An industrial control protocol identification and attack resistance processing method, system and server

Abstract

The application discloses a kind of industrial control protocol identification and attack processing method, system and server, and relates to data processing. Multiple-source interaction records in industrial control network are acquired to construct protocol attachment track and assign control location identification, and based on control location identification, occupation relationship and protocol shadow chain are formed. Real-time messages are mapped to protocol shadow chain to perform occupation verification to identify free control fragments, and active probing behavior is identified in combination with detection control location identification. Control is decoupled for abnormal behavior and imported into a limited redemption channel to form attack analysis texture, and based on attack analysis texture, traceability identification, hierarchical disposal and protocol attachment track and protocol shadow chain are synchronously updated. By implementing the technical solution, in a complex network environment where the host station and the field device are located, the context loss problem caused by the difficulty in reconstructing the protocol session due to the attack behavior of the attacker is solved, so as to improve the accuracy of industrial control protocol identification, enhance the anti-attack capability and improve the control accuracy of the industrial control system.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically to a method, system, and server for industrial control protocol identification and anti-attack processing. Background Technology

[0002] In industrial control systems, control protocols typically rely on continuous request-response chains and contextual relationships to express control semantics. Protocol identification and security protection methods are also generally based on semantic parsing and behavior determination using complete session structures. However, in actual industrial network operating environments, due to factors such as complex network topology, multi-level forwarding of communication links, and differences in device performance, protocol messages often undergo fragmentation, reassembly, buffering and forwarding, and packet loss during transmission. This results in the message sequences acquired by the acquisition side exhibiting out-of-order, incomplete, or semantically fragmented characteristics. Furthermore, under high load or network congestion scenarios, the probability of message loss increases significantly, and critical request or response segments in the protocol session cannot be completely captured, further exacerbating the discontinuity of the session structure.

[0003] For example, the master station issues switch opening and closing commands to multiple bay-level devices via industrial Ethernet, while field devices perform protocol conversion through a gateway, such as converting from IEC104 to Modbus or a proprietary protocol. Under high load or link congestion, some messages may be lost or out of order, resulting in an incomplete message sequence seen by the acquisition side. In this case, if an attacker inserts forged control messages, such as simulating opening confirmations or sending execution feedback prematurely, the system may mistakenly believe that the control has been completed, thereby concealing the true control path or inducing erroneous operations.

[0004] Therefore, in complex network environments where the master station and field devices are located, the context loss problem caused by attackers' attacks making it difficult to fully reconstruct the protocol session has become a major technical bottleneck that restricts the accuracy of industrial control protocol identification and the improvement of anti-attack capabilities, thus affecting the control accuracy of the final industrial control system. Summary of the Invention

[0005] This application provides an industrial control protocol identification and anti-attack processing method, system, and server, which solves the problem of missing context caused by the difficulty in completely reconstructing protocol sessions due to attackers' attack behavior in complex network environments between the master station and field devices. This improves the accuracy of industrial control protocol identification and enhances anti-attack capabilities, thereby improving the control precision of the industrial control system.

[0006] The first aspect of this application provides a method for industrial control protocol identification and anti-attack processing. The method includes: acquiring master station interaction records, slave station interaction records, protocol conversion records, device operation logs, and process variable evolution records from an industrial control network; performing time alignment and direction merging to construct a protocol attachment trajectory; and assigning a control position identifier to each control command; constructing an occupancy relationship between the control position identifiers based on the protocol attachment trajectory; and generating shadow control position identifiers corresponding to the control position identifiers to form a protocol shadow chain; performing control position identifier mapping processing on real-time messages and occupanting them within the protocol shadow chain. Verification is performed to identify detached control segments; a detection control position identifier is set in the protocol shadow chain, and the occupancy behavior of the detection control position identifier is identified based on the real-time message to obtain active detection behavior; the detached control segment is decoupled from the active detection behavior and imported into a restricted redemption channel to form an attack analysis texture; source tracing is performed based on the attack analysis texture, and the corresponding control position identifier is subject to hierarchical processing. At the same time, the protocol attachment trajectory and the protocol shadow chain are synchronously updated in combination with the evolution of the device operation stage to maintain the effectiveness of control position occupancy determination and attack identification under context-deficient conditions.

[0007] A second aspect of this application provides an industrial control protocol identification and anti-attack processing system. The system includes an acquisition module and a processing module. The acquisition module acquires master station interaction records, slave station interaction records, protocol conversion records, device operation logs, and process variable evolution records from the industrial control network, and performs time alignment and direction merging to construct a protocol attachment trajectory. Simultaneously, it assigns a control position identifier to each control command. The processing module constructs the occupancy relationship between the control position identifiers based on the protocol attachment trajectory and generates shadow control position identifiers corresponding to the control position identifiers to form a protocol shadow chain. The processing module further performs control position identifier mapping processing on real-time messages and maps them to the protocol shadow chain. The processing module performs occupancy verification to identify free control segments. It also sets detection control location identifiers in the protocol shadow chain and identifies occupancy behavior based on the real-time messages to obtain active detection behavior. Furthermore, the processing module decouples the free control segments from the active detection behavior and imports them into a restricted redemption channel to form an attack analysis texture. Finally, the processing module performs source tracing based on the attack analysis texture and performs tiered handling of the corresponding control location identifiers. Simultaneously, it updates the protocol attachment trajectory and the protocol shadow chain synchronously with the device's operational phase evolution to maintain the effectiveness of control location occupancy determination and attack identification under context-deficient conditions.

[0008] A third aspect of this application provides a server comprising a processor, a memory, a user interface, and a network interface, wherein the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the server to perform the method described above.

[0009] A fourth aspect of this application provides a non-transitory computer-readable storage medium storing instructions that, when executed, perform the method described above.

[0010] In summary, one or more technical solutions provided in this application have at least the following technical effects or advantages: By transforming protocol behavior into a protocol attachment trajectory and control location identification system, the identification process is freed from dependence on complete sessions, enabling stable recovery of control semantics even in cases of missing or out-of-order messages. Decoupling actual execution from identification judgment is achieved through protocol shadow chains, establishing a reliable reference system without affecting on-site control. Location mapping and occupancy verification enhance the ability to identify covert and semantic masquerading attacks. An active detection and identification mechanism is introduced by detecting control location identifiers, enabling early detection of pre-attack behaviors. Control decoupling and restricted fulfillment channels isolate risks while preserving the attack behavior evolution path, thus forming high-value attack analysis textures. Finally, combining source tracing, hierarchical handling, and a synchronous update mechanism that evolves with the device's operating status, precise protection and long-term stable operation are achieved. Therefore, even in complex network environments where the master station and field devices are located, this solution addresses the context loss problem caused by the difficulty in fully reconstructing protocol sessions, improving the accuracy of industrial control protocol identification and enhancing anti-attack capabilities, thereby improving the control precision of industrial control systems. Attached Figure Description

[0011] Figure 1 A flowchart illustrating an industrial control protocol identification and anti-attack processing method provided in this application embodiment; Figure 2 A schematic diagram of a module for an industrial control protocol identification and anti-attack processing system provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a server provided in an embodiment of this application.

[0012] Explanation of reference numerals in the attached figures: 21. Acquisition module; 22. Processing module; 31. Processor; 32. Communication bus; 33. User interface; 34. Network interface; 35. Memory. Detailed Implementation

[0013] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0014] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0015] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. In addition, the terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0016] To address the aforementioned technical problems, this application provides a method for industrial control protocol identification and anti-attack processing, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an industrial control protocol identification and anti-attack processing method provided in an embodiment of this application. The method is applied to a server and includes steps S110 to S160, as follows:

[0017] S110: Obtain master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs, and process variable evolution records from the industrial control network, and perform time alignment and direction merging to construct the protocol attachment trajectory, while assigning a control position identifier to each control command.

[0018] Specifically, a unified access and record aggregation environment is first established around the industrial control network, enabling the continuous reception of master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs, and process variable evolution records within the same processing plane. Master station interaction records refer to the interactive information sent by the master station equipment to the controlled field equipment, such as reading, writing, starting / stopping, switching, resetting, and parameter distribution. Slave station interaction records refer to the responses, confirmations, exception codes, or status data returned by slave devices to master station interaction requests. Protocol conversion records refer to the corresponding records formed when protocol conversion equipment rewrites fields, performs semantic transfers, addresses, or encapsulates messages between different protocol formats. Equipment operation logs refer to the records of internal equipment operation behaviors such as instruction reception, execution initiation, execution completion, exception triggering, and state switching. Process variable evolution records refer to the records of changes in physical process quantities such as temperature, pressure, current, voltage, opening degree, speed, and flow rate of the controlled object under control. The significance of this setting is that it no longer relies solely on the network packets themselves to recover control semantics, but allows communication behavior, device behavior, and process behavior to jointly participate in the subsequent protocol attachment trajectory construction, thereby improving the completeness and reliability of the subsequent identification results.

[0019] When performing source normalization on records from different sources, it is necessary to first convert data from different acquisition sources, different device formats, and different time writing methods into standardized record units. Source normalization refers to extracting the time field, device field, function field, object field, status field, and result field from the original record and mapping them into a unified data structure. The standard record unit is the smallest record carrier for subsequent unified processing, which contains at least the record time, source identifier, destination identifier, control object, functional semantics, direction attribute, execution status, result content, and source type. The recording time describes the moment the record occurred; the source and destination identifiers represent the start and end points of communication or behavior; the controlled object represents the device, register area, execution unit, or process variable channel to which the record operates; the functional semantics represent the control meaning of the record, such as read, write, start, stop, acknowledge, report, or conversion; the direction attribute represents the position of the record in the overall control chain, whether it is initiating, receiving, feeding back, or influencing; the execution status represents the state of the control behavior corresponding to the record, whether it is pending execution, in execution, completed, rejected, or abnormally interrupted; the result content retains the response value, code, status value, or variable change value; and the source type represents whether the standard record unit originates from the master station interaction record, slave station interaction record, protocol conversion record, device operation log, or process variable evolution record. After this step, all subsequent records participate in calculations under the same structure, avoiding semantic breaks due to different original source formats.

[0020] After forming standard record units, time alignment is required to map records distributed across different acquisition nodes, network paths, and write links to a unified timeline. Time alignment is not simply sorting by original timestamps; it first eliminates clock skew between acquisition sources, then compensates for communication transmission delays, log write delays, and process sampling delays, finally forming a unified time series. A unified time series is an ordered set of standard record units arranged on the same time base, reflecting the continuous temporal unfolding of the same control action from initiation to impact. To improve the accuracy of time alignment results, a time correction function can be constructed to correct records from different sources.

[0021] in, Indicates the corrected unified time; Indicates the original record time; This indicates the clock offset compensation amount for the acquisition node, which is determined based on the offset of the acquisition node relative to a unified clock reference. This represents the amount of network transmission delay compensation, which is estimated based on message link propagation delay, switching and forwarding delay, and queuing delay. This indicates the amount of log write latency compensation, determined based on the lag between the device log being triggered and the record being written to disk. This represents the process sampling delay compensation amount, determined comprehensively based on the sensor sampling period, edge buffer period, and upload period. The purpose of the above formula is to unify records originally in different time systems back to the same time reference plane, enabling subsequent sets of the same control commands to be correctly aggregated.

[0022] While completing time alignment, direction merging processing needs to be performed on standard record units. Direction merging processing means no longer distinguishing based solely on the direction of message transmission, but rather merging all standard record units into four categories based on control chain semantics: control initiation direction, control acceptance direction, control feedback direction, and control influence direction. The control initiation direction represents the direction in which the master station device initiates a control request or query request to the controlled object; the control acceptance direction represents the direction in which protocol conversion devices, edge nodes, or intermediate forwarding nodes transmit, modify, or accept control semantics; the control feedback direction represents the direction in which slave devices, execution units, or internal systems return responses or acknowledgments to preceding control actions; and the control influence direction represents the direction of state changes ultimately formed at the process variable level by the control actions. Because different standard record units differ in functional semantics, source type, and target, a direction determination function needs to be constructed to complete the merging.

[0023] in, Represents standard record unit The corresponding directional merging results; This represents the direction determination function; Indicates the source type, used to distinguish whether the record comes from the master station interaction record, slave station interaction record, protocol conversion record, device operation log, or process variable evolution record; The functional semantics are used to characterize whether the record belongs to the control meaning such as reading, writing, conversion, confirmation, or variable reporting; Indicates the controlled object, used to characterize which device, component, register area, or variable channel the record operates on; The result content is used to help identify whether the record is in the initiation, continuation, feedback, or influence stage. Through this directional merging process, the records in the subsequent unified time series are no longer unstructured, but are hierarchically organized into a traceable control direction chain.

[0024] After the unified time series and directional merging results are formed, interactive aggregation processing needs to be performed around the same controlled object to form a control instruction set. The controlled object refers to the unique target entity acted upon by the same control behavior; it can be the same device, the same register region, the same actuator, or the same process variable channel. Interactive aggregation processing refers to merging standard record units that revolve around the same controlled object within a unified time window and are functionally related into a complete control behavior unit. The control instruction set is the set of all standard record units corresponding to a control chain of the same controlled object. In practice, candidate starting points are first selected from the standard record units in the control initiation direction, and then records matching the candidate starting point in terms of controlled object, functional semantics, and time neighborhood are searched from the control receiving direction, control feedback direction, and control influence direction, thus forming a complete control instruction set. To evaluate whether a certain standard record unit should be merged into the current control instruction set, an aggregation correlation function can be constructed:

[0025] in, Represents standard record unit With standard recording unit The degree of aggregation correlation between them; This indicates the consistency of the control object and is used to determine whether two records act on the same control object. The value range can be set from 0 to 1, with the closer to 1 indicating higher consistency. This represents the semantic relevance of functions, used to determine the degree of semantic continuity between two records in terms of reading, writing, confirmation, conversion, or impact on presentation. The value can be set from 0 to 1. This represents temporal proximity, used to determine the degree of adjacency between two records in a unified time series. The value can be set from 0 to 1. This indicates the direction of connection matching, used to determine whether two records form a reasonable connection between the control initiation direction, control acceptance direction, control feedback direction, and control influence direction. The value range can be set from 0 to 1. , , , These represent weighting coefficients, each ranging from 0 to 1, with the sum of all weighting coefficients being 1. They are used to adjust the relative importance of control object consistency, functional semantic relevance, temporal proximity, and directional continuity matching in aggregation. This function can be used to group the most relevant standard record units into the same set of control instructions.

[0026] After the control command set is formed, a protocol attachment trajectory needs to be constructed based on it. The protocol attachment trajectory refers to the attached trajectory expression formed by the continuous unfolding of the same control command along the control initiation direction, control acceptance direction, control feedback direction, and control influence direction in a unified time sequence. It is not a single message path, but a control semantic trajectory that incorporates communication positions, execution positions, and influence positions. To make the protocol attachment trajectory structure clear, the control initiation position, protocol acceptance position, feedback return position, execution confirmation position, and influence presentation position need to be explicitly written within it. The control initiation position refers to the starting position where the control command is formally issued by the master station device; the protocol acceptance position refers to the transition position where the control semantics are transferred, rewritten, or maintained in the protocol conversion device or intermediate link; the feedback return position refers to the position where the slave device or execution unit responds to the control command or transmits its status; the execution confirmation position refers to the position where the device's internal log or state machine clearly indicates that the control behavior has been received, executed, or terminated; the influence presentation position refers to the position where the control behavior shows observable changes at the process variable level. Since the protocol attachment trajectory is essentially a position sequence, each position needs to be sequentially encoded.

[0027] in, Indicates the first Trajectory position encoding of each attachment location; This represents the position encoding function; This indicates the unified time of the standard recording unit corresponding to this location; Indicates the directional merging category to which this position belongs; This indicates the functional semantics corresponding to this position; This indicates the control object corresponding to that location. Using this location encoding function, the positional relationships within the protocol attachment trajectory can possess comparative, indexable, and traceable structural characteristics.

[0028] After the protocol attachment trajectory is constructed, a control position identifier needs to be assigned to each control command based on the control object, functional semantics, time sequence, and attachment position. The control position identifier is a unique position index assigned to each occupiable position in the protocol attachment trajectory; it is used for subsequent occupancy relationship construction, protocol shadow chain generation, and real-time message mapping verification. The control object is used to define which device, actuator, or variable channel the position belongs to; the functional semantics are used to define the control meaning corresponding to the position; the time sequence is used to define the order of the position within the same protocol attachment trajectory; and the attachment position is used to define whether the position is a control initiation position, protocol reception position, feedback return position, execution confirmation position, or position affecting presentation. To make the control position identifier assignment deterministic, a position identifier generation function can be constructed:

[0029] in, Indicates the first One control location identifier; This represents the location identifier generation function; Indicates the corresponding controlled object; Indicates the corresponding functional semantics; This indicates the corresponding time sequence, used to characterize the sequence order of that position within the associated protocol attachment trajectory; This represents the corresponding attachment location code. The control location identifier generated in this way can reflect which control object it belongs to, what functional semantics it belongs to, and what time priority it is. It can also be directly traced back to the specific attachment location, so it is suitable as a unified index for all subsequent location occupancy calculations.

[0030] After allocating control location identifiers, a bidirectional mapping relationship needs to be established between the protocol attachment trajectory and the control location identifiers. This bidirectional mapping means, on the one hand, writing the corresponding control location identifier to each attachment position of the protocol attachment trajectory, ensuring that any trajectory position can be uniquely indexed; on the other hand, writing back the protocol attachment trajectory number, control instruction set, control object, functional semantics, and temporal sequence number to the control location identifier, allowing each control location identifier to be traced back to its specific trajectory source. This setup is necessary because subsequent occupancy relationship construction requires extracting the temporal sequence, dependency, and mutual exclusion relationships between control location identifiers from the protocol attachment trajectory, while protocol shadow chain generation requires mapping back from the control location identifiers to the actual positions in the original protocol attachment trajectory. Without this bidirectional mapping relationship, subsequent steps would require repeatedly checking the original records, significantly increasing overall processing complexity and potentially introducing positional ambiguity.

[0031] To ensure the usability of the above results before proceeding to the next step, a consistency check is required between the protocol attachment trajectory and the control position identifier. This consistency check examines the positions within the same protocol attachment trajectory for issues such as time inversion, direction conflicts, functional semantic jumps, control object mismatches, and duplicate mapping of position identifiers. If the feedback return position under the same control object is found to be earlier than the control initiation position, it indicates a time alignment deviation; if a control position identifier is simultaneously mapped to two different control objects, it indicates a conflict in position identifier generation; if a lack of reasonable functional semantic continuity is found between the protocol acceptance position and the execution confirmation position, it indicates a mis-aggregation in the interaction aggregation process. To quantify the degree of consistency, a consistency scoring function can be constructed:

[0032] in, Indicates the overall consistency score; The time consistency score is used to evaluate whether the time sequence within the protocol attachment trajectory is reasonable, and the value can be set from 0 to 1. The direction consistency score is used to evaluate whether the control initiation direction, control acceptance direction, control feedback direction, and control influence direction constitute a reasonable acceptance. The value range can be set from 0 to 1. The functional semantic consistency score is used to evaluate whether the semantics of control commands are continuous at each attachment location. The value range can be set from 0 to 1. This represents the control object consistency score, used to evaluate whether each attachment location always points to the same control object. The value range can be set from 0 to 1. This represents the mapping consistency score, used to evaluate whether the bidirectional mapping between the protocol attachment trajectory and the control position identifier is unique and stable. The value range can be set from 0 to 1. , , , , These represent weighting coefficients, each ranging from 0 to 1, with the sum of the weighting coefficients being 1. They are used to adjust the influence of different consistency components on the overall score. When the consistency score reaches a preset threshold, it indicates that the current construction result can directly support the subsequent construction of occupancy relationships and the generation of protocol shadow chains. When the consistency score is lower than the preset threshold, it is necessary to perform backtracking time alignment processing, direction merging processing, interaction aggregation processing, or location identifier generation processing for correction.

[0033] S120. Construct the occupancy relationship between control location identifiers based on the protocol attachment trajectory, and generate shadow control location identifiers corresponding to the control location identifiers to form a protocol shadow chain.

[0034] Specifically, the above technical solution builds upon the previous step of obtaining the protocol attachment trajectory and control position identifiers. At this point, each control command has been located at a specific attachment position within the protocol attachment trajectory and assigned a unique control position identifier. Occupancy relationship refers to the positional constraints that must be satisfied when a control position identifier is legally entered, legally stayed, legally transmitted, and legally released within the protocol attachment trajectory. Shadow control position identifiers are those that correspond one-to-one with the original control position identifiers but only serve as references and verifications in the shadow environment and do not directly participate in actual execution. The protocol shadow chain is a shadowized position chain organized by all shadow control position identifiers according to the occupancy relationships between the original control position identifiers, used for subsequent real-time message control position identifier mapping and occupancy verification. The core purpose of this step is to further transform the protocol attachment trajectory, which originally only described the actual control semantic development path, into a computable, verifiable, and reproducible occupancy relationship system.

[0035] When performing position expansion processing on control position identifiers in the protocol attachment trajectory, it is necessary to first expand the control position identifiers in each protocol attachment trajectory according to time order, attachment position order, and control object belonging order to form a position sequence. Position expansion processing refers to converting the control position identifiers originally attached to the protocol attachment trajectory from a trajectory-based representation into a linearly searchable position arrangement; a position sequence refers to the ordered set formed after all control position identifiers in the same protocol attachment trajectory are expanded according to the legal control progression order. Since the protocol attachment trajectory already includes control initiation position, protocol acceptance position, feedback return position, execution confirmation position, and impact presentation position, the position expansion process needs to maintain the order of these positions in the original control chain, while preserving the control object, functional semantics, time order, and attachment position type corresponding to each control position identifier. To ensure that the position expansion results can be directly used for subsequent relationship extraction, a position sorting function can be constructed:

[0036] in, Indicates the first The sorting result of each control location identifier in the location sequence; This represents a positional sorting function; This indicates the temporal order of the control location identifier within the associated protocol attachment trajectory, used to characterize its sequential order within a unified time series; This indicates the attachment location type corresponding to the control location identifier, used to distinguish whether it belongs to a control initiation location, protocol acceptance location, feedback return location, execution confirmation location, or impact presentation location; This indicates the control object corresponding to the control location identifier, used to limit the object to which it applies; This indicates the functional semantics corresponding to the control location identifier, used to define its control meaning. Using this location sorting function, the control location identifiers in the protocol attachment trajectory can be expanded into a sequentially ordered, attribute-complete location sequence.

[0037] After the location sequence is formed, it is necessary to extract the temporal succession relationship between control location identifiers based on the location sequence. The temporal succession relationship refers to whether the legal occupancy of a control location identifier requires the prior legal occupancy of a preceding control location identifier, and whether the subsequent occupancy of a subsequent control location identifier will be enabled. In practice, it is necessary to sequentially check whether a stable succession is formed between the control initiation location and the protocol acceptance location, the protocol acceptance location and the feedback return location, the feedback return location and the execution confirmation location, and the execution confirmation location and the impact presentation location. If the preceding location is a necessary prerequisite for the occurrence of the following location, a temporal succession relationship is established between them. To quantitatively determine whether two control location identifiers constitute a temporal succession relationship, a temporal succession determination function can be constructed:

[0038] in, Indicates control location identifier With control location identifier The result of the timing sequence determination between them; This indicates the timing succession decision function; Indicates control location identifier With control location identifier The time order difference between them is used to characterize the interval between them in the position sequence; and These represent the attachment location types corresponding to the two control location identifiers; and These represent the functional semantics corresponding to the two control location identifiers; and These represent the control objects corresponding to the two control position identifiers. When the two control position identifiers are consistent in terms of the control object, form a valid sequential order in terms of attachment position type, form a sequential succession in terms of functional semantics, and their time sequence difference falls within a preset continuation window, it is determined that they have a temporal continuation relationship. After this extraction, the temporal continuation relationship can directly characterize which positions can legally advance from the previous position to the next.

[0039] While extracting the temporal sequence relationships, it is also necessary to extract mutual exclusion relationships based on the position sequence. A mutual exclusion relationship refers to the inability of two or more control position identifiers to be legally occupied simultaneously within the same time window, the same control object, or the same control chain branch. Mutual exclusion relationships typically occur between positions with opposite control meanings, competing final state paths, or incompatible execution states. For example, start and stop positions, write and rollback positions, and allowed and prohibited positions on the same control object can all constitute mutual exclusion relationships. When extracting mutual exclusion relationships, it is necessary to comprehensively consider the consistency of control objects, functional semantic conflicts, and temporal overlap. A mutual exclusion relationship determination function can be constructed as follows:

[0040] in, Indicates control location identifier With control location identifier The result of determining the mutual exclusion relationship between them; Represents a function for determining mutual exclusion; and These represent the control objects corresponding to the two control position identifiers; and These represent the functional semantics corresponding to the two control location identifiers; This indicates the degree of temporal overlap between two control location identifiers in the location sequence, used to characterize whether they might compete for occupancy within the same time window. If two control location identifiers belong to the same controlled object, their functional semantics conflict with each other in control logic, and there is a possibility of competition for occupancy within the same temporal domain, then they are determined to be mutually exclusive. This mutual exclusion relationship can prevent locations that should not coexist from being simultaneously considered legitimate during subsequent occupancy verification.

[0041] After extracting mutual exclusion relationships, it is necessary to extract dependency relationships. A dependency relationship refers to the condition that allows a control location to enter a legally occupied state, depending on whether another control location has already been legally occupied and is still in a valid acceptance state. Dependency relationships emphasize not a simple sequential order, but rather the triggering condition relationship between locations. For example, a feedback return location is usually dependent on its corresponding control initiation location, an execution confirmation location is usually dependent on its corresponding feedback return location, and an impact presentation location is usually dependent on its corresponding execution confirmation location. When extracting dependency relationships, it is necessary to pay attention to whether there are trigger-based connections between locations, and a dependency relationship determination function can be constructed:

[0042] in, Indicates control location identifier Control position identification The result of the dependency relationship determination; Describes the dependency relationship determination function; Indicates control location identifier With control location identifier Have the timing continuity conditions been met between them? and These represent the functional semantics of the two, and are used to determine whether the latter position depends on the triggering of the former position in terms of control meaning; and These represent the attachment position types of the two entities, used to determine whether a dependent position combination such as initiation to feedback, feedback to confirmation, or confirmation to impact has formed. A dependency relationship can be determined when the latter position not only follows the former position in time but also only has the entry condition after the former position has been legally occupied. The introduction of dependency relationships makes the occupancy relationship no longer merely a static adjacent relationship, but also endows it with conditional triggering attributes.

[0043] After extracting the attachment relationships, it is also necessary to extract the eviction relationships. Eviction relationships refer to the process where, after a control location identifier completes legal occupancy and meets predetermined termination conditions, its occupancy status is released, allowing subsequent similar locations to re-enter the legal occupancy window. Eviction relationships are mainly used to handle scenarios such as periodic polling, repeated acknowledgments, continuous monitoring, and cyclic execution. Without eviction relationships, control location identifiers of the same type may remain closed for an extended period after initial occupancy, preventing subsequent real packets from being re-attached. Extracting eviction relationships requires determining the position's functional semantics, the type of attached location, and the control chain termination conditions. A eviction relationship determination function can be constructed as follows:

[0044] in, Indicates control location identifier The results of the recycling relationship determination; This represents the function for determining recycling relationships; This indicates the functional semantics of the control location identifier, used to determine whether it is a one-time execution location or a repeatable execution location; This indicates the attachment location type of the control location identifier, used to determine whether it is in the initiation, feedback, confirmation, or impact phase; This indicates the completion status of the termination condition corresponding to the control position identifier, representing whether it has completed the current control loop and met the conditions for releasing occupancy. When the control position identifier belongs to the reusable position category and its corresponding control loop has been completed, the position is determined to enter the reclaimable state. The existence of the reclaimable relationship enables the entire control position system to maintain sustainable occupancy capability during long-term continuous operation.

[0045] After extracting the sequential succession, mutual exclusion, dependency, and recycling relationships, these relationships need to be uniformly written into the control position relationship table. The control position relationship table is a relational position constraint structure established for all control position identifiers. It records the succession, mutual exclusion, dependency, and recycling relationships between each control position identifier and other control position identifiers. The purpose of the control position relationship table is to solidify the relationship rules extracted item by item from the position sequence into a unified, queryable, callable, and inheritable relationship foundation to support the subsequent generation of shadow control position identifiers and the organization of the protocol shadow chain. In specific implementation, for each control position identifier, at least its preceding position set, succeeding position set, mutually exclusive position set, dependent position set, recycling condition, and current occupancy status are written into the control position relationship table. After doing this, it is no longer necessary to return to the protocol attachment trajectory to judge relationships position by position; instead, the relationship results can be directly called from the control position relationship table, improving the structure and real-time performance of subsequent processing.

[0046] After the control location relationship table is formed, a corresponding shadow control location identifier needs to be generated for each control location identifier based on the table. The shadow control location identifier is not a simple copy of the original control location identifier; rather, it inherits the control object, functional semantics, temporal order, and attached location attributes of the original control location identifier, and adds shadow attributes, making it a location index used only for shadow environment verification. Shadow attributes mean that the location only undertakes reference, mapping, and occupancy verification functions, and does not undertake actual execution functions. When generating shadow control location identifiers, it is necessary to ensure that each original control location identifier corresponds to one and only one shadow control location identifier. A shadow location generation function can be constructed as follows:

[0047] in, Indicates the original control position identifier Corresponding shadow control position identifier; Indicates the function that generates the shadow position; Indicates the original control position identifier; Indicates the corresponding controlled object; Indicates the corresponding functional semantics; Indicates the corresponding time sequence; This indicates the type of the corresponding attachment location. The function's purpose is to assign a shadow environment-specific identity to the control location while maintaining the original control location's semantics, allowing subsequent real-time messages to first be attached to the shadow control location identifier for legitimacy verification without directly affecting the real control chain.

[0048] After generating shadow control location identifiers, it's necessary to ensure that these identifiers inherit the temporal succession, mutual exclusion, dependency, and recycling relationships of their corresponding control location identifiers. Inheritance is not an abstract logical continuation, but rather a complete projection of the relational constraints in the control location relationship table onto the corresponding shadow control location identifiers. In other words, if temporal succession relationships exist between the original control location identifiers, the corresponding shadow control location identifiers should also maintain the same temporal succession relationships; if mutual exclusion, dependency, or recycling relationships exist between the original control location identifiers, the corresponding shadow control location identifiers should also maintain the same relational constraints. To evaluate the completeness of shadow inheritance, a relational inheritance consistency function can be constructed:

[0049] in, Indicates the shadow control location identifier Original control location markings Relationship inheritance consistency; It represents the consistency of temporal succession, and is used to evaluate whether the succession relationship before and after the original position has been completely copied to the shadow position; It represents the consistency of mutual exclusion inheritance and is used to evaluate whether the mutual exclusion constraint at the original position has been completely copied to the shadow position; It represents the consistency of dependency inheritance and is used to evaluate whether the triggering dependency at the original position has been completely copied to the shadow position; It represents the consistency of the recycling relationship and is used to evaluate whether the release and open conditions of the original position have been completely copied to the shadow position; , , , This represents the weighting coefficients, each with a value ranging from 0 to 1, and the sum of the weighting coefficients is 1. This consistency function ensures that the shadow control position identifiers are not merely formally corresponding, but rather possess a structurally isomorphic relationship with the original control position identifiers.

[0050] After all shadow control location identifiers are generated and their relationships are inherited, a chain-based organization process needs to be performed on each shadow control location identifier based on the control location relationship table to form a protocol shadow chain. Chain-based organization refers to organizing discrete shadow control location identifiers into a progressive, interruptible, releaseable, and reentrant shadow location chain according to temporal succession, dependency, mutual exclusion, and retrieval relationships. The protocol shadow chain is the overall shadow location structure formed after this chain-based organization process. In specific implementation, the main progression order between shadow control location identifiers is first determined based on temporal succession relationships. Then, the opening and triggering conditions for each shadow control location identifier are set based on dependency relationships. Next, the exclusion constraints between shadow locations are set based on mutual exclusion relationships. Finally, the release and reopening rules for shadow locations are set based on retrieval relationships. After this organization, the protocol shadow chain is no longer a static location table but a shadow link that can dynamically advance with real-time message mapping and occupancy status changes. This shadow chain provides a unified reference structure for subsequent identification of free control segments and active probing behavior.

[0051] After the protocol shadow chain is formed, a bidirectional association between the control location identifier and the shadow control location identifier needs to be established. This bidirectional association means, on the one hand, writing the corresponding shadow control location identifier into the original control location identifier, enabling direct location when tracing back from the real location to the shadow location; on the other hand, writing the corresponding original control location identifier, the associated protocol attachment trajectory, and inherited relationship items into the shadow control location identifier, ensuring semantic consistency when tracing back from the shadow location to the real source. This bidirectional association is crucial because subsequent real-time messages are first mapped to the shadow control location identifier for occupancy verification. If deemed legitimate or illegitimate, they need to be mapped back to the original control location identifier to determine if they belong to a legitimate location within the real control chain. Therefore, the bidirectional association essentially binds the protocol attachment trajectory and the protocol shadow chain into a homogeneous and isolated two-layer location system.

[0052] To ensure that the protocol shadow chain output in this step can be directly used for the real-time message control location identifier mapping and occupancy verification processing in the next step, a chain consistency check needs to be performed at the end. The chain consistency check checks for issues such as missing shadow positions, broken shadow relationships, mismatched inheritance relationships, mutual exclusion boundary conflicts, and mismatched recycling rules in the protocol shadow chain. If it is found that the original control location identifier already has a successor relationship in the control location relationship table, but the corresponding shadow control location identifiers do not have a successor relationship, it indicates that the chain organization is incomplete. If it is found that the original control location identifier has been determined to be mutually exclusive, but the corresponding shadow control location identifiers are still allowed to advance in parallel, it indicates that the mutual exclusion relationship inheritance has failed. If it is found that the original control location identifier has entered a recyclable state after meeting the termination condition, but the shadow control location identifier remains permanently closed, it indicates that the recycling relationship inheritance is inconsistent. For the above situations, it is necessary to backtrack the shadow control location identifier generation process and the chain organization process for correction until the protocol shadow chain and the control location relationship table achieve structural consistency again. After this check, the protocol shadow chain possesses stable, complete, and executable shadow reference capabilities.

[0053] S130. Perform control location identifier mapping processing on the real-time message and perform occupancy verification in the protocol shadow chain to identify free control segments.

[0054] Specifically, detached control segments refer to abnormal segments formed by real-time recording units that cannot find a legal place in the protocol shadow chain, or whose place can be made but do not meet the entry conditions, or whose entry conditions are met but are inconsistent with the current shadow chain progress status. When performing message normalization on real-time messages, the original real-time messages are first uniformly converted into real-time recording units. The real-time recording unit retains the message arrival time, source identifier, destination identifier, protocol type, function field, object field, payload field, direction attribute field, and link field. To avoid inconsistencies in subsequent processing caused by different protocol formats, a new normalization expression can be used to represent the compositional relationship of real-time recording units:

[0055] in, Indicates the first The real-time recording unit corresponding to each real-time message; Indicates the message arrival time, used to describe the moment when the real-time message enters the processing plane; Indicates the source identifier, used to describe the node that sent the message; Indicates the destination identifier, used to describe the message receiving node; Indicates the protocol type, used to describe the protocol category to which the message belongs or the intermediate protocol category after conversion; These are function fields used to represent control cues such as read, write, start, stop, acknowledge, and feedback. The object field is used to characterize register areas, device numbers, execution units, or variable channels; This represents the payload field, used to characterize payload content such as numerical values, status bits, code bits, or acknowledgment bits; The direction attribute field indicates whether the message is closer to the direction of control initiation, control reception, control feedback, or control influence. The link field represents the location of the network link in which the message is located. This expression emphasizes that the real-time recording unit consists of a set of unified attributes, rather than obtaining an abstract result through function mapping, making it more suitable for directly supporting subsequent item-by-item matching processing.

[0056] After a real-time recording unit is formed, control object attribution identification processing is performed. The purpose of this processing is to select the control object that best matches the current real-time recording unit from among multiple candidate control objects. An attribution expression in the form of distance decay can be used:

[0057] in, Indicates the first The real-time recording unit belongs to the first The degree of affiliation of each candidate control object; This represents the endpoint difference, used to characterize the degree of difference between the source and destination identifiers of the current real-time recording unit and the historical interaction endpoints of the candidate control object. The smaller the value, the closer they are. This indicates the object field difference, used to characterize the degree of difference between the current object field and the candidate control object address, register area, component number, or variable channel. The smaller the value, the closer they are. This represents the protocol path difference, used to characterize the degree of difference between the current protocol type and conversion path and the historical protocol path of the candidate control object. The smaller the value, the closer they are. This indicates the difference in link location, used to characterize the degree of difference between the current link field and the historical link location of the candidate control object. The smaller the value, the closer they are. , , , These represent adjustment coefficients, each ranging from 0 to 1, used to adjust the strength of the influence of each difference on the degree of belonging. The principle behind this formula is that the smaller the difference, the closer the denominator is to 1, and the higher the degree of belonging; the larger the difference, the larger the denominator, and the lower the degree of belonging. This can more directly reflect the proximity between the real-time recording unit and the candidate control object.

[0058] After obtaining the control object attribution result, functional semantic extraction processing is performed. This can be expressed using the similarity between the semantic response vector and the template vector. First, the functional field, payload field, direction attribute field, and protocol type are combined into a semantic observation vector, which is then matched with a predefined functional semantic template, as follows:

[0059] in, Indicates the first The functional semantic results ultimately extracted from each real-time recording unit; This indicates that the template category with the highest similarity is selected from all candidate functional semantic templates; Indicates the first The semantic observation vector corresponding to each real-time recording unit is composed of the function field, payload field, direction attribute field and protocol type encoded. Indicates the first Functional semantic template vectors are standard patterns used to represent different control meanings such as read semantics, write semantics, start semantics, stop semantics, confirmation semantics, feedback semantics, or influence presentation semantics. It represents the dot product of two vectors, used to measure how much their directions are aligned; Represents the magnitude of the semantic observation vector; This represents the magnitude of the functional semantic template vector. The principle behind this formula is that it compares the proximity between the current real-time recording unit and various functional semantic templates using cosine similarity, and the one with the highest similarity is the most likely functional semantic result.

[0060] After obtaining the control object attribution and functional semantic results, it is necessary to perform a candidate selection process on the shadow control location identifiers in the protocol shadow chain to form a set of candidate shadow control location identifiers. A product-type matching expression can be used so that the overall matching degree decreases synchronously when any key dimension is low:

[0061] in, Indicates the first The first real-time recording unit and the first Candidate matching degree between shadow control location identifiers; This represents the control object matching degree, which characterizes the consistency between the control object attribution result of the real-time recording unit and the control object to which the shadow control location identifier belongs. The value range can be set from 0 to 1. The functional semantic matching degree is used to characterize the degree of consistency between the functional semantic result of the real-time recording unit and the semantic category of the shadow control position identifier. The value range can be set to 0 to 1. This represents the direction attribute matching degree, which characterizes the consistency between the direction attribute of the real-time recording unit and the direction of the attachment position of the shadow control position identifier. The value range can be set from 0 to 1. , , This represents the exponential adjustment coefficient, with each value ranging from 0 to 1. It controls the sensitivity of the control object matching degree, functional semantic matching degree, and directional attribute matching degree in the overall matching degree. The principle behind this formula is that the candidate matching degree will only be high when all three factors—control object, functional semantic, and directional attributes—are simultaneously high. If any one of these factors is significantly low, the overall matching degree will be significantly suppressed, thereby reducing the probability of incorrect candidate positions being included in the set.

[0062] After forming a set of candidate shadow control position identifiers, it is necessary to map the real-time recording unit to the target shadow control position identifiers within it, and simultaneously determine the corresponding control position identifiers. A target position determination formula in the form of distance minimization can be used:

[0063] in, Indicates the first The final target shadow control position identifier number selected by each real-time recording unit; This indicates that the position with the smallest overall difference is selected from all candidate shadow control position identifiers; The amount of matching difference can be represented by... This is used to reflect the degree of deviation of the candidate matching degree from the ideal matching state; It represents the time order difference, used to characterize the degree of difference between the arrival time of the current real-time recording unit and the expected time window occupied by the candidate shadow control position identifier; This represents the adjacency state difference, used to characterize the degree of deviation in adjacency between the candidate shadow control location identifier and the currently occupied segment of the protocol shadow chain; , , These represent weighting coefficients, each ranging from 0 to 1, and the sum of the three is 1. The principle behind this formula is that the target shadow control position identifier should simultaneously satisfy the following conditions: optimal basic matching, closest temporal order, and most reasonable adjacency relationship. Therefore, the final mapping is completed by finding the position with the smallest overall difference.

[0064] After determining the target shadow control location identifier, an occupancy pre-check process needs to be performed on the target shadow control location identifier based on the control location relationship table. A minimum constraint threshold approach can be used, ensuring that the occupancy pre-check result is dominated by the weakest constraint term.

[0065] in, Indicates the target shadow control location identifier The pre-inspection value of occupancy; This indicates the temporal acceptance satisfaction level, which is used to characterize whether the preceding acceptance position required by the target shadow control position identifier has been legally occupied. The value range can be set from 0 to 1. The mutual exclusion conflict degree is used to characterize whether there is currently an occupancy conflict between the location mutually exclusive with the target shadow control location identifier. Its value range can be set to 0 to 1. Indicates the degree to which mutual exclusion is acceptable; This indicates the dependency satisfaction level, which characterizes whether the preceding position to which the target shadow control position identifier is attached meets the triggering conditions. The value range can be set from 0 to 1. This represents the openness of the occupancy check, indicating whether the target's shadow control location identifier has completed the previous round of occupancy release and reopened. The value can be set from 0 to 1. The principle behind this formula is that the legality of the occupancy pre-check is determined by the weakest condition. If any of the conditions of temporal succession, mutual exclusion, dependency, or occupancy is significantly insufficient, the overall occupancy pre-check value will decrease, thus better conforming to the strict constraint logic of the location entry conditions.

[0066] For target shadow control location identifiers that pass the occupancy pre-inspection, occupancy verification is also required to update the protocol shadow chain state. A geometric mean approach can be used to balance the four results: preceding consistency, subsequent openness, adjacency coherence, and branch consistency.

[0067] in, Indicates the target shadow control location identifier The occupancy verification value; This indicates the consistency of preceding shadows, which characterizes whether the target shadow control position identifier and its preceding shadow position maintain a correct occupancy relationship. The value range can be set from 0 to 1. This indicates the consistency of subsequent opening, which characterizes whether the opening status of subsequent positions can be reasonably opened after the current real-time recording unit occupies the position. The value range can be set to 0 to 1. This indicates the adjacency continuity, used to characterize whether the position is structurally continuous with the currently occupied segment of the protocol shadow chain. The value range can be set to 0 to 1. This represents the branch consistency, used to characterize whether the current position belongs to a legitimate branch that the current protocol's shadow chain is advancing. Its value can be set from 0 to 1. The principle behind this formula is that the geometric mean is sensitive to low values ​​in any given term, avoiding the problem of a low value in one dimension being masked by other high values. It is more suitable for representing occupancy verification, a judgment process that requires multiple conditions to be met simultaneously.

[0068] For real-time recording units that fail the occupancy pre-detection or occupancy verification processes, free control segments need to be generated based on the unmapped results, occupancy mismatch results, and verification mismatch results. A clustering center approach can be used to group abnormal real-time recording units into a single segment center:

[0069] in, Indicates the first The segment center representation of a free control segment; Indicates being merged into the first A set of real-time anomaly recording units in a free control segment; This indicates the number of real-time anomaly recording units in the set; Represents a set The feature vector of a single real-time anomaly recording unit in the data can be composed of unmapped results, occupancy mismatch results, verification mismatch results, control object attribution results, functional semantic results, and time window encoding. This formula represents the summation of the feature vectors of all real-time anomaly recording units within the same detached control segment. The principle behind this formula is that by averaging real-time anomaly recording units within the same temporal neighborhood, controlling the same entity, and exhibiting similar anomaly types, a single detached control segment is formed that represents the overall characteristics of the group of anomalies, rather than simply retaining scattered failure messages. This is more conducive to subsequent identification of proactive detection behaviors and the execution of control decoupling.

[0070] S140. Set a detection control location identifier in the protocol shadow chain, and identify the occupation behavior of the detection control location identifier based on real-time messages to obtain the active detection behavior.

[0071] Specifically, the above technical solution, in its implementation, continues based on the previous steps of constructing the protocol attachment trajectory, allocating control location identifiers, generating the control location relationship table, and organizing the protocol shadow chain. In other words, at this point, the system already possesses a shadow control location identifier system capable of representing legitimate control paths and can identify those detached control segments that have not been legally occupied. Therefore, this step no longer reinterprets the basic semantics of the original industrial control protocol. Instead, it further selects suitable target segments in the protocol shadow chain to expose probing behavior, generates detection control location identifiers, and analyzes the approach, dwell, migration, and attempted entry behaviors of these identifiers based on real-time messages to identify active probing behavior. The detection control location identifier refers to a special location identifier specifically set in a particular segment of the protocol shadow chain, used to observe and carry out anomalous probing behavior; detection attributes refer to the attributes that this location possesses to identify probing access; non-execution attributes refer to the fact that even if a real-time message attempts to enter this location, it will not trigger any real execution chain actions; observation attributes refer to the fact that this location can continuously record the frequency of approach, migration order, duration of stay, and boundary probing; and inducing attributes refer to the fact that this location is structurally adjacent to a legitimate shadow path and semantically presents an approachable appearance, thus attracting probing real-time messages. The significance of this step is that it further filters out the ordinary free control segments already identified in the previous steps into active probing behaviors with clear probing intentions, providing higher-value anomalous input for subsequent control decoupling and attack analysis texture formation.

[0072] When performing detection location selection based on the protocol shadow chain, it is necessary to first identify suitable target segments for deploying detection control location markers among the shadow control location markers. A location gap refers to an intermediate segment where two legitimate shadow control location markers are structurally adjacent but not currently allowed to be actually occupied; a reclamation window refers to a transition segment between the completion of a shadow control location marker's legitimate occupation in the previous round and its reopening in the next round; a mutual exclusion boundary refers to an isolated segment between two shadow control location markers that cannot be simultaneously valid in control logic; and a transition boundary refers to a location segment where there is a semantic transition between the segment before and after the protocol transition, but a direct legitimate connection has not yet been formed. The essence of detection location selection is to screen out the location regions from these segments that are most likely to expose tentative approach and boundary exploration behavior. The selection strength of the target segment can be represented by a normalized ratio.

[0073] in, Indicates the first The selection intensity of each candidate segment as the target segment; This indicates the significance of the location gap in the candidate segment, which is used to characterize the degree of non-openness and structural gap between the legal shadow positions of the segment. The value can be set from 0 to 1. This indicates the saliency of the recycling window, used to characterize whether the segment is located in a window position that has ended its occupation but has not yet been reopened. The value range can be set to 0 to 1. This indicates the saliency of the mutually exclusive boundary, used to characterize whether the segment is located between mutually exclusive shadow control location markers, and the value can be set from 0 to 1; This represents the saliency of the transition boundary, used to characterize whether the segment is located in the semantic transition zone between the position before and after the protocol transition. The value range can be set to 0 to 1. , , , These represent weighting coefficients, each with a value range of 0 to 1, used to adjust the influence of position gaps, reclaimed windows, mutual exclusion boundaries, and transformation boundaries on the selection intensity. This represents a smoothing parameter used to prevent the denominator from being zero; its value can be set to a positive value close to zero. The principle behind this formula is to apply squared enhancement to segments with high significance, making them easier to select in comprehensive comparisons. Simultaneously, it normalizes the overall scale through the denominator, avoiding bias caused by abnormal amplification of a single dimension. Using this formula, segments that are both close to legitimate paths and have high probing exposure value can be prioritized as target segments.

[0074] After the target segment is determined, detection and control position identifiers need to be generated for that segment. During generation, instead of simply copying existing shadow control position identifiers, a special position is constructed specifically for the target segment, ensuring it maintains structural connection with the protocol shadow chain while avoiding entry into the actual execution path. Each detection and control position identifier needs to include its target segment type, adjacent shadow control position identifier set, associated control object range, associated functional semantic range, detection attributes, non-execution attributes, observation attributes, and inducement attributes. The target segment type distinguishes whether the detection and control position identifier is placed in a position gap, a recycling window, a mutual exclusion boundary, or a transition boundary; the adjacent shadow control position identifier set describes which legal shadow positions it connects to; the associated control object range limits which type of control object it primarily observes; and the associated functional semantic range limits which type of control intent it primarily senses. The generation method of detection and control position identifiers can be represented using a projection overlay method.

[0075] in, Indicates the first The generation result of the detection control position identifier; This represents the target segment type projection item, used to map location gaps, reclaimed windows, mutually exclusive boundaries, or transformation boundaries to the corresponding basic category of the detection location; This indicates the type of target section to which the detection and control location identifier belongs; This represents the adjacent structure projection item, used to map the preceding position, following position, and boundary adjacent position to the structural attachment base of the detection position; Represents the set of adjacent shadow control location identifiers; This represents the semantic constraints of the object, used to limit the scope and functional semantics of the control object associated with the detection control location identifier; Indicates the scope of the associated control objects; Indicates the semantic scope of associated functions; This indicates an attribute overlay item, used to write detection attributes, non-execution attributes, observation attributes, and induced attributes into the detection control location identifier; This represents a combined state of detection attributes, non-execution attributes, and observation attributes; This indicates the strength of the induction attribute, and its value can be set from 0 to 1. The principle behind this formula is that the detection control location identifier is regarded as a special location entity jointly generated by four parts: segment basis, adjacency structure, object semantic constraints, and attribute superposition. This ensures that the location has both a clear link landing point and a clear observation and induction function.

[0076] After the detection control location identifier is generated, it needs to undergo adjacency attachment processing to establish preceding, succeeding, mutually exclusive, and segment boundary relationships with the shadow control location identifier. The preceding relationship describes which shadow control location identifiers immediately precede the detection control location identifier; the succeeding relationship describes which shadow control location identifiers follow the detection control location identifier; the mutually exclusive relationship describes which valid paths cannot be simultaneously established by the probe path monitored by this detection control location identifier; and the segment boundary relationship indicates the boundary or window near which the detection control location identifier is located. Only after the adjacency attachment processing is completed does the detection control location identifier truly become a structural node within the protocol shadow chain, rather than a detached label. The stability of the attachment can be represented using a multiplicative decay form.

[0077] in, Indicates the first The first detection control position identifier and the first Stability of adjacency connection between shadow control position identifiers; Represents an exponential function; This represents the preceding difference, which characterizes the degree of deviation between the current shadow control position identifier and the detection control position identifier in the preceding structure. The smaller the value, the more suitable it is as the preceding position. This indicates the amount of difference following the structure, used to characterize the degree of deviation from the structure following it. This represents the difference in mutual exclusion boundaries, used to characterize the degree of deviation from the mutual exclusion relationship; This represents the difference in the segment boundary, used to characterize the degree of deviation from the boundary of the target segment to which it belongs; , , , This represents the adjustment coefficient, and each value can be set from 0 to 1. The principle behind this formula is that the smaller the structural difference, the closer the exponent term is to zero, and the closer the connection stability is to 1; the larger the structural difference, the faster the connection stability decreases. This can better reflect the actual connection tightness between the detection control position marker and the shadow control position marker.

[0078] After completing the adjacency connection, open rules need to be configured for the detection control location identifier to define observable, semi-open, and closed states. The observable state means that the detection control location identifier is only responsible for recording approach and probing, and does not provide further propagation space for anomalous packets. The semi-open state means that, while maintaining non-executable attributes, anomalous packets are allowed to make limited retries, short stays, or local migrations near this location to capture a more complete probing path. The closed state means that the detection control location identifier does not currently participate in detection input, but only retains its structural position. The configuration of open rules needs to be determined by considering the target segment type, historical anomaly density, current protocol shadow chain activity, and the strength of inducible attributes. The configuration results of open rules can be represented using a three-state probability distribution.

[0079] in, Indicates the first The three-state open distribution vector corresponding to each detection and control position identifier has the first term corresponding to the observable state, the second term corresponding to the semi-open state, and the third term corresponding to the closed state. , , These represent the adaptability of the target segment type to the three states, and the value range can be set from 0 to 1. , , These represent the fit of historical anomaly density to the three states, respectively. , , These represent the degree to which the current shadow chain activity adapts to the three states; , , These represent the degree of fit of the induced attribute strength to the three states, respectively. , , The original support values ​​represent the three states; This represents the normalization factor. The principle behind this formula is that instead of directly assigning a detection and control position identifier to a single state, it first calculates the support values ​​for three states, then normalizes them to form a state distribution, and finally selects the state with the highest support value as its open state. This approach is more suitable for expressing the state configuration logic of detection and control position identifiers in dynamic environments.

[0080] After the detection control location markers are deployed and the opening rules are configured, it is necessary to perform detection location proximity identification processing based on real-time messages in cases where legal occupancy has not been completed or a free control segment has been formed. Detection location proximity identification processing refers to further determining whether a real-time message is approaching a detection control location marker after the previous steps have confirmed that a real-time message has failed to complete legal occupancy in the protocol shadow chain. Approaching behavior does not equate to tentative occupancy, but rather indicates that the real-time message is getting closer and closer to the area monitored by the detection control location marker in terms of control object, functional semantics, directional attributes, and time window. A hyperbolic normalized expression can be used:

[0081] in, Indicates the first The first real-time message to the first The proximity of each detection control position marker; This represents the control object difference, used to characterize the degree of deviation between the control object attribution result of the real-time message and the range of control objects associated with the detection control location identifier; This represents the functional semantic difference, used to characterize the degree of deviation between the functional semantic result of the real-time message and the functional semantic range associated with the detection control location identifier; This represents the difference in directional attributes, used to characterize the degree of deviation between the directional attributes of the real-time message and the allowable approach direction of the segment where the detection and control location identifier is located; This represents the time window difference, used to characterize the degree of deviation between the time when the real-time message appears and the current observation window of the detection and control position identifier; , , , These represent adjustment coefficients, each with a value range of 0 to 1. The principle behind this formula is that the smaller the four types of differences, the closer the denominator is to 1, and the closer the approximation is to 1; the larger the differences, the faster the approximation decreases. This clearly reflects whether there is an approximation relationship between the real-time message and the detection and control position identifier.

[0082] After the proximity detection and identification process is completed, the occupancy attempt determination process needs to be performed. The purpose of this process is to distinguish whether an abnormal message merely approaches the detection control location identifier accidentally, or whether it demonstrates an attempt to enter, remain, cross, or borrow space. In practice, it is necessary to aggregate continuous proximity records of the same source identifier, the same controlled object, the same functional semantics, or the same free control segment across multiple detection control location identifiers, and observe whether they exhibit characteristics such as repeated proximity, continuous dwelling, migration to adjacent locations, and boundary crossing. The degree of occupancy attempt can be represented using a cumulative increment format.

[0083] in, Indicates the first The degree of occupancy attempt by a group of consecutive abnormal behaviors on the detection and control location identifier; This represents the number of times or frequency that the same detection control position marker is approached multiple times within a continuous time window. The value range can be set to 0 to 1 through normalization. This indicates the duration of dwell time, used to characterize the extent to which abnormal behavior remains in a near-detection control location. This represents the neighbor migration amount, used to characterize the extent to which abnormal behavior moves sequentially between multiple adjacent detection control location identifiers; This represents the amount of boundary crossing, used to characterize the extent to which abnormal behavior attempts to cross mutually exclusive or transitional boundaries. , , , The values ​​represent adjustment coefficients, each ranging from 0 to 1. The principle behind this formula is that by accumulating the four types of behaviors—repeated approach, stay, migration, and traversal—the degree of occupancy increases slowly when the accumulated amount is small; as the accumulated amount continues to increase, the degree of occupancy gradually approaches 1, making it more suitable for expressing the evolutionary process of exploratory behavior from weak to strong.

[0084] After an occupancy attempt is confirmed, it needs to be categorized based on the segment type, adjacency relationship, and opening rules of the detection and control location identifier. The purpose of this categorization is to determine whether the current occupancy attempt is a location search attempt, a window re-entry attempt, a boundary crossing attempt, or a transition pathfinding attempt. A minimum deviation determination method can be used.

[0085] in, Indicates the first The type of probe that ultimately corresponds to the group occupancy attempt behavior; This indicates that the type with the smallest overall deviation is selected from all candidate trial types; This represents the segment type deviation, used to characterize the target segment type where the occupancy attempt mainly occurs compared to the first segment. The degree of deviation between the trial types; This represents the adjacency deviation, used to characterize the progression of the occupancy attempt behavior compared to the first... The degree of deviation between typical adjacency patterns of the trial-and-error type; This represents the open rule deviation, used to characterize the open state of the detection control position identifier when the occupancy attempt occurs, compared to the first... The degree of deviation between typical open conditions of the trial type; , , These represent weighting coefficients, each ranging from 0 to 1, and their sum is 1. The principle behind this formula is that it no longer judges from a positive score perspective, but directly compares the deviation between the current attempt behavior and various trial type templates; the one with the smallest deviation is the most suitable trial type. This format helps to highlight the boundary differences between different trial types.

[0086] After completing the typological identification process, the proactive determination process needs to be performed to obtain proactive probing behaviors. The essence of the proactive determination process is to further filter all occupancy attempts that have already undergone typological identification to identify truly abnormal behaviors with the intention of proactive searching, proactive detours, proactive approaching, and proactive avoidance. Persistence refers to the repeated occurrence of the behavior across multiple time windows; progression refers to the behavior advancing step by step from the periphery to the core along the detection control location marker; targeting refers to the behavior repeatedly pointing to the same control object, the same functional semantics, or the same boundary segment; avoidance refers to the behavior actively changing its position or path to continue probing after encountering obstruction. The intensity of proactiveness can be represented using a harmonic average.

[0087] in, Indicates the first The intensity of initiative in group occupancy attempts; This indicates persistence and is used to characterize the degree to which the behavior repeats within a continuous time window. Its value can be set from 0 to 1. This indicates progressiveness and is used to characterize the extent to which the behavior progresses from the periphery to the core among multiple detection and control location markers. The value can be set from 0 to 1. This indicates targeting, used to characterize whether the behavior is continuously focused on a specific controlled object, a specific functional semantic, or a specific boundary segment. The value range can be set from 0 to 1. This indicates avoidance behavior, which characterizes whether the behavior actively adjusts its direction or path to continue trying after a failure. The value range can be set from 0 to 1. This represents a smoothing parameter used to prevent the denominator from having a zero value; its value can be set to a positive value close to zero.

[0088] S150: Decouple the free control fragment from the active detection behavior and import the restricted realization channel to form an attack analysis texture.

[0089] Specifically, control decoupling refers to separating abnormal control behavior from the subsequent open state of the real execution chain, preventing abnormal behavior from continuing to drive the legitimate advancement of the real control location identifier; the set of controls to be decoupled refers to the set of abnormal controls formed by merging spatiotemporally similar, object-related, and path-related free control segments with active probing behaviors; shadow mapping continuation processing refers to reattaching abnormal control units that have been severed from the real execution chain to shadow control location identifiers, detection control location identifiers, or abnormal transition location identifiers within the protocol shadow chain; restricted redemption channel refers to a shadowized channel built on the protocol shadow chain, which allows abnormal control behavior to advance, provide feedback, and migrate in a limited manner under non-execution conditions; abnormal feedback mirroring processing refers to providing feedback echoes that exist only in the shadow environment for abnormal control behavior to induce it to continue exposing its control intentions; continuous observation processing refers to continuously recording the movement, dwelling, probing, and retrying processes of abnormal control behavior in the restricted redemption channel; and attack analysis texture refers to the structured behavioral texture results formed by these continuous abnormal behaviors in the dimensions of position, time, boundary, and direction.

[0090] When performing anomaly merging on detached control segments and active probe behaviors, both need to be mapped to anomaly control units first. Then, they are aggregated based on the control object, functional semantics, temporal neighborhood, and path neighborhood to form a set of controls to be decoupled. An anomaly control unit is the smallest anomalous behavior entity corresponding to a single detached control segment or active probe behavior. Temporal neighborhood refers to the time range within which anomaly control units are sufficiently close on a unified time axis to be considered part of the same anomalous advancement process. Path neighborhood refers to the structural range within which anomaly control units are close to each other in the protocol shadow chain, their approaching boundaries, or their migration paths, and can be considered part of the same anomalous advancement branch. During implementation, it is necessary to determine whether multiple detached control segments continuously act on the same control object, whether they repeatedly appear around the same functional semantics, and whether they continuously occur within the same protocol shadow chain segment. Simultaneously, it is necessary to determine whether multiple active probe behaviors progressively appear along the same target segment and whether they share the same source identifier or the same approach direction. If these conditions are met, they can be merged into the same set of controls to be decoupled. To quantify the degree of merging between anomaly control units, an anomaly merging strength function can be constructed:

[0091] in, Indicates abnormal control unit With the abnormal control unit Merge strength between; This represents the correlation degree of the controlled object, used to characterize whether two abnormal control units act on the same or adjacent controlled objects. The value range can be set from 0 to 1. This represents the functional semantic correlation, used to characterize the similarity of two anomaly control units in terms of semantic category. The value can be set from 0 to 1. This represents the temporal neighborhood correlation degree, used to characterize whether two abnormal control units are close in time. The value range can be set from 0 to 1. This represents the path neighborhood correlation degree, which is used to characterize the proximity of two abnormal control units in the protocol shadow chain segment, the detection control position identifier segment, or the approximation path. The value range can be set from 0 to 1. , , , These represent weighting coefficients, each ranging from 0 to 1, and their sum is 1. The principle behind this formula is that only when the controlled object, functional semantics, temporal neighborhood, and path neighborhood simultaneously exhibit high correlation are the anomaly control units more suitable to be merged into the same set of controls to be decoupled. Through this process, the system will no longer face scattered anomalies, but rather a set of anomaly controls that already possess continuous progressive meaning.

[0092] After the set of control elements to be decoupled is formed, the actual execution chain needs to be severed to block the subsequent open state of the corresponding control position identifier on the actual execution side. The actual execution chain refers to the actual control propagation link organized by the original control position identifier, which ultimately triggers actual device actions, actual execution confirmation, and actual impact presentation. The subsequent open state on the actual execution side refers to the state where, after the current control position identifier is occupied, its subsequent control position identifiers, dependent control position identifiers, and impact positions remain open and allow actual propagation. The essence of the actual execution chain severing process is to completely separate abnormal control behaviors in the set of control elements to be decoupled from the actual control propagation logic, preventing them from continuing to enter the execution confirmation position or impact presentation position. In specific implementation, it is necessary to first locate the set of control position identifiers corresponding to the set of control elements to be decoupled, then mark these control position identifiers as frozen on the actual execution side, blocking their related subsequent relationships, dependent relationships, and subsequent open relationships. Simultaneously, a decoupling mark is written into the control position relationship table, so that when subsequent real-time messages from the same abnormal set approach again, they can be directly identified as a decoupled path and will no longer trigger actual propagation. To quantify the degree of actual execution chain breakage, an expression for the actual breakage coefficient can be constructed:

[0093] in, Indicates the first The actual execution chain disconnection coefficient corresponding to each set of controls to be decoupled; This represents the set of control position identifiers corresponding to the control set to be unhooked; Represents a set A single control location identifier within; This indicates that the control location identifier has been successfully frozen and the subsequent open state has been blocked. The cutoff weight can be set from 0 to 1, with a larger value indicating a more thorough cutoff. The principle behind this formula is that as long as any key control location identifier in the set of controls to be unhooked is cut off, the overall actual execution chain will be significantly weakened; as more locations are cut off, the overall cutoff coefficient will quickly approach 1, indicating that the actual execution chain has been effectively blocked.

[0094] After the real execution chain is severed, shadow mapping continuation processing needs to be performed on the protocol shadow chain to attach the set of controls to be decoupled to the corresponding shadow control position identifier, detection control position identifier, or abnormal transition position identifier. An abnormal transition position identifier is a transitional position identifier specifically set in the protocol shadow chain to accommodate abnormal control behaviors that have been decoupled but still need to be observed. It differs from both legitimate shadow control position identifiers and pure detection control position identifiers, but rather lies in an abnormal accommodating position between the two. The purpose of shadow mapping continuation processing is to ensure that abnormal control behaviors that have been severed from the real execution chain do not disappear from the processing surface, but rather find a new attachment point in the shadow environment, allowing for continued observation of their direction and probing methods. In implementation, for anomalous control units originating from detached control segments, they are preferentially connected to the neighborhood of the shadow control position identifier where their last attempt failed; for anomalous control units originating from active probing behavior, they are preferentially connected to the neighborhood of the detection control position identifier where they most recently approached; for a set of control units to be decoupled that simultaneously includes detached control segments and active probing behavior, they are attached to the sequence of anomalous transition position identifiers to reflect the anomalous evolution process from deviation to probing to continuous advancement. To quantify the continuity fit between a specific anomalous control unit and a specific shadow attachment position, a continuity fit function can be constructed:

[0095] in, Indicates abnormal control unit Location of shadow attachment The degree of continuity and compatibility between them; It represents the object deviation amount, used to characterize the degree of deviation between the object controlled by the abnormal control unit and the control object associated with the attachment position; This represents the path deviation, used to characterize the degree of deviation between the source path of the anomaly control unit and the shadow path where the attachment location is located; This represents the time deviation, used to characterize the degree of deviation between the current moment of the anomaly control unit and the observation window of the attached position; , , This represents the adjustment coefficient, and each value can be set from 0 to 1. The principle behind this formula is that the closer the anomaly control unit and the attachment location are in terms of object, path, and time, the higher the continuity fit, making it more suitable as the continuation location for anomalous behavior in the shadow environment.

[0096] After the shadow mapping of the control set to be decoupled is completed, a restricted redemption channel needs to be constructed on the protocol shadow chain. Channel boundary constraints, redemption range constraints, path extension constraints, and response mirroring constraints are then written onto the restricted redemption channel. Channel boundary constraints limit abnormal control behavior to certain specified shadow segments, detection segments, and abnormal transition segments, preventing unlimited propagation to the entire protocol shadow chain. Redemption range constraints limit abnormal control behavior to triggering only virtual redemption results in the shadow environment within the channel, preventing triggering real device actions or real impacts. Path extension constraints limit abnormal control behavior to extending only along preset preceding, following, boundary approach, or abnormal transition directions. Response mirroring constraints limit the types of shadow feedback allowed in the channel and control their strength, timing, and duration. When constructing a restricted redemption channel, the starting point, boundary, and maximum extension length of the channel need to be determined first based on the source segment, approach segment, and potential diffusion segment of the control set to be decoupled. Then, the channel rules are initialized according to the aforementioned four types of constraints. To represent the overall constraint strength of the restricted redemption channel, a channel constraint function can be constructed:

[0097] in, Indicates the first The overall constraint strength of the restricted redemption channel; This represents the channel boundary constraint strength, used to characterize the degree to which the channel restricts the boundary of abnormal control behavior activities. The value range can be set from 0 to 1. This indicates the strength of the redemption range constraint, which characterizes the degree to which the channel restricts abnormal control behavior to only allowing shadow redemption to be triggered. The value range can be set from 0 to 1. This represents the path extension constraint strength, used to characterize the degree of restriction on the path and direction of migration for abnormal control behavior of the channel. The value can be set from 0 to 1. This represents the response mirror constraint strength, used to characterize the degree of restriction that the channel imposes on the abnormal feedback mirror type and feedback strength. The value range can be set from 0 to 1. , , , These represent weighting coefficients, each ranging from 0 to 1, and the sum of all four is 1. The principle behind this formula is that the four types of constraints jointly determine the tightness of the restricted realization channel. The higher the constraint strength, the smaller the space for abnormal control behavior to operate in this channel, and the more limited the feedback that can be obtained, but the observation results will be more concentrated and controllable.

[0098] After the restricted fulfillment channel is constructed, restricted fulfillment processing and abnormal feedback mirroring processing need to be performed on the set of controls to be decoupled within the restricted fulfillment channel. Restricted fulfillment processing allows abnormal control behavior to continue advancing within the restricted fulfillment channel, but this advancement only occurs in the shadow environment and cannot open subsequent positions on the real execution side. Abnormal feedback mirroring processing constructs virtual shadow feedback based on the advancement of abnormal control behavior in the shadow environment, allowing the abnormal control behavior to continue exposing its subsequent action intent without contacting the real device. In specific implementation, when the abnormal control unit in the set of controls to be decoupled advances to a certain shadow control position marker, detection control position marker, or abnormal transition position marker, the system will determine whether it can continue to migrate based on the path extension constraints and fulfillment range constraints of the restricted fulfillment channel. Simultaneously, it generates corresponding shadow response records, shadow state switching records, or shadow waiting echo records based on the response mirroring constraints, but these records will not be fed back to the real master station; they only remain in the shadow environment. To quantify the degree of restricted advancement of abnormal control behavior in the restricted fulfillment channel, a restricted fulfillment function can be constructed:

[0099] in, Indicates the first The degree of fulfillment of each abnormal control unit in the restricted fulfillment channel; This represents the path advancement capability, which characterizes the ability of the anomaly control unit to continue advancing to the next position or the anomaly transition position under the current channel constraints. The value range can be set from 0 to 1. This indicates the feedback mirror response capability, used to characterize the degree to which the anomaly control unit can obtain the shadow feedback mirror, and its value range can be set from 0 to 1; This indicates the boundary constraint strength, which characterizes the degree to which the current channel boundary restricts the anomaly control unit. The value can be set from 0 to 1. This represents the path compression intensity, used to characterize the degree of compression of the current path extension constraint on the advance range of the abnormal control unit. The value range can be set from 0 to 1. , , , The values ​​represent weighting coefficients, each ranging from 0 to 1. The principle behind this formula is that the realization of the anomaly control unit depends on its ability to advance and its ability to obtain feedback, but it is simultaneously suppressed by boundary constraints and path compression, thus reflecting its characteristic of being able to expand only to a limited extent within a restricted realization channel.

[0100] While performing restricted redemption processing and anomaly feedback mirroring, continuous observation processing is also required for the set of controls to be decoupled, in order to obtain continuous observation processing results. Continuous observation processing refers to the continuous recording of the position migration sequence, repeated approach count, boundary trial rhythm, conversion approach direction, waiting interval mode, and backoff retry mode of anomaly control behavior in the restricted redemption channel. The position migration sequence refers to the sequential movement path of the anomalous control behavior among multiple shadow positions, detection positions, and anomalous transition positions; the number of repeated approach counts refers to the number of times the anomalous control behavior approaches the same position or segment multiple times; the boundary trial rhythm refers to the time interval distribution and frequency pattern of the anomalous control behavior's attempts around the boundary position; the change in approach direction refers to whether the anomalous control behavior approaches from the segment before the change to the segment after the change, or approaches in reverse from the segment after the change to the segment before the change; the waiting interval pattern refers to how long the anomalous control behavior waits after a failed attempt or after receiving mirror feedback before continuing; the backtracking and retrying pattern refers to whether the anomalous control behavior, after failing to pass a position, retreats to the previous position to retry, or turns to an adjacent position to try again. To quantify the richness of continuous observation information, an observation information density function can be constructed:

[0101] in, Indicates the first The density of continuous observation information corresponding to each set of control systems to be decoupled; This represents the amount of location migration sequence information, used to characterize the completeness of the movement path of abnormal control behavior between different locations, and its value range can be set to 0 to 1; This indicates the amount of information about the number of repeated approaches, used to characterize the sufficiency of recording repeated approach behavior. The value can be set from 0 to 1. This represents the amount of rhythmic information at the boundary probe, used to characterize the degree of rhythmic feature recording around the boundary position. The value can be set from 0 to 1. This represents the amount of information about the transition approximation direction, used to characterize the degree of clarity of the approach direction of abnormal control behavior at the protocol transition boundary. The value can be set from 0 to 1. This indicates the amount of information about the waiting interval pattern, used to characterize the sufficiency of waiting duration and waiting distribution pattern records. The value can be set from 0 to 1. This indicates the amount of information about the rollback and retry mode, used to characterize the clarity of the rollback and retry strategy records. The value can be set from 0 to 1. , , , , , These represent weighting coefficients, each with a value ranging from 0 to 1, and the sum of all six is ​​1. The principle behind this formula is that the value of continuous observation processing results does not depend on a single dimension, but rather on the observation density composed of six types of information: path, frequency, rhythm, direction, waiting, and backtracking. The higher the density, the more sufficient the basis for subsequent texture extraction.

[0102] After obtaining the continuous observation processing results, texture extraction processing needs to be performed on the results to form an attack analysis texture. Texture extraction processing does not simply output the continuous observation results item by item, but rather compresses continuous behavioral features such as position migration order, repeated approach counts, boundary probing rhythm, conversion approach direction, waiting interval patterns, and backtracking retry patterns into a texture representation that describes the evolutionary style of attack behavior. The core of the attack analysis texture lies in its ability to simultaneously express the path pattern, temporal pattern, boundary pattern, and retry pattern of anomalous control behavior. For example, one attack analysis texture might exhibit high-frequency, short-interval boundary probing accompanied by backtracking retry, while another might exhibit low-frequency, long-waiting, progressive conversion approach. To extract this comprehensive texture from the continuous observation results, a texture extraction function can be constructed:

[0103] in, Indicates the first The attack analyzes the texture intensity value of the texture; This represents the path migration texture component, used to characterize the contribution of the position migration order to the overall texture. Its value can be set from 0 to 1. This represents the repeated proximity texture component, used to characterize the contribution of the number of repeated proximity counts to the overall texture. The value can be set from 0 to 1. This represents the boundary probing texture component, used to characterize the contribution of the boundary probing rhythm to the overall texture. Its value can be set from 0 to 1. This represents the transformation approximation texture component, used to characterize the contribution of the transformation approximation direction to the overall texture. The value can be set from 0 to 1. This represents the waiting interval texture component, used to characterize the contribution of the waiting interval pattern to the overall texture. Its value can be set from 0 to 1. This represents the fallback retry texture component, used to characterize the contribution of the fallback retry mode to the overall texture. Its value can be set from 0 to 1. , , , , , These represent weighting coefficients, each ranging from 0 to 1. The principle behind this formula is that by combining the six key behavioral components in a squared form and then taking the square root, the relative strength of each texture component is preserved, resulting in a single texture intensity value used to characterize the overall significance of the attack analysis texture. Further combining this with the value patterns of each component yields a complete description of the attack analysis texture.

[0104] S160. Based on the attack analysis texture, perform source tracing and identification, and perform hierarchical processing on the corresponding control position identifier. At the same time, combine the evolution of the device operation stage to perform synchronous updates on the protocol attachment trajectory and protocol shadow chain, so as to maintain the effectiveness of control position occupancy determination and attack identification under the condition of missing context.

[0105] Specifically, the above technical solution is a continuation of the previous steps, which have already established attack analysis textures, sets of controls to be unlinked, restricted cashing channels, and source chain binding relationships. In other words, at this point, the system can not only identify abnormal control behaviors but also understand their continuous progression, boundary probing, waiting, and retrying methods within the shadow environment. Therefore, the task of this step is no longer simply to observe anomalies, but to restore these structured attack analysis textures back to the real control location system, pinpoint their source, determine their spread, assess their risk level, implement corresponding measures, and synchronously correct the protocol attachment trajectory and protocol shadow chain in conjunction with the evolution of the device's operational phase. This ensures that the aforementioned measures do not fail due to changes in operating conditions and guarantees that the occupancy relationship upon which subsequent occupancy verification relies remains consistent. Source tracing and identification refers to locating the source location and propagation path of abnormal behavior in the protocol attachment trajectory based on attack analysis texture; texture decomposition processing refers to breaking down the overall attack analysis texture into several source tracing units that can respectively represent path characteristics, rhythmic characteristics, aggregation characteristics, and turning characteristics; source back-pointing processing refers to re-associating source tracing units with their original source chain binding relationships to the set of control to be decoupled, free control segments, active probing behaviors, and restricted realization channel segments; location back-tracing processing refers to further mapping these source tracing units from the shadow location system back to the original control location identification system; attribution identification processing refers to determining the source mode and propagation mode of abnormal behavior; influence domain identification processing refers to determining the range of control locations that abnormal behavior has affected or may continue to affect; risk classification processing refers to determining the source mode based on the source mode. The formula and diffusion range distinguish the corresponding control location identifiers into low-risk, medium-risk, and high-risk locations; the slow-release disposal, restricted disposal, and isolation disposal correspond to differentiated control strategies under different risk levels; the stage identification process refers to identifying the current operating stage of the equipment and how it has evolved relative to the previous stage; the trajectory update process and shadow synchronization update process simultaneously reflect the disposal results and the evolution of the equipment operating stage in the protocol attachment trajectory and the protocol shadow chain; the occupancy relationship consistency verification process refers to checking whether the updated protocol attachment trajectory and the updated protocol shadow chain are still consistent in terms of the correspondence, inheritance, dependency, and open status of the control location identifiers; the update and solidification process refers to writing the new structure after verification into the running cache and the historical cache to support the next round of occupancy verification processing.

[0106] When performing texture decomposition on attack analysis textures, it is first necessary to decompose a whole attack analysis texture into multiple source tracing units that can participate in backtracking separately. Attack analysis textures are essentially a comprehensive expression of the path migration characteristics, repeated approach characteristics, boundary probing characteristics, transformation approximation characteristics, waiting characteristics, and backtracking retry characteristics exhibited by abnormal control behavior in a restricted realization channel. If the whole texture is used directly to backtrack the true source, it is easy to fail to distinguish the true landing points of different abnormal components due to the over-concentration of information. Therefore, it needs to be decomposed into several source tracing units. A source tracing unit refers to the smallest backtracking structure decomposed from the attack analysis texture. Each source tracing unit retains only one dominant feature and its associated context. For example, one source tracing unit can mainly represent continuous approximation along mutually exclusive boundaries, another source tracing unit can mainly represent waiting and advancing around transformation boundaries, and yet another type of source tracing unit can mainly represent repeated retries around the same target position. During decomposition, it is not simply segmented by time, but rather divided around path change points, rhythm change points, boundary transformation points, and behavior turning points in the texture. The significance of doing this is that it allows a complex attack analysis texture to be broken down into several source-tracing units with a single dominant intent, making it easier to locate their sources separately in subsequent steps.

[0107] After the set of source tracing units is formed, source back-pointing processing needs to be performed on the set of source tracing units based on the source chain binding relationship. The source chain binding relationship is the binding relationship established in the previous steps between the attack analysis texture and the set of control to be decoupled, the free control fragment, the active probing behavior, the protocol shadow chain segment, and the restricted redemption channel path. The purpose of source back-pointing processing is to reattach each of the decomposed source tracing units to the abnormal behavior chain of its original source, thereby clarifying which type of free control fragment triggered the source tracing unit, which type of active probing behavior extended it, and which restricted redemption channel it advanced along. In practice, it is necessary to retrieve the formation source of each source tracing unit in the attack analysis texture, and then backtrack step by step along the source chain binding relationship to find its corresponding set of control to be decoupled, and further find the original abnormal control unit in the set of control to be decoupled. Through this processing, the system can distinguish whether a source tracing unit originates from a single free deviation, continuous position search, boundary crossing attempt, or from the superposition and evolution of multiple types of abnormal behaviors. In this way, subsequent location backtracking will no longer blindly search for the location on the texture surface, but will search for the location from the anomaly chain with a clear source, and the backtracking results will be more stable.

[0108] After completing the source back-pointing process, the location back-tracing process needs to be performed to determine the corresponding set of control location identifiers. Location back-tracing refers to further mapping the source-tracing units already attached to the anomaly chain through source back-pointing back from the location system within the protocol shadow chain back to the original control location identifier system. Since the attack analysis texture is formed in the restricted cashing channel and the protocol shadow chain, it most directly corresponds to the shadow control location identifier, the detection control location identifier, and the anomaly transition location identifier. Subsequent tiered processing targets the original control location identifier; therefore, the location results in the shadow environment must be backed up to the real location system. During implementation, it is necessary to first find the shadow control location identifier or detection control location identifier where the source-tracing unit was triggered based on the shadow path segment corresponding to it, and then use bidirectional association to back-traverse to the corresponding control location identifier. If a source-tracing unit spans multiple shadow segments, all the shadow positions involved must be mapped back to their corresponding control location identifiers and merged to form the set of control location identifiers corresponding to that source-tracing unit. Through this process, the abstract anomaly evolution features in the attack analysis texture are re-anchored to the real control location system, thereby providing a real location basis for subsequent attribution identification, influence domain identification, and risk management.

[0109] After obtaining the corresponding control location identifier set, attribution identification processing needs to be performed based on the control location identifier set. Attribution identification processing refers to determining the source category of abnormal behavior based on the distribution pattern, continuity, boundary crossing, and cross-segment migration of the corresponding control location identifier set in the protocol attachment trajectory. The source category is not simply distinguishing between single-point and multi-point anomalies, but rather identifying the occurrence pattern from the control logic perspective. For example, when the corresponding control location identifier set is mainly concentrated in adjacent locations under the same control object and there is no obvious cross-boundary migration, it can be identified as a single-branch source; when the corresponding control location identifier set is simultaneously distributed on multiple control objects or multiple non-adjacent branches and advances collaboratively in time, it can be identified as a concurrent diffusion source; when the corresponding control location identifier set clearly crosses mutual exclusion boundaries, recycling windows, or detection boundaries, it can be identified as a boundary crossing source; when the corresponding control location identifier set is distributed between the pre-protocol transition segment and the post-protocol transition segment, and is accompanied by functional semantic migration, it can be identified as a transition migration source. The significance of attribution identification processing lies not only in knowing where the anomaly has occurred, but also in knowing how the anomaly arrived at these locations, thereby providing a pattern basis for subsequent risk classification.

[0110] After completing the attribution identification process, the impact domain identification process needs to be performed to determine the scope of diffusion. The impact domain refers to the range of potentially affected locations, derived by extending forward, backward, and to adjacent boundary locations based on the temporal succession, mutual exclusion, dependency, and recovery relationships in the control location relationship table, starting from the corresponding control location identifier set. The purpose of the impact domain identification process is to determine which control locations the current abnormal behavior has already affected and which other control locations it may continue to impact. For example, if the current abnormality has occupied a control initiation location, then feedback return locations, execution confirmation locations, and impact presentation locations that have succession and dependency relationships with that location may all belong to the subsequent potential impact domain; if the current abnormality has approached a mutual exclusion boundary, then the mutual exclusion locations on the other side of the boundary may constitute the boundary diffusion impact domain; if the current abnormality has appeared at the protocol transition boundary, then the succession location of the transitioned segment may constitute the transition diffusion impact domain. Through this process, the system can expand the abnormal results that originally only corresponded to a portion of the locations into a diffusion range with clear boundaries and structure, providing a spatial basis for risk classification.

[0111] After determining the source category and diffusion range, risk classification is required based on these factors to identify low-risk, medium-risk, and high-risk locations. Risk classification is not solely based on the number of anomalies, but rather considers a comprehensive approach, including the complexity of the source category, the breadth of the diffusion range, whether boundary crossings have occurred, whether transformations or migrations have taken place, and whether the anomalous behavior is approaching the execution confirmation location and the location where the impact manifests along the succession relationship. Low-risk locations generally refer to control locations with a relatively simple source category, a small diffusion range, no boundary crossings, and primarily remaining at the peripheral observation or initial initiation level. Medium-risk locations generally refer to control locations where multi-location collaboration has occurred, local diffusion is significant, and the behavior is beginning to advance towards the succession and confirmation locations, but has not yet formed significant cross-boundary propagation. High-risk locations refer to control locations where boundary crossings, transformations or migrations, cross-controlled object diffusion have occurred, or the behavior is approaching highly sensitive locations such as the execution confirmation location and the location where the impact manifests. This classification ensures that subsequent handling is not a one-size-fits-all approach, but rather differentiated based on the risk level.

[0112] After risk classification is completed, mitigation measures need to be implemented for low-risk locations. Mitigation measures refer to increasing the subsequent entry conditions, tightening the observation threshold, and increasing the intensity of detection in the surrounding area without completely cutting off the legal occupancy capability of the control location marker. In implementation, additional observation markers can be added to the control location markers corresponding to low-risk locations, so that any subsequent approach behavior is prioritized and sent to a more stringent occupancy verification process; at the same time, the observation attributes of adjacent detection control location markers are enhanced, making subsequent probing behavior around the location easier to detect; if necessary, the retrieval and opening time can be appropriately delayed to prevent repeated use in a short period. The purpose of mitigation measures is not to immediately close the location, but to reduce the risk of its subsequent use while maintaining the continuity of system operation. This approach is suitable for low-risk locations where strong diffusion has not yet occurred.

[0113] For medium-risk locations, restrictive measures are required. Restrictive measures involve significantly reducing the legal occupancy window of the control location marker and cutting off some of its subsequent acceptance capabilities, making it difficult for abnormal behavior to continue spreading along the original path even if it approaches again. In implementation, the opening conditions for the control location marker corresponding to the medium-risk location can be raised, for example, requiring stricter pre-acceptance and dependency satisfaction levels before allowing re-entry; simultaneously, some acceptance relationships between it and subsequent sensitive locations can be frozen, preventing it from smoothly advancing the opening of confirmation locations or affecting presentation locations; new detection control location markers and abnormal transition location markers can also be added to its adjacent sections, forcing subsequent abnormal behavior to prioritize the shadow observation path rather than the actual execution path. The purpose of restrictive measures is to significantly reduce the possibility of this location continuing to become a springboard for spread while retaining the necessary minimum control capabilities.

[0114] For high-risk locations, isolation measures are required. Isolation measures refer to directly terminating the high-risk location's eligibility to occupy the space during the current operational phase and separating it from its related influence domain from the actual execution chain. During implementation, the control location identifier corresponding to the high-risk location can be marked as closed, preventing it from entering a legitimate open window; its advancement relationship with subsequent receiving locations, dependent locations, and boundary-adjacent locations can be severed; if necessary, adjacent highly sensitive locations within the same influence domain can be transferred to a strongly isolated state, thereby preventing abnormal behavior from continuing to penetrate through boundary bypasses or migrations. Simultaneously, these isolated locations retain their mirrored positions in the shadow environment for continued observation of abnormal approaching behavior. Isolation measures are applicable to control location identifiers that have clearly demonstrated strong diffusion, strong traversal, or highly sensitive advancement tendencies, with the aim of prioritizing the security of the actual execution chain.

[0115] After mitigation, restriction, and isolation measures are implemented for low-risk, medium-risk, and high-risk locations, the results need to be written back to the protocol attachment trajectory, control location relationship table, and protocol shadow chain. Writing back the results is not simply logging; it truly solidifies the status of the measures into the location system that will be used subsequently. Writing back to the protocol attachment trajectory means updating the current risk status, open status, and allowed-to-advance status of the control location identifier in the actual control path representation. Writing back to the control location relationship table means updating the relationship status between this location and its preceding, succeeding, mutually exclusive, and dependent locations; for example, a connection relationship is severed, a dependency relationship is strengthened, or a recovery condition is extended. Writing back to the protocol shadow chain means simultaneously modifying the open, adjacency, and observation status of the corresponding shadow control location identifiers, detection control location identifiers, and abnormal transition location identifiers. Through this writing back, the tiered measures will not remain at the level of the current analysis results but will truly change the structural foundation upon which subsequent occupancy verification depends.

[0116] After writing back the handling results, it is necessary to perform stage identification processing based on the evolution of the equipment operation stage. Equipment operation stage evolution refers to the phased changes in the current operating state of the equipment relative to the previous period, such as transitioning from the startup stage to the stable stage, from the stable stage to the switching stage, from the switching stage to the maintenance stage, from the maintenance stage to the recovery stage, or experiencing an abnormal rollback. The purpose of stage identification processing is that the allowed succession relationships, dependencies, opening sequences, and retrieval rhythms may differ for the same control location identifier in different equipment operation stages. If the current stage is not identified, and subsequent occupancy verification is continued based solely on the structure of the previous stage, legitimate actions may be misjudged as abnormal, or locations that should not be open may remain open in the new stage. Therefore, stage identification processing must comprehensively consider the equipment operation log, process variable evolution records, and the actual active locations in the recent protocol attachment trajectory to determine which operation stage the current equipment operating state belongs to, and whether that stage is a stable continuation, a smooth transition, a rapid switch, or an abnormal rollback. This processing provides a stage-based basis for subsequent trajectory update processing and shadow synchronization update processing.

[0117] After the phase identification results are generated, the protocol attachment trajectory needs to be updated based on these results. Trajectory update processing refers to correcting the control position identification order, open sections, connection paths, and attachment boundaries in the protocol attachment trajectory according to the currently identified equipment operating phase, making it adaptable to the current operating conditions. For example, during startup, some initialization control positions may be legally open, but these positions should be closed during the stable phase; during handover, temporary connection relationships may exist between some mutually exclusive paths, but these relationships should be severed during the stable phase; during maintenance, some manually confirmed positions may be explicitly open, but these positions are not legal paths during normal operation. The significance of trajectory update processing is to ensure that the protocol attachment trajectory always reflects the truly permissible control path structure under the current operating phase, rather than remaining in the control relationships of the old phase.

[0118] After updating the protocol attachment trajectory, a shadow synchronization update is required for the protocol shadow chain. Shadow synchronization update refers to readjusting the structure and state of shadow control location identifiers, detection control location identifiers, and abnormal transition location identifiers in the protocol shadow chain, based on the updated protocol attachment trajectory and considering the aforementioned risk mitigation results. During implementation, for control paths closed in the protocol attachment trajectory, their corresponding shadow control location identifiers and related detection control location identifiers must be closed simultaneously; for new paths enabled in the new phase, new shadow control location identifiers and necessary detection control location identifiers must be generated and attached simultaneously; for control location identifiers mitigated, restricted, or isolated due to risk mitigation, observation rules must be strengthened, opening rules tightened, or related shadow paths closed simultaneously in the protocol shadow chain. The purpose of shadow synchronization update is to ensure that the protocol shadow chain is always an isomorphic shadow of the protocol attachment trajectory, and does not retain the shadow structure of the old phase even when the actual path has changed. Only in this way can subsequent real-time messages mapped to the protocol shadow chain continue to obtain verification results consistent with the current real-world conditions.

[0119] After completing the trajectory update and shadow synchronization update processes, a consistency check of occupancy relationships needs to be performed on the updated protocol attachment trajectory and the updated protocol shadow chain. Occupancy relationship consistency refers to the synchronization and consistency between the updated real control path and the updated shadow control path in terms of control position identifier correspondence, temporal succession, dependency, mutual exclusion, and open state. If a control position identifier in the protocol attachment trajectory has been closed in the current operating phase, while the corresponding shadow control position identifier in the protocol shadow chain remains open, this indicates an inconsistency. Similarly, if a new path in the protocol attachment trajectory has been legally enabled, but the corresponding shadow control position identifier has not yet been generated in the protocol shadow chain, this also indicates an inconsistency. Furthermore, if a succession relationship has been severed due to risk mitigation, but the protocol shadow chain still retains the original preceding and following structure, this also constitutes an inconsistency. The purpose of the occupancy relationship consistency check is to compare these relationships and states item by item, identify all structural points that are still not synchronized after the update, and trigger corrections until the real path and shadow path reach a homogeneous state again. Only when this consistency condition is met will subsequent occupancy verification processes avoid misjudgments caused by structural asynchrony.

[0120] After confirming the consistency of the occupancy relationship, an update and solidification process needs to be performed to support subsequent occupancy verification. This update and solidification process involves writing the results of this round of source identification, risk classification, mitigation, restriction, isolation, stage identification, trajectory update, shadow synchronization update, and the final structural state after consistency verification into the runtime state cache and historical evolution cache. The runtime state cache directly supports the control location identifier mapping and occupancy verification processing of the next round of real-time messages, allowing the system to continue operating from the updated structure. The historical evolution cache records structural and handling changes from the previous stage to the current stage, enabling faster identification of repeated, staged, or evasive attacks should similar attack patterns reappear. Through this update and solidification process, the results of this step are not merely one-time analysis outputs but become the foundational input for the next round of identification and protection, thus forming a complete closed loop.

[0121] This application also provides an industrial control protocol identification and anti-attack processing system, referring to... Figure 2 , Figure 2This application provides an embodiment of an industrial control protocol identification and anti-attack processing method. The system is a server, which includes an acquisition module 21 and a processing module 22. The acquisition module 21 is used to acquire master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs, and process variable evolution records in the industrial control network, and perform time alignment and direction merging to construct a protocol attachment trajectory. At the same time, it assigns a control position identifier to each control command. The processing module 22 is used to construct the occupancy relationship between control position identifiers based on the protocol attachment trajectory, and generate shadow control position identifiers corresponding to the control position identifiers to form a protocol shadow chain. The processing module 22 is also used to perform control position identifier mapping on real-time messages. The processing module 22 is used to perform occupancy verification in the protocol shadow chain to identify free control segments; the processing module 22 is also used to set detection control position identifiers in the protocol shadow chain and identify occupancy behavior of the detection control position identifiers based on real-time messages to obtain active detection behavior; the processing module 22 is also used to perform control decoupling between free control segments and active detection behavior, and import them into a restricted redemption channel to form an attack analysis texture; the processing module 22 is also used to perform source tracing identification based on the attack analysis texture, and perform hierarchical handling of the corresponding control position identifiers, while simultaneously updating the protocol attachment trajectory and protocol shadow chain synchronously in combination with the evolution of the device operation stage, so as to maintain the effectiveness of control position occupancy determination and attack identification under context-deficient conditions.

[0122] This application also provides a server, as shown in the reference. Figure 3 , Figure 3 This is a schematic diagram of a server provided in an embodiment of this application. The server may include: at least one processor 31, at least one network interface 34, a user interface 33, a memory 35, and at least one communication bus 32.

[0123] The communication bus 32 is used to enable communication between these components.

[0124] The user interface 33 may include a display screen and a camera. Optionally, the user interface 33 may also include a standard wired interface and a wireless interface.

[0125] The network interface 34 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0126] The processor 31 may include one or more processing cores. The processor 31 connects to various parts of the server via various interfaces and lines, executing instructions, programs, code sets, or instruction sets stored in the memory 35, and calling data stored in the memory 35 to perform various server functions and process data. Optionally, the processor 31 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 31 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 31 and may be implemented as a separate chip.

[0127] The memory 35 may include random access memory (RAM) or read-only memory. Optionally, the memory 35 may include a non-transitory computer-readable storage medium. The memory 35 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 35 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 35 may also be at least one storage device located remotely from the aforementioned processor 31. Figure 3 As shown, the memory 35, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for industrial control protocol identification and anti-attack processing.

[0128] exist Figure 3In the server shown, the user interface 33 is mainly used to provide an input interface for users and obtain user input data; while the processor 31 can be used to call an application program stored in the memory 35 that is an industrial control protocol identification and anti-attack processing method. When executed by one or more processors, the server executes one or more methods as described in the above embodiments.

[0129] The foregoing description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Those skilled in the art will readily conceive of other embodiments of this disclosure upon considering the specification and the disclosure of practical truth. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A method for industrial control protocol identification and anti-attack processing, characterized in that, The method includes: Acquire master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs, and process variable evolution records in the industrial control network, and perform time alignment and direction merging to construct the protocol attachment trajectory, while assigning a control position identifier to each control command; Based on the protocol attachment trajectory, the occupancy relationship between the control location identifiers is constructed, and shadow control location identifiers corresponding to the control location identifiers are generated to form a protocol shadow chain; Control location identifier mapping processing is performed on real-time messages, and occupancy verification is performed in the protocol shadow chain to identify free control segments; A detection control location identifier is set in the protocol shadow chain, and the occupancy behavior of the detection control location identifier is identified based on the real-time message to obtain the active detection behavior; The free control segment is decoupled from the active detection behavior and imported into a restricted fulfillment channel to form an attack analysis texture; Based on the attack analysis texture, source tracing and identification are performed, and the corresponding control location identifiers are handled in a hierarchical manner. At the same time, the protocol attachment trajectory and the protocol shadow chain are updated synchronously in combination with the evolution of the device operation stage, so as to maintain the effectiveness of control location occupancy determination and attack identification under the condition of missing context.

2. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The process involves acquiring master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs, and process variable evolution records from the industrial control network, performing time alignment and direction merging to construct a protocol attachment trajectory, and assigning a control position identifier to each control command. Specifically, this includes: The master station interaction record, the slave station interaction record, the protocol conversion record, the device operation log, and the process variable evolution record are subjected to source normalization processing to generate standard record units; Time alignment processing is performed on the standard recording unit to form a unified time series. At the same time, direction merging processing is performed on the standard recording unit to construct the control initiation direction, control reception direction, control feedback direction, and control influence direction. Based on the unified time series and the merging results of each direction, interactive aggregation processing is performed around the same control object to form a set of control instructions. The protocol attachment trajectory is then constructed based on the set of control instructions, so that the protocol attachment trajectory includes the control initiation position, the protocol acceptance position, the feedback return position, the execution confirmation position, and the impact presentation position. Based on the control object, functional semantics, time sequence, and attachment position, a control position identifier is assigned to each control instruction on the protocol attachment trajectory, and a bidirectional mapping relationship is established between the protocol attachment trajectory and the control position identifier to support the subsequent construction of occupancy relationship and the generation of protocol shadow chain.

3. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The process of constructing the occupancy relationship between the control location identifiers based on the protocol attachment trajectory and generating shadow control location identifiers corresponding to the control location identifiers to form a protocol shadow chain specifically includes: The control position identifiers in the protocol attachment trajectory are subjected to position expansion processing to form a position sequence. Based on the position sequence, the temporal succession relationship, mutual exclusion relationship, dependency relationship and retrieval relationship between the control position identifiers are extracted, and the temporal succession relationship, mutual exclusion relationship, dependency relationship and retrieval relationship are written into the control position relationship table. Based on the control position relationship table, a corresponding shadow control position identifier is generated for each control position identifier, and the shadow control position identifier inherits the temporal succession relationship, mutual exclusion relationship, dependency relationship and recycling relationship of the corresponding control position identifier; Based on the control location relationship table, chain-based organization processing is performed on each of the shadow control location identifiers to form the protocol shadow chain, and a bidirectional association relationship is established between the control location identifier and the shadow control location identifier.

4. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The process of performing control location identifier mapping on real-time messages and performing occupancy verification in the protocol shadow chain to identify detached control segments specifically includes: The real-time message is processed to generate a real-time recording unit, and the control object attribution identification process and functional semantic extraction process are performed based on the real-time recording unit to obtain the control object attribution result and functional semantic result. Based on the control object attribution result, functional semantic result, and directional attribute, the shadow control location identifier in the protocol shadow chain is subjected to location candidate filtering processing to form a set of candidate shadow control location identifiers; The real-time recording unit is mapped to the target shadow control position identifier in the candidate shadow control position identifier set, and the corresponding control position identifier is determined synchronously. Based on the control position relationship table, an occupancy pre-check process is performed on the target shadow control position identifier to determine whether the timing inheritance relationship, mutual exclusion relationship, dependency relationship and reclamation relationship meet the occupancy conditions. An occupancy verification process is then performed on the target shadow control position identifier that passes the occupancy pre-check process to update the protocol shadow chain state. For real-time recording units that fail the occupancy pre-inspection or occupancy verification process, a free control segment is generated based on the unmapped result, occupancy mismatch result, and verification mismatch result.

5. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The step of setting a detection control location identifier in the protocol shadow chain and identifying occupancy behavior of the detection control location identifier based on the real-time message to obtain active detection behavior specifically includes: Based on the protocol shadow chain, the detection location selection process is performed to determine the target segment corresponding to the location gap, recycling window, mutual exclusion boundary and transformation boundary, and a detection control location identifier with detection attribute, non-execution attribute, observation attribute and inducement attribute is generated in the target segment. Adjacency linking is performed on the detection control location identifier to establish preceding, following, mutually exclusive, and segment boundary relationships with the shadow control location identifier. Opening rules are configured on the detection control location identifier to limit the observable, semi-open, and closed states. Based on the real-time message, if no legitimate occupancy is completed or a free control segment is formed, the detection location proximity identification process and occupancy attempt determination process are performed to determine the proximity behavior and occupancy attempt behavior of the real-time message to the detection control location identifier; Based on the segment type, adjacency relationship, and open rules of the detection and control location identifier, the occupancy attempt behavior is subjected to typified identification processing and initiative determination processing to obtain the active detection behavior.

6. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The process of decoupling the free control segment from the active detection behavior and importing it into a restricted fulfillment channel to form an attack analysis texture specifically includes: Anomaly merging processing is performed on the free control segment and the active detection behavior to form a set of control segments to be unhooked, and the real execution chain is cut off on the set of control segments to be unhooked to block the subsequent open state of the corresponding control position identifier on the real execution side. Based on the protocol shadow chain, the shadow mapping continuation process is performed on the control set to be decoupled, so that the control set to be decoupled is attached to the corresponding shadow control position identifier, detection control position identifier, or abnormal transition position identifier. A restricted redemption channel is constructed on the protocol shadow chain, and channel boundary constraints, redemption range constraints, path extension constraints, and response mirroring constraints are written to the restricted redemption channel; In the restricted redemption channel, restricted redemption processing and abnormal feedback mirroring processing are performed on the control set to be decoupled, and continuous observation processing is performed on the control set to be decoupled to obtain continuous observation processing results, so as to record the position migration order, repeated approach times, boundary trial rhythm, conversion approach direction, waiting interval mode and back-down retry mode. Texture extraction processing is performed on the continuous observation processing results to form attack analysis textures.

7. The industrial control protocol identification and anti-attack processing method according to claim 1, characterized in that, The process of performing source tracing and identification based on the attack analysis texture, and performing hierarchical processing on the corresponding control location identifiers, while simultaneously updating the protocol attachment trajectory and the protocol shadow chain in conjunction with the evolution of the device operation phase, in order to maintain the effectiveness of control location occupancy determination and attack identification under context-deficient conditions, specifically includes: The attack analysis texture is subjected to texture decomposition processing to form a source tracing unit set, and the source tracing unit set is subjected to source back-pointing processing and position back-tracing processing based on the source chain binding relationship to determine the corresponding control position identifier set; Attribution identification and influence domain identification processes are performed based on the control location identifier set to determine the source category and diffusion range, and risk classification processing is performed based on the source category and diffusion range to obtain low-risk, medium-risk, and high-risk locations. Slow-release measures are implemented for low-risk locations, restriction measures are implemented for medium-risk locations, and isolation measures are implemented for high-risk locations. The results of these measures are then written back to the protocol attachment trajectory, the control location relationship table, and the protocol shadow chain. Based on the evolution of the device's operating phase, a phase identification process is performed, and based on the phase identification results, a trajectory update process is performed on the protocol attachment trajectory, and a shadow synchronization update process is performed on the protocol shadow chain. The updated protocol attachment trajectory and the protocol shadow chain are subjected to a consistency check of the occupancy relationship, and an update and solidification process is performed when the consistency conditions are met, so as to support subsequent occupancy verification processing.

8. An industrial control protocol identification and anti-attack processing system, characterized in that, The system is used to execute the industrial control protocol identification and anti-attack processing method as described in any one of claims 1 to 7, wherein the system includes an acquisition module and a processing module, wherein... The acquisition module is used to acquire master station interaction records, slave station interaction records, protocol conversion records, equipment operation logs and process variable evolution records in the industrial control network, and perform time alignment and direction merging to construct the protocol attachment trajectory, while assigning a control position identifier to each control command. The processing module is used to construct the occupancy relationship between the control position identifiers based on the protocol attachment trajectory, and generate shadow control position identifiers corresponding to the control position identifiers to form a protocol shadow chain; The processing module is also used to perform control location identifier mapping processing on real-time messages and perform occupancy verification in the protocol shadow chain to identify free control segments; The processing module is also used to set a detection control location identifier in the protocol shadow chain, and to identify the occupation behavior of the detection control location identifier based on the real-time message to obtain the active detection behavior; The processing module is also used to decouple the free control segment from the active detection behavior and import it into a restricted realization channel to form an attack analysis texture. The processing module is also used to perform source tracing and identification based on the attack analysis texture, and to perform hierarchical processing on the corresponding control position identifier. At the same time, it is used to synchronously update the protocol attachment trajectory and the protocol shadow chain in combination with the evolution of the device operation stage, so as to maintain the effectiveness of control position occupancy determination and attack identification under context-deficient conditions.

9. A server, characterized in that, The server includes a processor, a memory, a user interface, and a network interface. The memory is used to store instructions. The user interface and the network interface are both used to communicate with other devices. The processor is used to execute the instructions stored in the memory to cause the server to perform the method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores instructions that, when executed, perform the method as described in any one of claims 1 to 7.

Images