Time consistency-based industrial control system cross-domain attack detection method

Abstract

This application discloses a method for detecting cross-domain attacks on industrial control systems (ICS) based on time consistency. The method includes: acquiring time-series data based on memory snapshots and traffic analysis from the control equipment of the ICS; constructing a sparse variable matrix and a dense variable matrix of the memory snapshots to determine log tampering detection information for the ICS; determining the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix; constructing a variable correlation matrix based on the dense variable matrix to detect the state consistency between each control variable; and jointly determining the detection result of source attack behavior in the ICS within a target time interval based on the time-series correlation information and state consistency. This application can improve the detection accuracy of source cross-domain attacks on ICS and can be widely applied in the field of computer technology.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method for detecting cross-domain attacks on industrial control systems based on time consistency. Background Technology

[0002] Industrial Control Systems (ICS) typically consist of a Supervisory Control and Data Acquisition (SCADA) host computer, programmable logic controllers (PLCs) and other control devices, field devices such as sensors and actuators, and an industrial control communication network connecting all levels. In this system, the PLC is the core execution unit, operating on a fixed scan cycle based on preset control logic. This periodic operating mechanism determines that the industrial control process is essentially time-driven. Under the same production process, each control variable exhibits a highly stable temporal pattern within a continuous scan cycle. Furthermore, because the same PLC coordinates and controls multiple physical modules in the industrial field, strong correlations exist between variables determined by the process logic. Traditional industrial control systems employ a closed, dedicated network deployment strategy, physically isolating them from the external environment, resulting in an extremely limited attack surface.

[0003] With the continuous advancement of the Industrial Internet and intelligent manufacturing strategies, the boundaries of industrial control systems (ICS) have expanded from closed, single control domains to composite architectures encompassing information and functional domains. This architectural shift allows attackers to exploit vulnerabilities in the information domain to achieve cross-domain penetration, directly tampering with collected data at sensor nodes in the functional domain, or using legitimate credentials to control SCADA systems and inject false control parameters into PLCs—essentially launching attacks at the data source. The stealth of such attacks lies in the fact that data maliciously tampered with at the source flows along the normal communication path, and the attack vector appears identical to legitimate data in its spatial flow. Defenders cannot detect anomalies from observable spatial inconsistencies arising at a specific point in the data flow. However, due to the cyclical nature of ICS operation, the statistical regularity of the time series and the correlation structure between variables in the false data injected by such source attacks will be disrupted, resulting in observable state inconsistencies over time.

[0004] Existing research on cross-domain detection methods for attacks on industrial control systems mainly focuses on two directions: detection of spatial path consistency and detection of anomalies in variable time-series data. The former is based on the core assumption that the attack vector will inevitably cause observable differences in the spatial propagation path of the data flow. It detects the deviation between the current data and the benchmark by setting comparison benchmarks at different spatial nodes (protocol layer, memory layer, state layer) of the data flow.

[0005] The shortcomings of related technologies include: (1) The detection mechanism takes spatial consistency as its core assumption and lacks targeted modeling of time dimension features. Both memory integrity verification and state invariant detection assume that the attack must cause observable deviations at the data flow spatial nodes or state transitions. This assumption is effective for attacks that disrupt propagation consistency, but ineffective for attacks injected from the source and compliant at the spatial path and protocol level. Such source attack anomalies are only reflected in the rhythm deviation of continuous time series and the destruction of structural correlation between variables. Existing solutions do not take time inconsistency as the core detection object, resulting in a systemic blind spot. (2) There is a lack of variable semantic extraction mechanism for PLC memory and protocol data. PLC memory is organized by register address index, and the variable boundary is determined by program compilation. It is difficult for the outside to directly obtain the starting address and type length from the original byte stream. The flow statistics time series analysis is only for macro statistical features and does not incorporate a deep semantic parsing mechanism for protocol messages. Summary of the Invention

[0006] The main objective of this application is to propose a time-consistency-based method for detecting cross-domain attacks on industrial control systems, which can improve the accuracy of detecting cross-domain attacks at the source of industrial control systems.

[0007] To achieve the above objectives, one aspect of this application proposes a cross-domain attack detection method for industrial control systems based on time consistency, comprising: Obtain timing data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; The memory snapshot is parsed based on the time-series data, and a sparse variable matrix of the memory snapshot is constructed. A dense variable matrix is ​​constructed based on the sparse variable matrix of the memory snapshot to determine the log tampering detection information of the industrial control system; Based on the historical time series data of each control variable in the dense variable matrix, determine the time series correlation information of each control variable under normal process conditions; A variable correlation matrix is ​​constructed based on the dense variable matrix, and then the state consistency among various control variables is detected based on the variable correlation matrix. Based on the time-series correlation information and the state consistency, a joint determination is made of the detection result that the industrial control system has source attack behavior within the target time interval.

[0008] In some embodiments, acquiring time-series data based on memory snapshots and traffic analysis from the control device of the industrial control system includes: Deploy traffic capture probes at critical communication link nodes in industrial control networks; Data is acquired from the control equipment of the industrial control system, including data written or read from the SCADA system, data written to the braking equipment in the industrial field, and data collected from sensors in the industrial field. When the control device is a PLC device, the step of obtaining time-series data based on memory snapshots and flow analysis from the control device of the industrial control system specifically includes: For the captured protocol messages, semantic parsing is performed according to the message format specifications of different industrial control protocols to restore the industrial control protocol and restore the original byte stream into a complete industrial control protocol application layer message with semantics; Extract the function code, logical register address, and numerical content from the complete industrial control protocol application layer message; Based on a preset acquisition cycle, multiple snapshots of PLC memory byte streams are obtained by periodically scanning the memory of the PLC device.

[0009] In some embodiments, the step of parsing the memory snapshot based on the time-series data and constructing the sparse variable matrix of the memory snapshot includes: By analyzing the layout of the PLC memory, the mapping relationship between the memory start address and data type length of each control variable is obtained, and a variable information mapping table is established. Based on the variable information mapping table, the memory byte stream snapshots at each time point are structurally segmented to construct a sparse variable matrix with temporal relationships.

[0010] In some embodiments, the step of structurally segmenting the memory byte stream snapshots at each time point based on the variable information mapping table to construct a sparse variable matrix with temporal relationships includes: For each control variable, starting from the memory start address of the control variable in the memory byte stream, take out multiple consecutive bytes, and perform byte order conversion and type decoding on the multiple bytes according to the data type to obtain the engineering quantity value of each control variable at the target time; By summing the engineering values ​​of multiple control variables in the memory byte stream snapshot at the target time, a variable value vector at the target time is obtained; By arranging the variable value vectors of multiple consecutive snapshot times in chronological order, a sparse variable matrix with temporal relationships is constructed.

[0011] In some embodiments, the step of constructing a dense variable matrix based on the sparse variable matrix of the memory snapshot to determine the log tampering detection information of the industrial control system includes: The historical log data of high-frequency records is obtained from the SCADA system; the historical log data records the values ​​of each control variable at each acquisition time. Extract the set of identical variables corresponding to the sparse variable matrix from the historical log data, and sort the set of identical variables in chronological order to construct a dense variable matrix; The sparse variable matrix is ​​numerically compared with the dense variable matrix to obtain the log tampering detection information of the industrial control system.

[0012] In some embodiments, determining the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix includes: During normal operation, the target model is trained using historical time-series data of each control variable in an initial reliable dense variable matrix, enabling the target model to learn the time-series correlation of each control variable under normal process conditions. Specifically, the target model simultaneously models prior correlation and sequential correlation for each time point, and constructs a symmetric KL divergence between the prior correlation and the sequential correlation. This symmetric KL divergence is used to enhance the distinguishability between normal and abnormal points among the control variables. During the detection phase, the real-time time series of each control variable in the dense variable matrix is ​​used as the input to the target model, and the anomaly score at each time point is output. Then, the control variable that has an anomaly in time series consistency is determined based on the anomaly score.

[0013] In some embodiments, constructing a variable correlation matrix based on the dense variable matrix, and then detecting state consistency among the various control variables based on the variable correlation matrix, includes: The dense variable matrix is ​​progressively advanced with a sliding window of target length, and the Pearson correlation coefficient is calculated for the value sequences of different control variables within the window. During normal operation, a reference distribution of correlation coefficients is established for each control variable pair based on historical data, and the co-change information between the value sequence of the tampered variable and the process-related variable is determined according to the confidence interval constructed by the Pearson correlation coefficient. During the detection phase, based on the deviation of the Pearson correlation coefficient from the confidence interval, it is determined whether the process correlation structure of the corresponding control variables has become abnormal, and the dynamic detection results of the correlation structure between variables are obtained.

[0014] In some embodiments, the step of jointly determining the detection result of source attack behavior in the industrial control system within a target time interval based on the time-series correlation information and the state consistency includes: The time-series consistency detection results of the control variables themselves are jointly analyzed with the dynamic detection results of the correlation structure between variables. If multiple variables have abnormal scores exceeding the threshold in a certain time interval, and the real-time correlation coefficient of the corresponding variable pair also deviates from the reference confidence interval, it is determined that there is a source attack behavior in that time interval. An alarm is output and the set of abnormal variables involved and the attack time interval are recorded.

[0015] Another aspect of this application embodiment provides a cross-domain attack detection device for industrial control systems based on time consistency, including: The first module is used to obtain time-series data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; The second module is used to parse the memory snapshot based on the time-series data and construct the sparse variable matrix of the memory snapshot; The third module is used to construct a dense variable matrix based on the sparse variable matrix of the memory snapshot, and to determine the log tampering detection information of the industrial control system. The fourth module is used to determine the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix. The fifth module is used to construct a variable correlation matrix based on the dense variable matrix, and then detect the state consistency among various control variables based on the variable correlation matrix. The sixth module is used to jointly determine the detection result of source attack behavior in the industrial control system within the target time interval based on the time sequence correlation information and the state consistency.

[0016] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0017] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0018] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0019] The embodiments of this application include at least the following beneficial effects: This application provides a method for detecting cross-domain attacks on industrial control systems based on time consistency. This method obtains time-series data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; parses the memory snapshots based on the time-series data and constructs a sparse variable matrix of the memory snapshots; constructs a dense variable matrix based on the sparse variable matrix of the memory snapshots to determine log tampering detection information of the industrial control system; determines the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix; constructs a variable correlation matrix based on the dense variable matrix, and then detects the state consistency between each control variable based on the variable correlation matrix; and jointly determines the detection result of source attack behavior in the industrial control system within the target time interval based on the time-series correlation information and the state consistency. This application establishes a variable information mapping table through protocol message semantic parsing and memory snapshot collaborative comparison, directly extracts variable value sequences with process semantics from the memory byte stream, and introduces cross-granularity consistency verification to actively verify log credibility, which can improve the detection accuracy of source cross-domain attacks on industrial control systems. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application; Figure 2 This is a flowchart of the overall steps provided in the embodiments of this application; Figure 3 This is a flowchart of time-series data acquisition based on memory snapshots and traffic analysis provided in an embodiment of this application; Figure 4 This is a time-series data anomaly detection graph based on multidimensional correlation provided in the embodiments of this application; Figure 5 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0022] It is understood that the terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0025] Before providing a detailed description of the embodiments of this application, some related technologies involved in the embodiments of this application will be described first, as follows: Existing technologies have the following main drawbacks in detecting attacks on industrial control systems (ICS): (1) Insufficient effectiveness of spatial consistency detection: The PLC memory integrity verification method based on hash comparison proposed in related technologies relies on the deviation between the current memory content and a fixed trusted benchmark. Variable data (sensor values, control status, etc.) belong to its critical memory area, but in real ICS, variables are continuously and legally updated during normal control cycles (host computer / protocol write commands). Any normal write operation will cause inconsistency between the current memory and the initial memory copy, and the hash will inevitably deviate, generating a large number of false alarms. Related technologies extract state transition conditions and invariant templates through static analysis of PLC code, and use the deviation of the runtime state sequence from the invariant as the detection basis. When an attacker constructs a false value that falls within the allowed range of the invariant, the state sequence does not produce a detectable deviation. At the same time, this method relies on PLC source code or decompilable files, making it difficult to deploy in a closed device environment.

[0026] (2) Insufficient depth of traffic statistics analysis: Related technologies use the statistical characteristics (message frequency, byte size, protocol type distribution, etc.) of industrial control protocol communication traffic such as Modbus and S7Comm as the modeling object. Their ARIMA timing model learns the macro-level traffic patterns of the communication layer, and the detection and judgment criteria are based on the deviation of traffic statistics from the predicted amount. In the source attack scenario targeted by this application, attackers can write false variable values ​​through legitimate industrial control protocol channels at normal communication frequencies. The number of messages, byte size, and protocol type distribution are all consistent with normal communication, and the traffic statistics characteristics cannot produce detectable timing deviations. Therefore, the criterion conditions of this method will not be triggered. The problem is that this method does not perform deep semantic analysis on industrial control protocol messages to extract the values ​​of each register variable. The detection object remains at the macro-level statistics of the communication layer. Therefore, it does not have the ability to model the value sequence of PLC control variables and the process correlation structure between variables. It is unaware of semantic anomalies at the variable value level.

[0027] The main reasons for the above shortcomings include two aspects: (1) The detection mechanism takes spatial consistency as the core assumption and lacks targeted modeling of time dimension features. Both memory integrity verification and state invariant detection assume that the attack must cause observable deviations at the data flow spatial nodes or state transitions. This assumption is effective for attacks that disrupt propagation consistency, but ineffective for attacks injected from the source and compliant at the spatial path and protocol level. Such source attack anomalies are only reflected in the rhythm deviation of continuous time series and the destruction of structural correlation between variables. The existing scheme does not take time inconsistency as the core detection object, resulting in a systemic blind spot. (2) The variable semantic extraction mechanism for PLC memory and protocol data is missing. PLC memory is organized by register address index, and the variable boundary is determined by program compilation. It is difficult for the outside to directly obtain the starting address and type length from the original byte stream. The flow statistics time series analysis is only for macro statistical features and does not incorporate a deep semantic parsing mechanism for protocol messages.

[0028] In view of this, this application provides a method for detecting cross-domain source attacks in industrial control systems based on time consistency. This method uses the multi-dimensional variable time consistency inherent in the PLC's periodic scanning execution mechanism as the core of detection. It combines PLC memory variable semantic extraction technology based on industrial control protocol traffic analysis with a multi-dimensional time anomaly detection method based on the Anomaly Transformer model. It extracts structured variable time-series data with process semantics from the PLC, a necessary control node through which data flows. It achieves joint modeling and dynamic anomaly detection in two dimensions: the time consistency of the variables themselves and the process correlation structure between variables. This enables effective detection of cross-domain source attacks in industrial control systems, improving the security protection capability of industrial control systems against covert source tampering attacks under the integrated architecture of information and functional domains.

[0029] The method proposed in this application mainly includes the following three parts: 1. A structured variable extraction method is proposed that combines industrial control protocol traffic restoration with PLC memory snapshots. By passively capturing and semantically parsing industrial control protocol messages such as Modbus TCP and S7Comm, function codes, logic register addresses, and numerical contents are extracted. A variable information mapping table is established in conjunction with PLC memory layout analysis. Based on the mapping table, the memory byte stream is structured and type-decoded to construct a sparse variable matrix.

[0030] 2. A cross-granularity consistency verification and log tampering repair method based on time window aggregation is proposed. Using the memory snapshot acquisition time as the anchor point, a window mean is constructed for dense SCADA logs. The tampering interval is located by dual criteria of standardized deviation and tampering ratio threshold. Repair is implemented using the memory snapshot interpolation results, and a dense variable matrix is ​​output.

[0031] 3. A dual-dimensional joint detection mechanism based on the Anomaly Transformer model and Pearson correlation coefficient is proposed. The former introduces an Anomaly-Attention unit, uses the symmetric KL divergence between prior association and sequence association as the anomaly score, and employs a Minimax strategy to strengthen the distinction between normal and abnormal points; the latter dynamically constructs the variable correlation matrix using a sliding window, and uses deviation from the historical confidence interval as the criterion for anomalies in the association structure. The two dimensions are jointly used to judge and output alarms.

[0032] The time-consistency-based cross-domain attack detection method for industrial control systems provided in this application can be fully applied to the security protection process of industrial control systems, promptly identify external attack risks against industrial control systems, and take timely and correct responses, greatly improving the security and reliability of industrial control systems.

[0033] The time-consistency-based cross-domain attack detection method and related equipment for industrial control systems provided in this application relate to the technical fields of computers, industrial control testing, and network security testing. The time-consistency-based cross-domain attack detection method for industrial control systems provided in this application can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the time-consistency-based cross-domain attack detection method for industrial control systems, but is not limited to the above forms.

[0034] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0035] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0036] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided in an embodiment of this application. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0037] Server 101 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0038] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0039] Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc. It can also be a vehicle-mounted terminal of the various device types described above, but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment does not impose any limitations.

[0040] Exemplary based on Figure 1 The implementation environment shown in this application embodiment provides a cross-domain attack detection method for industrial control systems based on time consistency. The following description uses the application of this cross-domain attack detection method for industrial control systems based on time consistency in server 101 as an example. It can be understood that this method can also be applied to terminal 102.

[0041] Reference Figure 2 , Figure 2 The flowchart illustrates a time-consistency-based cross-domain attack detection method for industrial control systems applied to servers, as provided in this application embodiment. The executing entity of this method can be any of the aforementioned computer devices (including servers or terminals). (Refer to...) Figure 2 The method may include the following steps: S201. Obtain timing data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; Specifically, step S201 includes: Deploy traffic capture probes at critical communication link nodes in industrial control networks; Data is acquired from the control equipment of the industrial control system, including data written or read from the SCADA system, data written to the braking equipment in the industrial field, and data collected from sensors in the industrial field. When the control device is a PLC device, the step of obtaining time-series data based on memory snapshots and flow analysis from the control device of the industrial control system specifically includes: For the captured protocol messages, semantic parsing is performed according to the message format specifications of different industrial control protocols to restore the industrial control protocol and restore the original byte stream into a complete industrial control protocol application layer message with semantics; Extract the function code, logical register address, and numerical content from the complete industrial control protocol application layer message; Based on a preset acquisition cycle, multiple snapshots of PLC memory byte streams are obtained by periodically scanning the memory of the PLC device.

[0042] In some embodiments, traffic capture probes can be deployed at key communication link nodes of the industrial control network to passively mirror and collect industrial control protocol messages such as Modbus and S7Comm. This does not inject any probe messages into the network and does not interfere with the normal operation of the industrial control system. For the captured protocol messages, semantic parsing is performed according to the message format specifications of different industrial control protocols to restore the industrial control protocol, converting the original byte stream into a complete application layer message with semantic meaning. Based on the protocol restoration, function codes, logical register addresses, and numerical content are extracted from read / write operation messages. Simultaneously, at fixed intervals... Perform periodic full scans of the PLC memory to obtain snapshots of the memory byte stream at various times. By combining PLC memory layout analysis, the mapping relationship between the starting memory address and data type length of variables is obtained, and a variable information mapping table is established. ,in, Let be the starting memory address of the i-th variable; The length in bytes of this variable is determined by its data type; The data type identifier determines the byte order conversion and type decoding methods; This serves as a read / write direction indicator to distinguish between sensor input variables and brake output variables.

[0043] S202. Parse the memory snapshot based on the time-series data and construct the sparse variable matrix of the memory snapshot; Specifically, step S202 includes: S2021. By analyzing the layout of the PLC memory, the mapping relationship between the memory starting address and data type length of each control variable is obtained, and a variable information mapping table is established. S2022. Based on the variable information mapping table, the memory byte stream snapshots at each time point are structurally segmented to construct a sparse variable matrix with temporal relationships.

[0044] Step S2022 above may include: S20221. For each control variable, starting from the memory start address of the control variable in the memory byte stream, extract multiple consecutive bytes, and perform byte order conversion and type decoding on the multiple bytes according to the data type to obtain the engineering quantity value of each control variable at the target time. S20222. Summarize the engineering values ​​of multiple control variables in the memory byte stream snapshot at the target time to obtain the variable value vector at the target time; S20223. Arrange the variable value vectors of multiple consecutive snapshot times in chronological order to construct a sparse variable matrix with temporal relationship.

[0045] In some embodiments, a mapping table may be used. Snapshots of memory byte streams at various times Perform structured segmentation. For the i-th variable, extract it from the snapshot byte stream... Starting from point 1, extract the continuous byte, according to data type Perform byte order conversion and type decoding to obtain the value of variable i. The amount of work done at any given time Repeat the above operation for all n variables in the mapping table to obtain the variable value vector at the k-th snapshot time: ,in, This represents an n-dimensional real vector space, meaning the vector consists of n real components. The variable value vectors from K consecutive acquisition times are arranged in chronological order to construct a sparse variable matrix with temporal relationships. : Where the k-th row of the matrix corresponds to The values ​​of all n variables at any given time are represented by column i, which corresponds to the time series of the i-th variable at K snapshot times. This is due to the varying acquisition period of the memory snapshots. Much longer than the SCADA log recording period The sampling density of this matrix on the time axis is lower than that of the log data, hence it is called a sparse variable matrix.

[0046] S203. Construct a dense variable matrix based on the sparse variable matrix of the memory snapshot to determine the log tampering detection information of the industrial control system; Specifically, step S203 includes: The historical log data of high-frequency records is obtained from the SCADA system; the historical log data records the values ​​of each control variable at each acquisition time. Extract the set of identical variables corresponding to the sparse variable matrix from the historical log data, and sort the set of identical variables in chronological order to construct a dense variable matrix; The sparse variable matrix is ​​numerically compared with the dense variable matrix to obtain the log tampering detection information of the industrial control system.

[0047] In some embodiments, this application can obtain historical log data recorded at a high frequency from a SCADA system. The logs record the values ​​of each variable at each acquisition time. The set of identical variables corresponding to the sparse variable matrix S is extracted and arranged in chronological order to construct a dense variable matrix. Where P is the total number of log time steps and the collection period is... Both matrices target the same set of PLC variables, but their data sources differ. The former is collected and recorded via SCADA software, posing a risk of tampering in a source attack scenario, while the latter originates directly from periodic reads of the PLC memory, thus possessing a degree of reliability. Therefore, comparing the two matrices reveals numerical discrepancies, which serve as the basis for detecting log tampering.

[0048] First, take the time of memory snapshot collection Using time anchors, extract half a snapshot period before and after each anchor time from the dense variable matrix D. All log samples within the range constitute the anchor point. Log window corresponding to the i-th variable ,in, This represents the recorded value of the i-th variable in the dense variable matrix D at the p-th log collection time, which is the amount of sampling work done by the SCADA log for variable i at that time. This represents the actual collection time corresponding to the p-th log collection sample; This represents the acquisition period for PLC memory snapshots, i.e., the time interval between two consecutive memory scans. The average value is calculated for the samples within the log window. Next, the window average value will be calculated. This serves as the representative value of the log variable at that anchor point, eliminating the influence of high-frequency sampling noise. For the i-th variable at the anchor point... Calculate the memory snapshot value at that location. Standardized deviation from log window mean : ,in, It is the standard deviation of variable i during its historical normal operation phase, used to eliminate the influence of differences in the units of measurement of different variables, making the deviation values ​​of each variable comparable. When Exceeding the preset threshold When the i-th variable is at the anchor point, it is determined that the i-th variable is at the anchor point. Log records near this location show unusual discrepancies. Furthermore, within a certain time period, a disproportionate number of discrepancies were observed. If variables show abnormal deviations at the same anchor point, then that time period is marked as the log tampering interval.

[0049] For time intervals marked as tampered with, the log repair process can be implemented using the memory snapshot variable values ​​at the two ends of the interval as endpoints. First, for continuous variables (such as floating-point physical quantities like temperature and pressure), linear interpolation is used to reconstruct the log data at each log time point within the tampered interval. Reconstruction variable estimates : ,in, This represents the reconstructed estimate of the i-th variable at the p-th log collection time within the tampering interval, which is the repair result of replacing the tampered log record with linear interpolation. The memory snapshot capture time corresponding to the left anchor point of the tampered interval is used as the starting endpoint of the linear interpolation. The memory snapshot acquisition time corresponding to the right-end anchor point of the tampered interval serves as the termination endpoint of the linear interpolation. This refers to the duration of the complete snapshot period spanned by the tampered interval; Represents the right-hand anchor point of the i-th variable. The memory snapshot engineering quantity value at that location, and the left anchor point value. Together they constitute two reliable endpoints for interpolation; For discrete variables (such as Boolean state variables), the nearest neighbor filling method is used, taking the memory snapshot value with the closest time distance as the repair value. Then, the repaired estimated value replaces the tampered record at the corresponding time in the log matrix D, and the repaired dense variable matrix is ​​output. .

[0050] The implementation process of steps S201-S203 above is as follows: Figure 3As shown, existing research largely focuses on spatial path compliance. Hash verification frequently generates false alarms under legitimate write scenarios within normal control cycles and fails to parse the semantic boundaries of variables; invariant detection is insensitive to false values ​​falling within the legitimate range; traffic statistics modeling lacks semantic parsing of protocol messages, meaning that when attackers write false values ​​at normal frequencies through legitimate channels, the criterion is not triggered. It is evident that existing solutions do not include the temporal inconsistency of variable value sequences within their detection scope, creating a common blind spot for source injection attacks. This application establishes a variable information mapping table through protocol message semantic parsing and memory snapshot collaborative comparison, directly extracting variable value sequences with process semantics from memory byte streams, and introducing cross-granularity consistency verification to actively verify log credibility, thus solving the fundamental problem of the lack of a variable semantic extraction mechanism in existing solutions. In terms of detection mechanism, Anomaly Transformer is used to model the temporal rhythm of variables, and Pearson correlation coefficient sliding window is used to dynamically characterize the process correlation between variables. The criterion is based on temporal state consistency rather than spatial path compliance, thus covering the common blind spot of existing solutions at the mechanism level.

[0051] S204. Based on the historical time series data of each control variable in the dense variable matrix, determine the time series correlation information of each control variable under normal process conditions; In some embodiments, anomaly detection of time-series data based on multidimensional correlations can be used to repair the dense variable matrix. As input, a joint mechanism of variable self-temporal consistency detection and dynamic detection of inter-variable correlation structure is used to detect state inconsistencies caused by source attacks in the time dimension. The principle is that the PLC, as a controller in industrial production, is mainly responsible for controlling industrial production equipment. Industrial production generally exhibits periodicity and correlation. Periodicity is manifested in the PLC's cyclical processing after entering the main program, and correlation is manifested in the PLC controlling various modules on-site, working together and being interconnected. This periodic execution and inter-module correlation result in correlation between the PLC's variables themselves and between variables during execution; this correlation is called state consistency. If the spurious value sequence injected by the source attack pollutes the PLC memory, no matter how carefully constructed the single-point values ​​are, it is difficult to simultaneously satisfy the temporal correlation of variables in the continuous scanning cycle dimension to completely replicate the normal process, and the stable correlation structure maintained among all correlated variables under the normal process. The disruption of both creates observable state inconsistencies in the time dimension, constituting the detection basis of this method. The specific process includes two steps: variable self-temporal consistency detection based on Anomaly Transformer and dynamic detection of inter-variable correlation structure based on Pearson correlation coefficient.

[0052] Specifically, step S204 includes: S2041. During normal operation, the target model is trained using historical time-series data of each control variable in the initial reliable dense variable matrix, enabling the target model to learn the time-series correlation of each control variable under normal process conditions; wherein, the target model simultaneously models prior correlation and sequential correlation for each time point, and constructs a symmetric KL divergence between the prior correlation and the sequential correlation; the symmetric KL divergence is used to enhance the distinguishability between normal and abnormal points in each control variable; S2042. In the detection phase, the real-time time series of each control variable in the dense variable matrix is ​​used as the input of the target model, and the anomaly score at each time point is output. Then, the control variable that has an anomaly in time consistency is determined based on the anomaly score.

[0053] In some embodiments, consistency detection of the variable's own state can be performed. Since there is a lack of attack-labeled samples in industrial control scenarios, an unsupervised time-series anomaly detection method is used to model the time-series sequences of each variable. Specifically, the existing Anomaly Transformer model is used to implement time-series anomaly detection based on association discrepancy.

[0054] During normal operation, an initial, reliable dense variable matrix is ​​utilized. The model is trained using historical time-series data of each variable, enabling it to learn the temporal correlations of each control variable under normal process conditions. An anomaly-attention mechanism is introduced, adding an anomaly-attention unit to each layer to simultaneously model two forms of correlation at each time point: prior association using a Gaussian kernel function. To characterize local temporal dependencies between adjacent time points, series-association learns global temporal dependencies from data using a self-attention mechanism. Association discrepancy is defined as the symmetric KL divergence between the prior association distribution and the series association distribution. , in, For prior association, For sequence association, For row normalization operation; The association difference function measures the prior association distribution at the same time point. Distribution associated with sequence The degree of inconsistency between them, the larger the value, the more likely that the time point is to be an outlier; This represents the KL divergence, which measures the degree of difference between two probability distributions. Here, we take the symmetric form (i.e., the sum of the positive and negative directions) to eliminate the asymmetry of the KL divergence. Indicates the direction of the KL divergence calculation, such as express P Compared to Q of KL Divergence, a measure of the degree of divergence. Q approximate P Information loss during the process; This represents the input time series data of the current layer of the model, and the prior association. Sequence association All based on X Calculations show that X The conditional variable indicates the computational context of the two association distributions. Generally, the prior associations of normal time-series points tend to be consistent with the sequence associations, with small differences. However, for anomalous time-series points, due to their deviation from the normal pattern, it is difficult for sequence associations to find similar neighborhoods, resulting in significant differences from the prior associations and a marked increase in association differences. During training, a minimax association learning strategy is used for alternating optimization: maximizing the association differences of normal points to enhance the expressive power of prior associations, and minimizing the overall reconstruction loss. The combined effect of these two strategies strengthens the discriminative power between normal and anomalous points in terms of association differences.

[0055] During the detection phase, a dense variable matrix is ​​used. The real-time time series of the i-th variable is used as the input to the model, and the model outputs the anomaly score at each time point. This score takes into account both correlation differences and reconstruction errors. When... Exceeding the judgment threshold determined by the normal data distribution of the training set If the i-th variable is found to have a timing consistency anomaly at time t, then the i-th variable is determined to have a timing consistency anomaly at time t.

[0056] S205. Construct a variable correlation matrix based on the dense variable matrix, and then detect the state consistency between each control variable based on the variable correlation matrix. Specifically, step S205 includes: The dense variable matrix is ​​progressively advanced with a sliding window of target length, and the Pearson correlation coefficient is calculated for the value sequences of different control variables within the window. During normal operation, a reference distribution of correlation coefficients is established for each control variable pair based on historical data, and the co-change information between the value sequence of the tampered variable and the process-related variable is determined according to the confidence interval constructed by the Pearson correlation coefficient. During the detection phase, based on the deviation of the Pearson correlation coefficient from the confidence interval, it is determined whether the process correlation structure of the corresponding control variables has become abnormal, and the dynamic detection results of the correlation structure between variables are obtained.

[0057] In some embodiments, for detecting state consistency among variables, a variable correlation matrix can be dynamically constructed within a sliding window based on the Pearson correlation coefficient. For dense variable matrices... Using a sliding window of length W, the Pearson correlation coefficient is calculated for the value sequences of variables i and j within the window. ,in , These are the mean values ​​of variables i and j within the window, respectively. The larger the absolute value of the coefficient, the stronger the linear correlation between the two variables; negative values ​​represent negative correlation, and positive values ​​represent positive correlation. Calculate the above coefficients for all variable pairs to construct the dynamic correlation matrix for the current time step. ; This represents the upper limit index of the summation within the sliding window, indicating the value from the current time. Looking back in the direction of history Step, and lower limit The total number of time steps involved in the calculation within the jointly defined window is ; Represents variable i at time i The value at that position is the historical observed engineering quantity value of variable i at the backtracking position of step b within the current sliding window; Representing variable j in The value at time point is also the historical observed engineering quantity value of variable j at the backtracking position of step b within the current sliding window; This represents the backtracking step index within the window, with a value range of [value missing]. ; This represents the actual historical moment corresponding to step b within the window, indicating the time from the current moment. The specific time position pointed to by shifting b sampling steps to the past, all within the window Together, they constitute the time interval on which this correlation coefficient calculation is based.

[0058] During normal operation, each variable pair is based on historical data. Establish a reference distribution for the correlation coefficient and determine its confidence interval. Source attacks typically only tamper with some sensor variables, disrupting the coordinated change patterns between the altered value sequence and its process-related variables (such as brake variables or intermediate variables that depend on the same physical quantity). During the detection phase, if the strong correlation maintained under normal operation is significantly weakened by the continuous injection of spurious values, it can lead to… Deviation from the historical reference confidence interval, i.e. Then, it can be determined that the variable is a pair. An anomaly occurred in the process-related structure.

[0059] S206. Based on the time-series correlation information and the state consistency, jointly determine the detection result of source attack behavior in the industrial control system within the target time interval.

[0060] Specifically, step S206 includes: The time-series consistency detection results of the control variables themselves are jointly analyzed with the dynamic detection results of the correlation structure between variables. If multiple variables have abnormal scores exceeding the threshold in a certain time interval, and the real-time correlation coefficient of the corresponding variable pair also deviates from the reference confidence interval, it is determined that there is a source attack behavior in that time interval. An alarm is output and the set of abnormal variables involved and the attack time interval are recorded.

[0061] This application embodiment combines the temporal consistency detection results of variables themselves with the dynamic detection results of the correlation structure between variables for joint analysis. If multiple abnormal scores of variables exist simultaneously within a certain time interval... Exceeding the threshold If the real-time correlation coefficients of the variable pairs involved also deviate from the reference confidence interval, it is determined that there is a source attack behavior in this time interval. An alarm is output and the set of abnormal variables involved and the attack time interval are recorded to provide time-series evidence for subsequent attack tracing.

[0062] The implementation process of steps S204-S206 above is as follows: Figure 4 As shown, existing research largely focuses on spatial path compliance. Hash verification frequently generates false alarms under legitimate write scenarios within normal control cycles and fails to parse the semantic boundaries of variables; invariant detection is insensitive to false values ​​falling within the legitimate range; traffic statistics modeling lacks semantic parsing of protocol messages, meaning that when attackers write false values ​​at normal frequencies through legitimate channels, the criterion is not triggered. It is evident that existing solutions do not include the temporal inconsistency of variable value sequences within their detection scope, creating a common blind spot for source injection attacks. This application establishes a variable information mapping table through protocol message semantic parsing and memory snapshot collaborative comparison, directly extracting variable value sequences with process semantics from memory byte streams, and introducing cross-granularity consistency verification to actively verify log credibility, thus solving the fundamental problem of the lack of a variable semantic extraction mechanism in existing solutions. In terms of detection mechanism, Anomaly Transformer is used to model the temporal rhythm of variables, and Pearson correlation coefficient sliding window is used to dynamically characterize the process correlation between variables. The criterion is based on temporal state consistency rather than spatial path compliance, thus covering the common blind spot of existing solutions at the mechanism level.

[0063] In summary, in view of the problems existing in the prior art, this application constructs a cross-domain attack detection method for industrial control systems based on time consistency, which is used to effectively identify cross-domain attacks on industrial control systems. The method mainly includes two parts: (1) Based on memory snapshot and traffic analysis, time-series data acquisition is performed on the PLC memory to obtain continuous memory snapshots; at the same time, deep semantic analysis is performed on the industrial control protocol traffic to analyze the function code corresponding to the read / write operation, the memory starting address of the variable, the data type and length information. The address space of the memory snapshot is structurally divided according to the above mapping relationship, and the actual engineering quantity value of each variable is separated. Then, based on the snapshots of multiple time slices, a sparse variable matrix with time sequence relationship is constructed. In addition, the SCADA system log is obtained to form a dense variable matrix. Taking the memory snapshot acquisition time as the time anchor point, the time windows of the two matrices are aligned, and the software layer tampering of the log is detected by time window aggregation and standardized deviation calculation. The tampering interval is repaired by the memory snapshot interpolation result, and finally the dense variable matrix is ​​output. (2) Anomaly detection based on multidimensional correlation in time-series data: Using the repaired dense variable matrix as input, the AnomalyTransformer model is employed to perform unsupervised anomaly detection on the time-series sequences of each control variable, identifying deviations in the temporal rhythm of the variables themselves. Simultaneously, a correlation matrix between variables is dynamically constructed based on the Pearson correlation coefficient within a sliding window to detect disruptions in the process correlation structure between variables. This joint analysis of the two dimensions enables effective perception of state inconsistencies caused by source attacks in the time dimension.

[0064] The method provided in this application can solve the following technical problems: (1) The boundaries of variables in the PLC memory byte stream cannot be directly identified, which means that processing them directly by byte will break the integrity of the variable values ​​and destroy the relationship between variables. To this end, this application establishes a variable information mapping table by restoring the industrial control protocol traffic and semantic parsing, combined with PLC memory layout analysis. Based on this mapping table, the memory byte stream snapshot is structured and type-decoded, and a sparse variable matrix is ​​constructed based on snapshots from multiple scan cycles, thereby realizing the reliable extraction of PLC control variable timing data.

[0065] (2) In the case of source attack, attackers may simultaneously tamper with SCADA logs to cover up traces and make the log data unreliable. To this end, this application uses the memory snapshot collection time as the time anchor point, and performs cross-granularity consistency verification on the sparse variable matrix and the dense log matrix through time window aggregation and standardized deviation calculation, detects the log tampering interval, and implements repair based on the memory snapshot interpolation results.

[0066] (3) The fake data injected by the source attack is compliant in terms of spatial path and protocol format, and existing detection methods will face systemic failure. Therefore, this application implements joint detection from two dimensions: the variable itself and the variables between variables. The Anomaly Transformer model is used to identify deviations in the temporal rhythm of the variables. At the same time, the correlation matrix of the variables is dynamically constructed based on the Pearson correlation coefficient. The deviation of the correlation coefficient from the historical confidence interval is used as the basis to determine the destruction of the process correlation structure between variables. Finally, the accurate perception of the inconsistency of the state caused by the source attack in the time dimension is achieved.

[0067] Existing industrial control system attack detection technologies rely on the core assumption of spatial consistency, which fails to detect semantic tampering under legitimate write paths at the source, and lacks a mechanism to verify the trustworthiness of variable data. The method provided in this application can achieve the following beneficial effects: 1. A variable extraction scheme that combines protocol flow restoration and PLC memory snapshot is proposed. By comparing and matching messages and byte streams, a variable information mapping table is established. The memory snapshot is structured and type-decoded, which solves the problem that the existing overall hash verification scheme cannot identify the semantic boundaries of variables and obtains reliable time-series data with physical process significance. 2. A cross-granularity consistency verification mechanism based on time window aggregation is introduced. The software layer tampering of SCADA logs is detected and interpolated for repair using the memory snapshot time as the anchor point. This avoids the fundamental defect of existing solutions that directly use potentially tampered variable data as detection input. 3. A two-dimensional joint detection mechanism is constructed using the Anomaly Transformer model and Pearson correlation coefficient. Normal baselines are established for the temporal rhythm of the variables themselves and the process correlation structure between variables. The detection is based on the consistency of the temporal dimension rather than the compliance of the spatial path, which realizes the effective detection of legitimate write attacks at the source and makes up for the functional deficiencies of existing methods in such attack scenarios.

[0068] Another aspect of this application embodiment provides a cross-domain attack detection device for industrial control systems based on time consistency, including: The first module is used to obtain time-series data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; The second module is used to parse the memory snapshot based on the time-series data and construct the sparse variable matrix of the memory snapshot; The third module is used to construct a dense variable matrix based on the sparse variable matrix of the memory snapshot, and to determine the log tampering detection information of the industrial control system. The fourth module is used to determine the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix. The fifth module is used to construct a variable correlation matrix based on the dense variable matrix, and then detect the state consistency among various control variables based on the variable correlation matrix. The sixth module is used to jointly determine the detection result of source attack behavior in the industrial control system within the target time interval based on the time sequence correlation information and the state consistency.

[0069] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0070] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned cross-domain attack detection method for industrial control systems based on time consistency. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0071] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0072] Please see Figure 5 , Figure 5 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 501 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 502 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 502 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 502 and is called and executed by the processor 501 to implement the time-consistency-based cross-domain attack detection method for industrial control systems according to the embodiments of this application. The input / output interface 503 is used to implement information input and output; The communication interface 504 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 505 transmits information between various components of the device (e.g., processor 501, memory 502, input / output interface 503, and communication interface 504); The processor 501, memory 502, input / output interface 503, and communication interface 504 are connected to each other within the device via bus 505.

[0073] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for detecting cross-domain attacks in industrial control systems based on time consistency.

[0074] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0075] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0076] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0077] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0078] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0079] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0080] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0081] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0082] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0083] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A time consistency-based detection method for cross-domain attacks in an industrial control system, characterized in that, include: Obtain timing data based on memory snapshots and traffic analysis from the control equipment of the industrial control system; The memory snapshot is parsed based on the time-series data, and a sparse variable matrix of the memory snapshot is constructed. A dense variable matrix is ​​constructed based on the sparse variable matrix of the memory snapshot to determine the log tampering detection information of the industrial control system; Based on the historical time series data of each control variable in the dense variable matrix, determine the time series correlation information of each control variable under normal process conditions; A variable correlation matrix is ​​constructed based on the dense variable matrix, and then the state consistency among various control variables is detected based on the variable correlation matrix. Based on the time-series correlation information and the state consistency, a joint determination is made of the detection result that the industrial control system has source attack behavior within the target time interval.

2. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 1, characterized in that, The acquisition of time-series data based on memory snapshots and traffic analysis from the control equipment of the industrial control system includes: Deploy traffic capture probes at critical communication link nodes in industrial control networks; Data is acquired from the control equipment of the industrial control system, including data written or read from the SCADA system, data written to the braking equipment in the industrial field, and data collected from sensors in the industrial field. When the control device is a PLC device, the step of obtaining time-series data based on memory snapshots and flow analysis from the control device of the industrial control system specifically includes: For the captured protocol messages, semantic parsing is performed according to the message format specifications of different industrial control protocols to restore the industrial control protocol and restore the original byte stream into a complete industrial control protocol application layer message with semantics; Extract the function code, logical register address, and numerical content from the complete industrial control protocol application layer message; Based on a preset acquisition cycle, multiple snapshots of PLC memory byte streams are obtained by periodically scanning the memory of the PLC device.

3. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 2, characterized in that, The step of parsing the memory snapshot based on the time-series data and constructing the sparse variable matrix of the memory snapshot includes: By analyzing the layout of the PLC memory, the mapping relationship between the memory start address and data type length of each control variable is obtained, and a variable information mapping table is established. Based on the variable information mapping table, the memory byte stream snapshots at each time point are structurally segmented to construct a sparse variable matrix with temporal relationships.

4. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 3, characterized in that, The step of structurally segmenting the memory byte stream snapshots at each time point based on the variable information mapping table to construct a sparse variable matrix with temporal relationships includes: For each control variable, starting from the memory start address of the control variable in the memory byte stream, extract multiple consecutive bytes, and perform byte order conversion and type decoding on the multiple bytes according to the data type to obtain the engineering quantity value of each control variable at the target time. The engineering values ​​of multiple control variables in the memory byte stream snapshot at the target time are summarized to obtain the variable value vector at the target time; By arranging the variable value vectors of multiple consecutive snapshot times in chronological order, a sparse variable matrix with temporal relationships is constructed.

5. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 1, characterized in that, The step of constructing a dense variable matrix based on the sparse variable matrix of the memory snapshot to determine the log tampering detection information of the industrial control system includes: The historical log data of high-frequency records is obtained from the SCADA system; the historical log data records the values ​​of each control variable at each acquisition time. Extract the set of identical variables corresponding to the sparse variable matrix from the historical log data, and sort the set of identical variables in chronological order to construct a dense variable matrix; The sparse variable matrix is ​​numerically compared with the dense variable matrix to obtain the log tampering detection information of the industrial control system.

6. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 1, characterized in that, The step of determining the time-series correlation information of each control variable under normal process conditions based on the historical time-series data of each control variable in the dense variable matrix includes: During normal operation, the target model is trained using historical time-series data of each control variable in an initial reliable dense variable matrix, enabling the target model to learn the time-series correlation of each control variable under normal process conditions. Specifically, the target model simultaneously models prior correlation and sequential correlation for each time point, and constructs a symmetric KL divergence between the prior correlation and the sequential correlation. This symmetric KL divergence is used to enhance the distinguishability between normal and abnormal points among the control variables. During the detection phase, the real-time time series of each control variable in the dense variable matrix is ​​used as the input to the target model, and the anomaly score at each time point is output. Then, the control variable that has an anomaly in time series consistency is determined based on the anomaly score.

7. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 1, characterized in that, The step of constructing a variable correlation matrix based on the dense variable matrix, and then detecting the state consistency among various control variables based on the variable correlation matrix, includes: The dense variable matrix is ​​progressively advanced with a sliding window of target length, and the Pearson correlation coefficient is calculated for the value sequences of different control variables within the window. During normal operation, a reference distribution of correlation coefficients is established for each control variable pair based on historical data, and the co-change information between the value sequence of the tampered variable and the process-related variable is determined according to the confidence interval constructed by the Pearson correlation coefficient. During the detection phase, based on the deviation of the Pearson correlation coefficient from the confidence interval, it is determined whether the process correlation structure of the corresponding control variables has become abnormal, and the dynamic detection results of the correlation structure between variables are obtained.

8. The method for detecting cross-domain attacks in industrial control systems based on time consistency according to claim 1, characterized in that, The step of jointly determining the detection result of source attack behavior in the industrial control system within the target time interval based on the time sequence correlation information and the state consistency includes: The time-series consistency detection results of the control variables themselves are jointly analyzed with the dynamic detection results of the correlation structure between variables. If multiple variables have abnormal scores exceeding the threshold in a certain time interval, and the real-time correlation coefficient of the corresponding variable pair also deviates from the reference confidence interval, it is determined that there is a source attack behavior in that time interval. An alarm is output and the set of abnormal variables involved and the attack time interval are recorded.

Images