An industrial control protocol abnormal interaction identification method based on deep learning

Abstract

The application provides an industrial control protocol abnormal interaction identification method and system based on deep learning, which comprises the following steps: collecting multi-source time series data and performing standardization processing, dynamically constructing an industrial protocol context knowledge graph to represent the correlation between heterogeneous protocol nodes; using multi-modal semantic embedding to fuse node attributes, traffic, logs, topology and other information into a unified semantic space, combining a graph structure deep neural network to aggregate node behavior characteristics, and obtaining a context behavior link model; based on historical normal behavior, performing multi-dimensional abnormality evaluation, and when the risk score exceeds a threshold, relying on the knowledge graph path to perform abnormal backtracking and generating a multi-modal traceability report. This method significantly improves the fusion and semantic understanding ability of multi-source heterogeneous data, effectively solves the problems that traditional machine learning is difficult to model complex protocol context and identify cross-device collaborative attacks and hidden penetration behaviors.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security monitoring technology, and in particular to a method and system for identifying abnormal interactions in industrial control protocols based on deep learning. Background Technology

[0002] Currently, the mainstream methods for industrial control protocol security protection mainly include rule-based intrusion detection technology and traffic analysis technology based on traditional machine learning. Rule-based detection methods rely on pre-set signature or attack signature libraries to identify known abnormal behaviors through pattern matching. While effective against known attacks, these methods struggle to detect unknown or variant attacks, and the rule libraries are costly to maintain, have slow updates, and are prone to high false positive rates. Traditional machine learning-based detection methods typically rely on manually designed statistical features (such as message length, time intervals, and function code distribution) combined with classification algorithms (such as support vector machines and random forests) for anomaly identification. Although these methods improve the detection capability of unknown anomalies to some extent, they still suffer from insufficient feature representation and limited ability to model complex protocol interaction logic, making it difficult to effectively capture fine-grained anomalies or hidden interaction patterns in protocol behavior.

[0003] Furthermore, data in industrial control network environments is characterized by diversity, high concurrency, and heterogeneous protocols. Existing methods still have significant shortcomings in addressing the fusion of multi-source heterogeneous data, protocol context modeling, and real-time performance assurance. Specifically: First, traditional methods struggle to effectively integrate multi-source data such as network traffic, device metadata, operation logs, and topology information, leading to insufficient understanding of the overall system behavior semantics. Second, they lack in-depth modeling of temporal dependencies and causal relationships during protocol interactions, making it difficult to identify complex attack paths across devices and protocols. Third, in high-traffic, high-dynamic scenarios, the real-time detection and scalability of existing systems are limited, making it difficult to meet the actual needs of large-scale industrial deployments. Summary of the Invention

[0004] To overcome the problems existing in related technologies, the purpose of this invention is to provide a deep learning-based method for identifying abnormal interactions in industrial control protocols. This method can improve the fusion and semantic understanding capabilities of multi-source heterogeneous data, and solves the problems that traditional machine learning methods have difficulty in modeling complex protocol contexts and in identifying cross-device collaborative attacks or covert penetration behaviors.

[0005] A deep learning-based method for identifying abnormal interactions in industrial control protocols, comprising: Multi-source time-series data acquisition is performed on multiple protocol traffic acquisition points in an industrial control system. The collected multi-source time-series data is decoded and formatted to generate a standardized protocol data base set; Based on a standardized protocol data set, an industrial protocol context knowledge graph is dynamically constructed through entity extraction and relation modeling to represent the correlation between heterogeneous protocol nodes. The node attributes in the constructed knowledge graph are mapped to a unified semantic feature space through multimodal semantic embedding, along with the multimodal data in the standardized protocol data set, to achieve multimodal feature fusion. Based on a unified semantic feature space, a graph-structured deep neural network is used to aggregate node behavior features to obtain a context behavior link model. Based on historical normal interaction behavior, a multi-dimensional anomaly assessment is performed on the context behavior link model to obtain a protocol interaction anomaly risk score. When the anomaly risk score exceeds the preset or adaptive threshold, anomaly interaction tracing analysis is performed based on the node and edge path relationship of the context knowledge graph to generate a multimodal anomaly tracing report.

[0006] In a preferred embodiment of the present invention, after generating the multimodal anomaly tracing report, the method further includes: A distributed storage and incremental update mechanism is adopted to dynamically adjust the knowledge graph structure and model parameters to adapt to changes in protocol type, topology changes and high-concurrency traffic scenarios.

[0007] In a preferred embodiment of the present invention, multi-source time-series data acquisition includes acquiring industrial control protocol traffic, host operation logs, and physical device operating parameters in the industrial control system. The industrial control protocol traffic includes IEC 60870-5-104, Modbus / TCP, or DNP3 protocol messages. The host operation logs include log information obtained through Syslog or Windows Event Log interfaces. The physical device operating parameters include voltage, current, circuit breaker status, temperature, or speed signals uploaded through intelligent electronic devices or sensor gateways using IEC 61850-9-2 or MQTT protocols.

[0008] In a preferred embodiment of the present invention, dynamically constructing an industrial protocol context knowledge graph includes: Based on the device's unique identifier, business object identifier, and scenario ID, the protocol behavior feature stream, host log entries, and physical layer sensor signals are associated and mapped in the spatiotemporal dimension to construct a consistent association structure that runs through the network layer, host layer, and physical layer. This structure is organized in the form of a directed graph, where nodes represent events at each layer and edges represent time and logical dependencies.

[0009] In a preferred embodiment of the present invention, multimodal semantic embedding includes: jointly embedding protocol communication sequences, parameter distribution and timing features with user identity, operation commands, process IDs and physical device operating parameters in host logs, mapping them to a unified semantic feature space, and forming a multimodal fusion feature representation.

[0010] In a preferred embodiment of the present invention, the graph-structured deep neural network employs a graph attention network or a graph convolutional network to perform neighborhood aggregation and context encoding on node features in a unified semantic feature space, thereby generating a context behavior link model containing multi-hop dependencies.

[0011] In a preferred embodiment of the present invention, multi-dimensional anomaly assessment includes: Within a sliding time window, the correlation of command responses, parameter consistency, and causal timing are analyzed. Granger causality test, dynamic time warping, and rule engine are used to jointly determine asynchronous, inconsistent, or causal break abnormal interaction behaviors.

[0012] In a preferred embodiment of the present invention, abnormal interaction tracing analysis includes: A hierarchical recursive tracing algorithm is used to analyze the manifestation of abnormal events at the network, host, and physical layers from top to bottom, locate suspected threat propagation paths, and generate threat assessment scores based on mismatch type, asset importance, and impact path length.

[0013] In a preferred embodiment of the present invention, the distributed storage and incremental update mechanism includes: continuously accumulating abnormal samples, false alarm cases and new business data during operation; using an online learning strategy to periodically drive incremental updates of the knowledge graph structure and model parameters; and distributing the updated data to edge nodes for version replacement after signature verification, supporting automatic rollback between old and new models.

[0014] In a preferred embodiment of the present invention, the method further includes: combining the density of field devices and the differences in network partitions, performing lightweight behavioral profile matching and preliminary anomaly screening at edge nodes, uploading only anomaly event summaries to the central platform, and triggering full data upload when continuous anomalies or high-risk scores are detected, with the central platform performing cross-regional distributed collaborative judgment.

[0015] The second objective of this invention is to provide a deep learning-based industrial control protocol abnormal interaction identification system for implementing the deep learning-based industrial control protocol abnormal interaction identification method described above.

[0016] The beneficial effects of this invention are as follows: This invention provides a deep learning-based method for identifying abnormal interactions in industrial control protocols. This method overcomes the limitations of traditional methods that rely solely on single network traffic data. By collecting and fusing multi-source time-series data, including original protocol data packets, device metadata, topology change records, and operation log text, and utilizing multimodal semantic embedding to map different types of data to a unified semantic space, it solves the problems of heterogeneous data formats and semantic fragmentation in industrial control environments. This enables the system to comprehensively understand the deep relationships between "device attributes," "network behavior," and "operational maintenance," laying a complete contextual foundation for subsequent high-precision anomaly detection. Furthermore, by dynamically constructing an industrial protocol context knowledge graph, core elements such as protocol fields, session objects, and command sequences are abstracted into nodes and edge relationships, achieving a structured expression of protocol interaction logic. Based on this, a graph-structured deep neural network is used to aggregate node behavior features, effectively capturing high-order topology features and long-range dependencies in protocol interactions. This solves the problems of traditional machine learning methods struggling to model complex protocol contexts and identify cross-device coordinated attacks or covert penetration behaviors. Moreover, this method employs a multi-dimensional anomaly evaluation mechanism, integrating multiple evaluation indicators based on historical normal behavior, rather than relying on a single statistical threshold or rule matching. This comprehensive evaluation approach reduces sensitivity to single features, effectively distinguishing genuine abnormal behavior from noise fluctuations, thereby lowering false alarm and false negative rates. Simultaneously, through adaptive threshold adjustment, the system can dynamically optimize judgment criteria based on actual operating environments, enhancing detection robustness across different industrial scenarios.

[0017] This application also provides a system for implementing the above-mentioned deep learning-based industrial control protocol abnormal interaction identification method. This system can comprehensively understand the deep relationship between "device attributes", "network behavior" and "operation and maintenance", and can solve the problems that traditional machine learning methods have difficulty in modeling complex protocol contexts and in identifying cross-device collaborative attacks or covert penetration behaviors. Attached Figure Description

[0018] Figure 1 This is a flowchart of the deep learning-based industrial control protocol abnormal interaction identification method provided in Embodiment 1 of the present invention. Detailed Implementation

[0019] Preferred embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0020] In industrial control network environments, data is characterized by diversity, high concurrency, and heterogeneous protocols. Existing methods still have significant shortcomings in addressing the fusion of multi-source heterogeneous data, protocol context modeling, and real-time performance assurance. Specifically: First, traditional methods struggle to effectively integrate multi-source data such as network traffic, device metadata, operation logs, and topology information, leading to insufficient understanding of the overall system behavior semantics. Second, they lack in-depth modeling of temporal dependencies and causal relationships during protocol interactions, making it difficult to identify complex attack paths across devices and protocols. Third, in high-traffic, high-dynamic scenarios, the real-time detection and scalability of existing systems are limited, making it difficult to meet the actual needs of large-scale industrial deployments.

[0021] Therefore, this application provides a deep learning-based method for identifying abnormal interactions in industrial control protocols to overcome the shortcomings of existing technologies.

[0022] Example 1 like Figure 1 As shown, this embodiment provides a deep learning-based method for identifying abnormal interactions in industrial control protocols. By constructing a dynamically evolving industrial protocol context knowledge graph and combining it with a large-model-driven multimodal semantic embedding and graph neural network inference mechanism, it achieves high-precision and interpretable anomaly detection of protocol interaction behavior in complex industrial control environments. The following detailed description of the method claimed in this application, along with a specific implementation process, further illustrates this method: A deep learning-based method for identifying abnormal interactions in industrial control protocols includes the following steps: S1: Collect raw protocol data packets, device metadata, topology change records, and operation log text from multiple protocol traffic acquisition points in the industrial control system to obtain multi-source time-series data covering devices in different locations and of different types. This step overcomes the limitations of traditional methods that rely solely on network traffic by introducing auxiliary information such as device attributes, system configurations, and maintenance logs, significantly improving the completeness and context coverage of the input data.

[0023] S2: The collected multi-source time-series data is decoded and formatted, including protocol field parsing, time-series feature normalization, operation log text structuring, and topology node information standardization, to generate a standardized protocol data base set. This process ensures that data from heterogeneous sources has a unified expression form, providing a consistent data foundation for subsequent semantic fusion.

[0024] S3: Based on the generated standardized protocol data set, entity extraction and edge relationship modeling methods are used to extract protocol fields, session objects, command sequences, and device identifiers, dynamically constructing an industrial protocol context knowledge graph to realize the relevance expression between heterogeneous protocol nodes. This graph not only reflects static connection relationships but also evolves and updates over time, fully characterizing the dynamic behavior patterns of protocol interactions.

[0025] S4: The node attributes in the industrial protocol context knowledge graph are mapped to a unified semantic feature space using a large-model multimodal semantic embedding algorithm, along with the traffic time-series features, operation log text, and device topology node information from the standardized protocol data base. This achieves multimodal feature fusion and semantic enhancement. This innovative design enables deep coupling of multiple types of information, including text, numerical values, and graph structures, significantly improving semantic representation capabilities.

[0026] S5: Based on the fused unified semantic feature space, enhanced semantic features are used as input, and graph neural networks are used to aggregate node behavior features to obtain high-order semantic association information between nodes and a contextual behavior link model. This mechanism can uncover potential behavioral paths beyond direct adjacency relationships, improving the ability to detect cooperative attacks or multi-hop penetration behaviors.

[0027] S6: Based on the historical normal interaction protocol context knowledge graph, the anomaly detection status is updated in real time. A threshold judgment is applied to the current context behavior link model based on semantic deviation, clustering distance, and large model prediction probability to obtain an anomaly risk score for protocol interaction. This comprehensive judgment mechanism combines the differences in representation space with statistical distribution characteristics, enhancing the robustness and adaptability of the judgment.

[0028] S7: If the risk score for protocol interaction anomalies exceeds the adaptive threshold, anomaly interaction tracing analysis will be automatically performed based on the node and edge path relationships in the context knowledge graph, generating a multimodal anomaly tracing report to assist in quickly locating the source of the anomaly interaction. This function provides highly interpretable risk attribution capabilities, significantly improving operational response efficiency.

[0029] S8: To address different protocol types, device topology changes, and high-concurrency traffic scenarios, a distributed storage and incremental graph update mechanism is employed to dynamically adjust the knowledge graph structure and behavioral link model parameters, thereby optimizing anomaly detection real-time performance and system scalability. This design ensures the long-term stable operation of the system in large-scale, highly dynamic industrial environments.

[0030] Step S1: Collect raw protocol data packets, device metadata, topology change records, and operation log text from multiple protocol traffic acquisition points in the industrial control system to obtain multi-source time-series data covering different locations and types of devices. Specifically, this includes: Select mirror ports or TAP probes deployed at the front end of PLCs, RTUs, DCS controllers, and SCADA servers as protocol traffic collection points to ensure coverage of critical communication links.

[0031] In industrial settings, representative network access layer and core switching nodes are selected, and hardware probes with deep packet inspection (DPI) capabilities are deployed to capture raw data packets from mainstream industrial control protocols such as Modbus / TCP, IEC 60870-5-104, and Profinet IO. The acquisition frequency is set to microsecond-level timestamp synchronization to ensure traceability of event sequences.

[0032] The protocol parsing engine is used to perform preliminary decapsulation of the received raw data packets, extracting the source / destination IP address, port number, protocol type, transaction ID, and function code fields.

[0033] The binary stream is disassembled layer by layer using a pre-defined protocol syntax tree template to identify the functional instruction segments of each protocol, such as read coil and write register operations in Modbus, thereby forming an initial sequence of behavior labels.

[0034] Synchronously collect device metadata, including device manufacturer and model, firmware version, region, asset security level, and list of open services.

[0035] This information comes from the CMDB (Configuration Management Database) or the asset management system API interface. A static attribute table is built based on the device's unique identifier (such as MAC address or SN number) for subsequent identity authentication and permission context modeling.

[0036] Subscribe in real time to topology change events published by the network topology management platform, and record the timestamps and impact range of link additions, deletions, or routing policy adjustments.

[0037] By combining NetFlow / IPFIX flow records with LLDP protocol detection results, a dynamic connection relationship snapshot is constructed, supporting cross-time period topology comparison analysis.

[0038] Collect operation log texts from operator workstations and engineering maintenance terminals, including login / logout records, configuration modification commands, parameter download actions, and approval process notes.

[0039] Centralized collection of log streams can be achieved using Syslog-ng or Windows Event Forwarding mechanisms, with timestamps and user identification information appended to prevent log tampering.

[0040] The five types of data sources mentioned above are aligned and labeled according to a unified time base (NTP synchronization) to form a multi-source raw data set with time-series index.

[0041] Each record is appended with a geographic tag of the collection point and a credibility weight, providing a basis for subsequent noise reduction and priority scheduling.

[0042] Step S2: Decode and format the collected multi-source time-series data, including protocol field parsing, time-series feature normalization, operation log text structuring, and topology node information standardization, to generate a standardized protocol data base set. Specifically, this includes: For different protocol types, a dedicated decoding module is invoked to convert the raw byte stream into a structured field object, preserving key semantic elements.

[0043] For example, for a Modbus request packet, it is mapped to the form {function_code: 5, address: 40001, value: 0xFF00}; for an IEC104 message, the ASDU structure is parsed and the telemetry / telecommunications type is restored.

[0044] Sliding window statistics are performed on continuous traffic characteristics (such as message length, response latency, and request frequency) to calculate the mean, variance, and trend slope.

[0045] Set the time window width to 10 seconds and the step size to 1 second, and output the triplet feature vector within each window. It is used to characterize the stability of local behavior.

[0046] By applying regular expression matching and named entity recognition technology, the "operation subject-action-target resource" triples are extracted from unstructured operation logs.

[0047] For example, "UserA modified the PID setting value of inverter VFD-03 at 2024-03-15T10:23:12" is parsed as (UserA, modify, PID_setpoint_of_VFD-03) and the operation sensitivity level is marked.

[0048] Convert the topology node information into a standard graph node description format, defining the node ID, type (terminal / gateway / server), physical location, and logical partition affiliation.

[0049] It uses JSON-LD format encoding, is compatible with the RDF semantic framework, and is easy to import into the knowledge graph storage system later.

[0050] Z-score normalization is performed on all numerical features to eliminate dimensional differences, as shown in the following formula: ; in, These are the original eigenvalues. and The outputs are the mean and standard deviation of the feature on the historical training set, respectively. It lies in a zero-mean, unit-variance distribution.

[0051] Construct a unified data model schema to map various types of processed data to a unified field naming system, generating a set of standard data entries containing timestamps, source devices, behavior types, feature vectors, and context labels.

[0052] The final output is a Parquet format fragmented file, which supports efficient batch loading and columnar querying.

[0053] Step S3: Based on the generated standardized protocol data base, entity extraction and edge relationship modeling methods are used to extract protocol fields, session objects, command sequences, and device identifiers, dynamically constructing an industrial protocol context knowledge graph to realize the relational expression between heterogeneous protocol nodes. Specifically, this includes: The rule engine and BiLSTM-CRF joint model are used to identify four core entities from standardized data: device nodes, protocol fields, operation commands, and session instances.

[0054] Device nodes are identified by a combination of IP address and port number; protocol fields such as “hold register” and “telemetry point” exist as attribute nodes; operation commands such as “write single register” are considered action nodes; a complete request-response cycle is defined as a session instance.

[0055] Establish six basic edge relationship types: communications_with (inter-device communication), contains_field (protocol contains fields), executes_command (device executes commands), belongs_to_session (behavior belongs to a session), precedes (command sequence), and located_in (device belongs to a geographical region).

[0056] Each edge carries a timestamp and confidence score, supporting time-series evolution tracking.

[0057] The newly arrived data entries are mapped to incremental subgraphs in the graph according to the time sequence. It is then determined whether there is an existing entity that matches the data. If not, a new node is created.

[0058] The SimHash algorithm is used to perform fuzzy matching of device fingerprints to avoid repeated modeling due to IP reassignment.

[0059] A time-slicing mechanism is introduced to divide the knowledge graph into snapshot subgraphs with a granularity of minutes. Each subgraph is stored independently and established with a causal link to the predecessor graph.

[0060] It allows backtracking to the global state at any point in time and supports reasoning across snapshot paths.

[0061] A lightweight conflict resolution strategy is designed to merge multiple attribute declarations for the same device based on the data source credibility priority (CMDB > Logs > Traffic Inference).

[0062] For contradictory values, retain the latest valid statement and mark the disputed status for manual review.

[0063] Periodically perform graph compression operations to abstract frequently co-occurring substructures into composite nodes. For example, summarize "PLC→Read→Sensor A→Return→Temperature Value" into a "Sensing Acquisition Chain" template node to reduce graph complexity.

[0064] Step S4: Map the node attributes in the industrial protocol context knowledge graph to the traffic time-series features, operation log text, and device topology node information in the standardized protocol data base set, using a large-model multimodal semantic embedding algorithm, to a unified semantic feature space, thereby achieving multimodal feature fusion and associated semantic enhancement. Specifically, this includes: Encoders are designed for different types of nodes in the graph: device nodes use GloVe pre-trained embedding combined with attribute concatenation; text log content is input into the BERT-base industrial control domain fine-tuning model to generate sentence vectors; temporal feature vectors are extracted for local patterns through a one-dimensional convolutional network.

[0065] The output dimension of each modal encoder is uniformly 128-dimensional.

[0066] A cross-modal attention mechanism is introduced to allow text descriptions to guide the distribution of attention weights to graph nodes.

[0067] For example, when analyzing a "remote restart" operation, the model automatically increases the attention coefficients of relevant nodes such as "firewall FIREWALL-01" and "engineer account ENG-05".

[0068] Construct multimodal joint training samples by packaging the graph subgraphs, corresponding log text summaries, and traffic statistics features within the same time window into a single input unit.

[0069] A contrastive learning objective function is adopted to maximize the embedding similarity between positive samples (with the same behavior) and minimize the similarity between negative samples.

[0070] The Knowledge-aware Graph Transformer (KGTransformer) architecture is used to inject graph structure information into the semantic space, so that adjacent nodes are close to each other in the embedding space.

[0071] The attention weights are calculated as follows: ; in, Represents a node The initial embedding, Let be a learnable transformation matrix, representing vector concatenation. For nodes To the neighbors Attention coefficient.

[0072] In each training batch, noisy negative sampling is introduced to randomly replace some edge relationships or text content, forcing the model to learn the true semantics rather than surface co-occurrence.

[0073] The ratio of negative samples is set to 1:3, meaning that each positive sample is paired with 3 incorrectly constructed relational triples.

[0074] Output the final unified semantic feature vector. ,in This vector integrates structural, textual, and numerical information, serving as the initial node representation for the graph neural network.

[0075] Step S5: Based on the fused unified semantic feature space, the enhanced semantic features are used as input, and a graph neural network is used to aggregate node behavior features to obtain high-order semantic association information between nodes and a contextual behavior link model. Specifically, this includes: The GraphSAGE-GCN hybrid architecture was selected as the backbone network, which balances inductive learning and local neighborhood aggregation capabilities.

[0076] Each layer aggregates the features of its direct neighbors and updates the representation of the central node through a non-linear activation function.

[0077] Define the aggregation function as a weighted mean pooling operation: ; in, For nodes The neighborhood group, It is the ReLU activation function. This is a trainable parameter matrix.

[0078] A three-layer stacked structure is set up to allow node information to be propagated up to a maximum range of three hops, capturing multi-hop path characteristics such as "attacker → jump server → PLC → sensor forgery".

[0079] A residual connection is added after the output of each layer to alleviate the gradient vanishing problem.

[0080] Introducing a time gating mechanism, the freshness of edge timestamps is considered in a weighted manner during the aggregation process: ; in, For the edge Last active time, Controlling the decay rate, the more recently the interaction occurs, the greater its impact.

[0081] Graph pooling is performed on the aggregated higher-order features to generate a global representation vector for the entire contextual behavior chain. .

[0082] The Set2Set mechanism is used to simulate sequence dependencies, which is suitable for variable-length graph structures.

[0083] The results of each round of inference are cached in the behavior memory bank, which supports dynamic comparison with historical normal patterns and provides a reference benchmark for subsequent anomaly scoring.

[0084] Step S6: For the historical normal interaction protocol context knowledge graph, update the anomaly detection status in real time, and determine the threshold of the current context behavior link model based on semantic deviation, clustering distance, and large model prediction probability to obtain a protocol interaction anomaly risk score. Specifically, this includes: The semantic deviation between the current behavioral link model and the historical normal cluster centers is calculated, using cosine distance as the metric: ; The higher the deviation, the higher the score.

[0085] The DBSCAN clustering algorithm is used to divide the embedding space of normal behavior to determine whether the current sample falls into an outlier region.

[0086] If it is classified as a noise point, a primary alarm signal is immediately triggered.

[0087] Input the current context into a pre-trained large language model (LLM-based Behavior Predictor) and output an estimate of the probability that an anomaly will occur within the next 5 minutes. .

[0088] The model is based on the Transformer-XL architecture and is trained in a self-supervised manner on millions of industrial control logs.

[0089] The final risk score is generated by combining three indicators: ; in, The weighting coefficients are determined based on the area under the ROC curve, with typical values ​​being [value missing]. .

[0090] Set adaptive threshold Its dynamic adjustment depends on the system load and recent false alarm rate: ; in, Based on the threshold, To adjust the gain, This represents the number of false alarms confirmed in the most recent hour.

[0091] when When an abnormal interaction event occurs, it is identified as an abnormal interaction event, enters the source analysis stage, and the score is recorded for model retraining.

[0092] Step S7: If the protocol interaction anomaly risk score exceeds the adaptive threshold, then based on the node and edge path relationships in the context knowledge graph, anomaly interaction tracing analysis is automatically performed to generate a multimodal anomaly tracing report to assist in quickly locating the source of the anomaly interaction. Specifically, this includes: Trigger the reverse path tracing algorithm, starting from the node with the highest anomaly score, traverse the incoming edges in reverse time order to find the earliest starting point that deviates from normal behavior.

[0093] Using Dijkstra's shortest path algorithm, the edge weight is determined by both the time interval and the degree of semantic mutation.

[0094] Extract all relevant raw data fragments, including related message payloads, original operation logs, and device status snapshots, and integrate them into a chain of evidence.

[0095] Each piece of evidence comes with a credibility rating and a source description.

[0096] Use the Natural Language Generation (NLG) module to write a Chinese source summary stating "who performed what operation, when and where, and what the possible consequences might be".

[0097] For example: "An unauthorized user was detected logging into the HMI station from the external IP 192.168.10.112 and attempting to issue a large number of illegal write register instructions to PLC-02." Generate a visual graph view that highlights the abnormal propagation path, marks suspicious edges with red arrows, and highlights affected nodes in yellow.

[0098] Supports clicking to expand detailed attributes and timeline.

[0099] Outputs a structured threat intelligence file conforming to the STIX 2.1 standard, which can be further consumed by SIEM systems or shared to industry alliance platforms.

[0100] It includes object types such as Attack Pattern, Malware, and Course of Action.

[0101] The complete report is pushed to the mobile devices of maintenance personnel and the SOC dashboard, supporting one-click transfer of the handling process and forming a closed-loop management.

[0102] Step S8: For different protocol types, device topology changes, and high-concurrency traffic scenarios, a distributed storage and incremental graph update mechanism is used to dynamically adjust the knowledge graph structure and behavioral link model parameters to optimize anomaly detection real-time performance and system scalability. Specifically, this includes: The knowledge graph data is sharded and stored in a distributed graph database cluster based on JanusGraph, and horizontally partitioned according to device region and protocol type.

[0103] Each shard is maintained by an independent Worker node, supporting parallel queries and updates.

[0104] The design incorporates an incremental learning mechanism. Once enough new samples (e.g., 10,000) are accumulated, a fine-tuning task is initiated to update the parameters of the graph neural network, thus avoiding full retraining.

[0105] Elastic Weight Consolidation (EWC) is used to prevent catastrophic forgetting.

[0106] The Apache Flink stream processing engine is introduced to implement a real-time graph update pipeline, which transforms data streams of up to 100,000 data points per second into graph operation instructions.

[0107] Window aggregation reduces redundant writes and improves throughput efficiency.

[0108] Configure an elastic scaling strategy: when CPU utilization remains above 80% for 5 minutes, automatically add computing nodes; when it falls below 30%, release idle resources.

[0109] Automated scheduling is achieved by leveraging the Kubernetes container orchestration platform.

[0110] The system manages hot and cold data in a hierarchical manner, with recently active subgraphs stored in the in-memory graph cache (RedisGraph) and historical graphs archived to object storage.

[0111] The query will be automatically routed to the appropriate level.

[0112] Regularly perform model performance evaluations, monitoring four core metrics: accuracy, recall, F1 score, and inference latency. If a drop exceeds 5%, trigger an alarm and initiate a diagnostic process.

[0113] Example 2 This embodiment provides a deep learning-based method for identifying abnormal interactions in industrial control protocols, used to implement the deep learning-based method for identifying abnormal interactions in industrial control protocols as described above.

[0114] This embodiment uses a smart grid dispatching system as an application scenario to provide a detailed explanation of the working process of the system implementing this method.

[0115] Mirrored ports are deployed at the front end of PLCs, RTUs, and SCADA servers in the substation, and deep packet inspection probes are configured to capture raw Modbus / TCP protocol data packets in real time, with microsecond-level timestamps appended. Simultaneously, device metadata, including device model, firmware version, and asset security level, is synchronously obtained through a configured management database interface. Link change events are acquired in real time by subscribing to the network topology management platform. Operator station operation log text is centrally collected using Syslog. All data sources are synchronized via NTP, forming a multi-source time-series data set.

[0116] The collected data is decoded and formatted: the Modbus protocol parsing module is invoked to convert the raw byte stream into structured field objects, extracting key fields such as function codes, register addresses, and data values; sliding window statistics are performed on continuous features such as message length and response latency to generate time-series feature vectors; regular expressions are used to extract "subject-action-target" triples from the operation log; and device information is converted into JSON-LD format node descriptions. All numerical features are Z-score normalized to generate a standardized protocol data base set.

[0117] Based on standardized data, a BiLSTM-CRF joint model is used to identify four core entities: device nodes, protocol fields, operation commands, and session instances. Six edge relationship types are established: inter-device communication, protocol-included fields, device-executed commands, behavior belonging to a session, command sequence, and device geographical region affiliation. New data is mapped into incremental subgraphs in chronological order, and the SimHash algorithm is used for device fingerprint matching to avoid redundant modeling. The graph is divided into minute-level snapshot subgraphs, establishing causal links across time segments to support global state backtracking.

[0118] Encoders are designed for different modalities of data: device nodes use GloVe pre-trained embeddings combined with attribute concatenation; text logs are input into a BERT-based industrial control domain fine-tuned model to generate sentence vectors; temporal features are extracted for local patterns via a one-dimensional convolutional network. A cross-modal attention mechanism is introduced, allowing text descriptions to guide the distribution of attention weights to graph nodes. A contrastive learning objective function is used for joint training to maximize the embedding similarity between samples with the same behavior. Finally, a 128-dimensional unified semantic feature vector is output as the initial node representation of the graph neural network.

[0119] A hybrid architecture of GraphSAGE-GCN is adopted as the backbone network, with a three-layer stacked structure to allow information to propagate within a three-hop range. The aggregation function employs weighted mean pooling and introduces a temporal gating mechanism, weighting edges according to their freshness to give more influence to recent interactions. Graph-level pooling is performed on the aggregated high-order features to generate a global representation vector of the contextual behavior chain. The inference results of each round are cached in the behavior memory for dynamic comparison with historical normal patterns.

[0120] Calculate the semantic deviation (cosine distance) between the current behavior link and the historical normal cluster centers, and use the DBSCAN clustering algorithm to determine whether it falls into an outlier region. Input the current context into a pre-trained large language model and output the probability of anomaly occurrence. Generate a risk score by combining three indicators: R = α·d_cos + β·d_cluster + γ·(1-p_normal), where the weight coefficients are determined by optimization based on the area under the ROC curve. Set an adaptive threshold τ(t), which is dynamically adjusted according to the system's false alarm rate. When R exceeds the threshold, it is judged as an abnormal interaction event.

[0121] The reverse path tracing algorithm is triggered, starting from the node with the highest anomaly score, traversing the incoming edges in reverse chronological order, and using Dijkstra's shortest path algorithm to find the earliest starting point deviating from normal behavior. Relevant message payloads, original operation logs, and device status snapshots are extracted to form a chain of evidence. A Chinese source summary is written using the natural language generation module, such as: "Unauthorized IP 10.10.1.102 was detected logging in from the engineer station and continuously issuing illegal register write commands to PLC-03 at 10:23:15, deviating from the historical behavior baseline." A visual graph view is generated, highlighting the anomaly propagation path, and a threat intelligence file conforming to the STIX 2.1 standard is output and pushed to the mobile terminals of operations personnel and the security operations center platform.

[0122] This system constructs a multi-source time-series data system by collecting raw protocol data packets, device metadata, topology change records, and operation log text. It then utilizes multimodal semantic embedding to map structured and unstructured data to a unified semantic space, achieving a comprehensive semantic understanding of device attributes, network behavior, and operational processes. This overcomes the contextual gaps inherent in traditional methods that rely on a single data source. Furthermore, by dynamically constructing an industrial protocol context knowledge graph, it abstracts protocol fields, session objects, command sequences, and other elements into nodes and edge relationships. Combined with a graph-structured deep neural network for high-order feature aggregation, it effectively captures cross-device and cross-protocol collaborative behavior patterns and long-range dependencies. This solves the technical challenges of traditional machine learning in modeling complex protocol contexts and identifying covert infiltration behaviors.

[0123] It should be noted that the use of terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying abnormal interactions in industrial control protocols based on deep learning, characterized in that, include: Multi-source time-series data acquisition is performed on multiple protocol traffic acquisition points in an industrial control system. The collected multi-source time-series data is decoded and formatted to generate a standardized protocol data base set; Based on a standardized protocol data set, an industrial protocol context knowledge graph is dynamically constructed through entity extraction and relation modeling to represent the correlation between heterogeneous protocol nodes. The node attributes in the constructed knowledge graph are mapped to a unified semantic feature space through multimodal semantic embedding, along with the multimodal data in the standardized protocol data set, to achieve multimodal feature fusion. Based on a unified semantic feature space, a graph-structured deep neural network is used to aggregate node behavior features to obtain a context behavior link model. Based on historical normal interaction behavior, a multi-dimensional anomaly assessment is performed on the context behavior link model to obtain a protocol interaction anomaly risk score. When the anomaly risk score exceeds the preset or adaptive threshold, anomaly interaction tracing analysis is performed based on the node and edge path relationship of the context knowledge graph to generate a multimodal anomaly tracing report.

2. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to claim 1, characterized in that: After generating the multimodal anomaly attribution report, the following is also included: A distributed storage and incremental update mechanism is adopted to dynamically adjust the knowledge graph structure and model parameters to adapt to changes in protocol type, topology changes and high-concurrency traffic scenarios.

3. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to claim 1, characterized in that: Multi-source time-series data acquisition includes collecting industrial control protocol traffic, host operation logs, and physical device operating parameters from the industrial control system. The industrial control protocol traffic includes IEC 60870-5-104, Modbus / TCP, or DNP3 protocol messages. The host operation logs include log information obtained through Syslog or Windows Event Log interfaces. The physical device operating parameters include voltage, current, circuit breaker status, temperature, or speed signals uploaded through intelligent electronic devices or sensor gateways using IEC 61850-9-2 or MQTT protocols.

4. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to claim 1, characterized in that: Dynamically constructing an industrial protocol context knowledge graph includes: Based on the device's unique identifier, business object identifier, and scenario ID, the protocol behavior feature stream, host log entries, and physical layer sensor signals are associated and mapped in the spatiotemporal dimension to construct a consistent association structure that runs through the network layer, host layer, and physical layer. This structure is organized in the form of a directed graph, where nodes represent events at each layer and edges represent time and logical dependencies.

5. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to any one of claims 1-4, characterized in that: Multimodal semantic embedding includes: jointly embedding protocol communication sequences, parameter distributions, and time-series features with user identity, operation commands, process IDs, and physical device operating parameters in host logs, mapping them to a unified semantic feature space, and forming a multimodal fusion feature representation.

6. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to any one of claims 1-4, characterized in that: Graph-structured deep neural networks employ graph attention networks or graph convolutional networks to perform neighborhood aggregation and context encoding on node features in a unified semantic feature space, generating a context behavior link model that includes multi-hop dependencies.

7. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to any one of claims 1-4, characterized in that: Multidimensional anomaly assessment includes: Within a sliding time window, the correlation of command responses, parameter consistency, and causal timing are analyzed. Granger causality test, dynamic time warping, and rule engine are used to jointly determine asynchronous, inconsistent, or causal break abnormal interaction behaviors.

8. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to any one of claims 1-4, characterized in that: Anomaly interaction tracing analysis includes: A hierarchical recursive tracing algorithm is used to analyze the manifestation of abnormal events at the network, host, and physical layers from top to bottom, locate suspected threat propagation paths, and generate threat assessment scores based on mismatch type, asset importance, and impact path length.

9. The method for identifying abnormal interactions in industrial control protocols based on deep learning according to claim 2, characterized in that: The distributed storage and incremental update mechanism includes: continuously accumulating abnormal samples, false alarm cases and new business data during operation; using an online learning strategy to periodically drive incremental updates of the knowledge graph structure and model parameters; and distributing the updated data to edge nodes for version replacement after signature verification, supporting automatic rollback between old and new models.

10. A deep learning-based industrial control protocol abnormal interaction identification system, characterized in that: The system is used to implement the deep learning-based industrial control protocol abnormal interaction identification method as described in any one of claims 1-9.

Images