Industrial control system security detection method and system based on multi-source data fusion

Abstract

The application discloses a kind of industrial control system safety detection method and system based on multi-source data fusion, it is related to industrial control safety field.It includes: synchronous acquisition flow, log, PLC state and physical time sequence data and align time reference;Multi-source data is structured and is analyzed and semantically mapped;Dynamic behavior baseline is constructed using unsupervised learning algorithm, and "control-physical" correlation consistency model is established;Based on model implementation protocol semantics, physical process and control logic multidimensional collaborative detection;Risk assessment is combined with asset criticality, operating mode and process stage to perceive context.This application can break through single-dimensional detection limitation, identify "format legal but malicious intent" hidden attack, adapt to complex working condition switching, significantly reduce false alarm rate, and improve the ability of industrial control system to resist APT attack.

Description

Technical Field

[0001] This invention belongs to the field of information security technology for industrial control systems. Specifically, it relates to a security detection method and system for industrial control systems based on multi-source data fusion. Background Technology

[0002] Industrial control systems are widely used in critical infrastructure sectors affecting national welfare and people's livelihoods, such as power, manufacturing, and chemical industries. Their operational safety is directly related to the continuity of industrial production and public safety. With the rapid development of the Industrial Internet and intelligent manufacturing, industrial control systems are undergoing a profound transformation from closed environments to open and interconnected environments. However, this openness also exposes industrial control systems to increasingly severe cyberattack threats, such as viruses, ransomware, and advanced persistent threats (APTs) targeting specific industrial protocols. Because industrial control environments have extremely high requirements for real-time performance and availability, and extensively use proprietary industrial protocols and specific hardware devices, traditional IT network security protection methods are often difficult to apply directly due to a lack of understanding of industrial protocol semantics, unfamiliarity with industrial control business logic, and inability to meet real-time requirements.

[0003] Currently, security detection in industrial control systems mainly relies on several traditional methods. One type is rule-based or attack signature-based detection, which heavily depends on known attack signature databases and lacks effective identification capabilities for zero-day attacks and unknown potential threats. Another type is static baseline-based detection, which typically identifies anomalies by establishing static normal models of network traffic or device configurations. For example, a typical existing solution involves deploying probes on critical links in the industrial control network to collect network traffic using protocols such as Modbus TCP or OPC, parsing statistical characteristics such as connection relationships, packet lengths, and frequencies, and comparing these characteristics with static baselines such as the set of access source IPs or the range of register access frequencies obtained in advance during normal operation. If the current characteristics deviate from the baseline by more than a threshold, an alarm is triggered.

[0004] However, the aforementioned existing technologies have significant limitations in practical applications. First, detection methods based on static models are poorly adaptable to dynamic changes in operating conditions and complex production processes in industrial systems, easily misinterpreting normal production mode switching as an attack, resulting in a persistently high false alarm rate. Second, most existing detection methods are single-dimensional, typically limited to analyzing network traffic or host logs, failing to deeply correlate and analyze the semantics of industrial control protocols, the real-time status of physical processes, and the execution sequence of control logic, leading to severely insufficient detection depth. Furthermore, existing technologies generally lack the ability to perceive business context, failing to integrate security events with the current production stage, process flow, and the criticality of assets, making accurate risk assessment impossible. When faced with attackers stealing legitimate credentials and sending legally formatted malicious commands, or covertly deceiving and tampering with physical processes and sensors, traditional methods often struggle to effectively identify such attacks due to the lack of consistency verification between control commands and physical responses. Therefore, in the context of open and interconnected industrial control systems, how to realize an intelligent detection method that can integrate multi-source heterogeneous data, establish dynamic behavior models, and perform multi-dimensional correlation analysis based on business context, so as to improve the detection capability of complex attacks and reduce false alarms, has become an urgent technical problem to be solved in the field of industrial control security. Summary of the Invention

[0005] The purpose of this invention is to provide a security detection method and system for industrial control systems based on multi-source data fusion, which mainly solves the shortcomings of existing industrial control security detection methods in dealing with covert protocol attacks and cross-dimensional APT attacks, such as lack of protocol semantic understanding, lack of multi-source data correlation, poor adaptability of static baselines, and single risk assessment dimensions.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A security testing method for industrial control systems based on multi-source data fusion includes the following steps:

[0008] S1 collects and acquires multi-source heterogeneous data from industrial control systems, and uses the Precision Time Protocol (PTP) to control the time deviation of all acquisition nodes within the microsecond range.

[0009] S2 performs multi-source data structured parsing and semantic mapping operations. Through a preset protocol fingerprint library and address mapping table, the collected binary stream data is transformed into a structured feature vector containing instruction semantic features, temporal location features, and physical state features.

[0010] S3, to perform dynamic behavior baseline modeling, and to build an unsupervised learning model using historical multi-source heterogeneous data under normal working conditions;

[0011] S4, perform multi-dimensional collaborative detection, input the real-time collected data into the unsupervised learning model, and perform anomaly identification by calculating the residual between the real-time observation value and the model prediction value;

[0012] S5 performs context-aware dynamic risk assessment operations, combining the criticality of the affected assets, the current production operation mode, and the process stage to which they belong, to quantify and score the detected abnormal events and output graded alarm information.

[0013] Furthermore, in this invention, the multi-source heterogeneous data is synchronously acquired through traffic acquisition probes, host monitoring agents, and controller listening modules deployed at key nodes of the industrial control network, including network traffic data, industrial control host log data, programmable logic controller (PLC) operating status data, and physical process data collected by sensors.

[0014] Further, in step S2, the structured parsing operation extracts the function code, slave address, and data field of the industrial protocol message using Deep Packet Inspection (DPI) technology; for non-public private protocols, a heuristic algorithm based on bitstream alignment and frequent itemset mining is used to segment the fields, identifying the control field representing control commands and the status field representing measurement values; the semantic mapping operation obtains the correspondence between tag names and register addresses by accessing the process database PIMS, and converts the values ​​into semantic tuples with process attributes.

[0015] Furthermore, in step S3, the specific implementation of the dynamic behavior baseline modeling is as follows: the preprocessed multi-source time series data is divided into a sliding window sequence and input into an LSTM encoder. The high-dimensional input is mapped to a low-dimensional latent space through multi-layer nonlinear transformation. The original input sequence is reconstructed using an LSTM decoder based on the latent space features, and the model is optimized by minimizing the reconstruction error function, wherein the reconstruction error function adopts the mean square error (MSE).

[0016] Furthermore, in step S3, the unsupervised learning model is a control-physical correlation consistency model that uses a long short-term memory autoencoder (LSTM-Autoencoder) as the core algorithm to jointly train the synchronized control command sequence and the physical response sequence, thereby establishing a model to characterize the expected trajectory of physical quantity changes under control commands.

[0017] Furthermore, in this invention, the multi-dimensional collaborative detection includes protocol semantic compliance detection, physical process consistency detection, and control logic integrity detection; the physical process consistency detection is achieved by calculating the real-time residual sequence R(t) = |Y real (t) - Y pred (t)|realize, where Y real(t) represents the physical quantity acquired in real time, Y pred R(t) is the predicted value output by the model; an alarm is triggered when R(t) exceeds the dynamic threshold within N consecutive sampling periods; the dynamic threshold is adaptively adjusted according to the working condition switching state.

[0018] Furthermore, in this invention, the control logic integrity detection is achieved by periodically reading the program checksum of the PLC and comparing it with the security baseline, while simultaneously monitoring the logic flip sequence of the input / output mapping area within the PLC scanning cycle. If the logic jump order violates the preset control logic diagram structure, it is determined that a logic tampering attack exists.

[0019] Furthermore, in this invention, the dynamic risk assessment operation employs a multi-factor weighted assessment model, and the formula for calculating the risk value R is: R = S W asset M mode P phase Where S is the baseline severity determined by the degree to which outliers deviate from the baseline, and W... asset M represents the key weight of the affected assets. mode P is the operating mode coefficient. phase This represents the process stage coefficient.

[0020] The present invention also provides a detection system for implementing the above detection method, comprising:

[0021] The multi-source heterogeneous data perception layer is used to acquire multi-source data through traffic acquisition probes, host monitoring agents, and controller listening modules, and to achieve time alignment of each acquisition node using a time synchronization module.

[0022] The dynamic behavior baseline modeling layer is used to construct a dynamic behavior baseline model under normal operating conditions using an LSTM encoder and LSTM decoder.

[0023] The multi-dimensional collaborative detection engine layer is used to implement multi-dimensional anomaly identification through the protocol semantic compliance detection module, physical process consistency detection module, and control logic integrity detection module;

[0024] The context-aware dynamic risk assessment layer is used to quantify and score detected abnormal events and output graded alarms.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] (1) The present invention uses an LSTM autoencoder to construct a dynamic behavior baseline that integrates control command sequence and physical response timing characteristics. It is equipped with an incremental learning mechanism to automatically adapt to normal parameter deviations caused by equipment wear and environmental changes. It does not require frequent manual updates of detection rules, which can reduce the false alarm rate in production mode switching and equipment debugging scenarios, and significantly reduce the burden of handling invalid alarms for safety operation and maintenance personnel.

[0027] (2) This invention integrates four types of heterogeneous data sources: network traffic, host logs, PLC operating status, and physical process sensor data. It constructs a multi-dimensional collaborative detection system for protocol semantic compliance verification, physical process consistency verification, and control logic integrity verification. This breaks through the limitation of traditional solutions that "can only identify illegal format messages". It can effectively detect covert attacks such as illegally issued malicious instructions with stolen legitimate permissions, sensor data deception, and PLC logic tampering. It also improves the overall recognition rate of unknown zero-day attacks and APT attacks.

[0028] (3) This invention constructs a multi-factor dynamic risk assessment model that integrates asset criticality weight, operation mode coefficient and process stage coefficient. It can automatically adjust the detection sensitivity and alarm threshold according to the production scenario: automatically increase the detection priority in the high-risk reaction process stage, and automatically filter the fluctuation alarms generated by normal debugging operations in the shutdown maintenance stage. It realizes the deep adaptation of safety detection logic and industrial production business logic, and meets the requirements of industrial control system for high real-time performance and high availability.

[0029] (4) This invention solves the problem of time reference alignment of multi-source heterogeneous data through microsecond-level PTP time synchronization technology, providing a data foundation for the time-series correlation analysis of control commands and physical responses. The whole solution does not require hardware modification of existing PLCs, sensors and other industrial field equipment. It can be quickly put into operation by deploying a flow probe on the mirror port of the core switch and a lightweight monitoring agent on the engineer station. It is compatible with mainstream industrial protocols such as Modbus TCP, OPC UA and PROFINET. The deployment cost is only 30% of that of traditional industrial control security solutions, and it has stronger adaptability. Attached Figure Description

[0030] Figure 1 This is a logic block diagram of the detection system of the present invention.

[0031] Figure 2 This is a flowchart illustrating the workflow of multi-dimensional anomaly detection and correlation analysis in this invention.

[0032] Figure 3 This is a schematic diagram illustrating the establishment and detection principle of the "control-physics" consistency model in this invention.

[0033] Figure 4 This is a flowchart of the detection method of the present invention. Detailed Implementation

[0034] The present invention will be further described below with reference to the accompanying drawings and embodiments. The embodiments of the present invention include, but are not limited to, the following embodiments.

[0035] like Figure 1 As shown in the figure, an industrial control system safety detection system disclosed in this invention has an overall architecture consisting of four logical layers: a multi-source heterogeneous data perception layer, a dynamic behavior baseline modeling layer, a multi-dimensional collaborative detection engine layer, and a context-aware dynamic risk assessment layer. The multi-source heterogeneous data perception layer is configured at the front end of the industrial control network, achieving real-time capture of network-wide data through traffic acquisition probes, host monitoring agents, and controller listening modules. Traffic acquisition probes are deployed on mirrored ports of the core switch, using deep packet inspection technology to perform real-time parsing of industrial protocols such as Modbus TCP, OPC UA, and PROFINET, and to perform security detection on Modbus TCP, DCS, PLC, and HMI. The host monitoring agent resides as a lightweight service at the engineer's station and operator's station, responsible for collecting configuration software operation logs, system login logs, and process change information. The controller listening module periodically extracts the PLC's internal operating status, key register values, and program checksums through the PLC's programming interface or dedicated communication channel.

[0036] The overall system workflow is as follows: Figure 4 As shown, within the multi-source heterogeneous data sensing layer, the time synchronization module achieves clock alignment across all network devices using the Precision Time Protocol (PTP). The master clock node periodically sends synchronization messages (Sync) to the traffic acquisition probe, host monitoring agent, and controller listening module, recording the sending time t1. Each acquisition node receives the synchronization message and records the receiving time t2, subsequently responding with a delay request message (Delay). Req The system records the transmission time t3, and the master clock node receives the message and records the time t4. By calculating Delay = [(t2 - t1) + (t4 - t3)] / 2, the system offsets network transmission delays, limiting the timestamp discrepancies between data from different sources to the microsecond level. This high-precision alignment mechanism achieves precise coupling between control commands and physical feedback signals on the time axis. After receiving the raw data, the data preprocessing unit executes a wavelet transform algorithm to remove high-frequency noise from the sensor signals and uses the Min-Max normalization method to map physical data of different dimensions, such as pressure, flow rate, and temperature, to the [0,1] interval, eliminating the impact of data magnitude differences on subsequent modeling.

[0037] During the initial operational phase of the system, which is in normal production and free from attacks, the system performs multi-source heterogeneous data perception and high-precision time synchronization. At this time, the dynamic behavior baseline modeling layer collects pre-processed structured data feature vectors and performs multi-source data structured parsing and semantic mapping. The semantic mapping process utilizes a pre-built process object mapping table to map register address 40001 in the Modbus protocol to "pressure of reactor No. 1" and 40002 to "speed of feed pump A", thereby transforming the dry binary data into semantic tuples with business logic meaning.

[0038] The dynamic behavior baseline modeling operation is then performed. The core of this step lies in constructing an unsupervised reconstruction model using an LSTM encoder and LSTM decoder. The LSTM encoder receives sliding window data containing control command sequences and physical state sequences, extracts the temporal features of the operating conditions through a multi-layer recurrent neural network, and compresses them into a low-dimensional latent space. The LSTM decoder is responsible for reconstructing the original input sequence from these latent space features. During training, the system continuously reduces the mean squared error between the original input vector X and the reconstructed vector X', enabling the model to grasp the causal relationships in the normal production process. For example, the model learns the physical correlation rule that "when the feed pump speed increases by 10%, the liquid level count should rise at a slope of 0.02 m / s after a 5-second lag time." This "control-physical" correlation consistency model, utilizing the correlation fusion module, not only includes numerical correspondences but also covers the temporal response characteristics, forming a dynamic behavior baseline.

[0039] like Figure 2 As shown, a multi-dimensional collaborative detection operation is then performed. In real-time monitoring mode, the multi-dimensional collaborative detection engine layer inputs real-time data streams into the trained model. The protocol semantic compliance detection module verifies whether the function code of the current message conforms to the business logic through the built-in industrial protocol state machine. For example, if a write operation to the PLC configuration area is detected during normal production, this module will identify it as an anomaly that violates protocol semantics. The physical process consistency detection module is the core detection unit of this invention. It calculates the residual sequence R(t) =|Y| between real-time physical observations and model predictions. real (t) - Y pred (t)| is used to identify attacks. When an attacker steals legitimate credentials and sends a valid "open exhaust valve" command, if the pressure value fed back by the physical sensor does not decrease according to the trajectory predicted by the model, the physical process consistency detection module will immediately identify this inconsistency, thereby discovering a hidden physical tampering attack.

[0040] Meanwhile, the control logic integrity detection module obtains the PLC's program checksum in real time through the controller monitoring module. If an attacker tampers with the control logic by illegally downloading a program, even if they hide their tracks in network traffic, this module will trigger an alarm due to a failed checksum comparison. The topology association unit is responsible for fusing the aforementioned abnormal events scattered across different dimensions. Based on the physical topology connections of assets and the sequence of process logic, it clusters protocol anomalies, physical anomalies, and logical anomalies on a unified timeline. If the same PLC triggers both an unauthorized access alarm and a physical feedback anomaly alarm within a short period, the topology association unit merges these two low-level events into a single high-level security event: "suspected PLC injection attack and physical process tampering," significantly reducing the single-point false alarm rate.

[0041] refer to Figure 3 As shown, after detecting an anomaly, the system performs a context-aware dynamic risk assessment. Upon receiving a high-order security event, the context-aware dynamic risk assessment layer calls a preset risk assessment model to calculate the risk value R. This calculation process comprehensively considers four core factors. First, the system reads the base severity S corresponding to the anomaly type from the configuration table; for example, the severity of physical consistency anomalies is usually set to the highest level. Second, it uses the asset criticality weighting factor W... asset Identify the importance of the affected assets. If the anomaly involves a PLC on a core production line, the weight is 1.0; if it involves edge monitoring sensors, the weight is 0.3.

[0042] In this embodiment, the system uses the operating mode coefficient M mode Adjust the evaluation results. In the actual application scenario of a chemical production line, when the system is in "full-speed production mode," any tiny physical deviation means a huge safety risk; in this case, the coefficient is set to 1.0. However, when the system is in "shutdown maintenance mode" or "equipment repair mode," legitimate debugging operations by technicians may cause drastic fluctuations in physical quantities. In this case, the system automatically lowers the coefficient to 0.5, thereby filtering out normal fluctuation alarms generated during maintenance. Finally, the process stage coefficient P... phase The risk level is fine-tuned based on the degree of hazard in the production process. During the critical exothermic phase of the chemical reaction, the coefficient is set to 1.2 to improve detection sensitivity. The risk assessment model calculates the final risk value R = S using a product form. W asset M mode P phase The results are then mapped to four alarm levels.

[0043] The response and linkage interface executes differentiated handling logic based on the risk level. For events calculated as "extremely high risk," the response and linkage interface automatically sends a linkage signal to the Safety Instrumented System (SIS), triggering an emergency shutdown procedure to prevent serious safety incidents such as physical explosions, and simultaneously displays the attack path topology map at the top of the main screen of the security operations center. For "medium-low risk" events, the system performs operations such as recording audit logs, sending pop-up alerts to operator stations, and attaching associated physical characteristic curves for manual verification.

[0044] To further enhance the system's adaptability, the dynamic behavior baseline modeling layer is also equipped with an incremental learning module. During long-term production, due to equipment wear or changes in ambient temperature, the response characteristics of physical quantities may drift extremely slowly. The incremental learning module periodically analyzes the statistical distribution of reconstruction errors. If it detects a slight shift in the error center without any accompanying abnormal instructions or logical changes, it is determined to be normal physical drift. At this point, the module uses the production data from the most recent week to fine-tune and update the weights of the LSTM model, ensuring that the baseline model always conforms to the current physical reality, avoiding the tedious work of frequently maintaining a static baseline manually.

[0045] In a real-world chemical production line application, suppose an attacker exploits an undisclosed vulnerability to gain access to the operator station and issues an instruction to shut down the circulating cooling water pump. Because the attacker uses a legitimate communication protocol and legitimate control privileges, traditional detection devices based on flow statistics or rule features cannot identify this malicious behavior. However, in the system provided in this embodiment of the invention, the flow acquisition probe first captures the instruction and structures it into semantic tuples. The physical process consistency detection module predicts, based on the "control-physical" correlation model, that the internal temperature of the reactor should exhibit an exponential upward trend within 30 seconds after the cooling water pump is shut down. However, the attacker uses deception to tamper with the temperature sensor's feedback data, keeping it at a constant, normal value.

[0046] At this point, the physical process consistency detection module, by comparing the temperature rise curve predicted by the model with the constant curve fed back by the sensor, discovered that the residual between the two rapidly exceeded the dynamic threshold, thus identifying a temperature sensor spoofing attack. The topology association unit immediately correlated this physical anomaly with the water pump shutdown command issued by the operator station, generating a high-risk safety event. The context-aware dynamic risk assessment layer identified that the current process was in a critical stage of high-pressure synthesis and involved core reactor assets, calculating a risk value R that reached an extremely high risk threshold. The response linkage interface then triggered an audible and visual alarm and automatically isolated the infected operator station, thus successfully preventing the attack before disaster occurred.

[0047] The industrial control system security detection method and system provided in this invention achieve accurate identification of complex attack behaviors within the industrial control environment through deep fusion of multi-source data and dynamic behavior analysis. It solves the baseline problem of data association through high-precision time synchronization, the baseline modeling problem in dynamic environments through LSTM-Autoencoder, the identification problem of hidden physical tampering through residual analysis, and the alarm accuracy problem through context-aware evaluation. The entire system is configured as a closed-loop defense system, providing solid technical support for the security of critical infrastructure in the context of the Industrial Internet. This system not only possesses the ability to defend against known attacks, but also achieves proactive perception and early warning of unknown zero-day attacks through deep learning of the laws governing physical processes, meeting the stringent requirements of industrial control environments for high real-time performance, high reliability, and low false alarm rates.

[0048] The above embodiments are merely one of the preferred embodiments of the present invention and should not be used to limit the scope of protection of the present invention. Any modifications or refinements made to the main design concept and spirit of the present invention that are not of substantial significance, but solve the same technical problem as the present invention, should be included within the scope of protection of the present invention.

Claims

1. A security detection method for industrial control systems based on multi-source data fusion, characterized in that, Includes the following steps: S1 collects and acquires multi-source heterogeneous data from industrial control systems, and uses the Precision Time Protocol (PTP) to control the time deviation of all acquisition nodes within the microsecond range. S2 performs multi-source data structured parsing and semantic mapping operations. Through a preset protocol fingerprint library and address mapping table, the collected binary stream data is transformed into a structured feature vector containing instruction semantic features, temporal location features, and physical state features. S3, to perform dynamic behavior baseline modeling, and to build an unsupervised learning model using historical multi-source heterogeneous data under normal working conditions; S4, perform multi-dimensional collaborative detection, input the real-time collected data into the unsupervised learning model, and perform anomaly identification by calculating the residual between the real-time observation value and the model prediction value; S5 performs context-aware dynamic risk assessment operations, combining the criticality of the affected assets, the current production operation mode, and the process stage to which they belong, to quantify and score the detected abnormal events and output graded alarm information.

2. The industrial control system security detection method based on multi-source data fusion according to claim 1, characterized in that, The multi-source heterogeneous data is synchronously acquired through traffic acquisition probes, host monitoring agents, and controller listening modules deployed at key nodes of the industrial control network. This includes network traffic data, industrial control host log data, programmable logic controller (PLC) operating status data, and physical process data collected by sensors.

3. The industrial control system security detection method based on multi-source data fusion according to claim 2, characterized in that, In step S2, the structured parsing operation extracts the function code, slave address, and data field of the industrial protocol message using Deep Packet Inspection (DPI) technology. For non-public private protocols, a heuristic algorithm based on bitstream alignment and frequent itemset mining is used to segment the fields, identifying the control field representing control commands and the status field representing measurement values. The semantic mapping operation obtains the correspondence between tag names and register addresses by accessing the process database PIMS, and converts the values ​​into semantic tuples with process attributes.

4. The industrial control system security detection method based on multi-source data fusion according to claim 3, characterized in that, In step S3, the specific implementation of the dynamic behavior baseline modeling is as follows: the preprocessed multi-source time series data is divided into a sliding window sequence and input into an LSTM encoder. The high-dimensional input is mapped to a low-dimensional latent space through multi-layer nonlinear transformation. The original input sequence is reconstructed using an LSTM decoder based on the features of the latent space, and the model is optimized by minimizing the reconstruction error function, wherein the reconstruction error function adopts the mean square error (MSE).

5. The industrial control system security detection method based on multi-source data fusion according to claim 4, characterized in that, In step S3, the unsupervised learning model is a control-physical correlation consistency model that uses a long short-term memory autoencoder (LSTM-Autoencoder) as the core algorithm to jointly train the synchronized control command sequence and physical response sequence, thereby characterizing the expected trajectory of physical quantity changes under control commands.

6. The industrial control system security detection method based on multi-source data fusion according to claim 5, characterized in that, The multi-dimensional collaborative detection includes protocol semantic compliance detection, physical process consistency detection, and control logic integrity detection; the physical process consistency detection is achieved by calculating the real-time residual sequence R(t) = |Y real (t) - Y pred (t)|realize, where Y real (t) represents the physical quantity acquired in real time, Y pred R(t) is the predicted value output by the model; an alarm is triggered when R(t) exceeds the dynamic threshold within N consecutive sampling periods; the dynamic threshold is adaptively adjusted according to the working condition switching state.

7. The industrial control system security detection method based on multi-source data fusion according to claim 6, characterized in that, The control logic integrity detection is achieved by periodically reading the program checksum of the PLC and comparing it with the safety baseline. At the same time, the logic flip sequence of the input-output mapping area within the PLC scanning cycle is monitored. If the logic jump order violates the preset control logic diagram structure, it is determined that there is a logic tampering attack.

8. The industrial control system security detection method based on multi-source data fusion according to claim 7, characterized in that, The dynamic risk assessment operation adopts a multi-factor weighted assessment model, and the formula for calculating the risk value R is: R = S W asset M mode P phase Where S is the baseline severity determined by the degree to which outliers deviate from the baseline, and W... asset M represents the key weight of the affected assets. mode P is the operating mode coefficient. phase This represents the process stage coefficient.

9. A safety detection system for an industrial control system implementing the method of any one of claims 1 to 8, characterized in that, include: The multi-source heterogeneous data perception layer is used to acquire multi-source data through traffic acquisition probes, host monitoring agents, and controller listening modules, and to achieve time alignment of each acquisition node using a time synchronization module. The dynamic behavior baseline modeling layer is used to construct a dynamic behavior baseline model under normal operating conditions using an LSTM encoder and LSTM decoder. The multi-dimensional collaborative detection engine layer is used to implement multi-dimensional anomaly identification through the protocol semantic compliance detection module, physical process consistency detection module, and control logic integrity detection module; The context-aware dynamic risk assessment layer is used to quantify and score detected abnormal events and output graded alarms.

Images