A collaborative security defense method and system for industrial control systems
By establishing a detection command library in the industrial control system and combining passive monitoring with collaborative decision-making, the legality of commands can be dynamically determined. This solves the problem that existing technologies cannot detect internal attacks on the controller and adapt to dynamic switching of process stages, achieving a balance between efficient security protection and production availability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NINGBO IND WATER SUPPLY CO LTD
- Filing Date
- 2026-06-17
- Publication Date
- 2026-07-21
AI Technical Summary
Existing industrial control systems lack proactive verification mechanisms, making it impossible to detect latent attacks within the controller. Active detection and passive monitoring lack coordinated decision-making, static rules cannot adapt to dynamic switching of process stages, and the determination of command legality lacks process context awareness, resulting in high false alarm and false negative rates and an inability to adapt to multi-protocol environments.
By establishing a probe command library, low-risk probe commands are periodically sent. Combined with passive monitoring and deep analysis of network traffic, a collaborative decision engine is used for correlation matching. The legality of the commands is dynamically determined based on the process operation status, and graded handling is implemented.
It enables proactive detection of internal attacks on the controller, reduces false alarm and false negative rates, adapts to dynamic switching of process stages, balances security and production availability, and improves the accuracy and adaptability of detection.
Smart Images
Figure CN122431228A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology for industrial control systems, and specifically to a collaborative security defense method and system for industrial control systems. Background Technology
[0002] Industrial control systems are widely used in critical infrastructure sectors such as power, water supply, and petrochemicals, serving as core systems for safeguarding national welfare and people's livelihoods. With the deepening integration of informatization and industrialization, industrial control systems are gradually shifting from closed architectures to open and interconnected systems. More and more common protocols, hardware, and software are being introduced into industrial control environments, leading to increased cybersecurity threats. As a crucial component of urban lifeline projects, the safe operation of industrial water supply systems directly impacts public water safety and social stability. A cyberattack resulting in uncontrolled water treatment parameters or water supply interruptions would have extremely serious consequences.
[0003] Based on existing technologies, the industrial control system (ICS) security field generally suffers from the following common technical bottlenecks. First, there is a lack of proactive verification mechanisms. Existing solutions rely on passive monitoring or passive network traffic collection for analysis. Once an attacker has penetrated and tampered with the controller's logic, passive detection methods will fail to detect it unless the tampered device exhibits abnormal traffic patterns during normal communication. Second, there is a lack of coordination between proactive detection and passive monitoring. In actual operation, the false positive and false negative rates of single detection methods are high—passive monitoring may result in false positives due to normal manual operations by maintenance personnel, while proactive detection may lead to misjudgments due to excessive response latency caused by network congestion. Simply combining the two detection results cannot effectively solve this problem; a collaborative judgment mechanism capable of correlating and analyzing anomalies from multiple sources is lacking. Third, the determination of command legality lacks process context awareness. Existing static rules or behavioral models cannot adapt to the frequent dynamic switching of process stages in water supply systems. They cannot dynamically adjust the set of legal commands based on the current process state, nor can they predict and classify the potential process consequences of executing suspicious commands.
[0004] Chinese patent document CN109981583A discloses a method for assessing the situation of industrial control networks. This method uses a security gateway to perform deep analysis and feature extraction on Modbus TCP protocol packets, constructs feature vectors, and utilizes an improved multi-class SVM classifier for situation assessment. This achieves the technical effect of improving the accuracy of attack type identification and the system's generalization ability. However, it still has the following problems: It adopts a purely passive detection architecture, which cannot detect advanced persistent attacks such as firmware tampering or logic modification already lurking inside the controller; it only supports feature extraction for the Modbus TCP single protocol, making it difficult to adapt to industrial control environments with mixed protocols; it lacks a collaborative decision-making mechanism for active detection and passive monitoring, resulting in a high false positive and false negative rate for single detection paths; it lacks command blocking capabilities, only outputting situation assessment values and alarms; and it does not consider the process context in determining the legality of commands, making it unsuitable for scenarios with dynamic switching of process stages.
[0005] Chinese patent document CN114567463A discloses an industrial network information security monitoring and protection system. This system collects industrial control network communication data in real time through a message acquisition module. It analyzes and compares data across five levels—address, protocol, instruction, process, and logic—using a whitelist to identify, warn of, and block abnormal messages, achieving comprehensive and transparent monitoring and multi-layered security assessment. However, it still suffers from the following problems: the overall architecture remains passively monitored; all detection relies on the analysis of collected messages, lacking the ability to actively probe and verify the internal security status of the controller, and is unable to detect attacks already lurking within the equipment; each layer of security assessment relies on statically pre-configured whitelist rules, failing to automatically adjust the set of legitimate instructions based on dynamic switching of process stages, and unable to distinguish between different legitimate versions of the same instruction at different process stages; instruction handling is based solely on binary judgment of whether it matches the whitelist, lacking the ability to reason about, evaluate, and categorize the consequences of instruction execution; and there is no cross-verification or collaborative decision-making mechanism between active and passive detection. Summary of the Invention
[0006] To address the shortcomings of existing technologies, the present invention aims to provide a collaborative security defense method and system for industrial control systems, which can proactively detect latent attacks within the controller, reduce false alarm and false negative rates through active and passive collaborative decision-making, and dynamically determine the legality of instructions based on process context to balance security protection and production availability.
[0007] Terminology Explanation: Unless otherwise defined, all technical terms in this document have the same meanings as commonly understood by one of ordinary skill in the art to which the subject matter of the claims pertains. Unless otherwise stated, all patents, patent inventions, and publications cited in this document are incorporated herein by reference in their entirety. If multiple definitions exist for terms in this document, the definitions in this chapter shall prevail.
[0008] It should be understood that the above brief description and the following detailed description are exemplary and for illustrative purposes only, and do not limit the subject matter of the invention in any way. In this invention, the singular is used in conjunction with the plural unless otherwise specifically stated. It should also be noted that, unless otherwise stated, the use of “or” or “or” means “and / or”. Furthermore, the use of the term “comprising” and other forms such as “including,” “containing,” and “contains” are not limiting.
[0009] Unless specifically defined herein, the use of various commercially available products herein employs standard techniques, or is carried out in accordance with methods known in the art or the description of this invention. The techniques and methods described herein can generally be implemented according to conventional methods well known in the art, based on the descriptions in the various summary and more specific documents cited and discussed in this specification.
[0010] The term "low-risk probe instruction" used in this article refers to probe instructions sent to industrial control equipment that do not change the actual control logic and production operation status of the equipment. It includes only read-only query instructions and loopback verification instructions for dedicated non-functional registers, and its risk level is limited to "no impact" or "minor impact".
[0011] The term "spatiotemporal correlation window" used in this article refers to the time and space range set by the collaborative decision engine when performing correlation matching. The time dimension is a time interval before and after the occurrence of a certain abnormal event, and the spatial dimension is the same device or the same network area. It is used to retrieve and match actively detected abnormal events and passively detected abnormal events within this range.
[0012] The term "correlation gain coefficient" used in this article refers to a multiplier factor introduced in the calculation of the comprehensive threat score. It takes a value greater than 1 when both active detection and passive monitoring report anomalies and successfully correlate them to improve alarm confidence, and takes a value less than 1 when only a single detection method reports anomalies to suppress possible false alarms.
[0013] The term "global process status table" used in this article refers to a record table maintained by the process instruction identification module. It integrates real-time process parameter values provided by the passive inspection module, equipment operation mode information provided by the active inspection module, and process stage switching instructions identified from SCADA communication messages, and records the current process stage and real-time values of key process parameters for each process area.
[0014] The term "tiered handling" used in this article refers to the four differentiated handling methods adopted by the process instruction identification module for intercepted process control instructions based on the results of instruction legality determination and consequence assessment. These methods are ranked from low to high severity as follows: release, alarm release, delayed execution (waiting for confirmation from maintenance personnel), and blocking.
[0015] To achieve the above objectives, the present invention provides the following technical solution: A collaborative security defense method for industrial control systems includes the following steps: S1: Establish a detection command library. The detection command library records low-risk detection commands for key control equipment in industrial control systems. Each detection command includes the target equipment identifier, command content, expected response content, and expected response delay range. S2: The active inspection module sends low-risk detection commands to key control equipment according to the preset detection cycle. It compares the actual response content of the equipment with the expected response content and the actual response delay with the expected response delay range. When the actual response content is inconsistent with the expected response content, or the actual response delay exceeds the expected response delay range, or no response is received within the preset maximum waiting time, an active detection abnormal event is generated. S3: Continuously monitors industrial control network traffic through a passive verification module, performs in-depth analysis of industrial control protocols, establishes a baseline model of device communication behavior, and generates passive abnormal events when real-time traffic deviates from the baseline model. S4: Through the collaborative decision engine, actively detected abnormal events and passive abnormal events are correlated and matched within the preset spatiotemporal correlation window to calculate a comprehensive threat score. When the comprehensive threat score exceeds the preset alarm threshold, a collaborative alarm is generated. S5: The process control system obtains the current process operation status through the process instruction identification module. When a new process control instruction is intercepted, the legality of the process control instruction is determined and the consequences are evaluated based on the process operation status. The process control instruction is then handled in a graded manner based on the determination and evaluation results. The graded handling includes release, alarm release, delayed execution, or blocking.
[0016] Furthermore, the low-risk detection instructions include register read instructions, device status query instructions, and loopback verification instructions. Among them, the register read instructions are used to perform read-only queries on the set values and operating parameters in the holding registers or input registers of the target device; the device status query instructions are used to query the current operating mode and fault status of the target device; and the loopback verification instructions are used to write a temporary verification value to the target device's dedicated non-functional verification register and then immediately read back the value of the verification register. The dedicated non-functional verification register is not associated with any actual control logic.
[0017] Furthermore, in S2, the active inspection module and the passive inspection module share communication timing information. When each detection cycle arrives, the active inspection module queries the current communication load status of the target device. If the target device is in an idle communication state, a low-risk detection command is sent; if the target device is in a busy communication state, the sending is delayed. The active inspection module also maintains a sliding window to record the detection results of each detected device for the most recent preset number of times. Normal response, abnormal response delay, abnormal response content, and response timeout are assigned different scores as the quantitative values of the detection results. Each quantitative value of the detection result is assigned a weight and a weighted average is calculated as the device health score. The more recent the detection result, the higher the weight. When the device health score is lower than the preset health threshold, the device is determined to be in a suspicious state.
[0018] Furthermore, in S3, the device communication behavior baseline model includes a matrix of legitimate communication relationships between devices, the normal frequency range of various read and write operations, and the statistical distribution of data packet characteristics; passive abnormal events at least include the abnormality type, the quantitative value of the abnormality degree, the associated device identifier, and the occurrence timestamp.
[0019] Furthermore, in S4, the association matching includes time association rules, device association rules, and causal association rules. The time association rule is: within the spatiotemporal association window, actively detected abnormal events and passive abnormal events involve the same device. The device association rule is: a passive abnormal event indicates that an unauthorized host sends a command to a certain control device, and an actively detected abnormal event indicates that the response data of the control device has a deviation. The causal association rule is: a passive abnormal event first detects an abnormal write operation, and then an actively detected abnormal event finds that the readback value of the corresponding register does not match the expected response content recorded in the detection command library. The calculation of the comprehensive threat score introduces an association gain coefficient. When both actively detected abnormal events and passive abnormal events exist and are successfully associated, the association gain coefficient is greater than 1. When there is only one type of abnormal event, the association gain coefficient is less than 1.
[0020] Furthermore, in S5, the process operation status is obtained in the following ways: real-time process parameter values are obtained from the passive inspection module, equipment operation mode information is obtained from the active inspection module, and process stage switching instructions are identified by parsing the communication messages between the upper-level monitoring system and the controller; the process instruction identification module integrates the above information to maintain a global process status table, recording the current process stage and real-time values of key parameters for each process area.
[0021] Furthermore, in S5, the legality determination includes: matching the instruction type of the process control instruction with the set of legal operation instructions corresponding to the current process stage, and matching the parameter value carried by the process control instruction with the legal parameter range corresponding to that instruction in the set of legal operation instructions; the consequence assessment includes: based on a preset process parameter influence relationship diagram, which describes the direction and magnitude of the influence of each operation instruction on the process parameters, inferring the direction and magnitude of the process parameter change that would result if the process control instruction were executed, determining whether the affected parameters would exceed the safe range, and classifying the severity of the consequences into three levels: minor, moderate, and severe.
[0022] Furthermore, the tiered handling includes: when a process control instruction passes the legality determination, releasing the instruction to the target equipment for execution; When a process control instruction fails the legality assessment and the consequences are deemed minor, an alarm is triggered, meaning the instruction is allowed to proceed and an alarm is sent to the safety management platform. When a process control instruction fails the legality assessment and the consequences are assessed as moderate, the instruction is temporarily blocked and a confirmation request is sent to the operation and maintenance personnel. The instruction is only allowed to be executed after confirmation is received within a limited time. If no confirmation is received within the time limit, the instruction is discarded. When a process control command fails the legality assessment and the consequences are deemed serious, the command is blocked and an emergency alarm is sent to the safety management platform. When the collaborative decision engine marks the target equipment of a process control command as suspicious, the process command identification module increases the severity level of the command by an additional level in the consequence assessment. If the consequence assessment is already at the severity level, the severity level remains unchanged.
[0023] A collaborative security defense system for industrial control systems includes an active inspection module, a passive inspection module, a collaborative decision engine, and a process instruction recognition module. The active inspection module stores a low-risk detection instruction library for critical control equipment. It sends detection instructions to critical control equipment according to a preset detection cycle and compares the actual response of the equipment with the expected response to generate active detection anomaly events. The passive inspection module continuously monitors the industrial control network traffic, performs in-depth analysis of the industrial control protocol, establishes a baseline model of device communication behavior, and generates passive abnormal events when the real-time traffic deviates from the baseline model. The collaborative decision engine is connected to the active inspection module and the passive inspection module respectively. Within the preset spatiotemporal correlation window, it performs correlation matching on actively detected abnormal events and passive abnormal events, calculates the comprehensive threat score, and generates a collaborative alarm when the alarm threshold is exceeded. The process instruction identification module is connected to the active inspection module, the passive inspection module, and the collaborative decision engine to obtain the current process operation status of the industrial control system. It performs legality judgment and consequence assessment on the intercepted process control instructions based on the process operation status, and implements graded handling of the process control instructions according to the judgment and assessment results.
[0024] Furthermore, the active inspection module and the passive inspection module share communication timing information through an internal message interface. The data content transmitted by the internal message interface is the device communication load status information. The active inspection module obtains the communication load status of the target device through the internal message interface and sends a probe command when the target device is in a communication idle state. The collaborative decision engine performs association matching through time association rules, device association rules, and causal association rules, and introduces an association gain coefficient when calculating the comprehensive threat score. When both actively detected abnormal events and passively detected abnormal events exist and are successfully associated, the association gain coefficient is greater than 1. When only one type of abnormal event exists, the association gain coefficient is less than 1.
[0025] Compared with the prior art, the present invention has the following advantages: I. This invention periodically injects low-risk detection commands into key control devices through an active inspection module and compares the device responses. This proactively detects advanced persistent attacks such as firmware tampering and logic modification that have been lurking inside the controller, thus overcoming the shortcomings of existing purely passive detection architectures that cannot perceive the internal security status of devices.
[0026] Second, this invention uses a collaborative decision engine to perform three-dimensional matching of actively detected abnormal events and passively monitored abnormal events, including time correlation, device correlation, and causal correlation. It also introduces a correlation gain coefficient to automatically improve alarm confidence during dual verification and automatically suppress false alarms during single detection, effectively reducing the false alarm rate and missed alarm rate caused by single detection methods.
[0027] Third, this invention uses a process instruction identification module to perceive the process operation status in real time, dynamically switch the set of legal instructions according to the current process stage, and evaluate and classify the consequences of executing suspicious instructions. This solves the problem that the existing static whitelist scheme cannot adapt to the dynamic switching of process stages, and achieves a reasonable balance between security protection and production availability. Attached Figure Description
[0028] Figure 1 A flowchart of a collaborative security defense method for industrial control systems provided by the present invention; Figure 2 This invention provides a structural schematic diagram of a collaborative security defense system for industrial control systems. Detailed Implementation
[0029] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0030] The present invention will be further described below by way of specific embodiments. Unless otherwise specified, all instruments, devices, equipment, reagents, products, etc., used in the embodiments of the present invention are obtained through conventional commercial means.
[0031] Unless otherwise stated, conventional methods within the scope of the art shall be used.
[0032] Example 1 like Figure 1 As shown, this invention provides a collaborative security defense method for industrial control systems, comprising the following steps: A detection command library is established, which records low-risk detection commands for critical control equipment in industrial control systems. Each detection command includes the target equipment identifier, command content, expected response content, and expected response delay range. The active verification module sends low-risk detection commands to the critical control equipment according to a preset detection cycle. The actual response content of the equipment is compared with the expected response content, and the actual response delay is compared with the expected response delay range. When the actual response content is inconsistent with the expected response content, or the actual response delay exceeds the expected response delay range, or no response is received within the preset maximum waiting time, an active detection anomaly event is generated. The passive inspection module continuously monitors the industrial control network traffic, performs in-depth analysis of the industrial control protocol, establishes a baseline model of device communication behavior, and generates passive abnormal events when the real-time traffic deviates from the baseline model. Through a collaborative decision-making engine, actively detected abnormal events and passively detected abnormal events are correlated and matched within a preset spatiotemporal correlation window to calculate a comprehensive threat score. When the comprehensive threat score exceeds a preset alarm threshold, a collaborative alarm is generated. Through a process instruction recognition module, the current process operation status of the industrial control system is obtained. When a new process control instruction is intercepted, the legality of the process control instruction is determined and the consequences are assessed based on the process operation status. Based on the determination and assessment results, the process control instruction is handled in a graded manner, including release, alarm release, delayed execution, or blocking.
[0033] Specifically, during the system initialization phase, a detection command library is established for key control equipment in the industrial control system. Taking an industrial water supply scenario as an example, key control equipment includes PLCs for the intake pump station, controllers for the dosing system, PLCs for the filter control, level controllers for the clear water tank, and frequency converters for the delivery pump station. Each command record in the detection command library includes a command identifier, a target equipment identifier (i.e., equipment IP address, equipment type, and process area), command content (i.e., the specific industrial control protocol message content), expected response content (i.e., the response data format and value range that the equipment should return under normal conditions), expected response delay range (i.e., the upper and lower limits of the response delay under normal conditions, in milliseconds), and a risk level marker (only commands at the "no impact" and "minor impact" levels are included). The active verification module sends detection commands to the key control equipment according to a preset detection cycle, with a default cycle of 60 seconds. After sending the detection command, the active verification module starts a response waiting timer. Within the preset maximum waiting time (default 3 seconds), if a response is received from the target equipment, response content comparison and response delay comparison are performed. Response content comparison compares the actual response data with the expected response content recorded in the probe command library, field by field. If they are inconsistent, a "Response Content Anomaly" event is generated, and the deviation field and deviation magnitude are marked. Response latency comparison calculates the time difference from sending the probe command to receiving the response and compares it with the expected latency range. If it exceeds the upper limit, a "Response Latency Anomaly" event is generated. If no response is received within the maximum waiting time, a "Response Timeout" event is generated. The passive inspection module continuously monitors industrial control network traffic, performs deep analysis on industrial control protocols such as Modbus TCP, S7Comm, OPC UA, and IEC 104, extracts communication quintuples, function codes, operation data, and message timestamps, and establishes a baseline model of device communication behavior based on this. When real-time traffic deviates from the baseline model, the passive inspection module generates a passive anomaly event. The collaborative decision engine maintains a spatiotemporal correlation window (default 5 minutes before and after), receives active probe anomaly events and passive anomaly events in real time, performs correlation matching within the correlation window, calculates a comprehensive threat score, and generates a collaborative alarm when it exceeds a preset alarm threshold (default 0.7). The process instruction recognition module acquires the current process operation status of the industrial control system in real time. When a new process control instruction is intercepted, it performs a legality judgment and consequence assessment based on the current process operation status, and makes one of four disposal decisions based on the results: release, alarm release, delay execution, or block.
[0034] Through the coordinated operation of the above five steps, this invention achieves an organic combination of active detection and passive monitoring, enabling the discovery of advanced persistent attacks already lurking in the controller, while dynamically determining the legitimacy of instructions based on the process context, thus achieving a balance between security and production availability.
[0035] In one specific implementation of this embodiment, low-risk detection instructions include register read instructions, equipment status query instructions, and loopback verification instructions. Register read instructions are used to perform read-only queries on the setpoints and operating parameters in the holding registers or input registers of the target equipment. For example, reading the rated speed setpoint stored in the water pump PLC or the dosing ratio parameter stored in the dosing system controller. These instructions do not change any equipment status, and the risk level is "no impact." Equipment status query instructions are used to query the current operating mode (automatic or manual) and fault status word of the target equipment. For example, querying the current operating stage identifier (filtration, backwashing, or standby) of the filter PLC. These instructions also do not change the equipment status, and the risk level is "no impact." Loopback verification instructions are used to write a temporary verification value to the target equipment's dedicated non-functional verification register and then immediately read back the value of the verification register to verify whether the write and read are consistent. The dedicated non-functional verification register is a specially reserved register and is not associated with any actual control logic; therefore, the risk level of the loopback verification instruction is "minor impact" (only a brief write operation to the verification register). By limiting the probe commands to two types of operations—read-only query and dedicated register loopback verification—it is ensured that the probe process does not affect the normal operation of the industrial control system.
[0036] In one specific implementation of this embodiment, the active verification module and the passive verification module share communication timing information. While continuously monitoring network traffic, the passive verification module continuously monitors the communication load status of each device and transmits this information to the active verification module via an internal message interface. At the start of each detection cycle, the active verification module first queries the current communication load status of the target device: if the device is in an idle state (i.e., the number of communication packets within the most recent sampling time window is less than a set threshold), it immediately sends a detection command; if the device is in a busy state, it delays sending, waiting for the next idle window, but the delay time does not exceed 50% of the detection cycle. If this limit is exceeded, it is forced to resend in the next cycle. The active verification module also maintains a sliding window, defaulting to the 10 most recent detection results, and calculates a device health score for each detected device. The health score is calculated as follows: 1 point for a normal response, 0.5 points for abnormal response latency, 0 points for abnormal response content, and 0 points for response timeout. The health score is a weighted average of the scores within the sliding window, with more recent detection results having higher weights. When a device's health score falls below a preset health threshold (default 0.6), the device is deemed to be in a suspicious state, and an active anomaly detection alarm is generated and sent to the collaborative decision engine. Idle window scheduling avoids interference with normal production communication, and sliding window weighted scoring avoids false alarms caused by occasional network fluctuations.
[0037] In one specific implementation of this embodiment, the device communication behavior baseline model established by the passive inspection module includes three parts. The first part is a matrix of legitimate communication relationships between devices, recording which devices communicate with each other in a normal production environment, what protocols are used, and the direction of communication. Communication relationships outside the matrix are considered unauthorized communication. The second part is the normal frequency range of various read and write operations. The call frequency (in times / minute) of each function code is statistically analyzed with the device as the center, establishing the mean and standard deviation of the frequency baseline. When the real-time frequency deviates from the baseline by more than a set multiple (default 3 times the standard deviation), it is considered a frequency anomaly. The third part is the statistical distribution of data packet characteristics, statistically analyzing the distribution characteristics of the size and value range of data packets sent and received by each device. Data values exceeding the normal range are considered data anomalies. The structure of passive abnormal events includes an event number, anomaly type (unauthorized communication, frequency anomaly, data anomaly, or protocol anomaly), an anomaly severity quantification value (a floating-point number between 0 and 1, representing the normalization degree of deviation from the baseline), a list of associated device identifiers, and an occurrence timestamp. Through multi-dimensional baseline modeling, the passive inspection module can comprehensively cover various abnormal communication behaviors in industrial control networks.
[0038] In one specific implementation of this embodiment, the association matching performed by the collaborative decision engine includes three types: time association rules, device association rules, and causal association rules.
[0039] The time association rule is as follows: If an abnormal response of a controller is detected by active detection, and abnormal communication behavior involving the same controller is also detected by passive monitoring within 5 minutes before and after the time of the occurrence, then the two events are associated as the same attack event. The association is based on the proximity of time and the consistency of device identification.
[0040] The device association rule is as follows: If passive monitoring detects that an unauthorized host is sending instructions to the controller (unauthorized communication event), and active detection within a short period of time subsequently detects that the response data of the same controller is deviated (abnormal response content event), then the two events are associated as a targeted attack event against that controller. The association is based on the consistency of the target device and the matching of the attack logic of the event type.
[0041] The causal association rule is as follows: If the passive monitoring first detects an abnormal write register operation (such as writing a speed setting value that exceeds the normal range to the water pump PLC), and then the active detection finds that the readback value of the corresponding register does not match the reference value (indicating that the setting value has indeed been modified), then the association is determined to be a malicious parameter tampering attack. The association is based on the causal logic of the consistency of the operation object and the order of time.
[0042] The calculation of the comprehensive threat score introduces a correlation gain coefficient. The scoring formula is: Comprehensive Threat Score = (Active Anomaly Value × Active Weight + Passive Anomaly Value × Passive Weight) × Correlation Gain Coefficient. The passive anomaly value is taken from the quantified anomaly value recorded in passive anomaly events, and is a floating-point number between 0 and 1, representing the degree of normalization from the baseline. The proactive anomaly severity value is quantified by the proactive inspection module based on the anomaly type and deviation degree of the proactively detected anomalous events. It is also a floating-point number between 0 and 1, and its quantization rule is as follows: For abnormal events in response content, the active abnormality level value is the product of the proportion of the deviation field of the actual response content relative to the expected response content and the normalized value of the deviation magnitude of each deviation field relative to the expected value. The larger the deviation, the closer the value is to 1. For response delay anomalies, the active anomaly level value is the ratio of the portion of the actual response delay that exceeds the upper limit of the expected response delay range to that upper limit, and is truncated to the interval [0, 1]. The more timeouts there are, the closer the value is to 1. For response timeout events, the active anomaly severity value is directly set to the maximum value of 1; when multiple anomaly types occur simultaneously within the same detection period, the active anomaly severity value is set to the maximum value among the above-mentioned quantization values.
[0043] The default values for both active and passive weights are 0.5. When both actively detected and passively detected anomalies exist and are successfully correlated, the correlation gain coefficient is 1.5; when only one type of anomaly exists, the correlation gain coefficient is 0.8. By setting the correlation gain coefficient, the alarm confidence is automatically increased during dual verification, and possible false alarms are appropriately suppressed during single detection, thus achieving adaptive alarm accuracy adjustment.
[0044] In one specific implementation of this embodiment, the process instruction recognition module obtains the process operation status through three channels.
[0045] Channel 1 obtains real-time process parameter values from the passive inspection module. During the process of parsing the industrial control protocol message, the passive inspection module extracts the process measurement data (such as water level, flow rate, pressure, residual chlorine, turbidity, pH value, etc.) carried in it and transmits it to the process instruction recognition module in real time.
[0046] Channel 2 obtains equipment operating mode information from the active inspection module. This module, during periodic equipment checks, acquires information such as the equipment operating mode (automatic or manual) and operating stage identifiers, which are then transmitted to the process command identification module. Channel 3 identifies process stage switching commands (such as the "start backwashing" command issued by SCADA) by parsing communication messages between the SCADA system and the controller, thereby tracking the current process stage of each process area.
[0047] The process instruction recognition module integrates information from the three channels mentioned above to maintain a global process status table, recording the current process stage and real-time values of key parameters for each process area. Taking an industrial water supply scenario as an example, the process areas are divided into water intake area, coagulation area, sedimentation area, filtration area, disinfection area, clean water storage area, and water delivery and distribution area. Each area defines several process stages based on its actual operating status. Taking the filtration area as an example, the process stages include normal filtration stage, backwash preparation stage, backwash execution stage (including air washing and water washing sub-stages), filter recovery stage, and standby stage. Through three-channel fusion sensing, the real-time performance and accuracy of the process status table are ensured.
[0048] In one specific implementation of this embodiment, after the process instruction recognition module intercepts a new process control instruction, it first performs instruction parsing to identify the target device, operation type, operation object, and operation data value of the instruction. Then, based on the process region to which the target device belongs, it queries the global process status table for the current process stage and real-time values of key process parameters.
[0049] The legality determination involves two layers of matching: the first layer is instruction type matching, which determines whether the instruction is within the set of legal operation instructions corresponding to the current "process area + process stage"; the second layer is parameter range matching, which determines whether the parameter value carried by the instruction is within the legal parameter range corresponding to the instruction. For example, in the normal filtration stage of the filtration area, legal instructions include reading the filter tank level (parameter is none), adjusting the filtration rate (parameter range is 0.5 to 8.0 m / h), and reading the effluent turbidity (parameter is none), while instructions such as starting the backwash pump and opening the drain valve are not in the set of legal instructions.
[0050] If an instruction fails the legality matching test, a consequence assessment is initiated. Based on a pre-defined process parameter influence diagram, the consequence assessment infers which process parameters will change, the direction of change, and the estimated magnitude of the change if the instruction is executed, thereby determining whether the affected parameters will exceed safe limits or trigger alarm thresholds. The severity of the consequences is categorized into three levels: minor (parameter changes are within the normal range but deviate from the baseline), moderate (parameters may exceed limits but will not immediately cause equipment damage or safety accidents), and severe (parameters will exceed dangerous thresholds, potentially leading to equipment damage, water pollution, or pipeline rupture, etc.). Dynamically determining instruction legality through process context resolves the issue of inconsistent legality for the same instruction at different process stages.
[0051] In one specific implementation of this embodiment, the graded treatment includes four methods.
[0052] When a process control command passes the validity check (the command type is valid and the parameters are within the range), it is directly released to the target equipment for execution.
[0053] When a process control instruction fails the legality assessment but the consequences are deemed minor, an alarm release is executed. This means that while the instruction is being released, an alarm notification is sent to the safety management platform and operations personnel for post-event review.
[0054] When a process control instruction fails the legality check and the consequences are assessed as moderate, the instruction is temporarily blocked, and a confirmation request is sent to the operations and maintenance personnel. The instruction can only be released for execution after the operations and maintenance personnel confirm it through the security management platform within a limited time (60 seconds by default). If no confirmation is made within the time limit, the instruction is discarded and recorded in the security audit log.
[0055] When a process control command fails the legality assessment and the consequences are deemed serious, the command is immediately blocked from reaching the target equipment. At the same time, an emergency alarm is sent to the safety management platform. The alarm content includes the blocked command content, the reason for the blocking, and the recommended safety handling measures.
[0056] When the collaborative decision-making engine marks the target equipment of a process control command as suspicious, the process command identification module upgrades the severity level of the command sent to that equipment by an additional level in the consequence assessment. That is, a command originally assessed as minor is upgraded to moderate, and a command originally assessed as moderate is upgraded to severe. This tiered handling mechanism avoids excessive disruption to normal operations, and the linkage with the collaborative decision-making engine enables real-time sharing of threat intelligence and dynamic adjustment of defense strategies.
[0057] Example 2 like Figure 2 As shown, the present invention also provides a collaborative security defense system for industrial control systems, including an active inspection module, a passive inspection module, a collaborative decision engine, and a process instruction recognition module.
[0058] The active inspection module stores a low-risk detection instruction library for critical control equipment. It sends detection instructions to critical control equipment according to a preset detection cycle, compares the actual response of the equipment with the expected response, and generates active detection anomaly events.
[0059] The passive verification module continuously monitors the industrial control network traffic, performs in-depth analysis of the industrial control protocol, establishes a baseline model of device communication behavior, and generates passive abnormal events when the real-time traffic deviates from the baseline model.
[0060] The collaborative decision engine is connected to both the active inspection module and the passive inspection module. Within a preset spatiotemporal correlation window, it performs correlation matching on actively detected abnormal events and passive abnormal events, calculates a comprehensive threat score, and generates a collaborative alarm when the alarm threshold is exceeded.
[0061] The process instruction identification module is connected to the active inspection module, the passive inspection module, and the collaborative decision engine to obtain the current process operation status of the industrial control system. It performs legality judgment and consequence assessment on the intercepted process control instructions based on the process operation status, and implements graded handling of the process control instructions according to the judgment and assessment results.
[0062] The data flow relationship between the four modules is as follows: the passive inspection module transmits real-time process parameter values and equipment communication load status to the process instruction identification module and the active inspection module, respectively; the active inspection module transmits equipment operation mode information to the process instruction identification module and transmits actively detected abnormal events to the collaborative decision engine; the passive inspection module transmits passive abnormal events to the collaborative decision engine; and the collaborative decision engine transmits collaborative alarms and suspicious equipment status markers to the process instruction identification module and the safety management platform.
[0063] In one specific embodiment of this example, a communication timing information sharing interface is provided between the active inspection module and the passive inspection module. The active inspection module obtains the communication load status of the target device through the sharing interface and sends a probe command when the target device is in a communication idle state. The collaborative decision engine performs correlation matching through time correlation rules, device correlation rules, and causal correlation rules, and introduces a correlation gain coefficient when calculating the comprehensive threat score. When both actively detected abnormal events and passively detected abnormal events exist and are successfully correlated, the correlation gain coefficient is greater than 1 (value 1.5); when only one type of abnormal event exists, the correlation gain coefficient is less than 1 (value 0.8). Through the interface design between modules and the correlation gain mechanism, deep collaboration between active and passive detection methods is achieved at the system architecture level.
[0064] Example 3 The following are two typical embodiments of the present invention in industrial water supply scenarios.
[0065] In this embodiment, a standard deployment scheme is adopted.
[0066] This system was deployed in a water treatment plant with a daily processing capacity of 200,000 tons. The system covers six process areas: water intake, coagulation and dosing, sedimentation, filtration, disinfection, and water delivery, with a total of 12 PLC controllers and 4 RTU remote terminals.
[0067] The passive inspection module collects network traffic through the switch's mirror port and parses both Modbus TCP and S7Comm protocols. The active inspection module polls and probes all 16 control devices in a 60-second cycle, probing 4 devices per cycle, with each device completing a full round of probing in 4 minutes.
[0068] The spatiotemporal correlation window of the collaborative decision engine is set to 5 minutes before and after, the correlation gain coefficient is 1.5 for dual verification and 0.8 for single detection, and the alarm threshold is set to 0.7.
[0069] The process instruction identification module is deployed in series on the critical communication link between the SCADA system and the PLC network to perform real-time review of all downlink control instructions. The process status model is pre-configured with legal instruction sets and parameter ranges for 6 process regions and a total of 28 process stages.
[0070] Example 4 In this embodiment, a tiered deployment scheme is adopted. For water supply systems with existing basic security protection facilities, a bypass deployment method is used, without changing the existing network architecture.
[0071] Both the passive and active verification modules are deployed in a bypass manner and are not connected in series in the control and communication link.
[0072] The process instruction recognition module operates in bypass monitoring mode, performing only detection and alarm functions without performing blocking operations. It is suitable for the system trial operation phase or scenarios with extremely high availability requirements.
[0073] After a period of trial operation, based on the analysis results of alarm data, the parameters and thresholds of the process status model are adjusted, and the system is gradually switched to the standard deployment scheme.
[0074] The tiered deployment scheme reduces the risks in the early stages of system launch, while the data accumulation during the trial operation phase optimizes the detection parameters, providing data support for subsequent standard deployment.
[0075] The above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent transformations or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.
Claims
1. A collaborative security defense method for industrial control systems, characterized in that, Includes the following steps: S1: Establish a detection command library, which records low-risk detection commands for key control equipment in industrial control systems. Each low-risk detection command includes the target equipment identifier, command content, expected response content, and expected response delay range. S2: The active inspection module sends the low-risk detection command to the key control device according to the preset detection cycle, compares the actual response content of the key control device with the expected response content, and compares the actual response delay with the expected response delay range. When the actual response content is inconsistent with the expected response content, or the actual response delay exceeds the expected response delay range, or no response is received within the preset maximum waiting time, an active detection abnormal event is generated. S3: The passive verification module continuously monitors the industrial control network traffic, performs in-depth analysis of the industrial control protocol, establishes a baseline model of device communication behavior, and generates a passive abnormal event when the real-time traffic deviates from the baseline model of device communication behavior. S4: Through the collaborative decision engine, the actively detected abnormal events and the passive abnormal events are correlated and matched within a preset spatiotemporal correlation window to calculate a comprehensive threat score. When the comprehensive threat score exceeds a preset alarm threshold, a collaborative alarm is generated. S5: The process control system obtains the current process operation status through the process instruction identification module. When a new process control instruction is intercepted, the legality of the process control instruction is determined and the consequences are evaluated according to the process operation status. The process control instruction is then handled in a graded manner according to the determination and evaluation results. The graded handling includes release, alarm release, delayed execution, or blocking.
2. The collaborative security defense method for industrial control systems according to claim 1, characterized in that: The low-risk detection commands include register read commands, device status query commands, and loopback verification commands. The register read instruction is used to perform read-only queries on the set values and operating parameters in the holding register or input register of the target device; The device status query command is used to query the current operating mode and fault status of the target device; The loopback verification instruction is used to write a temporary verification value to the dedicated non-functional verification register of the target device and then immediately read back the value of the verification register. The dedicated non-functional verification register is not associated with any actual control logic.
3. The collaborative security defense method for industrial control systems according to claim 1, characterized in that: The active testing module and the passive testing module share communication timing information; The active inspection module queries the current communication load status of the target device at the end of each detection cycle. If the target device is in an idle communication state, the low-risk detection command is sent; if the target device is in a busy communication state, the sending is delayed. The active inspection module also maintains a sliding window to record the detection results of each detected device for the most recent preset number of times. Normal response, abnormal response delay, abnormal response content, and response timeout are each assigned a different score as the quantified value of the detection result. Each quantified value of the detection result is assigned a weight and a weighted average is calculated as the device health score. The more recent the detection result, the higher the weight. When the device health score is lower than the preset health threshold, the detected device is determined to be in a suspicious state.
4. The collaborative security defense method for industrial control systems according to claim 1, characterized in that: In S3, the device communication behavior baseline model includes a matrix of legitimate communication relationships between devices, the normal frequency range of various read and write operations, and the statistical distribution of data packet characteristics; The passive abnormal event shall include at least the abnormality type, the abnormality degree quantification value, the associated device identifier, and the occurrence timestamp.
5. A collaborative security defense method for industrial control systems according to claim 1, characterized in that: In S4, the association matching includes time association rules, device association rules, and causal association rules; The time association rule is as follows: within the spatiotemporal association window, actively detected abnormal events and passively detected abnormal events involve the same device; The device association rule is as follows: passive abnormal events indicate that an unauthorized host sends a command to a certain control device, and active detection abnormal events indicate that the response data of the control device is deviated; The causal association rule is as follows: a passive abnormal event first detects an abnormal write operation, and then an active abnormal event detects that the readback value of the corresponding register does not match the expected response content recorded in the detection instruction library; The calculation of the comprehensive threat score introduces a correlation gain coefficient. When both actively detected and passively detected abnormal events exist and are successfully correlated, the correlation gain coefficient is greater than 1. When only one type of abnormal event exists, the correlation gain coefficient is less than 1.
6. A collaborative security defense method for industrial control systems according to claim 1, characterized in that: In S5, the process operating status is obtained in the following way: The system obtains real-time process parameter values from the passive inspection module, obtains equipment operation mode information from the active inspection module, and identifies process stage switching instructions by parsing the communication messages between the upper-level monitoring system and the controller. The process instruction recognition module integrates the above information to maintain a global process status table, recording the current process stage and real-time values of key parameters for each process area.
7. A collaborative security defense method for industrial control systems according to claim 1, characterized in that: In S5, the legality determination includes: matching the instruction type of the process control instruction with the set of legal operation instructions corresponding to the current process stage, and matching the parameter value carried by the process control instruction with the range of legal parameters corresponding to the instruction in the set of legal operation instructions; The consequence assessment includes: based on a preset process parameter influence relationship diagram, which describes the direction and magnitude of the influence of each operation command on the process parameters, inferring the direction and magnitude of the process parameter changes that would result if the process control command were executed, determining whether the affected parameters would exceed the safe range, and classifying the severity of the consequences into three levels: minor, moderate, and severe.
8. A collaborative security defense method for industrial control systems according to claim 7, characterized in that: The tiered treatment includes: When the process control command passes the legality determination, the process control command is released to the target equipment for execution; When the process control command fails the legality determination and the consequences are assessed as minor, an alarm is triggered, that is, the command is allowed and an alarm is sent to the safety management platform. When the process control command fails the legality determination and the consequences are assessed as moderate, the process control command is intercepted and a confirmation request is sent to the operation and maintenance personnel. The command is only allowed to be executed after confirmation is received within a limited time. If no confirmation is received within the time limit, the command is discarded. When the process control command fails the legality determination and the consequences are assessed as serious, the process control command is blocked and an emergency alarm is sent to the safety management platform; When the collaborative decision engine marks the target equipment of the process control command as suspicious, the process command identification module increases the severity level of the command by an additional level in the consequence assessment. When the consequence assessment is already at the severity level, the severity level is maintained.
9. A collaborative security defense system for industrial control systems, employing the collaborative security defense method for industrial control systems as described in any one of claims 1-8, characterized in that, It includes an active inspection module, a passive inspection module, a collaborative decision engine, and a process instruction recognition module; The active inspection module stores a low-risk detection instruction library for key control equipment, sends detection instructions to the key control equipment according to a preset detection cycle, and compares the actual response of the key control equipment with the expected response to generate active detection of abnormal events. The passive verification module continuously monitors the industrial control network traffic, parses the industrial control protocol, establishes a baseline model of device communication behavior, and generates a passive abnormal event when the real-time traffic deviates from the baseline model of device communication behavior. The collaborative decision engine is connected to the active inspection module and the passive inspection module respectively. It performs correlation matching on the active detection anomaly events and the passive anomaly events within a preset spatiotemporal correlation window, calculates a comprehensive threat score, and generates a collaborative alarm when the alarm threshold is exceeded. The process instruction identification module is connected to the active inspection module, the passive inspection module, and the collaborative decision engine, respectively. The active inspection module transmits equipment operation mode information to the process instruction identification module, the passive inspection module transmits real-time process parameter values to the process instruction identification module, and the collaborative decision engine transmits suspicious equipment status markers to the process instruction identification module. The process instruction identification module acquires the current process operation status of the industrial control system, performs a legality judgment and consequence assessment on the intercepted process control instructions based on the process operation status, and implements graded handling of the process control instructions according to the judgment and assessment results.
10. A collaborative security defense system for industrial control systems according to claim 9, characterized in that: The active inspection module and the passive inspection module share communication timing information through an internal message interface. The data content transmitted by the internal message interface is the device communication load status information. The active inspection module obtains the communication load status of the target device through the internal message interface and sends a probe command when the target device is in a communication idle state. The collaborative decision engine performs the association matching through time association rules, device association rules, and causal association rules, and introduces an association gain coefficient when calculating the comprehensive threat score. When both actively detected abnormal events and passively detected abnormal events exist and are successfully associated, the association gain coefficient is greater than 1. When there is only one type of abnormal event, the association gain coefficient is less than 1.