Industrial edge multi-node anomaly detection method and device, equipment and storage medium

Abstract

Embodiments of the present application provide an industrial edge multi-node anomaly detection method, device, equipment and storage medium. The method comprises: acquiring security event data and real-time traffic data; analyzing the traffic distribution anomaly degree of the security event data to obtain a plurality of abnormal events; performing spatio-temporal correlation on the abnormal events to obtain an event correlation tree; generating a dynamic baseline based on the real-time traffic data and a preset dynamic smoothing algorithm; comparing the dynamic baseline with the real-time traffic data to obtain an effective abnormal alarm sequence; processing the effective abnormal alarm sequence through a preset time sequence state model to obtain a plurality of attack stage recognition results; and generating an anomaly detection result according to the event correlation tree, the effective abnormal alarm sequence and the attack stage recognition result. The method is used to achieve cross-node event spatio-temporal correlation, dynamic baseline self-adaptation, multi-stage attack accurate identification and tracing, and improve the accuracy and response efficiency of industrial edge environment anomaly detection.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular to an anomaly detection method, apparatus, equipment and storage medium for multiple nodes at the industrial edge. Background Technology

[0002] With the rapid development of industrial control systems towards digitalization and networking, edge computing technology has been widely applied in industrial production sites. Numerous edge nodes are deployed on the production line to handle data acquisition and local processing, forming a distributed industrial edge computing architecture. Industrial network security, as a core component ensuring the stable operation of industrial production, is becoming increasingly important. Event correlation and anomaly detection technologies in multi-node industrial edge environments have become a key research direction in the field of industrial security.

[0003] Existing anomaly detection technologies in industrial edge environments mostly employ a centralized processing architecture, transmitting security data collected from all edge nodes to a central control unit for centralized processing. The central control unit analyzes the received data based on preset static detection rules, identifies abnormal events at individual edge nodes, and performs simple correlations on these abnormal events using predefined association rules. Ultimately, it generates security alarm information and issues corresponding defense commands.

[0004] Existing technologies cannot simultaneously achieve global event correlation across edge nodes and accurate anomaly detection under dynamic operating conditions. They are difficult to effectively identify multi-step attack behaviors across nodes in industrial edge environments, resulting in low accuracy and high false alarm rate in anomaly detection. This fails to meet the core requirements of real-time and reliable security protection in industrial production sites. Summary of the Invention

[0005] This application provides an anomaly detection method, apparatus, device, and storage medium for multiple nodes at the industrial edge, in order to improve the accuracy and response efficiency of anomaly detection.

[0006] In a first aspect, embodiments of this application provide an anomaly detection method for multiple nodes at an industrial edge, including:

[0007] Acquire security event data and real-time traffic data collected from multiple edge nodes;

[0008] The abnormality of traffic distribution in the security event data is analyzed based on a preset distribution entropy algorithm to obtain multiple abnormal events;

[0009] Spatiotemporal correlation is performed on the aforementioned abnormal events to obtain an event correlation tree;

[0010] A dynamic baseline is generated based on the real-time traffic data and a preset dynamic smoothing algorithm;

[0011] The dynamic baseline is compared with the real-time traffic data to obtain an effective anomaly alarm sequence;

[0012] The effective anomaly alarm sequence is processed by a preset time-series state model to obtain multiple attack stage identification results;

[0013] Anomaly detection results are generated based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification results.

[0014] In one possible implementation, the event association tree is obtained by performing spatiotemporal correlation on the abnormal events, including:

[0015] Obtain historical abnormal events of the same edge node within the same preset time period, and calculate the feature similarity between the abnormal events in the current time window and the historical abnormal events in the time dimension;

[0016] Obtain abnormal events from different edge nodes within the same preset time period, and compare the consistency of the triggering characteristics of the abnormal events from different edge nodes in the spatial dimension.

[0017] When the feature similarity is lower than a preset threshold or the triggering features are consistent, an association edge is established from the high-level intrusion alarm event to the corresponding abnormal event, and the event association tree with a directed acyclic graph structure is generated according to the time sequence of the events.

[0018] In one possible implementation, calculating the feature similarity between anomalous events within the current time window and historical anomalous events in the time dimension includes:

[0019] Extract the probability distribution of at least one type of event feature from the historical anomalous events to form a historical distribution vector;

[0020] Extract the probability distribution of common event features from abnormal events within the current time window to form the current distribution vector;

[0021] Calculate the divergence between the current distribution vector and the historical distribution vector;

[0022] The feature similarity is determined based on the difference between the divergence value and a preset constant.

[0023] In one possible implementation, generating the dynamic baseline based on the real-time traffic data and the preset dynamic smoothing algorithm includes:

[0024] Obtain the sequence of real-time traffic data measurements at multiple consecutive moments within a preset window, as well as the baseline value at the previous moment;

[0025] Calculate the arithmetic mean of the flow measurement sequence;

[0026] The arithmetic mean is combined with the baseline value of the previous time step according to a preset weight to obtain the current baseline value;

[0027] The rate of change is determined based on the change in flow measurement values ​​at adjacent times in the flow measurement value sequence, and the preset weight is adjusted when the rate of change meets the preset fluctuation condition.

[0028] In one possible implementation, the valid anomaly alarm sequence is processed using the preset time-series state model to obtain the identification results of the multiple attack stages, including:

[0029] Obtain the alarm type identifier of each alarm in the valid abnormal alarm sequence;

[0030] Each alarm type identifier is input into a pre-trained word embedding model, which outputs a corresponding fixed-dimensional feature vector and arranges them in chronological order as an initial vector sequence.

[0031] The initial vector sequence is normalized to obtain the observation vector sequence;

[0032] The observation vector sequence is input into a preset state sequence model for path decoding to obtain the state path with the highest state probability value.

[0033] Each state in the state path is identified as the result of the identification of the multiple attack stages.

[0034] In one possible implementation, an anomaly detection result is generated based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification result, including:

[0035] The set of affected nodes is determined based on the event association tree;

[0036] Based on the current attack stage in the attack stage identification result;

[0037] The current attack phase is compared with a preset strategy mapping table to obtain the corresponding defense action type;

[0038] Based on the defense action type, a defense command is generated and sent to each edge node in the affected node set;

[0039] The event association tree is traversed in a depth-first manner, starting from the root node and visiting each node layer by layer along the parent-child relationship, and the sequence of nodes visited during the visit is recorded.

[0040] The earliest intrusion alarm event in the node sequence is identified as the attack starting point;

[0041] Extract the feature information of the attack source from the attack origin, and arrange the nodes in the node sequence according to the access order to obtain the attack path;

[0042] The anomaly detection result is generated based on the valid anomaly alarm sequence, the attack phase identification result, and the attack path.

[0043] Secondly, embodiments of this application provide an anomaly detection device for multiple nodes at an industrial edge, comprising:

[0044] The acquisition module is used to acquire security event data and real-time traffic data collected from multiple edge nodes;

[0045] The anomaly analysis module is used to analyze the anomaly degree of traffic distribution of the security event data based on a preset distribution entropy algorithm to obtain multiple anomaly events;

[0046] The association module is used to perform spatiotemporal association on the abnormal events to obtain an event association tree;

[0047] The generation module is used to generate a dynamic baseline based on the real-time traffic data and a preset dynamic smoothing algorithm;

[0048] The comparison module is used to compare the dynamic baseline with the real-time traffic data to obtain an effective abnormal alarm sequence;

[0049] The processing module is used to process the effective abnormal alarm sequence through a preset time-series state model to obtain multiple attack stage identification results;

[0050] The analysis module is used to generate anomaly detection results based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification results.

[0051] In one possible implementation, the association module is specifically used for:

[0052] Obtain historical abnormal events of the same edge node within the same preset time period, and calculate the feature similarity between the abnormal events in the current time window and the historical abnormal events in the time dimension;

[0053] Obtain abnormal events from different edge nodes within the same preset time period, and compare the consistency of the triggering characteristics of the abnormal events from different edge nodes in the spatial dimension.

[0054] When the feature similarity is lower than a preset threshold or the triggering features are consistent, an association edge is established from the high-level intrusion alarm event to the corresponding abnormal event, and the event association tree with a directed acyclic graph structure is generated according to the time sequence of the events.

[0055] In one possible implementation, the association module is further configured to:

[0056] Extract the probability distribution of at least one type of event feature from the historical anomalous events to form a historical distribution vector;

[0057] Extract the probability distribution of common event features from abnormal events within the current time window to form the current distribution vector;

[0058] Calculate the divergence between the current distribution vector and the historical distribution vector;

[0059] The feature similarity is determined based on the difference between the divergence value and a preset constant.

[0060] In one possible implementation, the generation module is specifically used for:

[0061] Obtain the sequence of real-time traffic data measurements at multiple consecutive moments within a preset window, as well as the baseline value at the previous moment;

[0062] Calculate the arithmetic mean of the flow measurement sequence;

[0063] The arithmetic mean is combined with the baseline value of the previous time step according to a preset weight to obtain the current baseline value;

[0064] The rate of change is determined based on the change in flow measurement values ​​at adjacent times in the flow measurement value sequence, and the preset weight is adjusted when the rate of change meets the preset fluctuation condition.

[0065] In one possible implementation, the processing module is specifically used for:

[0066] Obtain the alarm type identifier of each alarm in the valid abnormal alarm sequence;

[0067] Each alarm type identifier is input into a pre-trained word embedding model, which outputs a corresponding fixed-dimensional feature vector and arranges them in chronological order as an initial vector sequence.

[0068] The initial vector sequence is normalized to obtain the observation vector sequence;

[0069] The observation vector sequence is input into a preset state sequence model for path decoding to obtain the state path with the highest state probability value.

[0070] Each state in the state path is identified as the result of the identification of the multiple attack stages.

[0071] In one possible implementation, the analysis module is specifically used for:

[0072] The set of affected nodes is determined based on the event association tree;

[0073] Based on the current attack stage in the attack stage identification result;

[0074] The current attack phase is compared with a preset strategy mapping table to obtain the corresponding defense action type;

[0075] Based on the defense action type, a defense command is generated and sent to each edge node in the affected node set;

[0076] The event association tree is traversed in a depth-first manner, starting from the root node and visiting each node layer by layer along the parent-child relationship, and the sequence of nodes visited during the visit is recorded.

[0077] The earliest intrusion alarm event in the node sequence is identified as the attack starting point;

[0078] Extract the feature information of the attack source from the attack origin, and arrange the nodes in the node sequence according to the access order to obtain the attack path;

[0079] The anomaly detection result is generated based on the valid anomaly alarm sequence, the attack phase identification result, and the attack path.

[0080] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0081] The memory stores computer-executed instructions;

[0082] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0083] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0084] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0085] The anomaly detection method, apparatus, device, and storage medium for multiple nodes at the industrial edge provided in this application acquire security event data and real-time traffic data from multiple edge nodes. A distribution entropy algorithm is used to quantify the concentration of traffic distribution within security events to identify anomalies. Anomalies are then spatiotemporally correlated according to their occurrence time and the node to which they belong to, constructing an event association tree. Simultaneously, real-time traffic data combined with a dynamic smoothing algorithm continuously updates the normal behavior baseline. The difference between real-time traffic and the baseline generates an effective anomaly alarm sequence, which is then input into a time-series state model to analyze the attack's stage. Finally, based on the event association tree, alarm sequence, and attack stage identification results, an anomaly detection report is generated, and the attack path is reconstructed. This achieves global correlation of cross-node attack behavior, adaptive adjustment of the baseline under dynamic operating conditions, and accurate identification of multi-stage attacks. It overcomes the shortcomings of existing technologies, such as missing event correlations, poor dynamic adaptability, and insufficient multi-step attack detection capabilities, thereby improving the accuracy of anomaly detection in industrial edge environments, reducing false alarm rates, and enabling rapid tracing of attack paths. Attached Figure Description

[0086] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0087] Figure 1 A schematic diagram illustrating the application scenario of the anomaly detection method for multiple nodes at the industrial edge provided in this application;

[0088] Figure 2 A flowchart illustrating the anomaly detection method for multiple nodes at the industrial edge provided in this application;

[0089] Figure 3 A schematic diagram of the structure of the industrial edge multi-node anomaly detection device provided in this application;

[0090] Figure 4 A schematic diagram of the structure of the electronic device provided in this application.

[0091] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0092] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0093] First, let me explain the terms used in this application:

[0094] Edge nodes: computing devices or controllers deployed in industrial sites that have local data acquisition and processing capabilities.

[0095] Security event data: Raw record information related to the system security status collected by edge nodes, including event type, trigger characteristics, occurrence time and level identifier.

[0096] Real-time traffic data: Instant measurement information such as the number of data packets or protocol distribution transmitted by the edge node network interface within a continuous time window.

[0097] Predefined distribution entropy algorithm: a predefined mathematical calculation method based on the principle of information entropy, used to measure the degree of concentration of traffic distribution.

[0098] Abnormal events: Event records that deviate from the normal pattern by analyzing the abnormality of traffic distribution in security event data.

[0099] Spatiotemporal correlation: A processing method that combines the chronological order of events with the location of their respective edge nodes to analyze the relationship between abnormal events.

[0100] Event Association Tree: A directed acyclic graph data structure that uses high-level intrusion alarm events as the root node and organizes cross-node abnormal events through parent-child relationships.

[0101] Predefined dynamic smoothing algorithm: A predefined smoothing calculation method that dynamically updates the normal behavior reference value by weighted fusion of historical baseline and current measurement value.

[0102] Dynamic baseline: A reference value for normal behavior that is updated over time and used to compare with real-time traffic data to identify anomalies.

[0103] Valid anomaly alarm sequence: A sequence of multiple alarms that meet the anomaly judgment criteria, generated by comparing the dynamic baseline with real-time traffic data, arranged in chronological order.

[0104] Pre-set temporal state model: A pre-trained probabilistic model used to describe the state transitions of attack behavior at each stage in the time dimension.

[0105] Attack phase identification results: Multiple discrete state identifiers reflecting the attack evolution process are obtained by decoding the alarm sequence through a time-series state model.

[0106] Attack path: Starting from the attack origin, the propagation path is formed by the edge nodes and corresponding events that pass through the parent-child relationships in the event association tree.

[0107] The specific application scenario of this application is a distributed system with multiple edge nodes deployed in an industrial internet environment, such as a production line controller, intelligent warehousing equipment, and a new energy power station data acquisition unit. In this scenario, attacks often manifest as cross-node propagation, for example, moving laterally from a single edge node after intrusion to the core production unit, or launching an attack through the coordinated efforts of multiple nodes.

[0108] Based on the above scenarios, it can be seen that existing technologies that rely on independent detection by a single node or a fixed threshold baseline have the technical problem of being unable to correlate abnormal events scattered across different nodes in terms of time and space. This results in cross-node attacks not being globally identified and is difficult to adapt to dynamic changes in industrial site conditions.

[0109] The anomaly detection method for multiple nodes at the industrial edge provided in this application solves the technical problems of missing cross-node attack correlation and insufficient dynamic adaptability in existing technologies by employing a distributed entropy algorithm to identify abnormal traffic distribution events and constructing an event correlation tree through spatiotemporal correlation of these events. Simultaneously, it utilizes a dynamic smoothing algorithm to generate an adaptive baseline to obtain effective anomaly alarm sequences, and then uses a time-series state model to analyze the attack phase, ultimately generating detection results and tracing the attack path. The following detailed description of the technical solution and how it solves the aforementioned technical problems is provided with specific embodiments. These specific embodiments can be combined with each other, and similar concepts or processes may not be repeated in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0110] Figure 1 The diagram illustrates an application scenario of the anomaly detection method for multiple nodes at the industrial edge provided in this application. Figure 1 As shown, it includes: terminal 101 and server 102.

[0111] Among them, terminal 101 is deployed in multiple edge nodes in the industrial site to collect local security event data and real-time traffic data, and send the collected data to server 102.

[0112] Server 102 serves as the central control terminal, receiving security event data and real-time traffic data sent by multiple terminals 101, and performing the following operations: analyzing the anomaly degree of traffic distribution in the security event data using a preset distribution entropy algorithm to obtain multiple abnormal events; performing spatiotemporal correlation on the abnormal events to obtain an event association tree; generating a dynamic baseline based on real-time traffic data and a preset dynamic smoothing algorithm; comparing the dynamic baseline with the real-time traffic data to obtain a valid anomaly alarm sequence; processing the valid anomaly alarm sequence using a preset temporal state model to obtain multiple attack stage identification results; and generating anomaly detection results based on the event association tree, the valid anomaly alarm sequence, and the attack stage identification results.

[0113] Figure 2 This is a flowchart illustrating the anomaly detection method for multiple nodes at the industrial edge provided in this application. The execution entity in this embodiment can be... Figure 1 The server 102 in the illustrated embodiment can also be other computer-related devices, and this embodiment is not particularly limited.

[0114] like Figure 2 As shown, the anomaly detection method for multiple nodes at the industrial edge includes the following steps:

[0115] Step S201: Acquire security event data and real-time traffic data collected from multiple edge nodes.

[0116] Specifically, traffic data from local network interfaces and security-related records generated during system operation are collected by edge nodes deployed in industrial sites. Security event data includes four key fields: event type, trigger characteristics, occurrence timestamp, and event level. The event type is limited to three categories: intrusion alarm, abnormal traffic, or unauthorized access; the trigger characteristics include source IP address, destination port, and protocol type; the occurrence timestamp uses a nanosecond-level high-precision clock to record the event trigger moment, ensuring accurate reconstruction of the event sequence; the event level is divided into five levels according to preset rules, with level one representing the most serious threat and level five representing the lowest risk.

[0117] By simultaneously acquiring discrete event records reflecting abnormal behavior and continuous traffic data reflecting load changes, a foundational input is provided for subsequent multi-dimensional analysis, avoiding detection blind spots due to data gaps.

[0118] Step S202: Analyze the anomaly degree of traffic distribution in security event data based on the preset distribution entropy algorithm to obtain multiple abnormal events.

[0119] Specifically, before analysis, the process includes aligning and encoding security event data according to a standard format to generate standardized security event records. These records are encapsulated using a unified structure, such as JSON Schema, and include fields such as version number, event ID, node identifier, timestamp, event type, feature vector, and level label.

[0120] Traffic distribution characteristics are extracted from standardized security event logs. These characteristics are categorized and summarized according to three dimensions: protocol type, source IP address, or destination port, to obtain a sequence of the proportion of each type of traffic in the total traffic. For example, for the protocol type dimension, the number of packets for protocols such as Modbus / TCP, OPC UA, HTTP, and SSH within a unit time window is summarized, and their proportion of the total traffic is calculated to form a sequence of proportions. The Ruili entropy event correlation module uses the second-order Ruili entropy formula to calculate the anomaly degree of the current traffic distribution. Its mathematical expression is:

[0121]

[0122] in, Indicates the first The proportion of traffic of a particular class in the total traffic. This formula reflects the anomaly of network behavior by measuring the concentration of traffic distribution: when traffic is highly concentrated in a few classes, The value increases, A decrease in the value indicates a potential anomaly. The Ruili entropy event correlation module continuously maintains the time series of historical Ruili entropy values ​​and calculates their moving average. By extracting traffic percentage sequences categorized by protocol type, source address, or destination port, the concentration of the current traffic distribution is calculated using a second-order distributed entropy function, and periods with entropy values ​​below a dynamic threshold are marked as anomalous events.

[0123] In normal industrial network traffic, the distribution of various protocols and addresses is relatively uniform. Attacks (such as denial of service or scanning) can cause traffic to concentrate on a few types, resulting in a decrease in distribution entropy. By quantifying the change in entropy, anomalies can be identified, and traffic periods that deviate from the normal pattern can be filtered out. Discrete anomaly events are generated for subsequent correlation, transforming the original high-dimensional traffic data into a structured set of anomaly events, reducing the complexity of data analysis, while maintaining sensitivity to various attack patterns.

[0124] The distribution entropy algorithm quantifies the degree of deviation from normal events by calculating the concentration of traffic distribution. For example, when traffic is highly concentrated in a few protocol types, the entropy value decreases, triggering an anomaly flag. This algorithm dynamically adjusts the threshold using the moving average of historical entropy values ​​to avoid false alarms caused by periodic fluctuations in operating conditions.

[0125] Step S203: Perform spatiotemporal correlation on the abnormal events to obtain the event correlation tree.

[0126] Specifically, the timestamp and edge node identifier of each abnormal event are used as spatiotemporal coordinates. Parent-child relationships are established based on the chronological order of events and triggering characteristics between nodes (such as the same source address or protocol combination). A directed acyclic graph (DAG) event association tree is constructed with high-level intrusion alarms as the root node. The establishment of association edges follows the chronological order (e.g., the parent node's event time is earlier than the child node's event time), and potential loops are detected and eliminated using a topological sorting algorithm (such as the Kahn algorithm). For example, when constructing association edges, if a child node's event time is found to be earlier than the parent node's time, the edge is rejected, ensuring that the event association tree is always a DAG.

[0127] Single-point anomalies may be random noise, while multiple anomalous events that are temporally continuous and spatially distributed across different nodes may belong to the same attack chain. Through joint matching in both spatiotemporal dimensions, isolated events can be aggregated into attack paths. Organizing dispersed anomalous events into a hierarchical structure reflecting the attack propagation process enables global correlation of cross-node events, improving the ability to identify multi-node coordinated attack behaviors such as lateral movement and distributed attacks.

[0128] Step S204: Generate a dynamic baseline based on real-time traffic data and a preset dynamic smoothing algorithm.

[0129] Specifically, by setting a time window length, the system continuously collects flow measurement values ​​at various times within the window and calculates the average value to obtain the baseline value of the previous time moment. The average value and the previous time moment's baseline value are then linearly combined according to preset weights to obtain the current baseline value. Simultaneously, the flow rate change rate between adjacent time moments is monitored, and when the rate of change exceeds a threshold, the weighting coefficients are adjusted to accelerate baseline response. The dynamic smoothing algorithm fuses historical baselines with current flow data using an exponentially weighted moving average, allowing the baseline value to smoothly follow normal behavior changes. For example, in scenarios with a sudden increase in production load, the algorithm automatically adjusts the weighting parameters to accelerate baseline convergence and ensure the dynamic adaptability of anomaly detection.

[0130] Due to dynamic changes in industrial site conditions (such as production rhythm switching), fixed baselines cannot keep pace with normal behavior. Exponentially weighted moving averages, by integrating historical and current data, allow the baseline to smoothly follow long-term trends; simultaneously, by sensing the rate of change, they increase the weight of current data during sudden fluctuations, balancing stability and sensitivity. By adaptively capturing the normal fluctuation range of traffic flow, they avoid false alarms and false negatives caused by static thresholds, improving the robustness of anomaly detection.

[0131] Step S205: Compare the dynamic baseline with the real-time traffic data to obtain an effective abnormal alarm sequence.

[0132] Specifically, at each sampling moment, the real-time flow measurement value is compared with the corresponding dynamic baseline value. When the deviation ratio exceeds the preset range, a single feature is marked as abnormal. When multiple features are abnormal at the same time or a single feature is abnormal multiple times in a row, it is determined as a valid abnormal alarm and organized into an alarm sequence in chronological order.

[0133] Single-instance deviations may originate from measurement noise, requiring multi-dimensional or multi-period joint judgment to eliminate false alarms. Valid alarms within a continuous time window are serialized to prepare input for subsequent time-series modeling. By filtering out random fluctuations from continuous traffic comparisons, a reliable set of abnormal alarms is generated while preserving their temporal order, effectively improving the alarm signal-to-noise ratio and ensuring that the sequences entering the model have clear attack indication significance, thus reducing unnecessary computation.

[0134] Step S206: Process the valid abnormal alarm sequence through a preset time-series state model to obtain the identification results of multiple attack stages.

[0135] Specifically, the type identifiers of each alarm in the effective anomaly alarm sequence are converted into fixed-dimensional feature vectors and arranged in time to form an observation vector sequence. This sequence is then input into a pre-trained state space model (including normal, scanning, detection, exploitation, and theft states), and a dynamic programming algorithm is used to decode the hidden state path with the highest probability value. The continuous states in the path are the attack phase sequence.

[0136] For example, Hidden Markov Models can be used to identify the attack stage by inferring the most probable state path from the observation sequence through state transition probabilities and observation probabilities that depend on the reaction time. Analyzing the attack behavior logic behind the alarm sequence transforms scattered alarms into semantically meaningful attack stages, enabling the stage-based localization of complex attacks (such as advanced persistent threats), providing stage information for differentiated defense, and improving detection depth.

[0137] Step S207: Generate anomaly detection results based on the event association tree, valid anomaly alarm sequence, and attack phase identification results.

[0138] Specifically, the affected node set is determined based on the event association tree; according to the current stage in the attack stage identification results, defense actions are queried from the preset policy mapping table and issued to the relevant nodes; a depth-first traversal is performed on the event association tree, visiting from the root node to the leaf node, extracting the earliest high-level event as the attack starting point and its characteristic information, and recording the access order as the attack path; the alarm sequence, stage results, and path are integrated to generate the final anomaly detection report. The preset policy mapping table supports dynamic updates to adapt to new attack patterns.

[0139] The attack path is implicit in the parent-child relationships and temporal sequence of the event association tree, and the attack propagation trajectory can be reconstructed through graph traversal algorithms. Simultaneously, by combining the stage identification results, blocking strategies can be dynamically selected, outputting a complete detection conclusion including the attack source, propagation link, behavior at each stage, and affected nodes, and triggering automated defense, shortening the time from detection to response, providing a traceable chain of evidence, and meeting the closed-loop security requirements of industrial sites.

[0140] The anomaly detection method for multiple nodes in the industrial edge provided by this invention constructs an event association tree through distributed entropy spatiotemporal correlation, dynamically weighted smoothing adaptive baseline, time-series state model parsing attack stages, and graph traversal tracing attack paths. This achieves global correlation of cross-node abnormal events, accurate anomaly determination under dynamic operating conditions, stage identification and rapid tracing of multi-step attacks, thereby improving the accuracy and response efficiency of anomaly detection in the industrial edge environment.

[0141] This embodiment provides a detailed description of the process of obtaining an event association tree by performing spatiotemporal correlation on abnormal events as described in the above embodiments. The specific implementation of this process includes the following steps:

[0142] Step a1: Obtain historical abnormal events of the same edge node within the same preset time period, and calculate the feature similarity between the abnormal events in the current time window and the historical abnormal events in the time dimension.

[0143] Specifically, based on a fixed time period (such as the same hour every day), the system reads the set of historical abnormal events generated by the edge node in the same time period of multiple past periods from the storage; extracts the set of newly generated abnormal events in the current time window; constructs probability distributions for events in the two sets according to features such as type and source address, and calculates similarity using the distance metric between distributions.

[0144] Industrial equipment behavior often exhibits periodic patterns (such as shift changes and batch production; the time settings can be configured according to actual conditions), and the distribution of normal abnormal events remains relatively stable within the cycle. By comparing the deviation between the current distribution and the historical distribution for the same period, abnormal pattern changes caused by attacks can be identified, while false anomalies caused by periodic load fluctuations can be suppressed. This effectively filters out abnormal events that are inconsistent with historical behavior from a time perspective, eliminating periodic noise and thus improving the accuracy of anomaly detection in periodic scenarios, reducing false alarms caused by normal business fluctuations.

[0145] Step a2: Obtain abnormal events of different edge nodes within the same preset time period, and compare the consistency of the triggering characteristics of abnormal events of different edge nodes in the spatial dimension.

[0146] Specifically, select the same time window (e.g., the last five minutes) to collect abnormal events generated by multiple edge nodes; extract the trigger feature set of each abnormal event (e.g., source address, destination port, protocol combination); compare the event features of different nodes to determine whether the feature values ​​are the same or belong to the same attack mode (e.g., the same source address appears on multiple nodes at the same time).

[0147] Anomalies in a single node may originate from local failures or random noise; the simultaneous appearance of the same source address or attack characteristics on multiple nodes strongly indicates the presence of distributed attacks (such as scanning, denial-of-service attacks) or lateral movement. Spatial feature matching can aggregate events from isolated nodes into global attacks. By identifying cross-node, same-source attack events from a spatial dimension, lateral correlations between anomalous events across different nodes can be established, enabling global awareness of distributed attacks and lateral movement.

[0148] Step a3: When the feature similarity is lower than the preset threshold or the trigger features are consistent, establish the association edge from the high-level intrusion alarm event to the corresponding abnormal event, and generate an event association tree with a directed acyclic graph structure according to the time order of the events.

[0149] Specifically, the intrusion alarm event with the highest event level (such as level one or level two) is used as the root node; for the selected abnormal events that meet the conditions, directed edges are established from the root node in chronological order, pointing to subsequent abnormal events, and parent-child relationships are also established between subsequent abnormal events in chronological order; ensuring that there are no loops in the entire structure, forming a directed acyclic graph.

[0150] Organizing directed edges in chronological order allows for the reconstruction of attack propagation paths; the acyclic structure ensures that each event has a clear predecessor and successor, avoiding circular dependencies that lead to confusion in tracing the source; it transforms the temporal and spatial correlation results into a computable and traversable hierarchical graph structure, compressing attack information into a clear event relationship graph, supporting efficient graph traversal operations (such as depth-first search), and facilitating the rapid location of attack sources and propagation paths.

[0151] In some alternative implementations, step a1 above includes:

[0152] Step a11: Extract the probability distribution of at least one type of event feature from historical anomalous events to form a historical distribution vector.

[0153] Specifically, we select feature dimensions such as event type, source address, and protocol type; count the frequency of each feature value in the historical abnormal event set; and normalize the frequency vector so that the sum of all components is 1 to obtain the probability distribution vector. The probability distribution of the features reflects the structural pattern of abnormal events within historical normal periods. Transforming discrete events into continuous probability vectors facilitates subsequent comparisons using information theory or distance metrics.

[0154] By quantifying the set of historical anomalous events into a fixed-dimensional distribution vector, and using it as a benchmark for similarity comparison, the impact of differences in the number of events on the comparison is eliminated.

[0155] Step a12: Extract the probability distribution of the same event characteristics from the abnormal events within the current time window to form the current distribution vector.

[0156] Specifically, for the set of abnormal events generated within the current time window, select the same event feature dimensions as in the above steps; analyze the frequency of occurrence of each feature value and normalize it to form the current probability distribution vector, keep the feature dimensions consistent, and ensure that the current distribution and the historical distribution are comparable in the same semantic space, so as to provide vector inputs to be compared for subsequent divergence calculation.

[0157] Step a13: Calculate the divergence between the current distribution vector and the historical distribution vector.

[0158] Specifically, symmetric divergence functions such as Jensen-Shannon divergence or Kullback-Leibler divergence can be used. Given two probability distribution vectors, the divergence value calculates the degree of difference between the current distribution vector and historical distribution vectors. The divergence value quantifies the difference between the two probability distributions; a larger value indicates a more significant deviation between the current anomaly distribution and historical patterns, suggesting the potential for new attack types or behavioral changes. By transforming distribution differences into a single numerical indicator, a quantitative similarity measure is provided, avoiding subjective judgment and improving detection consistency.

[0159] Step a14: Determine the feature similarity based on the difference between the divergence value and the preset constant.

[0160] Specifically, a constant (usually 1 or the maximum possible divergence value) is preset. The divergence value is subtracted from this constant, and the difference is used as the feature similarity. The higher the similarity, the closer the current distribution is to the historical distribution. The larger the divergence value, the greater the difference; therefore, similarity and divergence are negatively correlated. By using constant subtraction, the difference measure is converted into an intuitive similarity score, which is easy to compare with a preset threshold (similarity below the threshold is considered an anomaly).

[0161] This invention achieves joint association of abnormal events in both time and space by comparing the current distribution of abnormal events with the historical distribution in the time dimension, comparing the consistency of triggering features of cross-node abnormal events in the spatial dimension, establishing an event association tree with a directed acyclic graph structure based on similarity or consistency conditions, and using distribution vectorization and divergence calculation to quantify similarity.

[0162] This embodiment provides a detailed description of the process of generating a dynamic baseline based on real-time traffic data and a preset dynamic smoothing algorithm in the above embodiments. The specific implementation of this process includes the following steps:

[0163] Step b1: Obtain the sequence of real-time traffic measurement values ​​for multiple consecutive moments within a preset window, as well as the baseline value of the previous moment.

[0164] Specifically, by setting a fixed-length time window (e.g., a window containing the most recent consecutive sampling times), the flow measurement values ​​for each time point within that window are sequentially read from the real-time flow data cache, forming a sequence of measurement values. Simultaneously, the baseline values ​​calculated at the previous time point are read from the baseline storage area. The fixed-length window ensures data freshness, and the baseline values ​​from the previous time point carry long-term behavioral memory, preparing the necessary numerical inputs for the current baseline calculation. This includes the measurement set within the window and the baseline reference point from the previous time point, ensuring the temporal continuity and data representativeness of baseline updates and preventing drastic disturbances to the baseline caused by single-point measurement anomalies.

[0165] Step b2: Calculate the arithmetic mean of the flow measurement sequence.

[0166] Specifically, the flow measurements taken at multiple times within the window are summed and divided by the window length to obtain the arithmetic mean of the window. The arithmetic mean reflects the overall flow level within the window, is more stable than measurements taken at a single time point, can smooth out short-term random fluctuations, and preserve the long-term trend of flow changes.

[0167] By compressing multiple discrete measurements within a window into a single representative value, which serves as a feature of the current data in the current update cycle, the impact of noise on baseline updates can be reduced, allowing the baseline to primarily follow long-term changes in traffic rather than instantaneous jumps.

[0168] Step b3: Combine the arithmetic mean with the baseline value of the previous time step according to a preset weight to obtain the current baseline value.

[0169] Specifically, an exponentially weighted moving average is used, which multiplies the arithmetic mean by the current data weight, the baseline value of the previous time step by the historical weight, and the sum of the two products. The result is used as the baseline value of the current time step; the sum of the two weights is 1.

[0170] The weights in the weighted fusion determine the baseline's sensitivity to changes; higher historical weights make the baseline smoother, while higher current weights make the baseline respond faster. By outputting dynamic reference values ​​that reflect the current level of normal behavior, subsequent anomaly detection is performed, maintaining baseline stability under stable operating conditions and smoothly following changes in flow trends to avoid drastic fluctuations.

[0171] Step b4: Determine the rate of change based on the change in flow measurement values ​​at adjacent times in the flow measurement value sequence, and adjust the preset weights when the rate of change meets the preset fluctuation conditions.

[0172] Specifically, in industrial settings, situations such as production line switching and batch equipment start-ups and shutdowns can cause short-term, drastic fluctuations in flow. Under conventional weighting, the baseline response lags, easily leading to false alarms. By monitoring the rate of change between adjacent time points, such abrupt changes can be quickly identified, and the weight of the current data can be temporarily increased, allowing the baseline to converge to the new operating condition more quickly.

[0173] By traversing the obtained flow measurement value sequence, the difference between each adjacent time point is calculated and divided by the earlier time point value to obtain multiple instantaneous change rates. The proportion of these change rates whose absolute value exceeds a set threshold (e.g., 50%) is summarized. If this proportion exceeds a preset proportion, the current data weight and historical weight are adjusted to equal values ​​(e.g., 0.5 each). This system dynamically senses sudden environmental changes, proactively adjusts the baseline's adaptive speed, shortens the baseline's stabilization time under new operating conditions, reduces invalid alarms caused by scene changes, and improves the dynamic adaptability of anomaly detection.

[0174] For example, the mathematical expression for dynamically updating the baseline value using the exponentially weighted moving average algorithm is:

[0175]

[0176] in, Indicates the first Time of the first Baseline value of class feature, This is the current weight; for example, the initial value is set to 0.3. The historical baseline weight is set, for example, with an initial value of 0.7. This represents the window size, with a value of 10. Indicates the first Time of the first The actual measured value of the class feature.

[0177] When the system detects that the production load fluctuation exceeds 50% (e.g., caused by changes in operating conditions such as production line switching or equipment start-up and shutdown), it will... and All values ​​were adjusted to 0.5 to accelerate the baseline's adaptability to sudden scene changes. The baseline update cycle was set to no more than one second to ensure that the baseline always closely reflects the current operating state. During the anomaly detection phase, if the actual measured value... Greater than the baseline value If the value is 1.5 times or less than two-thirds of the original value, it is considered a single-feature anomaly. Furthermore, when two types of features simultaneously exhibit single-feature anomalies, or when any feature is judged as a single-feature anomaly for three consecutive cycles, the event is marked as a valid anomaly and an alarm is triggered. The baseline adaptation error is controlled within 5% to ensure high sensitivity and a low false alarm rate even under complex operating conditions. When the flow rate change (e.g., the change in flow measurement values ​​between adjacent times divided by the earlier value) exceeds a preset threshold, the weighting parameters are adjusted (e.g., reducing the historical baseline weight from 0.7 to 0.5 and increasing the current data weight from 0.3 to 0.5) to allow the baseline to converge to the new operating condition more quickly. For example, when a production line switch causes a sudden increase in flow, the baseline response is accelerated to avoid misjudgment. The specific values ​​above are illustrative; in actual applications, the values ​​can be adjusted according to the actual situation, and no specific restrictions are imposed here.

[0178] This invention achieves dynamic and smooth tracking of industrial edge network traffic and rapid adaptation under sudden changes by acquiring the sequence of flow measurement values ​​within a window and the baseline value at the previous time, calculating the arithmetic mean of the sequence, weighting and combining them to obtain the current baseline value, monitoring the rate of change between adjacent time points and adjusting the weights. This improves the response efficiency and stability of the dynamic baseline to fluctuations in production load.

[0179] This embodiment details the process described in the above embodiment of processing valid abnormal alarm sequences using a preset time-series state model to obtain multiple attack stage identification results. The specific implementation of this process includes the following steps:

[0180] Step c1: Obtain the alarm type identifier of each alarm in the valid abnormal alarm sequence.

[0181] Specifically, alarm records are read one by one from the valid abnormal alarm sequence, the alarm type code in the preset fields (such as port scan, login failure, protocol abnormality, etc.) is parsed, and the type identifier string corresponding to each alarm is extracted.

[0182] Anomaly alarm sequences contain information about the attack behavior at different stages. Alarm type identifiers are key attributes that distinguish different attack actions. By converting alarm sequences into type identifier sequences, which serve as the original input for the feature transformation process, the semantic category information of the alarms is preserved, providing discrete symbol input for the word embedding model.

[0183] Step c2: Input each alarm type identifier into the pre-trained word embedding model, output the corresponding fixed-dimensional feature vector, and arrange them in chronological order as an initial vector sequence.

[0184] Specifically, by loading a word embedding model (such as a windowed prediction model) pre-trained on a large amount of historical alarm corpus, each alarm type identifier is fed into the model as a query term, and the model outputs a pre-trained fixed-length (such as 128-dimensional) real vector. All output vectors are arranged sequentially according to the original alarm time order to form an initial vector sequence.

[0185] Alarm type identifiers are discrete symbols, and directly inputting them into a state-space model will result in the loss of semantic similarity relationships. Word embedding maps these symbols to a continuous vector space, making semantically similar alarm types also appear close to each other in the vector space, thereby improving the model's generalization ability to attack patterns. Transforming discrete type identifiers into continuous feature representations that the model can compute enhances its ability to recognize alarms with different expressions but the same semantics, improving the robustness of classification during the attack phase.

[0186] Step c3: Normalize the initial vector sequence to obtain the observation vector sequence.

[0187] Specifically, calculate the magnitude (i.e., the square root of the sum of squares of each component) for each vector in the initial vector sequence, divide each component by the magnitude to scale the vector magnitude to a unit length; or use a more general standardization method (such as subtracting the mean and then dividing by the standard deviation) to make the numerical range fall within a preset interval.

[0188] Feature vectors generated by different alarm types may have differences in dimensions or scales. Normalization adjusts all vectors to a uniform scale, eliminates the influence of dimensions, ensures the stability of model training and the accuracy of analysis, prepares standardized observation data for model input, improves the numerical stability of state sequence model decoding, and avoids misjudgments caused by feature scale skew.

[0189] Step c4: Input the observation vector sequence into the preset state sequence model for path decoding to obtain the state path with the highest state probability value.

[0190] Specifically, the predefined state sequence model can adopt a Hidden Markov Model, by predefining a set of states (including normal, port scanning, vulnerability detection, vulnerability exploitation, data theft, etc.), a state transition probability matrix, and an observation probability matrix. Using the observation vector sequence as input, a dynamic programming algorithm (such as the Viterbi algorithm) is used to recursively calculate the maximum probability of reaching each state at each time step, and the predecessor state is recorded. After processing the sequence, backtracking is performed to obtain the state sequence that maximizes the overall probability.

[0191] Different stages of an attack correspond to different alarm observation distributions, and there are temporal transition probabilities between stages (e.g., from port scanning, it can only transition to vulnerability detection, not data theft). Dynamic programming algorithms utilize transition probabilities and observation probabilities to filter out the path with the highest matching degree to the observation sequence from all possible state sequences, thereby reconstructing the attack's evolution process. This maps the observation vector sequence to a hidden attack stage sequence, enabling precise stage identification of multi-step attacks, distinguishing normal fluctuations from attack behavior, and supporting differentiated defense responses.

[0192] Step c5: Determine each state in the state path as the result of multiple attack phase identification.

[0193] Specifically, an attack phase is a continuous subsequence of states excluding normal states in the state path. Each state identifier represents a specific step in the attack behavior, and the sequence order reflects the evolutionary logic of the attack. By removing the parts representing normal states from the decoded state path, the continuous abnormal state sequence is extracted and output in chronological order as a list of attack phases (such as scanning, probing, exploiting, and stealing). Each phase can be accompanied by its start and end positions on the timeline.

[0194] The hidden state path is transformed into readable attack stage labels, serving as input for coordinated defense and attribution analysis. By providing a structured description of attack progress, it facilitates the selection of blocking strategies based on the current stage and provides a basis for stage division in forensic analysis.

[0195] For example, the preset time-series state model adopts the Hidden Markov Model, which contains five basic elements: state set, observation set, state transition probability matrix, observation probability matrix and initial state probability vector.

[0196] The state set contains five discrete states: Indicates a normal state. Indicates the port scan status. Indicates the vulnerability detection status. Indicates the vulnerability exploitation status. This indicates the data theft status, fully covering the lifecycle of a typical APT (Advanced Persistent Threat) attack. The observation set consists of valid anomaly alert sequences, with alert type identifiers converted into fixed-dimensional real-valued vectors via a word embedding model. The word embedding model is pre-trained using historical alert text during the training phase, with a window size of 5 and 100 iterations. After training, the data is stored in a read-only parameter file, which is prohibited from being modified online during runtime to ensure the determinism and auditability of the detection logic.

[0197] K-means clustering is performed on the alarm vectors, with the number of clusters set to 5. The cluster centers correspond to the five attack stages mentioned above, thus initializing the state transition probability matrix A and the observation probability matrix B. Wherein, Indicates from state Transition to state The probability, Indicates the state The next generation The probability of each observation vector. Initial state probability vector. elements This represents the probability that the system is initially in state Sᵢ, usually denoted as [missing information]. The rest are 0.

[0198] The model parameters are iteratively optimized using the Baum-Welch algorithm, with labeled historical attack alert sequences as training samples. The maximum number of iterations and the convergence error threshold are also set. After training, valid anomaly alert sequences are received and processed using a sliding window approach with a window size of 10, converting alerts within the window into observation vector sequences. The Viterbi algorithm is used to decode the optimal state path, with the following recursive formula:

[0199]

[0200]

[0201] in, Indicates at time In state The probability of the maximum probability path. Record the preceding state of this path. When the decoded state path contains... and its subsequent states (i.e. or When a multi-step attack is detected, a high-level alarm is triggered.

[0202] This invention, through extracting alarm type identifiers, word embedding vectorization, sequence normalization, state path decoding, and stage output, achieves the conversion from discrete alarm sequences to continuous attack stage sequences, effectively improving the accuracy of multi-step attack identification and the precision of stage division.

[0203] This embodiment provides a detailed description of the process in the above embodiment for generating anomaly detection results based on the event association tree, valid anomaly alarm sequence, and attack phase identification results. The specific implementation of this process includes the following steps:

[0204] Step d1: Determine the set of affected nodes based on the event association tree.

[0205] Specifically, each node in the event association tree corresponds to an abnormal event, and the scope of nodes affected by the attack can be fully reflected by the edge node identifiers associated with all nodes in the tree. By traversing all nodes in the event association tree, the edge node identifier field is extracted from each node, and these identifiers are deduplicated to form a node set. This determines the scope of edge nodes that need to be defended, providing precise target nodes for subsequent defense commands and avoiding sending invalid commands to irrelevant nodes.

[0206] Step d2: Identify the current attack stage based on the attack stage identification results.

[0207] Specifically, the attack phase status at the end of the time series is read from the attack phase identification results. This status represents the latest stage that the attack behavior has evolved to. This enables the defense action to be dynamically adjusted according to the actual threat level caused by the attack, thus achieving differentiated response.

[0208] Because multi-stage attacks are progressive, the current stage of the attack determines the appropriate defense strategy. For example, earlier stages (such as scanning) require different response measures than later stages (such as data theft).

[0209] Step d3: Compare the current attack phase with the preset strategy mapping table to obtain the corresponding defense action type.

[0210] Specifically, a pre-defined policy mapping table stores the correspondence between attack phases and defense action types (e.g., temporary blocking of source addresses for the port scanning phase, and closure of high-risk service ports for the vulnerability exploitation phase). Using the current attack phase as the lookup key, a matching defense action type is retrieved from the table. Based on the defense action type, standardized defense instructions (e.g., in JSON format, including action type, target node identifier, and parameter details) are constructed and distributed to affected edge nodes via a secure communication channel (e.g., TLS-encrypted MQTT protocol).

[0211] Different attack phases pose varying degrees of harm and urgency to the production system. Pre-defined mapping relationships encode response strategies into executable rules, enabling the system to automatically select appropriate defense measures, achieving automated decision-making for security strategies, and reducing delays in manual intervention.

[0212] Step d4: Generate defense instructions based on the defense action type and send them to each edge node in the affected node set.

[0213] Specifically, a standardized instruction containing action parameters (such as the source address to be intercepted and the port number to be closed) is constructed according to the type of defense action; the instruction is sent to each of the aforementioned affected edge nodes through a secure communication channel (such as an encrypted transmission protocol); and a confirmation message is returned after the edge nodes execute the instruction.

[0214] By issuing unified instructions, all affected nodes are ensured to update their local protection policies within the same time window, enabling defense actions to take effect simultaneously on multiple nodes. This blocks the lateral spread of attacks, effectively shortens the time difference between detection and defense, and prevents attackers from continuing to penetrate during the response gap.

[0215] Step d5: Perform a depth-first traversal of the event association tree, starting from the root node and visiting each node level by level along the parent-child relationship, and record the sequence of nodes visited during the visit.

[0216] Specifically, starting from the root node of the event association tree (high-level intrusion alarm event), a child node and its descendant nodes are visited first through recursion or an explicit stack, and then other branches are visited backtracking. Each time a node is entered, it is added to the sequence, and finally a list of nodes is obtained in the order of visit.

[0217] Depth-first traversal can completely cover all nodes in the tree, and the characteristic of visiting each node layer by layer along the parent-child relationship ensures that the parent node always appears before the child node in the sequence, generating an ordered list of nodes for subsequent extraction of the attack starting point and construction of the propagation path. This flattens the tree structure into a linear sequence, which is convenient for sequential processing and path extraction.

[0218] For example, if the root node is an unauthorized SSH (SecureShell) login event to an AGV (Automated Guided Vehicle) controller, and its child nodes include Modbus write operations to a PLC (Programmable Logic Controller) from the same source IP, and OPC UA (OPC Unified Architecture) connection attempts to a SCADA (Supervisory Control and Data Acquisition) server, then the propagation path can be reconstructed as "the attacker accesses the AGV controller from an external network, and then moves laterally to the PLC and SCADA system." The source tracing analysis module integrates the attack source, propagation path, attack behaviors at each stage (such as scanning, probing, exploitation, and theft), and information on affected nodes to generate a structured source tracing report. The report can be in XML format and includes key fields such as the attacker's initial access location, lateral movement trajectory, vulnerability exploitation nodes, and data leakage endpoints, enabling security operations personnel to respond quickly and collect evidence.

[0219] Step d6: Locate the earliest intrusion alarm event in the node sequence as the attack starting point.

[0220] Specifically, events of intrusion alarm type are filtered out from the node sequence, and the timestamps of these events are compared. The event with the smallest timestamp is selected as the attack starting point. The attack starting point is characterized by a high event level and the earliest occurrence time; this point represents the moment when the attacker first successfully compromises the edge node.

[0221] Step d7: Extract the feature information of the attack source from the attack origin and arrange the nodes in the node sequence according to the access order to obtain the attack path.

[0222] Specifically, characteristic fields such as source address and physical port of access device are read from the attack origin node as attack source characteristic information. The recorded node sequence is output in order from the root node to the current traversal endpoint. Each node in the sequence corresponds to an event or a lateral movement in the attack process, forming a complete attack path. The output is structured path information that can be reviewed and used for forensics by security personnel, providing a complete backtracking chain of the attack process.

[0223] Step d8: Generate anomaly detection results based on the valid anomaly alarm sequence, attack phase identification results, and attack path.

[0224] Specifically, the effective anomaly alarm sequence, attack phase identification results, and attack path are encapsulated into a unified data structure (such as structured text or key-value pair format), and timestamp and event summary fields are added to form a complete anomaly detection report.

[0225] The anomaly detection results include the detection basis (alarm sequence), analysis conclusions (attack phase), and source tracing evidence (attack path), which facilitates security operations personnel to fully understand the attack event.

[0226] This invention identifies affected nodes through an event association tree and coordinates the issuance of defense commands, performs a depth-first traversal to reconstruct the node sequence and extract the attack starting point and attack path, and integrates alarm sequences and stage identification results to form a complete report, effectively improving the automated response capability and post-attack analysis efficiency of industrial edge environments to cross-node attacks.

[0227] Figure 3 This is a schematic diagram of the anomaly detection device for multiple nodes at the industrial edge provided in this application. Figure 3 As shown, the industrial edge multi-node anomaly detection device 30 includes:

[0228] The acquisition module 301 is used to acquire security event data and real-time traffic data collected from multiple edge nodes;

[0229] The anomaly analysis module 302 is used to analyze the anomaly degree of traffic distribution of security event data based on a preset distribution entropy algorithm to obtain multiple anomaly events;

[0230] The association module 303 is used to perform spatiotemporal association on abnormal events to obtain an event association tree;

[0231] Generation module 304 is used to generate a dynamic baseline based on real-time traffic data and a preset dynamic smoothing algorithm;

[0232] The comparison module 305 is used to compare the dynamic baseline with the real-time traffic data to obtain an effective abnormal alarm sequence;

[0233] Processing module 306 is used to process valid abnormal alarm sequences through a preset time-series state model to obtain multiple attack stage identification results;

[0234] Analysis module 307 is used to generate anomaly detection results based on the event association tree, valid anomaly alarm sequence, and attack phase identification results.

[0235] In one possible implementation, the association module 303 is specifically used for:

[0236] Obtain historical abnormal events of the same edge node within the same preset time period, and calculate the feature similarity between the abnormal events in the current time window and the historical abnormal events in the time dimension;

[0237] Obtain abnormal events from different edge nodes within the same preset time period, and compare the consistency of the triggering characteristics of the abnormal events from different edge nodes in the spatial dimension.

[0238] When the feature similarity is lower than the preset threshold or the trigger features are consistent, an association edge is established from the high-level intrusion alarm event to the corresponding abnormal event, and an event association tree with a directed acyclic graph structure is generated according to the time sequence of the events.

[0239] In one possible implementation, the association module 303 is further configured to:

[0240] Extract the probability distribution of at least one type of event feature from historical anomalous events to form a historical distribution vector;

[0241] Extract the probability distribution of common event features from abnormal events within the current time window to form the current distribution vector;

[0242] Calculate the divergence between the current distribution vector and the historical distribution vectors;

[0243] Feature similarity is determined based on the difference between the divergence value and a preset constant.

[0244] In one possible implementation, the generation module 304 is specifically used for:

[0245] Obtain the sequence of real-time traffic measurement values ​​for multiple consecutive moments within a preset window, as well as the baseline value of the previous moment;

[0246] Calculate the arithmetic mean of the sequence of flow measurements;

[0247] The arithmetic mean is combined with the baseline value from the previous time step according to a preset weight to obtain the current baseline value;

[0248] The rate of change is determined based on the change in flow measurement values ​​at adjacent times in the flow measurement value sequence, and the preset weights are adjusted when the rate of change meets the preset fluctuation conditions.

[0249] In one possible implementation, the processing module 306 is specifically used for:

[0250] Obtain the alarm type identifier of each alarm in the valid abnormal alarm sequence;

[0251] Each alarm type identifier is input into a pre-trained word embedding model, which outputs a corresponding fixed-dimensional feature vector and arranges them in chronological order as an initial vector sequence.

[0252] The initial vector sequence is normalized to obtain the observation vector sequence;

[0253] The observation vector sequence is input into a preset state sequence model for path decoding to obtain the state path with the highest state probability value.

[0254] Each state in the state path is identified as a result of multiple attack phases.

[0255] In one possible implementation, the analysis module 307 is specifically used for:

[0256] Determine the set of affected nodes based on the event association tree;

[0257] Based on the current attack stage in the attack stage identification results;

[0258] The current attack phase is compared with the preset strategy mapping table to obtain the corresponding defense action type;

[0259] Defense commands are generated based on the type of defense action and sent to each edge node in the set of affected nodes;

[0260] Perform a depth-first traversal of the event association tree, starting from the root node and visiting each node level by level along the parent-child relationship, and record the sequence of nodes visited during the process;

[0261] The earliest intrusion alert event in the node sequence is identified as the attack starting point;

[0262] Extract the feature information of the attack source from the attack origin and arrange the nodes in the node sequence according to the access order to obtain the attack path;

[0263] Anomaly detection results are generated based on valid anomaly alarm sequences, attack phase identification results, and attack paths.

[0264] The anomaly detection device for multiple nodes at the industrial edge provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0265] Figure 4 A schematic diagram of the structure of the electronic device provided in this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the electronic device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0266] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0267] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0268] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0269] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0270] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0271] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0272] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0273] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0274] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0275] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0276] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0277] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0278] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0279] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0280] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. An anomaly detection method for multiple nodes at an industrial edge, characterized in that, include: Acquire security event data and real-time traffic data collected from multiple edge nodes; The abnormality of traffic distribution in the security event data is analyzed based on a preset distribution entropy algorithm to obtain multiple abnormal events; Spatiotemporal correlation is performed on the aforementioned abnormal events to obtain an event correlation tree; A dynamic baseline is generated based on the real-time traffic data and a preset dynamic smoothing algorithm; The dynamic baseline is compared with the real-time traffic data to obtain an effective anomaly alarm sequence; The effective anomaly alarm sequence is processed by a preset time-series state model to obtain multiple attack stage identification results; Anomaly detection results are generated based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification results.

2. The method according to claim 1, characterized in that, The event association tree is obtained by performing spatiotemporal correlation on the abnormal events, including: Obtain historical abnormal events of the same edge node within the same preset time period, and calculate the feature similarity between the abnormal events in the current time window and the historical abnormal events in the time dimension; Obtain abnormal events from different edge nodes within the same preset time period, and compare the consistency of the triggering characteristics of the abnormal events from different edge nodes in the spatial dimension. When the feature similarity is lower than a preset threshold or the triggering features are consistent, an association edge is established from the high-level intrusion alarm event to the corresponding abnormal event, and the event association tree with a directed acyclic graph structure is generated according to the time sequence of the events.

3. The method according to claim 2, characterized in that, Calculate the feature similarity between the current time window's anomalous events and historical anomalous events along the time dimension, including: Extract the probability distribution of at least one type of event feature from the historical anomalous events to form a historical distribution vector; Extract the probability distribution of common event features from abnormal events within the current time window to form the current distribution vector; Calculate the divergence between the current distribution vector and the historical distribution vector; The feature similarity is determined based on the difference between the divergence value and a preset constant.

4. The method according to claim 1, characterized in that, The dynamic baseline is generated based on the real-time traffic data and the preset dynamic smoothing algorithm, including: Obtain the sequence of real-time traffic data measurements at multiple consecutive moments within a preset window, as well as the baseline value at the previous moment; Calculate the arithmetic mean of the flow measurement sequence; The arithmetic mean is combined with the baseline value of the previous time step according to a preset weight to obtain the current baseline value; The rate of change is determined based on the change in flow measurement values ​​at adjacent times in the flow measurement value sequence, and the preset weight is adjusted when the rate of change meets the preset fluctuation condition.

5. The method according to claim 1, characterized in that, The valid anomaly alarm sequence is processed by the preset time-series state model to obtain the identification results of the multiple attack stages, including: Obtain the alarm type identifier of each alarm in the valid abnormal alarm sequence; Each alarm type identifier is input into a pre-trained word embedding model, which outputs a corresponding fixed-dimensional feature vector and arranges them in chronological order as an initial vector sequence. The initial vector sequence is normalized to obtain the observation vector sequence; The observation vector sequence is input into a preset state sequence model for path decoding to obtain the state path with the highest state probability value. Each state in the state path is identified as the result of the identification of the multiple attack stages.

6. The method according to claim 1, characterized in that, Anomaly detection results are generated based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification results, including: The set of affected nodes is determined based on the event association tree; Based on the current attack stage in the attack stage identification result; The current attack phase is compared with a preset strategy mapping table to obtain the corresponding defense action type; Based on the defense action type, a defense command is generated and sent to each edge node in the affected node set; The event association tree is traversed in a depth-first manner, starting from the root node and visiting each node layer by layer along the parent-child relationship, and the sequence of nodes visited during the visit is recorded. The earliest intrusion alarm event in the node sequence is identified as the attack starting point; Extract the feature information of the attack source from the attack origin, and arrange the nodes in the node sequence according to the access order to obtain the attack path; The anomaly detection result is generated based on the valid anomaly alarm sequence, the attack phase identification result, and the attack path.

7. An anomaly detection device for multiple nodes at the industrial edge, characterized in that, include: The acquisition module is used to acquire security event data and real-time traffic data collected from multiple edge nodes; The anomaly analysis module is used to analyze the anomaly degree of traffic distribution of the security event data based on a preset distribution entropy algorithm to obtain multiple anomaly events; The association module is used to perform spatiotemporal association on the abnormal events to obtain an event association tree; The generation module is used to generate a dynamic baseline based on the real-time traffic data and a preset dynamic smoothing algorithm; The comparison module is used to compare the dynamic baseline with the real-time traffic data to obtain an effective abnormal alarm sequence; The processing module is used to process the effective abnormal alarm sequence through a preset time-series state model to obtain multiple attack stage identification results; The analysis module is used to generate anomaly detection results based on the event association tree, the valid anomaly alarm sequence, and the attack phase identification results.

8. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images