state modality encoding vector has a dimension of 768. The two types of encoding are optimized together with the skeleton network parameters during training. The text token embedding vector and the physical state embedding vector after position encoding and modality encoding are arranged alternately according to timestamps to form a unified operation-physical temporal sequence, which is used as the input of the skeleton network. The backbone network is pre-trained to construct a process-physical causal alignment corpus containing 500,000 operation-physical causal pairs. The following three pre-training tasks are designed to enable the backbone network to learn the correspondence between operation actions and physical variables, common sense of physical causality, and process flow knowledge: Masking process-physical joint modeling task: Construct text containing operation actions and physical variables, randomly mask the tokens corresponding to the operation actions or physical variables with a 15% probability, and train the skeleton network to predict the masked tokens based on the context. Physical constraint violation detection task: Construct positive and negative example sequence pairs of operation actions and physical state changes. Negative example sequence pairs are generated by exchanging the temporal relationship between operation instructions and physical state changes. Train the skeleton network to determine whether the operation actions and physical state changes in the sequence pairs are consistent. Process procedure sequence prediction task: Input an incomplete sequence of operation steps, train the skeleton network to predict the next normal operation step; Specifically, in this embodiment, the AdamW optimizer is used for pre-training, the initial learning rate is set to 3e-4, cosine annealing decay is used after linear warm-up, the batch size is 32, the training epochs are 10, gradient clipping is used to prevent gradient explosion, and the clipping threshold is set to 1.0. After pre-training, an industrial control safety instruction fine-tuning dataset is constructed to fine-tune the backbone network. Each data point in the industrial control safety instruction fine-tuning dataset contains an input instruction and an ideal output pair. The input instructions include a sequence of operation event descriptions and a sequence of physical state numerical descriptions, as well as prompts requiring the evaluation of the compliance of the operation intent and physical consequences, and the output of the threat level of the abnormal intent. The ideal output includes a thought chain reasoning process of intent analysis, physical consequence prediction, and the threat level of the abnormal intent. Furthermore, the fine-tuning stage adopts a low-rank adaptation method, injecting a low-rank matrix with a rank of 8 into the attention layer of the backbone network, updating only about 0.1% of the parameters, setting the learning rate to 2e-5, the batch size to 16, and the training epochs to 5. Above the last hidden state of the fine-tuned backbone network, the last hidden state vector of the last valid token in the sequence is extracted. This hidden state vector is a latent space representation that integrates all operations and physical state context information of the entire input sequence. A threat assessment head network is constructed. This network is a feedforward network comprising: an input layer receiving a 768-dimensional hidden state vector; a first hidden layer, a fully connected layer with a 256-dimensional output, using the GeLU activation function; a dropout layer randomly discarding neurons with a probability of 0.3 to prevent overfitting; a second hidden layer, a fully connected layer with a 64-dimensional output, using the GeLU activation function; and an output layer, a fully connected layer with a 1-dimensional output, using the Sigmoid activation function. The threat assessment head network outputs a continuous numerical value within the range [0,1] as the threat level of the abnormal intent. In this process, the threat assessment head network is trained together with the backbone network during the fine-tuning phase. It employs mean squared error loss or Huber loss (in this embodiment, the threshold parameter for Huber loss can be set to 0.5) to fit the output of the abnormal intent threat level to the target score in the industrial control security instruction fine-tuning dataset. The target score is labeled by security experts based on the actual threat level of the operational behavior, with 0 indicating complete normality and 1 indicating extremely high threat. An early stopping strategy is used during training: training is stopped and the optimal model parameters are restored when the validation set loss does not decrease for three consecutive rounds. Based on the above, the large language model provided in this embodiment, when identifying the threat level of abnormal intent, performs cross-modal attention calculation on the input sequence based on built-in process procedure knowledge, physical causal chains, and safety constraints. It establishes a causal reasoning chain from operational actions to changes in physical state, predicts the physical state trend within the next five time steps, and assesses whether the corresponding trend violates a preset safety threshold. This yields the probability of violation of operational intent and the severity of physical consequences. Finally, the threat assessment head network outputs a comprehensive abnormal intent threat level. The beneficial effects of this embodiment include: applying the knowledge reasoning capability of the large language model to industrial control security detection, realizing a technological paradigm innovation from data fitting to detect abnormal curves to knowledge reasoning to identify abnormal intent; achieving joint understanding of operational semantics and physical state through multimodal embedding layer design, breaking the limitation of isolated processing of two types of data in traditional methods; enabling the model to achieve good performance without a large amount of labeled data by incorporating proprietary knowledge of the industrial control field through a three-stage pre-training task; and making the model interpretable through fine-tuning of the thought chain, making the output reasoning process easier for security analysts to understand the basis for threat judgment.

[0025] In a specific embodiment, specialized detection is performed for three types of special abnormal behaviors in industrial control networks: identity impersonation, internal unauthorized access, and operational condition conflicts. These three types of behaviors may not be fully captured in the operational intent compliance analysis of a large language model because they often manifest as a sequence of instructions that are formally legal but pose risks under specific identities or operational conditions. Specifically, such as Figure 3 As shown, step S3 identifies abnormal operational behaviors caused by identity theft, internal unauthorized access, or operating condition conflicts, and performs a process context mismatch risk analysis on the operation instructions; specifically, it includes the following steps: S31. Extract the operator identity, operation role, instruction code, and instruction parameters of the current operation instruction sequence from the operation instruction data; extract the current values ​​of key physical quantities related to process safety from the physical process status data; S32. Based on the historical operation command sequence of the operator's identity, construct a first-order Markov behavior model corresponding to the identity and record the transition probabilities between normal operation commands. The specific construction process is as follows: For each operator identity, collect all operation command sequences in the past 90 days, count the number of transitions between any two consecutive operation command types, and form a transition matrix M, where M[i][j] represents the frequency of transition from command type i to command type j; normalize each row of the transition matrix to obtain the transition probability matrix P, where P[i][j] is the conditional probability; to avoid the zero probability problem, this embodiment adopts the Laplace smoothing strategy, and the smoothing parameter is set to 0.01; calculate the average log-likelihood probability of the current operation command sequence under the corresponding first-order Markov behavior model, where the formula for calculating the average log-likelihood probability of the current operation command sequence under the corresponding first-order Markov behavior model is: ; In the formula, L is the average log-likelihood probability of the current operation instruction sequence under the corresponding first-order Markov behavior model, T is the length of the current operation instruction sequence, i.e., the total number of operation instructions contained in the sequence, t is the loop index variable, representing the position number of the current instruction in the sequence, and P is the state transition probability matrix, which is the core parameter of the first-order Markov behavior model. The type of the t-th operation instruction in the current operation instruction sequence. The type of the (t+1)th operation instruction in the current operation instruction sequence. Indicates from the first Class instructions are transferred to the first Conditional probability of instruction class; The corresponding average log-likelihood probability is negatively normalized to obtain the identity behavior deviation of the current operation instruction sequence; The formula for calculating the identity behavior deviation degree is as follows: ; In the formula, ABD is the identity behavior deviation degree of the current operation instruction sequence, L is the average log-likelihood probability of the current operation instruction sequence, Lt is the preset likelihood probability threshold. In this embodiment, for example, the preset likelihood probability threshold is the 5th percentile of the average log-likelihood distribution of the corresponding operator's historical normal operation sequence, and a is the normalization slope control parameter, which is determined by fitting historical data. S33. Based on a preset access control matrix, check whether the current operator role has the authority to execute the instruction code; wherein, the access control matrix, defined according to the industrial control system function code, includes the authorization relationship between operation types such as reading holding registers, writing single registers, writing multiple registers, and reading input status and the operator role; if not, the basic unauthorized access level is set to 1; if so, further check whether the instruction parameters exceed the upper limit of the parameter range for the corresponding operator role to the corresponding instruction, wherein, the upper limit of the parameter range is formulated according to the process safety operation procedures, for example, the upper limit of the ordinary operator's authority to modify the reactor temperature setpoint is 150 degrees Celsius; if it exceeds, calculate the parameter exceedance ratio, and normalize the parameter exceedance ratio using the preset maximum unauthorized access parameter range to obtain the unauthorized access level of the current operation instruction sequence; The formula for calculating the degree of privilege escalation is as follows: ; In the formula, PED is the permission level of the current operation instruction sequence, Pa is the actual parameter value of the instruction, Pmax is the maximum value of the corresponding instruction parameter authorized by the corresponding operator role, and Po is the physical maximum allowed value of the corresponding parameter defined by the system. S34. Construct a fuzzy rule knowledge base, which contains multiple process prohibition rules. Each process prohibition rule includes a physical quantity state condition, an instruction action condition, and a conflict weight; for example, "IF reactor pressure is high AND operation instruction is to open exhaust valve THEN conflict weight is 0.9". The fuzzy set of physical quantity states is defined by a membership function. In this embodiment, triangular membership functions and trapezoidal membership functions are used. Each physical quantity defines three fuzzy states: low, normal, and high. The membership function parameters are obtained by clustering historical normal operating data and combining process prohibition rules. The process expert knowledge is determined; the current value of the key physical quantity is used to calculate the membership degree of each physical quantity state condition. For example, for a high pressure ambiguity state, the membership function is a trapezoidal function with parameters that the membership degree is 1 when the pressure is greater than 1.2 MPa, increases linearly when the pressure is between 1.0 and 1.2 MPa, and is 0 when the pressure is less than 1.0 MPa; the current operation command is matched with each command action condition; based on the conflict weights corresponding to all process prohibition rules that simultaneously satisfy the physical quantity state conditions and command action conditions, the working condition conflict degree of the current operation command sequence is calculated;

[0026] The formula for calculating the degree of conflict under the operating conditions is as follows: ; In the formula, WCC represents the condition conflict degree of the current operation command sequence, and Ra represents the set of all process prohibition rules activated by the combination of the current operation command and physical state. Let V be the membership degree of the current value of the physical quantity V to the fuzzy state (such as "high liquid level") defined in the preconditions of rule r. The preset weights for rule r, This is used to extract the maximum value of the calculation result of the formula in parentheses from the set of all activated process prohibition rules; wherein, the current value V of the key physical quantity is input into the membership function of each rule in the fuzzy rule knowledge base to calculate the membership value of the current value V of the key physical quantity to the fuzzy state conditions in each rule. The membership function is defined by a set of preset membership parameters (such as fuzzy set boundary thresholds, function shape control points, etc.), and the membership value is a continuous value calculated in real time based on the current value V of the physical quantity and the membership parameters.

[0027] In one specific embodiment, step S3 identifies abnormal operational behaviors caused by identity impersonation, internal unauthorized access, or operating condition conflicts, and performs a process context mismatch risk analysis on the operation instructions; it also specifically includes: S35. The identity behavior deviation degree, the authority overreach degree, and the working condition conflict degree calculated from the current operation instruction sequence are combined into a three-dimensional feature vector, which is then input into a pre-trained logistic regression model. The logistic regression model learns the feature distribution of historical attack samples and normal operation samples and outputs the process context mismatch risk of the current operation instruction sequence.

[0028] In a specific embodiment, the logistic regression model structure is as follows: the input layer is 3-dimensional, the weight matrix W is 3×1 in size, the bias term b is a scalar, and the output is compressed to the [0,1] interval by the Sigmoid function; The training dataset for the logistic regression model contains 5,000 historical samples, where positive samples are abnormal operations marked in historical attack events, and negative samples are normal operations in normal operation data. The ratio of positive to negative samples is 1:4 to alleviate the class imbalance problem. The model training uses L2 regularization to prevent overfitting, with the regularization coefficient C set to 1.0. The solution algorithm uses the finite memory BFGS quasi-Newton method, with the maximum number of iterations set to 100. The model output is the risk of process context mismatch, which can comprehensively reflect the degree of operational anomaly risk caused by identity theft, unauthorized access, or conflicting operating conditions.

[0029] Based on the above, the beneficial effects of this embodiment include: capturing the operator's personalized behavior patterns through a first-order Markov behavior model to effectively detect identity impersonation attacks; accurately identifying internal unauthorized behavior through a two-layer check of role permission boundaries and parameter ranges; handling the uncertainty of physical state boundaries through a fuzzy rule knowledge base to solve the problem of missed detection in traditional hard threshold methods when operating conditions change abruptly; and significantly reducing the false alarm rate compared to single-index detection through three-layer risk comprehensive assessment.

[0030] The purpose of this embodiment is to integrate the threat level of abnormal intent based on large language model reasoning and the risk of process context mismatch based on rules and statistics, and to achieve a comprehensive assessment of the global intrusion threat level through temporal feature extraction and meta-learning models. The detection results at a single moment may be misjudged due to sensor noise or instantaneous disturbances, and different types of attacks exhibit different characteristics at different time scales. Therefore, it is necessary to synchronize the risk values ​​of the two dimensions to a unified time axis and perform temporal modeling.

[0031] In a specific embodiment, such as Figure 4 As shown, step S4 predicts the intrusion threat level of the industrial control network based on the results of abnormal intent threat level identification and process context mismatch risk analysis; it includes the following specific steps: S41. Synchronize the threat level of abnormal intent and the risk of process context mismatch in the current operation instruction sequence to a unified time axis; S42. Set a monitoring time window with a fixed duration (in this embodiment, the fixed duration can be 10 seconds). At the end of each monitoring time window, obtain the abnormal intent threat level and process context mismatch risk corresponding to the window, and record them as sequence A and sequence B respectively. S43. If there is a new sequence of operation instructions in the current time window, take the degree of threat of abnormal intent and the risk of process context mismatch of the corresponding new sequence of operation instructions. S44. If there is no new operation instruction sequence in the current time window, the abnormal intent threat level and process context mismatch risk of the corresponding operation instruction sequence in the previous time window are inherited. S45. Within a sliding time window, extract the abnormal intent threat level, process context mismatch risk, exponentially weighted moving average of sequence A within the past first preset duration, exponentially weighted moving average of sequence B within the past first preset duration, maximum value and variance of sequence A within the past second preset duration, and maximum value and variance of sequence B within the past second preset duration from sequence A and sequence B to construct a six-dimensional feature vector, which serves as the input to the intrusion threat level prediction model. The second preset duration is longer than the first preset duration. In a specific embodiment, the first preset duration can be set to 60 seconds (6 time windows), and the second preset duration can be set to 300 seconds (30 time windows). Further, in this embodiment, when there is no new operation instruction sequence within the current time window, in addition to inheriting the abnormal intent threat level and process context mismatch risk, the corresponding exponentially weighted moving average, maximum value, and variance are also maintained or decayed based on the inherited values. Specifically, the exponentially weighted moving average remains unchanged, while the historical sequence window upon which the maximum value and variance are based slides forward, no longer containing repeated old values, to avoid feature passivation.

[0032] This embodiment uses sequence A as the calculation parameter sequence, and the calculation formula for the exponentially weighted moving average is explained as follows: ; In the formula, This represents the exponentially weighted moving average of the anomalous intent threat level sequence A within the current time window (index i), used to reflect the recent overall risk level and eliminate random fluctuations from single observations. b is a smoothing factor, ranging from (0,1]. The closer b is to 1, the greater the weight of the current value, the weaker the smoothing effect, and the more sensitive the sequence is to instantaneous changes; the closer b is to 0, the greater the weight of historical values, the stronger the smoothing effect, and the more stable the sequence. Furthermore, in this embodiment, b=0.3 is determined using a historical data fitting method (5000 samples, aiming to minimize prediction error); ai is the original value of the anomalous intent threat level within the current time window (index i). This represents the weighted moving average of the abnormal intent threat level index calculated in the previous time window (index i-1). It should be noted that for the initial window (i=1), the weighted moving average of the abnormal intent threat level index is set as the average value of the abnormal intent threat level during the historical normal period. In this embodiment, the overall average value of the abnormal intent threat level under normal conditions in the training set is taken as the initial value.

[0033] In a specific embodiment, step S4 predicts the intrusion threat level of the industrial control network based on the results of abnormal intent threat level identification and process context mismatch risk analysis; it also includes the following specific content: The extracted six-dimensional feature vector is input into a pre-trained multilayer perceptron model; the multilayer perceptron model includes an input layer, at least one hidden layer and an output layer, and the activation function of the output layer is the sigmoid function; the output value of the multilayer perceptron model is used as the prediction result of the intrusion threat level of the industrial control network within the current time window.

[0034] In a specific embodiment, the multilayer perceptron model structure is as follows: the input layer receives a 6-dimensional feature vector; the first hidden layer is a fully connected layer with a 32-dimensional output dimension, using the ReLU activation function, and a batch normalization layer is added to accelerate training; the Dropout layer randomly discards neurons with a probability of 0.2; the second hidden layer is a fully connected layer with a 16-dimensional output dimension, using the ReLU activation function; the output layer is a fully connected layer with a 1-dimensional output dimension, using the Sigmoid activation function to output the predicted intrusion threat level in the interval [0,1]. The training dataset for the multilayer perceptron model contains 10,000 labeled samples. Each sample consists of a six-dimensional feature vector calculated from the abnormal intent threat level sequence and the process context mismatch risk sequence for 30 consecutive time windows, as well as the actual intrusion status label for the corresponding time window. The label is determined by the security incident investigation results, with 1 indicating that an intrusion event did occur during the period and 0 indicating that there was no intrusion. The Adam optimizer was used during training, with an initial learning rate of 0.001, a batch size of 32, and 50 training epochs. An early stopping strategy was adopted, which stopped the training when the validation set loss did not decrease for 10 consecutive epochs. The loss function used was binary cross-entropy loss. To address the class imbalance problem, the weight of positive samples was set to 3 and the weight of negative samples was set to 1. The model evaluation metrics included accuracy, precision, recall, and F1 score, achieving an F1 score of 0.92 on the validation set.

[0035] Based on the content, the beneficial effects of this embodiment include: capturing the progressive evolution characteristics of attack behavior through temporal feature extraction, effectively detecting slow penetration attacks; the exponentially weighted moving average feature reflects recent risk trends, the variance feature reflects the degree of risk fluctuation, and the maximum value feature reflects peak risk, thus characterizing intrusion risk from multiple perspectives; the multilayer perceptron model automatically learns the nonlinear combination weights of multidimensional features, which has stronger expressive power compared to the fixed weighted fusion method; and the sliding time window design enables continuous output of real-time intrusion threat level, meeting the real-time requirements of industrial control security monitoring.

[0036] In a specific embodiment, step S5 involves executing an adaptive response control scheme based on the predicted intrusion threat level of the industrial control network; this includes the following specific steps: S51. Extract the predicted intrusion threat level of the industrial control network within the current time window; S52. A preset response threshold is set. When the predicted intrusion threat level of the industrial control network within the current time window is greater than the response threshold, the current industrial control network is determined to be in an intruded state, and a blocking command is immediately issued to the corresponding controller. When the predicted intrusion threat level of the industrial control network within the current time window is less than or equal to the response threshold, the current industrial control network is determined to be in a normal state. The default sampling frequency of the current acquisition probe is maintained, and the operation events and corresponding intrusion threat level prediction results of the current time window are recorded to the security audit log without triggering real-time alarms. The weight and threshold values ​​not specifically described in this embodiment are determined as follows: 5000 sets of historical operation data of the industrial control network containing normal operations and known intrusion events are acquired. The operation command sequence, physical process status data, and corresponding actual security status labels (whether identity impersonation, unauthorized operation, or real intrusion has occurred) are collected synchronously within each time window. For each set of data, candidate intermediate features are calculated, such as the average log-likelihood probability L, the undetermined parameter expression in the identity behavior deviation degree ABD, the exponentially weighted moving average, etc. At the same time, the real anomaly judgment result corresponding to each set of data (such as whether intrusion or unauthorized operation has occurred) is obtained. These 5000 sets of data were imported into the `curve_fit` nonlinear least squares fitting function in the SciPy library of the Python scientific computing environment to construct an objective function for the parameters to be optimized (e.g., the ABD calculation formula or the intrusion threat prediction error function). Maximizing the coefficient of determination was the optimization objective, and the Levenberg-Marquardt algorithm was used for iterative solution. The output was the optimal parameter combination that minimized the sum of squared residuals between the fitted curve and the true label. Specifically, for Lt and a in the identity behavior bias, ... For the fitting function, with the L-value distribution of historical normal operation sequences and the identity fraud event labels as dependent variables, Lt is fitted and taken as the 5th percentile of the log-likelihood distribution of historical normal operations, with a=10. For the smoothing factor of the exponentially weighted moving average, with the objective of minimizing the mean square error between the EWMA predicted value and the actual risk sequence, the fitting smoothing factor is 0.3. For the response threshold, with the objective of maximizing detection accuracy and minimizing false alarm rate, the threshold that maximizes the F1 score on the validation set is selected as the response threshold through grid search combined with five-fold cross-validation.

[0037] Example 2

[0038] like Figure 5 As shown, this embodiment provides an industrial control network intrusion detection system based on a large language model, including: The data acquisition module is used to synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network. The operation detection module combines operation instruction data, control behavior logs, and physical process status data to build a joint analysis engine for process semantics and physical constraints based on a large language model. This engine performs time-series predictions of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat from abnormal intentions. The process risk detection module is used to combine operation instruction data and physical process status data to identify abnormal operation behaviors caused by identity impersonation, internal unauthorization, or operating condition conflicts, and to perform process context mismatch risk analysis on operation instructions. The intrusion threat prediction module is used to predict the intrusion threat level of industrial control networks based on the results of abnormal intent threat level identification and process context mismatch risk analysis. The response control module is used to execute adaptive response control schemes based on the predicted intrusion threat level of the industrial control network.

[0039] The parameters and steps for implementing the corresponding functions of each unit module in the industrial control network intrusion detection system based on a large language model of the present invention described above can be referred to the parameters and steps in the embodiments of the industrial control network intrusion detection method based on a large language model described above, and will not be repeated here.

[0040] The various embodiments in this invention are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the embodiments for IoT devices and media are relatively simple in description because they are fundamentally similar to the method embodiments; relevant parts can be referred to the descriptions in the method embodiments.

[0041] The systems, media, and methods provided in the embodiments of the present invention are in one-to-one correspondence. Therefore, the systems and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the systems and media will not be repeated here.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0043] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0044] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0045] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0046] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0047] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0048] It should also be noted that the terms include, encompass, or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Without further limitations, the presence of additional identical elements in the process, method, article, or apparatus that includes elements is not excluded.

[0049] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. An industrial control network intrusion detection method based on a large language model, characterized in that, Includes the following steps: Step S1: Synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network; Step S2: Combining operation instruction data, control behavior logs, and physical process status data, a joint analysis engine for process semantics and physical constraints is constructed based on a large language model to perform time-series prediction of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat of abnormal intentions. Step S3: Combining operation instruction data and physical process status data, identify abnormal operation behaviors caused by identity theft, internal unauthorization, or operating condition conflicts, and conduct process context mismatch risk analysis on operation instructions. Step S4: Based on the results of identifying the degree of threat from abnormal intent and the results of the risk analysis of process context mismatch, predict the degree of intrusion threat to the industrial control network; Step S5: Based on the predicted intrusion threat level of the industrial control network, execute an adaptive response control scheme.

2. The industrial control network intrusion detection method based on a large language model according to claim 1, characterized in that, In step S2, a joint analysis engine for process semantics and physical constraints is constructed based on a large language model to perform time-series prediction of the compliance of operational intentions and physical consequences, thereby identifying the threat level of abnormal intentions; specifically, it includes the following: S21. Align the operation instruction data with the control behavior log by timestamp to generate an operation event description sequence of the current operation instruction sequence in natural language form; aggregate the physical process state data by the same time window to generate a physical state numerical description sequence of the current operation instruction sequence. S22. Input the operation event description sequence and the physical state numerical description sequence into a pre-built process semantics and physical constraint joint analysis engine; the core of the joint analysis engine is a large language model fine-tuned in the field of industrial safety, which has built-in process specification knowledge, physical causal chain and safety constraints; S23. The large language model, based on built-in knowledge, performs cross-modal attention calculation on the input sequence, establishes a causal reasoning chain from operation action to physical state change, predicts the physical state trend within a preset time step in the future, and evaluates whether the corresponding physical state trend violates the preset safety threshold, thereby obtaining the probability of violation and the severity of physical consequences of the operation intention of the current operation instruction sequence. S24. Construct a threat assessment head network on top of the output layer of the large language model. The threat assessment head network is a two-layer fully connected network with the Sigmoid function as the activation function of the output layer. Input the latent space representation of the violation probability and the severity of the physical consequences of the operation intention into the threat assessment head network, and output the abnormal intent threat level of the current operation instruction sequence.

3. The industrial control network intrusion detection method based on a large language model according to claim 2, characterized in that, In step S3, abnormal operating behaviors caused by identity theft, internal unauthorized access, or operating condition conflicts are identified, and a process context mismatch risk analysis is performed on the operating instructions. Specifically, the following steps are included: S31. Extract the operator identity, operation role, instruction code, and instruction parameters of the current operation instruction sequence from the operation instruction data; extract the current values ​​of key physical quantities related to process safety from the physical process status data; S32. Based on the historical operation instruction sequence of the operator's identity, construct a first-order Markov behavior model corresponding to the identity, and record the transition probability between normal operation instructions; calculate the average log-likelihood probability of the current operation instruction sequence under the corresponding first-order Markov behavior model, and perform negative normalization on the corresponding average log-likelihood probability to obtain the identity behavior deviation degree of the current operation instruction sequence. S33. Based on the preset access control matrix, check whether the current operator role has the permission to execute the instruction code; if not, the basic unauthorized access level is set to 1; if so, further check whether the instruction parameters exceed the upper limit of the parameter range of the corresponding operator role for the corresponding instruction; if so, calculate the parameter excess ratio and normalize the parameter excess ratio using the preset maximum unauthorized access parameter range to obtain the unauthorized access level of the current operation instruction sequence. S34. Construct a fuzzy rule knowledge base, which contains multiple process prohibition rules. Each process prohibition rule includes a physical quantity state condition, an instruction action condition, and a conflict weight. Calculate the membership degree of the current value of the key physical quantity to each physical quantity state condition, and match the current operation instruction with each instruction action condition. Calculate the working condition conflict degree of the current operation instruction sequence based on the conflict weights corresponding to all process prohibition rules that simultaneously satisfy both the physical quantity state condition and the instruction action condition.

4. The industrial control network intrusion detection method based on a large language model according to claim 3, characterized in that, Step S3, which identifies abnormal operational behaviors caused by identity theft, internal unauthorized access, or conflicting operating conditions, and performs a process context mismatch risk analysis on the operational instructions, further includes: S35. The identity behavior deviation degree, the authority overreach degree, and the working condition conflict degree calculated from the current operation instruction sequence are combined into a three-dimensional feature vector, which is then input into a pre-trained logistic regression model. The logistic regression model learns the feature distribution of historical attack samples and normal operation samples and outputs the process context mismatch risk of the current operation instruction sequence.

5. The industrial control network intrusion detection method based on a large language model according to claim 4, characterized in that, In step S4, the intrusion threat level of the industrial control network is predicted based on the results of abnormal intent threat level identification and process context mismatch risk analysis. The specific steps include the following: S41. Synchronize the threat level of abnormal intent and the risk of process context mismatch in the current operation instruction sequence to a unified time axis; S42. Set a fixed monitoring time window. At the end of each monitoring time window, obtain the degree of abnormal intent threat and the risk of process context mismatch corresponding to the window, and record them as sequence A and sequence B respectively. S43. If there is a new sequence of operation instructions in the current time window, take the degree of threat of abnormal intent and the risk of process context mismatch of the corresponding new sequence of operation instructions. S44. If there is no new operation instruction sequence in the current time window, the abnormal intent threat level and process context mismatch risk of the corresponding operation instruction sequence in the previous time window are inherited. S45. Within a sliding time window, extract the abnormal intent threat level of the current time window, the process context mismatch risk of the current time window, the exponentially weighted moving average of sequence A within the past first preset duration, the exponentially weighted moving average of sequence B within the past first preset duration, the maximum value and variance of sequence A within the past second preset duration, and the maximum value and variance of sequence B within the past second preset duration from sequence A and sequence B, and construct a six-dimensional feature vector as input to the intrusion threat level prediction model; wherein, the second preset duration is longer than the first preset duration.

6. The industrial control network intrusion detection method based on a large language model according to claim 5, characterized in that, Step S4, based on the results of identifying the degree of threat from abnormal intent and the results of analyzing the risk of process context mismatch, predicts the degree of intrusion threat to the industrial control network; it also includes the following specific content: The extracted six-dimensional feature vector is input into a pre-trained multilayer perceptron model; the multilayer perceptron model includes an input layer, at least one hidden layer and an output layer, and the activation function of the output layer is the sigmoid function; the output value of the multilayer perceptron model is used as the prediction result of the intrusion threat level of the industrial control network within the current time window.

7. The industrial control network intrusion detection method based on a large language model according to claim 6, characterized in that, In step S5, an adaptive response control scheme is executed based on the intrusion threat level prediction results of the industrial control network. The specific steps include the following: S51. Extract the predicted intrusion threat level of the industrial control network within the current time window; S52. Preset response threshold: When the predicted intrusion threat level of the industrial control network within the current time window is greater than the response threshold, the current industrial control network is determined to be in an intruded state, and a blocking command is immediately issued to the corresponding controller; when the predicted intrusion threat level of the industrial control network within the current time window is less than or equal to the response threshold, the current industrial control network is determined to be in a normal state, the default sampling frequency of the current acquisition probe is maintained, and the operation events of the current time window and the corresponding predicted intrusion threat level are recorded to the security audit log without triggering real-time alarms.

8. An industrial control network intrusion detection system based on a large language model, implemented according to any one of claims 1-7, characterized in that, The system includes: The data acquisition module is used to synchronously collect operation command data, control behavior logs, and physical process status data through acquisition probes deployed at various levels of the industrial control network. The operation detection module combines operation instruction data, control behavior logs, and physical process status data to build a joint analysis engine for process semantics and physical constraints based on a large language model. This engine performs time-series predictions of the compliance of operation intentions and physical consequences, thereby identifying the degree of threat from abnormal intentions. The process risk detection module is used to combine operation instruction data and physical process status data to identify abnormal operation behaviors caused by identity impersonation, internal unauthorization, or operating condition conflicts, and to perform process context mismatch risk analysis on operation instructions. The intrusion threat prediction module is used to predict the intrusion threat level of industrial control networks based on the results of abnormal intent threat level identification and process context mismatch risk analysis. The response control module is used to execute adaptive response control schemes based on the predicted intrusion threat level of the industrial control network.

Images