Method for constructing hydropower station monitoring business scenario industrial control network attack and defense dataset

Abstract

The application discloses a hydropower station monitoring business scenario industrial control network attack and defense dataset construction method, comprising: constructing a simulation test platform of a hydropower station monitoring business scenario; injecting an attack load based on a hydropower station industrial control protocol semantic construction on the simulation test platform, and performing an attack behavior according to a preset multi-stage chain attack process; the preset multi-stage chain attack is a complete attack sequence composed of multiple attack stages which are logically continuous and have a causal relationship; synchronously collecting network flow data, system log data and running state data of a hydropower physical process simulation model of the simulation test platform during and after the attack behavior execution process, obtaining original data records; based on the preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels.

Description

Technical Field

[0001] This invention relates to the field of industrial control network security technology, and in particular to a method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario. Background Technology

[0002] In hydropower station monitoring systems, the industrial control network, as a core component, undertakes the task of real-time monitoring and control of the hydropower generation process. Its security is directly related to the stability of power supply and the reliability of critical infrastructure. In recent years, with the deep integration of industrial control systems and information networks, network attacks targeting hydropower station industrial control networks have become increasingly frequent. These attacks are characterized by specialization, concealment, and persistence, especially multi-stage, chain-like advanced persistent threats (APTs), which pose a serious risk to industrial control systems. Therefore, conducting research on industrial control network attack detection and defense technologies, and constructing high-quality attack datasets for algorithm training and evaluation, has become a crucial step in improving the network security protection capabilities of hydropower stations.

[0003] Currently, there are some publicly available attack datasets in the field of industrial control network security research, such as datasets based on general IT networks or simple industrial control protocols (such as Modbus). These datasets are usually generated by simulating single attack behaviors or using synthetic traffic, and lack deep adaptation to specific industry business scenarios. Hydropower station monitoring has unique industrial control protocols (such as IEC 60870-5-104, DNP3, etc.), dedicated controlled equipment (such as gate controllers, turbine governors), and complex hydropower physical processes. Existing datasets are difficult to truly reflect the semantic logic and physical impact of attacks in hydropower station scenarios.

[0004] Existing dataset construction methods often focus on network traffic collection, neglecting the synchronous acquisition and correlation of multi-source data such as system logs and physical process operation status. This results in a single data dimension, failing to comprehensively depict the performance of attack chains at different system levels. Furthermore, most methods simulate attack behaviors in isolation, neglecting the logical continuity and causal relationships between attack stages. This makes it difficult to reproduce the multi-stage chain attack process of attackers gradually penetrating and moving laterally in the real world, thus limiting the ability of detection models based on such datasets to identify advanced threats.

[0005] Due to the aforementioned limitations, security defense models trained on existing datasets often suffer from high false alarm rates, high false negative rates, or poor adaptability in actual deployments at hydropower stations, and are unable to effectively cope with semantic attacks and complex attack chains targeting business logic. Summary of the Invention

[0006] The purpose of this invention is to provide a method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios. By constructing a test environment for business simulation, injecting multi-stage chain attacks based on industrial control protocol semantics, and simultaneously collecting and labeling multi-source data, a high-quality, scenario-fit attack dataset is constructed. This solves the problem that existing datasets suffer from poor detection model training performance due to isolated attack behaviors, lack of business logic semantics, and single data dimensions.

[0007] To address the aforementioned technical problems, a first aspect of this invention provides a method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring scenario, comprising the following steps: A simulation test platform for monitoring business scenarios of hydropower stations is constructed. The simulation test platform includes at least a simulated monitoring master station, an industrial control network and several key controlled devices, and a controlled simulation model of the physical process of hydropower generation. On the simulation test platform, an attack payload based on the semantic construction of the hydropower station industrial control protocol is injected, and the attack behavior is executed according to the preset multi-stage chain attack process. The preset multi-stage chain attack is a complete attack sequence consisting of multiple attack stages that are logically continuous and have a causal relationship. Simultaneously collect network traffic data, system log data, and operating status data of the simulation test platform during and after the execution of the attack behavior to obtain raw data records; Based on the preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels.

[0008] Furthermore, the injection of an attack payload based on the semantics of the hydropower station industrial control protocol, and the execution of the attack behavior according to a preset multi-stage chain attack process, includes: Based on the communication specifications of the target industrial control protocol, attack payload units with malicious business logic semantics are generated. Multiple attack payload units are arranged according to a preset attack logic to form a multi-stage attack chain with stage dependencies. The multi-stage attack chain is executed on the simulation test platform, wherein the injection parameters of the attack payload are dynamically adapted according to the execution results of the current stage and the previous stage of the multi-stage attack chain. Obtain multi-dimensional response data generated by the simulation test platform during the attack execution process.

[0009] Furthermore, the communication specification based on the target industrial control protocol generates an attack payload unit with malicious business logic semantics, including: Parse the message structure and function code definition of the target industrial control protocol to establish a compliant message generation template; Based on the hydropower station monitoring business logic, obtain the aforementioned key controlled equipment and corresponding safe operation thresholds; The malicious semantic rules corresponding to the key controlled device are mapped to the compliant message generation template to generate a communication message that conforms to the protocol syntax specification but carries the malicious semantic rules, thereby obtaining the attack payload unit and performing protocol syntax compliance verification.

[0010] Furthermore, the step of arranging multiple attack payload units according to preset attack logic to form a multi-stage attack chain with stage dependencies includes: Based on the multiple consecutive attack stages included in the multi-stage attack chain, at least one attack payload unit is allocated to each attack stage. Based on the preset attack logic, establish the dependency relationship between different attack stages; Based on the aforementioned dependencies, the triggering conditions and execution parameters of the corresponding attack payload unit are configured for each attack phase. Based on the attack phase, the allocated attack payload unit, the dependencies, and the triggering conditions, an attack chain description file that can be parsed and executed by the attack injection engine is generated.

[0011] Furthermore, the injection parameters of the attack payload are dynamically adapted based on the execution results of the current stage and the previous stage of the multi-stage attack chain, including: Obtain the execution result of the previous attack stage in the multi-stage attack chain, the execution result including successfully obtained access permissions for industrial control equipment or identified network topology information; Based on the execution result, the runtime context of the multi-stage attack chain is updated. The runtime context is used to characterize the currently accessible set of industrial control devices and the known system state. Based on the updated runtime context and the target of the current stage, the target device address, protocol function code, and payload content parameters of the attack payload to be injected are dynamically parsed and determined. The parameters determined by the analysis are adapted to the corresponding attack payload unit and injected into the simulation test platform.

[0012] Furthermore, based on the preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels, including: The network traffic data, system log data, and operating status data in the original data records are time-series aligned and correlated based on the reference time. The attack chain description file corresponding to the preset multi-stage chain attack process is parsed to obtain the start timestamp, end timestamp and corresponding attack type identifier of each attack stage. Based on the start and end timestamps of the attack phase, the network traffic data, system log data, and running status data within the corresponding time period are tagged with the corresponding attack phase labels on the time-aligned original data records. The attack type identifier associated with the attack stage label is assigned as an attack type label to the corresponding data record; The attack dataset is generated by integrating all data records with attack stage and attack type labels.

[0013] Further, the step of parsing the attack chain description file corresponding to the preset multi-stage chain attack process to obtain the start timestamp, end timestamp, and corresponding attack type identifier of each attack stage includes: Identify several attack stages and their configuration information in the attack chain description file; Preset time plan information is extracted from the configuration information of each attack phase. The preset time plan information includes a start time and an end time defined based on absolute time or relative time to the attack chain start time. Based on the time plan information, calculate the start and end timestamps of each attack phase when the multi-stage attack chain is actually executed. Based on the configuration information of each attack stage, an attack type identifier representing the attack technique attributes is obtained through parsing. The logic performs consistency verification on the start timestamp, the end timestamp, and the attack type identifier.

[0014] Furthermore, the attack type identifier includes an attack technique tag and a business function impact tag; The parsing yields attack type identifiers that characterize the attack technique attributes, including: Based on the attack stage configuration information in the attack chain description file, the classification identifier defined according to the preset attack technology classification system is extracted as the attack technology label. Based on the key controlled equipment targeted in the attack phase, and combined with the functions of the key controlled equipment in the hydropower station monitoring business, the affected function category identifiers are used as business function impact labels. The attack technique tag and the business function impact tag are associated with the corresponding attack stage.

[0015] Furthermore, after associating the attack technique tag with the business function impact tag to the corresponding attack stage, the method further includes: Obtain information on proactive defense measures triggered by the simulation testing platform during the execution of the attack, and tag the data records within the corresponding time period with defense measures. Using attack events as an index, the tagged network traffic data, system log data, operational status data, and defense measure tags are associated to generate a defense dataset.

[0016] Furthermore, before synchronously collecting network traffic data, system log data, and operational status data of the simulation test platform during and after the execution of the attack, the method further includes: Configure a high-precision time synchronization protocol for all data acquisition nodes in the simulation test platform to establish a reference time; When collecting data, the precise timestamp of each network traffic data, system log data, and operating status data is obtained based on the reference time.

[0017] Accordingly, a second aspect of the present invention provides a device for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario, comprising: The platform construction module is used to build a simulation test platform for hydropower station monitoring business scenarios. The simulation test platform includes at least a simulated monitoring master station, an industrial control network and several key controlled devices, and a controlled simulation model of the hydropower generation physical process. An attack execution module is used to inject an attack payload based on the semantics of the hydropower station industrial control protocol into the simulation test platform and execute the attack behavior according to a preset multi-stage chain attack process. The preset multi-stage chain attack is a complete attack sequence consisting of multiple attack stages that are logically continuous and have a causal relationship. The data acquisition module is used to synchronously collect network traffic data, system log data, and operating status data of the simulation test platform during and after the execution of the attack behavior, so as to obtain raw data records. The dataset generation module is used to annotate the original data records based on the preset multi-stage chain attack process to obtain an attack dataset with attack stage labels and attack type labels.

[0018] Accordingly, a third aspect of the present invention provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute the above-described method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario.

[0019] Accordingly, a fourth aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario.

[0020] The above-described technical solutions of the embodiments of the present invention have the following beneficial technical effects: 1. By constructing a highly realistic simulation test platform for hydropower station monitoring operations, and orchestrating and executing multi-stage chain attacks based on protocol semantics and with stage dependencies on this platform, we have achieved accurate reproduction of advanced persistent threat (APT) attack chains in the real world. This solves the problem that traditional datasets cannot effectively simulate the real tactical intentions of attackers' gradual infiltration and lateral movement due to the single attack scenario and isolated attack behavior. It provides a crucial data foundation for training and testing next-generation security models capable of detecting complex and chain attacks. 2. By parsing the semantics of the target industrial control protocol, a compliant yet malicious attack payload is constructed. The injection parameters for the next stage can be dynamically adapted based on the execution results of the previous attack stage (such as the permissions obtained and the topology discovered), achieving a high degree of adaptability between the attack behavior and the business environment context. This solves the problems of rigidity and disconnection from the target system state in previous attack injection methods, thereby generating more covert and targeted attack traffic. This enables the defense model trained on this dataset to more effectively identify precise attacks based on semantic understanding and contextual changes. 3. Through a high-precision time synchronization protocol, the synchronous collection and time-series alignment of multi-dimensional data such as network traffic, system logs, and physical process operation status were achieved. Based on the attack chain description file, the data was labeled with precise tags down to the attack stage (including attack technology tags and business function impact tags). This solved the problems of existing datasets having single data dimensions, coarse labeling granularity, and lack of attack tactical background information. It provides unprecedented refined data support for studying the chain reaction of attack behavior at different system levels (network, host, physical process), developing detection algorithms based on multi-source information fusion, and assessing the actual impact of attacks on business functions. Attached Figure Description

[0021] Figure 1 This is a flowchart of the method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario, provided in an embodiment of the present invention. Figure 2 This is a block diagram of the data set construction device for industrial control network attacks and defenses in hydropower station monitoring business scenarios provided in this embodiment of the invention.

[0022] Figure label: 1. Platform building module; 2. Attack execution module; 3. Data acquisition module; 4. Data set generation module. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0024] Please refer to Figure 1 The first aspect of this invention provides a method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario, comprising the following steps: Step S100: Construct a simulation test platform for the monitoring business scenario of a hydropower station. The simulation test platform shall include at least a simulated monitoring master station, an industrial control network and several key controlled devices, and a simulation model of the controlled hydropower physical process.

[0025] The simulation test platform is not simply an interconnection of network devices, but a closed-loop simulation system that deeply integrates information space and physical processes. It can accurately simulate the actual operating environment of the hydropower station's production control area. Specifically, it includes three key components: a simulated monitoring master station, a real industrial control network and key controlled equipment, and a high-fidelity simulation model of the hydropower generation physical process.

[0026] The monitoring master station typically deploys software with standard Supervisory Control and Data Acquisition (SCADA) capabilities, such as an HMI / SCADA system based on commonly used hydropower station protocols like IEC60870-5-104 or DNP3, to achieve visualized monitoring and control command issuance for the entire simulation system. The industrial control network is built according to a typical hydropower station layered structure (e.g., field control layer, process monitoring layer). Network devices may include industrial switches, routers, and firewalls, connecting several key controlled devices, such as programmable logic controllers (PLCs), remote terminal units (RTUs), or intelligent electronic devices (IEDs). These controlled devices need to load realistic control logic programs to execute control of the physical processes. The hydropower physical process simulation model is the platform's distinctive feature and core. Through high-precision mathematical models (such as equations based on fluid mechanics and rotor dynamics), it simulates in real-time changes in key physical parameters such as water intake pipeline pressure, turbine speed, generator power, and guide vane opening, forming a closed-loop interaction with the output commands of controllers such as PLCs, thus realistically reproducing the complete chain from control commands to changes in physical state.

[0027] Step S200: On the simulation test platform, an attack payload based on the semantic construction of the hydropower station industrial control protocol is injected, and the attack behavior is executed according to the preset multi-stage chain attack process. The preset multi-stage chain attack is a complete attack sequence consisting of multiple attack stages that are logically continuous and have a causal relationship.

[0028] Executing the attack on the established simulation test platform is the core step. The key lies in the attack's construction method and execution logic, emphasizing its realism and complexity, distinguishing it from random, isolated attack injections. In practice, the attack payload must first be constructed based on the communication specifications of the target industrial control protocol (such as IEC 60870-5-104). This requires in-depth analysis of the protocol's message structure, function code definitions (such as single-point remote control, two-point remote signaling, normalized measurement values), and data unit identifiers (such as information object addresses) to generate syntactically compliant but semantically malicious communication messages. For example, the attack payload might be a message conforming to the IEC 60870-5-104 protocol ASDU format, but its function code has been tampered with to perform illegal operations, or the information object address points to a critical protection device, and the data value has been set to a malicious instruction exceeding the safe operating threshold.

[0029] The attack follows a pre-defined multi-stage chain attack process. This means the attack is not a single action, but a complete sequence of logically continuous and causally related stages. A typical attack chain might include: the first stage involves network reconnaissance and vulnerability scanning to discover vulnerable nodes in the industrial control network; the second stage uses discovered vulnerabilities to gain access to a specific PLC; the third stage, based on the gained access, tampers with the PLC's control logic or issues malicious control commands; and the fourth stage may attempt lateral movement to attack more critical controllers in the network. The initiation of each subsequent stage depends on the successful execution of the previous stage. For example, lateral movement can only proceed if access to the first PLC is successfully gained, using it as a starting point. This orchestration method can highly simulate the attack patterns of Advanced Persistent Threats (APTs).

[0030] Step S300: Simultaneously collect network traffic data, system log data, and operating status data of the simulation test platform during and after the execution of the attack behavior to obtain raw data records.

[0031] Throughout the entire execution of the attack, data from multiple levels of the simulation testing platform is collected simultaneously to capture traces and impacts of the attack across different dimensions. The data sources collected mainly include three categories: network traffic data, system log data, and operational status data from the simulation model of hydropower physical processes.

[0032] Network traffic data is captured at key network nodes (such as between the monitoring master station and the controller network, or between different control areas) via port mirroring or network splitters, recording the complete content, timestamp, source / destination IP address, and port of all industrial control protocol messages (such as 104 protocol messages). System log data is collected from the system logs of the monitoring master station server, workstation operating systems, and key controlled devices such as PLCs and RTUs, including user login records, process creation and termination, error reports, and configuration changes. The operational status data of the hydropower physical process simulation model records the values ​​of its key internal variables in real time, such as the changes in head, flow rate, generator active / reactive power, voltage, and frequency over time. To achieve accurate correlation between these three types of data, a high-precision time synchronization protocol (such as the PTP protocol) must be configured for all data acquisition nodes before collection, establishing a unified reference time to ensure that each data record has a traceable timestamp with microsecond or millisecond precision.

[0033] Step S400: Based on the preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels.

[0034] The raw data records are unlabeled and unstructured, and must be precisely labeled to be transformed into attack datasets that can be used for supervised learning or algorithm evaluation. The labeling work is strictly based on the multi-stage chain attack process preset in step S200.

[0035] First, the "attack chain description file" (which may be in XML or JSON format) defining the attack flow needs to be parsed to obtain the precise start and end timestamps of each attack phase, as well as the attack technique type identifier used in that phase. Then, using this timestamp information, the raw data records collected in step S300 and aligned chronologically are segmented and labeled. For example, if the attack chain description file indicates that the "privilege escalation" phase begins at time T1 and ends at time T2, then all network traffic captured within this time window, generated system logs, and physical process model status data will be labeled with the "privilege escalation" attack phase tag. Simultaneously, based on the attack technique type identifier (such as "command injection" or "register tampering"), the data for the corresponding time period is tagged with the attack type. Furthermore, the attack type identifier can be refined into attack technique tags (following classification frameworks such as MITRE ATT&CK for ICS) and business function impact tags (such as "affecting power generation regulation" or "endangering equipment mechanical safety"), thereby enriching the semantic information of the data from both technical and business dimensions.

[0036] The attack dataset generated using the above construction method possesses high levels of scenario realism, attack complexity, and data multidimensionality. It not only includes realistic hydropower station industrial control network traffic but also synchronously correlates system logs and physical process state changes, providing fine-grained annotations based on attack chain stages. This makes the dataset extremely effective for training and validating advanced industrial control network intrusion detection and security protection algorithms that require understanding attack context, detecting multi-stage coordinated attacks, and assessing the ultimate impact of attacks on physical systems. It significantly outperforms traditional datasets built based on isolated attacks and single-dimensional traffic data.

[0037] Furthermore, in step S200, the injected attack payload is constructed based on the semantics of the hydropower station's industrial control protocol, and the attack behavior is executed according to a preset multi-stage chain attack process, including: Step S210: Based on the communication specifications of the target industrial control protocol, generate an attack payload unit with malicious business logic semantics.

[0038] Generating attack payload units ensures that the payload strictly adheres to the target industrial control protocol syntax while embedding malicious semantics capable of disrupting normal business logic. In practice, this requires a thorough understanding of the target industrial control protocol's format and semantics (e.g., the IEC 60870-5-104 protocol widely used in hydropower stations). This includes a precise understanding of the structure of its Application Service Data Units (ASDUs), such as the definitions and usage of fields like Type Identifier (TI), Variable Structure Qualifier (VSQ), Transmission Reason (COT), Common Address (COA), and Information Object Address (IOA). Simultaneously, the meaning of various function codes must be mastered, such as process commands (C_SC_NA_1 for single-point remote control), setpoint commands (C_SE_NA_1 for normalizing setpoints), and measurement transmissions (M_ME_NA_1 for normalizing measurements).

[0039] Based on this, malicious semantics need to be defined in conjunction with the actual monitoring business logic of the hydropower station. For example, the normal operating parameters and safe operating thresholds of key controlled equipment (such as PLCs used to control guide vane opening and RTUs used to monitor reservoir water levels or unit vibration) need to be analyzed. Malicious semantic rules are designed for these devices and parameters, and may include sending a speed setpoint far exceeding the safety limit to the turbine governor PLC, or sending an illegal "emergency shutdown" command to the gate control RTU. Subsequently, these malicious rules are mapped to the previously established compliant message generation template. For example, an ASDU of type C_SE_NA_1 is constructed, whose information object address points to the turbine speed setpoint register, while the actual normalized value is deliberately set to correspond to a dangerously high speed. Before injection, the generated attack payload unit must be verified by a protocol conformance verification tool or script to ensure that its message structure and field value range fully comply with the 104 protocol standard, thereby bypassing the primary security protection mechanism based on protocol syntax checking.

[0040] Step S220: Arrange multiple attack payload units according to preset attack logic to form a multi-stage attack chain with stage dependencies.

[0041] A single attack payload unit can typically only perform one specific attack action, while real advanced threats usually consist of a series of ordered actions. Multiple independent attack payload units can be organically arranged according to a pre-defined attack tactical logic to form a multi-stage attack chain with inter-stage dependencies.

[0042] First, the attack flow needs to be broken down based on a complete attack script. This script defines multiple consecutive attack phases, such as initial intrusion, privilege escalation, lateral movement, asset discovery, and final attack execution. One or more attack payload units that best achieve the objectives of each phase are assigned to each phase. For example, in the "initial intrusion" phase, a malicious code execution payload exploiting a vulnerability in the engineering software might be assigned; in the "final attack execution" phase, the malicious speed setting value payload generated in step S210 would be assigned.

[0043] Secondly, the key lies in establishing logical dependencies between different attack phases. These dependencies typically manifest as follows: the execution of a subsequent phase depends on the successful completion of the previous phase. For example, the "lateral movement" phase requires that the "privilege escalation" phase has successfully acquired sufficient privileges at the initial foothold; the "final attack execution" phase requires that the "asset discovery" phase has successfully located the target controller. During orchestration, each attack phase needs to be configured with explicit trigger conditions and execution parameters. Trigger conditions may include time delays, receiving specific network response packets, or detecting a specific state change in the target system. Execution parameters may include the target device's IP address, protocol port, etc. These parameters can be preset static values ​​during orchestration or set as variables that are dynamically resolved at runtime based on the context.

[0044] Ultimately, all this information (attack phase sequence, payload unit allocation, dependencies, triggering conditions, parameter configuration) is integrated into a structured attack chain description file (such as in JSON or YAML format), which can be accurately parsed and executed by subsequent attack injection engines.

[0045] Step S230: Execute a multi-stage attack chain on a simulation test platform, wherein the injection parameters of the attack payload are dynamically adapted according to the execution results of the current stage and the previous stage of the multi-stage attack chain.

[0046] The execution of the attack chain is not simply a sequential playback of preset payloads, but an intelligent process that dynamically adjusts based on the attack's progress. The injection parameters for the attack payload need to be dynamically adapted based on the current stage's objective and the actual execution results of the previous stage in the multi-stage attack chain, simulating the attacker's decision-making and adjustment capabilities in a real-world environment. After initiating the attack chain, the attack injection engine continuously monitors the execution results of each stage. These results constitute the attack's "runtime context," which may include a list of successfully compromised device IP addresses, network topology information stolen from these devices, acquired user credentials, and other identified high-value targets.

[0047] When the attack chain needs to transition from one stage to the next, the injection engine dynamically parses and determines the specific parameters of the attack payload to be injected based on the updated runtime context. For example, in the "lateral movement" stage, the engine uses the network topology information obtained in the "privilege escalation" stage to dynamically select the IP address of the next adjacent device to be attacked as the target. As another example, in the "final attack execution" stage, if the attack target is to modify the settings of a PLC, the engine needs to parse the exact protocol address of the PLC (such as the Information Object Address (IOA) in the 104 protocol) and the currently available communication session parameters from the context. This dynamic adaptation mechanism allows the attack chain to adapt to different network environments, improving the success rate and stealth of the attack, and avoiding the problems of attack failure or easy detection by static rules due to the use of fixed parameters.

[0048] Step S240: Obtain multi-dimensional response data generated by the simulation test platform during the attack execution process.

[0049] The ultimate goal of executing an attack is not to destroy the system, but to observe and record the system's response when attacked, thereby generating data for analysis. Therefore, throughout the entire attack chain, multi-dimensional response data generated by the simulation test platform must be acquired synchronously. This data serves as the raw material for subsequently constructing the dataset, characterizing the impact of the attack on the system from different dimensions. The dimensions of the acquired data correspond to the data types collected in step S300, but this step focuses more on capturing this data in real-time and in a targeted manner during attack execution.

[0050] Specifically, it is necessary to continuously capture all industrial control protocol traffic flowing through key network nodes. This includes malicious packets sent by the attack injection engine, normal interaction packets between the monitoring master station and the controlled devices, and abnormal communication traffic that may be generated after being affected by the attack. Simultaneously, it is necessary to record system logs generated by various components on the simulation test platform (such as the monitoring master station server, HMI workstation, PLC, etc.). These logs may record security events such as permission changes, abnormal logins, process anomalies, and configuration modifications. Crucially, it is also necessary to synchronously record the operational status data of the hydropower physical process simulation model, such as the real-time change curves of key physical quantities like generator active power, grid frequency, turbine speed, and guide vane opening. By precisely aligning the attack execution timeline with the time-series records of this multi-dimensional data, the complete causal chain of how a network attack gradually penetrates the industrial control network and ultimately triggers anomalies or failures in the physical process can be clearly observed.

[0051] Based on the above steps, this invention can generate highly realistic and complex industrial control network attack traffic. First, the payload constructed based on protocol semantics ensures the effectiveness of the attack at the business logic level; second, the multi-stage chained orchestration simulates the tactics, techniques, and processes (TTPs) of advanced threats, making the attack scenario more coherent and in-depth; finally, the dynamic adaptation of attack parameters and the synchronous acquisition of multi-dimensional response data jointly ensure that the generated dataset can accurately reflect the dynamic interaction between attack behavior and system response, providing an indispensable high-quality data foundation for training and evaluating next-generation industrial control network security protection models capable of detecting complex, multi-stage attack chains.

[0052] Furthermore, in step S210, based on the communication specifications of the target industrial control protocol, an attack payload unit with malicious business logic semantics is generated, including: Step S211: Parse the message structure and function code definition of the target industrial control protocol and establish a compliant message generation template.

[0053] Parsing the message structure and function code definitions of the target industrial control protocol is fundamental to generating compliant attack payloads. This requires decoding the selected industrial control protocol layer by layer to achieve a precise digital description of the protocol specifications. Taking the IEC 60870-5-104 protocol, commonly used in hydropower station monitoring, as an example, the parsing work needs to be carried out at multiple levels, including the link layer and application layer. At the application layer, the focus is on the composition of its Application Service Data Unit (ASDU). This includes accurately defining the number of bits, value range, and encoding method for each field. For example: a single-byte Type Identification (TI) to distinguish message types (such as telemetry, tele-signaling, remote control, point setting, etc.); a single-byte Variable Structure Qualifier (VSQ) to indicate the number of subsequent information objects and addressing mode; a single-byte or double-byte Cause of Transmission (COT) to explain the reason for message generation (such as periodic call, burst, activation, activation confirmation, etc.); a two-byte Common Address of ASDU (COA), which usually represents the station address; and a two-byte or three-byte Information Object Address (IOA) to uniquely identify a specific tele-signaling point or telemetry point. Simultaneously, all function codes supported by the protocol and their specific semantics under a specific type identifier must be listed in detail. For example, a message with type identifier 45 (C_SC_NA_1, single-point remote control) has its function embodied in a one-byte remote control operation instruction (such as closing, opening, and their selection, execution, etc.) in the information object data section.

[0054] Based on this in-depth analysis, a structured compliant message generation template can be established. At the software level, this template can be a data structure or configuration file containing all required fields and their constraints (such as data type, length, and valid value range). For example, a template instance can be created for each common ASDU type of the 104 protocol (such as C_SC_NA_1, C_SE_NA_1, M_ME_NA_1, etc.). The template ensures that any message generated based on it fully conforms to the national standards or international specifications of the 104 protocol in terms of syntax. This is a prerequisite for successful payload injection and interaction with the target device, preventing messages from being discarded by the underlying communication stack or causing communication interruptions due to incorrect message format.

[0055] Step S212: Based on the hydropower station monitoring business logic, obtain several key controlled devices and their corresponding safe operation thresholds.

[0056] Identifying key controlled equipment and their safe operating thresholds based on the hydropower station's monitoring business logic is a core step in providing target guidance and destructive basis for injecting malicious semantics into attack payloads. This step requires a deep understanding of the control logic and safety constraints of the hydropower station's production process. Key controlled equipment refers to field controllers that, if maliciously manipulated, could directly lead to abnormal power generation, equipment damage, or even safety accidents. These mainly include programmable logic controllers (PLCs), remote terminal units (RTUs), and intelligent electronic devices (IEDs) with control logic installed. Specifically, in a hydropower station scenario, these devices may include governor PLCs that control the turbine guide vane opening, excitation system PLCs that control generator excitation, gate control RTUs that control intake or tailrace gates, and various protection devices (IEDs) used for relay protection.

[0057] Safe operating thresholds refer to the upper and lower limits, or normal operating ranges, of the physical parameters monitored or controlled by these controlled devices. These thresholds are typically derived from the equipment manufacturer's technical specifications, the power plant's operating procedures, and the power system's safety and stability standards. For example, for hydroelectric generator sets, key safe operating thresholds include: the maximum permissible speed of the turbine (to prevent runaway), the maximum permissible temperature of the generator windings and core (to prevent overheating damage), the upper and lower limits of the generator set's active and reactive power (to ensure grid stability), and the unit's vibration amplitude threshold (to prevent mechanical damage). Methods for obtaining this information include analyzing the control system's design documents, configuration logic diagrams, alarm setpoint lists on the human-machine interface (HMI), and interviewing domain experts. Establishing a list containing fields such as "equipment identifier (e.g., PLC_1_governor)," "controlled physical quantity (e.g., unit speed)," "safety upper limit (e.g., 115% of rated speed)," and "safety lower limit (e.g., 85% of rated speed)" is the foundation for subsequent malicious rule design.

[0058] Step S213: Map the corresponding malicious semantic rules of the key controlled device to the compliant message generation template, generate a communication message that conforms to the protocol syntax specification but carries malicious semantic rules, obtain the attack payload unit, and perform protocol syntax compliance verification.

[0059] The business logic threat identified in step S212 (i.e., malicious manipulation of specific device parameters) is transformed into a compliant protocol message that can be transmitted over the network and parsed and executed by the target device. Malicious semantic rules define the specific content of the attack, such as: "Send a setpoint to the speed controller PLC (address 10.1.1.10) to set the turbine speed target value to 130% of the rated speed, exceeding the safety limit." The rule includes the target device identifier, controlled parameters, and malicious value.

[0060] The mapping process involves filling the elements from these rules into the corresponding fields of the message template established in step S211. Continuing with the 104 protocol and the above rules as an example: First, select the message template with type identifier C_SE_NA_1 (normalized setpoint command, type identifier is usually 50). Then, fill in the fields: The Common Address (COA) field is filled with the station address corresponding to the target speed controller PLC (e.g., 1). The Information Object Address (IOA) field is filled with the specific register address of the PLC that stores the speed setpoint (e.g., 40010 obtained through configuration analysis). The Transmission Reason (COT) field is usually set to Activation (e.g., 3). The most crucial part is the Information Object Data section, i.e., the setpoint itself. The physical quantity value "130% rated speed" needs to be converted into a normalized short floating-point number or integer format according to the protocol specification and filled into the corresponding position in the template. Ultimately, a complete and syntactically correct 104 protocol ASDU message is generated. This message appears as a legitimate setting command to the receiving end (speed controller PLC), but the data it carries instructs the device to perform a dangerous operation. After the payload unit is generated, protocol syntax compliance verification must be performed. This can be done using dedicated protocol analysis tools, custom message verification scripts, or during test communications with real devices / emulators to ensure the message is free of structural errors, can successfully penetrate the protocol stack, and can be parsed by the target, thus guaranteeing the effectiveness of the attack.

[0061] The above implementation method can generate attack payload units that strictly adhere to the target industrial control protocol syntax specifications and accurately carry malicious semantics targeting the critical business logic of hydropower stations. This method effectively overcomes the problems often encountered in traditional attack simulations, such as message format errors and semantic inconsistencies leading to ineffective attacks or easy detection by simple rules. It lays a solid and reliable foundation for subsequently constructing highly realistic multi-stage chain attack scenarios that can effectively test the depth of security protection mechanisms.

[0062] Furthermore, step S220, which involves arranging multiple attack payload units according to preset attack logic to form a multi-stage attack chain with stage dependencies, includes: Step S221: Based on the multiple consecutive attack stages contained in the multi-stage attack chain, allocate at least one attack payload unit for each attack stage.

[0063] A complete multi-stage attack chain typically consists of multiple logically consecutive attack phases with clearly defined objectives. A typical multi-stage attack chain targeting a hydropower station's industrial control network may include, but is not limited to, the following phases: initial reconnaissance scanning, exploiting vulnerabilities to gain initial privileges, lateral movement within the network, discovery of industrial control assets and network topology, privilege maintenance, and final attack execution (such as data tampering or functional destruction). Each phase requires a specific attack payload unit to achieve its tactical objective. For example, in the "initial reconnaissance scanning" phase, the assigned payload unit might be a port scanning script based on ICMP or TCPSYN, or a service probe message targeting industrial control protocols (such as the 104 protocol), with the aim of discovering online hosts and open ports in the network. In the "exploiting vulnerabilities to gain initial privileges" phase, the payload unit might be exploit code targeting a specific PLC firmware vulnerability or SCADA software vulnerability, used to establish an initial foothold on the target system. In the final "attack execution" phase, the payload unit is the compliance protocol message generated in step S210, containing malicious business logic semantics, such as a 104 protocol message sending a malicious setting value to the speed controller PLC. The allocation is based on the principle that the function of the payload unit must be highly matched with the target of the attack phase, ensuring that each phase has effective technical means to advance the attack chain.

[0064] Step S222: Based on the preset attack logic, establish the dependency relationship between different attack stages.

[0065] Establishing dependencies between different attack phases is crucial for ensuring a logically sound attack chain and simulating the behavior of real Advanced Persistent Threats (APTs). These dependencies define the execution order and logical conditions between phases, transforming the attack chain from an isolated collection of actions into an organic whole. The dependencies are primarily manifested in the fact that the initiation of subsequent phases depends on the successful completion of one or more preceding phases. For example, the "lateral movement" phase inevitably depends on the success of the "exploitation to gain initial privileges" phase, because only after gaining privileges on one device can one use it as a springboard to move to other devices. Similarly, the "final attack execution" phase typically heavily relies on the results of the "ICS and network topology discovery" phase, as attackers need to accurately know the target controller's IP address, protocol type, and specific control parameter addresses (such as IOA) to launch a precise attack.

[0066] The pre-defined attack logic specifies these dependencies in detail. Technically, these relationships can be represented as a directed acyclic graph (DAG) or simple sequential logic and conditional judgments. For example, it can be defined that phase B can only begin after phase A's execution status is marked as "successful." More complex dependencies might include: phase C requiring both phases A and B to succeed, or phase D being able to choose different execution paths under different conditions, such as phase A's success or phase B's failure. This establishment of dependencies forces the attack injection engine to consider the attack context and progress at runtime, simulating the decision-making process of a real attacker adjusting subsequent strategies based on previous results, greatly enhancing the realism and complexity of the attack scenario.

[0067] Step S223: Based on the dependency relationship, configure the triggering conditions and execution parameters of the corresponding attack payload unit for each attack stage.

[0068] After clarifying the stage dependencies, it is necessary to configure the specific triggering conditions and execution parameters of the corresponding attack payload unit for each attack stage. This is the core link in transforming the static attack flow into a dynamic, executable attack chain. The triggering conditions specify when and under what circumstances the attack stage is activated. They are usually based on the execution results and system state of its preceding stages. Common triggering conditions include: time delay (such as waiting for a specific time after the preceding stage ends before execution), receiving a specific network response (such as receiving a response indicating that the target port is open), detecting a specific state change in the target system (such as the startup of a process), or most directly, the preceding stage being marked as "successful" or "completed".

[0069] Execution parameters define the specific values ​​required by the attack payload unit during injection, enabling the payload to adapt to dynamically changing attack environments. Based on dependencies, many execution parameters are no longer pre-written static values ​​but rather variables that need to be dynamically assigned based on the output of the preceding stages. For example, in the "lateral movement" stage, the key parameter of the target IP address often needs to be dynamically obtained from the list of online hosts output in the "initial reconnaissance scan" stage. Similarly, in the "final attack execution" stage, the Information Object Address (IOA) in the attack payload (such as a malicious 104 protocol message) may need to be retrieved from the PLC location table obtained in the "ICP asset discovery" stage. The configuration process specifies the data source for the parameters of each payload unit; this could be a constant, a predefined list read from a configuration file, or a variable reference pointing to a specific output of the preceding stage. This mechanism ensures that the attack chain can flexibly adapt to different target network environments.

[0070] Step S224: Based on the attack stage, allocated attack payload units, dependencies, and triggering conditions, generate an attack chain description file that can be parsed and executed by the attack injection engine.

[0071] Generating the attack chain description file is the final step in persisting and structuring all the aforementioned orchestration results (attack phases, payload unit allocation, dependencies, triggering conditions, and execution parameters). This file is the "operation script" that the attack injection engine can parse and execute. This description file is typically defined using a machine-readable structured data format, such as JSON, YAML, or XML. The file content clearly defines the metadata of the entire attack chain, such as name, description, and version. At its core is an ordered list of phases, with each item in the list describing a specific attack phase in detail.

[0072] A specific stage description typically includes the following key fields: a unique stage identifier (ID), a stage name (e.g., "Reconnaissance"), the identifier or path of one or more assigned attack payload units, the triggering conditions for that stage (represented as logical expressions or scripts), and a list of execution parameters required by the stage payload units (indicating whether each parameter is a static value or a dynamic variable, and the source of the dynamic variable's value, e.g., source_stage_id: "Stage1", output_field: "target_ip"). The file also explicitly defines the IDs of the preceding stages that the stage depends on through fields such as depends_on. During runtime, the attack injection engine loads and parses this description file, scheduling and executing each attack stage sequentially according to the logical order and conditions defined in the file. It also dynamically resolves data transfer issues between stages based on dependencies and parameter configurations, thereby automating the simulation of the entire multi-stage attack chain.

[0073] Furthermore, the injection parameters of the attack payload in step S230 are dynamically adapted based on the execution results of the current stage and the previous stage of the multi-stage attack chain, including: Step S231: Obtain the execution result of the previous attack stage in the multi-stage attack chain. The execution result includes successfully obtained access permissions for industrial control devices or identified network topology information.

[0074] When executing a multi-stage attack chain, the attack injection engine does not simply follow a predetermined order. Instead, it continuously monitors and acquires the output of each stage. These results serve as the basis for intelligent adjustments and continuous advancement of the attack chain. Specifically, the content and form of the results depend on the objective of the previous stage. For example, if the previous stage was "network reconnaissance scanning," the result might be a structured list containing the IP addresses of online devices discovered in the network, open port numbers, and operating system or service version information inferred through fingerprinting. If the previous stage was "exploiting vulnerabilities to gain privileges," a successful execution might include the IP address of the compromised device, the access privilege level obtained on that device (such as ordinary user privileges, root / administrator privileges), and the identifier of the established backdoor connection session or the obtained valid authentication credentials (such as username and password, API keys, etc.). If the previous stage was "industrial control system asset discovery," the results might be more specific, such as the device models and firmware versions of PLCs and RTUs in the industrial control network obtained through passive listening or active querying, as well as a table of key control points (such as the Information Object Address (IOA) list and its meaning in the IEC 104 protocol). These results are typically output to a specified log file or memory data structure in a predefined format by the attack payload unit after execution, for the core scheduling module of the attack injection engine to read and parse.

[0075] Step S232: Based on the execution result, update the runtime context of the multi-stage attack chain. The runtime context is used to characterize the set of currently accessible industrial control devices and the known system states.

[0076] The runtime context is updated based on the acquired execution results, providing continuous and shared situational awareness for the attack chain. The runtime context can be understood as a globally maintained state database or knowledge base during the execution of the attack chain, summarizing all key information about the target system accumulated from the start of the attack to the present. When a new attack phase completes and produces results, the engine does not discard this information but integrates it into the runtime context. Update operations include adding new information and correcting existing information. For example, when the "network reconnaissance scan" phase discovers a new IP address (such as 10.1.1.20), the engine adds it to the "identified device list" in the runtime context. When the "exploitation" phase successfully compromises the PLC with IP address 10.1.1.10, the engine updates the device's status in the context, marking it as "compromised," and recording the acquired privilege level and access method. If a subsequent "lateral movement" phase uses 10.1.1.10 as a springboard to compromise 10.1.1.20, the device list and status in the context will be updated again. Furthermore, the context may also include information such as network topology diagrams (connections between devices), known credential bases, and identified network services. This ever-expanding context enables the attack chain to make decisions in subsequent stages based on the most comprehensive understanding of the system, simulating the process by which a real attacker gradually accumulates knowledge and expands their gains.

[0077] Step S233: Based on the updated runtime context and the target of the current stage, dynamically parse and determine the target device address, protocol function code, and payload content parameters of the attack payload to be injected.

[0078] When the attack injection engine's scheduler prepares to execute the next attack phase (e.g., phase N), it first refers to the dependencies defined for that phase in the attack chain description file to confirm that its preceding phases have been successfully completed. Then, the engine combines the preset goal of the current phase N (e.g., "send malicious setpoints to the turbine governor PLC") and the latest runtime context to parse and calculate the specific parameters required to execute the payload unit of this phase. These parameters typically include the target device address, protocol function code, and payload content parameters. The determination of the target device address may rely on the "list of identified devices" and "device functional roles" information in the context; for example, its IP address can be obtained by searching for a device labeled "governor PLC." The protocol function code is usually determined by the attack payload unit itself and the phase goal, but sometimes it may need to be selected from the context based on the target device's protocol support.

[0079] The most crucial aspect is the dynamic parsing of payload content parameters. For example, the payload of stage N is a setpoint command (C_SE_NA_1) according to the IEC 104 protocol. Its Information Object Address (IOA) parameter cannot be hard-coded but needs to be obtained from the runtime context. The engine might execute a query logic, such as: "In the 'infiltrated' device, find the 'speed controller PLC' and obtain the IOA address (e.g., 40010) corresponding to the 'speed setpoint' from its 'point table'." Similarly, the malicious value to be set (e.g., 130% of rated speed) may need to be calculated based on security threshold information in the context. This dynamic parsing mechanism ensures the accuracy of attack commands, enabling it to adapt to different target network environments. Even if the specific configuration of the target is unknown during initial orchestration, it can dynamically adapt through exploration and learning during the attack process.

[0080] Step S234: Adapt the parsed parameters to the corresponding attack payload unit and inject them into the simulation test platform.

[0081] Adapting the parsed parameters to the corresponding attack payload unit and injecting them is the final step in completing the attack. During the orchestration phase (step S220), the attack payload unit is typically designed as a template with parameter placeholders. For example, in a 104 protocol message template, fields such as target IP address, port, Information Object Address (IOA), and set values ​​may be variables (e.g., {{target_ip}}, {{ioa_address}}, {{malicious_value}}). The attack injection engine fills these placeholders with the specific parameter values ​​dynamically parsed in step S233, completing the instantiation of the payload template and generating a fully ready and targeted attack message. Subsequently, the engine injects the instantiated attack message into the industrial control network of the simulation test platform through a specified network interface using an appropriate communication library (such as a socket programming library). The timing and method of injection may be controlled by triggering conditions (such as wait time and synchronization signals) defined in the attack chain description file.

[0082] Specifically, in step S400, based on a preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels, including: Step S410: The network traffic data, system log data, and running status data in the original data records are time-series aligned and correlated based on the reference time.

[0083] The data processed consists of network traffic data, system log data, and operational status data from a hydroelectric power physical process simulation model, all collected synchronously but independently during the attack execution process. This data is captured by collectors deployed in different locations. Although a reference time was established before collection using a high-precision time synchronization protocol (such as PTP or at least NTP), the timestamp accuracy and recording frequency within each data stream may differ. The primary task of time alignment is to unify all data into a common time coordinate system using this reference time as the axis. Specific operations include: for network traffic data, each packet has a precise capture timestamp; for system logs, each record also includes its generation timestamp; and for physical operational status data, it is time-series data recorded at a specific sampling frequency (e.g., 100 times per second). The alignment process requires algorithms such as interpolation, resampling, or nearest neighbor matching to ensure that, for any given point in time, the status of different data sources at that moment or within a very short time window can be obtained.

[0084] Association, on the other hand, establishes logical connections between records from different data sources based on temporal alignment. For example, it may be necessary to associate a malicious 104 protocol message (network traffic data) injected at a specific time with a "configuration change" event (system log data) that the target PLC might record in its system log after receiving the message, and with the subsequent abnormal increase in turbine speed reflected in the hydropower model (operational status data). This association is not necessarily a direct causal relationship determination, but rather provides a temporal proximity basis for subsequent annotation, ensuring that all relevant data records can be completely marked within the time window of the attack phase, forming a data fragment that reflects the full picture of the attack.

[0085] Step S420: Parse the attack chain description file corresponding to the preset multi-stage chain attack process to obtain the start timestamp, end timestamp and corresponding attack type identifier of each attack stage.

[0086] The description file (such as in JSON or YAML format) is orchestrated before attack execution, fully defining the logical flow of the multi-stage attack chain. It's crucial to accurately extract the timing and attack type information for each stage. The parsing process first identifies all attack stages defined in the file and their unique identifiers. For each stage, the key is to extract its time schedule information. This information can be defined in two ways: one is based on absolute time, such as explicitly specifying that stage A starts at 14:00:00 on 2023-10-27; the other, more common, is based on relative time, such as defining stage B as starting 5 seconds after the attack chain begins and lasting 10 seconds.

[0087] When the attack injection engine actually executes the attack chain, it records the absolute timestamp of the entire chain's start. The parser uses this absolute start time, combined with the relative time schedule of each stage in the description file, to calculate the precise start and end timestamps of each stage on the actual timeline. For example, if the attack chain starts at time T0, and the description file specifies that stage 1 starts with a 0-second delay and lasts for 30 seconds, then the start timestamp of stage 1 is T0, and the end timestamp is T0+30 seconds. Simultaneously, the parser needs to extract the attack type identifier from the configuration information of each stage. This identifier typically corresponds to a standard attack classification system, such as the technology ID in the MITRE ATT&CK for ICS framework (e.g., T0800: network connection enumeration). Finally, the parser performs logical consistency verification on the extracted time information and attack type identifier, ensuring, for example, that the time intervals of the stages do not overlap or have logical conflicts, guaranteeing the accuracy of the labeling basis.

[0088] Step S430: Based on the start and end timestamps of the attack phase, label the network traffic data, system log data, and running status data within the corresponding time period on the time-aligned original data records, respectively.

[0089] The start and end timestamps of each attack phase obtained in step S420 are used as time filters and applied to the multi-source raw data records that have been time-aligned in step S410. For each data segment (such as a network packet, a system log, or a physical quantity sampling point), the system checks whether its timestamp falls within the time interval [T_start, T_end] of a certain attack phase. If so, the data record is labeled with that attack phase. For example, assuming the time interval of the "privilege escalation" phase is [T1, T2], then all network traffic with timestamps between T1 and T2 (including exploit packets sent by the attacker and response packets from the target system), logs generated during this period (such as abnormal login records and privilege change logs), and the running status data of the physical process model during this time period (at which point there may not be any obvious anomalies) will be marked as the "privilege escalation" phase. This labeling is fine-grained; a data record can only belong to a specific attack phase (based on the timestamp), thus clearly depicting the progression of the attack chain. For data records with a very short duration but spanning the boundary between two stages (e.g., a message whose timestamp is very close to T2), clear rules need to be established for processing, such as classifying them into the initial stage.

[0090] Step S440: Assign the attack type identifier associated with the attack phase label as the attack type label to the corresponding data record.

[0091] Attack phase labels (e.g., "Phase 2: Lateral Movement") describe the progress of the attack, while attack type labels reveal the specific attack techniques employed in that phase and their potential impact on operational functions. The attack type identifier, parsed in step S420 and bound to each attack phase, is assigned as an additional label to all data records already tagged with that phase. The attack type identifier is typically a composite label, potentially containing two layers: first, an attack technique label, defined according to a standard classification system (e.g., MITRE ATT&CK for ICS), such as "T0863: Lateral Movement Using Remote Services"; and second, a operational function impact label, describing the specific operational functions of the hydropower station that the attack technique may affect, such as "affecting power generation regulation" or "endangering mechanical equipment safety."

[0092] For example, all data records marked as being in the "lateral movement" phase, in addition to the phase label "lateral movement," will also be assigned the attack technique label "T0863: Lateral movement using remote services," and the business function impact label "affecting power generation regulation," derived from analysis of its attack target (e.g., movement to the speed controller PLC). This dual-labeling system allows the dataset to not only be used to train models for detecting specific attack phases, but also to study the behavioral characteristics of different attack techniques and assess the impact of attacks on actual production operations.

[0093] Step S450: Integrate all data records with attack stage labels and attack type labels to generate an attack dataset.

[0094] All data records processed in the preceding steps—that is, each network traffic, system log, and physical operational status data entry is accompanied by precise attack stage and attack type labels—are aggregated, organized, and stored according to a specific structure and format. The integration process includes data cleaning (removing obviously invalid or erroneous data), format standardization (e.g., converting network traffic to PCAP format, logs to a unified CSV or JSON format, and physical data to a time-series database format), and indexing (e.g., indexing by time range, attack stage, and attack type for fast retrieval).

[0095] The resulting dataset is a structured collection of data, potentially containing multiple files or database tables. It typically comes with detailed metadata documentation explaining the data's source, format, labeling system definitions, attack scenario descriptions, and other information. Such datasets can be directly used for training machine learning models (as labeled samples for supervised learning), for offline evaluation of intrusion detection algorithms (calculating metrics such as detection rate and false positive rate), or for security researchers to analyze behavioral patterns in complex attack chains.

[0096] Through the aforementioned systematic annotation process, this solution transforms raw, unstructured multi-source monitoring data into a high-quality dataset with precise temporal context, clear attack phase segmentation, and explicit technical semantic annotation. This dataset accurately reflects the evolution trajectory and impact of multi-stage chain attacks at different levels of industrial control networks, host systems, and physical processes. It provides an indispensable, high-quality benchmark data resource for developing next-generation industrial control network security detection and defense technologies capable of understanding attack context, correlating multi-source evidence, and ultimately achieving early and accurate warnings.

[0097] Further, in step S420, the attack chain description file corresponding to the preset multi-stage chain attack process is parsed to obtain the start timestamp, end timestamp, and corresponding attack type identifier for each attack stage, including: Step S421: Identify several attack stages and their configuration information in the attack chain description file.

[0098] Attack chain description files are typically defined using structured data formats (such as XML or JSON), where each attack stage is an independent configuration block containing a stage identifier, description information, dependency parameters, and execution parameters. During parsing, the overall structure of the description file is first read by a file parser to identify all configuration blocks marked as attack stages. Then, the configuration information for each stage is extracted, including the stage name, unique ID, list of dependencies for preceding stages, and references to attack payload units. For example, in a hydropower station monitoring scenario, a typical attack chain might include four stages: the first stage is network reconnaissance, aimed at scanning active devices in the industrial control network; the second stage is vulnerability exploitation, targeting the identified turbine governor controller for privilege acquisition; the third stage is lateral movement, penetrating from the turbine controller to the gate controller; and the fourth stage is business logic attack, tampering with gate opening commands. During parsing, it is necessary to ensure that the configuration information for each stage is complete and conforms to the preset schema specifications for subsequent processing.

[0099] Step S422: Extract preset time plan information from the configuration information of each attack phase. The preset time plan information includes start and end times defined based on absolute time or relative time to the attack chain start time.

[0100] The timing information defines the sequence of attack phases, including start and end times. These times can be based on absolute time (e.g., 2023-10-01 14:00:00) or relative time (e.g., a phase starts 0 seconds after the chain starts and ends 30 seconds after the chain starts) or relative time (e.g., a phase starts 0 seconds after the chain starts and ends 30 seconds after the chain starts). Configuration information typically includes "start_time" and "end_time" fields, or uses the "duration" field combined with a relative offset to calculate the time interval. For example, for the second phase (exploitation) of the aforementioned hydroelectric power plant attack chain, the configuration might specify a start time as a relative time "+10s" (meaning it starts 10 seconds after the chain starts), a duration of "20s", and an end time as a relative time "+30s". The extraction process requires accurately parsing these time expressions and converting them into a standard time representation, while also handling potential conditional dependencies, such as the start of a phase requiring the successful completion of the previous phase. In this case, the timing plan may include dynamic adjustment logic.

[0101] Step S423: Based on the time schedule information, calculate the start and end timestamps of each attack phase when it is actually executed in the multi-stage attack chain.

[0102] The calculation process uses the actual start time of the attack chain as the baseline time point. This time is uniformly obtained through a high-precision time synchronization protocol (such as IEEE 1588 PTP) to ensure time consistency across all data acquisition nodes. For plans defined by absolute time, they are directly converted into timestamps; for plans defined by relative time, the actual timestamp is obtained by adding a relative offset to the chain start timestamp. For example, if the attack chain starts at time T0, and the second phase plan has a relative start time of "+10s" and a duration of "20s", then its start timestamp is T0+10 seconds, and its end timestamp is T0+30 seconds. The calculation must consider compensation for time synchronization errors and handle dynamic dependencies between phases. For instance, the actual start time of the current phase may be delayed due to the execution result of the previous phase; in this case, the timestamp needs to be adjusted according to the runtime context. Finally, the timestamp of each phase is recorded with millisecond or microsecond precision for subsequent data annotation.

[0103] Step S424: Based on the configuration information of each attack stage, the attack type identifier representing the attack technique attributes is parsed and obtained.

[0104] The attack type identifier consists of two parts: an attack technique label and a business function impact label. The attack technique label is defined according to a pre-defined attack technique classification system (such as the MITRE ATT&CK for ICS framework), extracting the "technique_id" or similar field from the phase configuration and mapping it to a standard classification identifier, such as "T0860: Network Reconnaissance" or "T0883: Command Injection". The business function impact label is determined based on the function of the critical controlled equipment targeted in this phase within the hydropower station monitoring system. For example, an attack on the turbine governor might affect the power generation regulation function, tagged as "Power Generation Control"; an attack on the gate controller might affect the water flow regulation function, tagged as "Water Flow Scheduling". During the parsing process, the device function mapping table needs to be accessed to convert the device identifiers in the configuration into business function categories, ensuring that the labels accurately reflect the potential impact of the attack on the physical process.

[0105] Step S425: Perform consistency verification on the logic of start timestamp, end timestamp, and attack type identifier.

[0106] The verification process includes temporal logic checks and semantic consistency checks. Temporal logic checks ensure that timestamps at each stage do not overlap or contradict each other; for example, the start time of a later stage must not be earlier than the end time of a previous stage, and the time intervals must conform to the dependencies of the attack chain. Semantic consistency checks verify the matching degree between the attack type identifier and the stage description. For example, if the stage is configured as "vulnerability exploitation," the attack technique label should be of the "exploitation" class, and the business function impact label should correspond to the actual function of the target device. The verification algorithm may employ a rule engine to automatically verify the relationship between time series and labels, logging and triggering adjustment mechanisms when anomalies are detected. For example, if a stage timestamp is detected to abnormally span multiple discontinuous intervals, the time schedule is recalculated; if the attack type label does not match the device function, the configuration mapping logic is backtracked.

[0107] Furthermore, the attack type identifier includes an attack technique label and a business function impact label; correspondingly, the parsing in step S424 yields an attack type identifier characterizing the attack technique attributes, including: Step S424a: Based on the attack stage configuration information in the attack chain description file, extract the classification identifier defined according to the preset attack technology classification system as the attack technology label.

[0108] Based on a pre-defined attack technique classification system, typically employing an industry-standard framework such as the MITRE ATT&CK for ICS matrix, each attack stage's configuration information in the attack chain description file includes a specific technique classification identifier field, such as `technique_id`. The parsing process first locates and reads the value of this field, then maps and verifies it against standard entries in the pre-defined classification system. For example, for a stage configured to exploit a vulnerability in the turbine governor protocol for illegal command injection, its `technique_id` field value might be "T0883," which corresponds to the technique "Command Injection" in the ATT&CK for ICS framework. To ensure label accuracy, a locally maintained classification system mapping library is accessed to verify the validity of the `technique_id`, and its standardized technique name (such as "command injection") is used as the attack technique label. This process ensures an accurate description of the attack methods from a technical perspective, providing standardized input features for subsequent behavior-based detection algorithms.

[0109] Step S424b: Based on the key controlled equipment targeted in the attack phase, and combined with the functions undertaken by the key controlled equipment in the hydropower station monitoring business, the affected function category identifier is used as the business function impact label.

[0110] First, the key controlled device identifiers targeted in this phase are extracted from the configuration information of the attack phase, such as "Unit_1_TurbineGovernor" or "Gate_2_Controller". Then, a predefined "device-function" mapping table is queried, which details the specific functions of each key controlled device in the hydropower station monitoring operations within the simulation test platform. For example, the main function of the turbine governor is categorized as "power generation control," while the gate controller's function is categorized as "reservoir level / flow regulation." The parser maps the device identifiers to their corresponding business function categories and uses the category identifier (such as "power generation control" or "water flow scheduling") as a business function impact label. This step links the purely technical attack actions with the specific consequences of the business scenario, enabling the dataset to reflect the actual impact of the attack on the physical production process.

[0111] Step S424c: Associate the attack technology tag with the business function impact tag to the corresponding attack stage.

[0112] The aforementioned association is not a simple parallel storage, but rather, within the internal data structure of the attack chain, a unified set of tags is created for each attack stage object. This set includes both technical attributes and business impact attributes. For example, for the command injection attack stage targeting a hydro turbine governor, its final attack type identifier will be integrated as "Technology: Command Injection (T0883) - Impact: Power Generation Control," and this association is persistently recorded in the metadata of the attack dataset. When generating the final attack dataset, every data record collected during this period (whether it's network traffic, system logs, or physical status data) will carry this composite attack type identifier.

[0113] Furthermore, after associating the attack technique label with the business function impact label to the corresponding attack stage in step S424c, the method further includes: Step S424d: Obtain information on proactive defense measures triggered by the simulation test platform during the execution of the attack, and tag the data records within the corresponding time period with defense measures.

[0114] Information on defensive measures is obtained through the management interfaces of security devices (such as industrial firewalls and intrusion detection systems) deployed in the monitoring platform, alarm logs from the Security Information and Event Management System (SIEM), and manual intervention records by administrators. This information specifically includes the trigger time of the defensive measure, the measure type (e.g., "blocking specific IP connections," "modifying firewall policies," "isolating abnormal devices," "restoring normal operation instructions"), the target object (e.g., protected PLC addresses or network segments), and the execution result. A unique defensive measure identifier is generated for each record, and it is precisely mapped to the attack timeline based on its trigger time and duration. For example, when the attack chain reaches the lateral movement phase, attempting to access the gate controller from the turbine controller, the network detection system might trigger a rule to block the cross-zone access request at time T1; this defensive action is recorded, and packets from the corresponding network session after time T1 are tagged with "Defense Measures: Access Blocked." This process ensures that defensive actions can be precisely correlated with attack actions on the timeline.

[0115] Step S424f: Using attack events as an index, associate the tagged network traffic data, system log data, running status data, and defense measure tags to generate a defense dataset.

[0116] Here, an "attack event" refers to a complete, uniquely identified, multi-stage chain attack instance. First, a data structure centered on the attack event ID is established. This ID links all information about the attack, including the attack chain description, the start and end times of each stage, attack technique tags, business impact tags, and triggered defense measure tags. Then, time-aligned network traffic data, system log data, and operational status data from the hydropower physical process simulation model are assigned to their corresponding attack stages or defense response periods based on their timestamps and linked using the attack event ID. The resulting dataset is a structured collection where each record contains not only the original data content and a high-precision timestamp but also contextual tags (e.g., "Attack Stage: Stage Two - Lateral Movement," "Attack Technique: T0869 - Abuse of Trusted Relationships," "Business Impact: Control System Network," "Defense Measures: Time T1 - Access Blocking"). This organization allows researchers to clearly trace the entire lifecycle of an attack and analyze the causal relationship between attack behavior and system responses (including automated platform defense and manual intervention).

[0117] In addition, before step S300, which involves synchronously collecting network traffic data, system log data, and operational status data of the simulation test platform during and after the execution of the attack, the following steps are also included: Step S301: Configure a high-precision time synchronization protocol for all data acquisition nodes in the simulation test platform and establish a reference time.

[0118] Establishing a unified time reference within the simulation testing platform is fundamental to ensuring accurate time-series correlation of subsequently acquired multi-source data. This step requires high-precision time synchronization configuration for all nodes involved in data generation within the platform. These nodes include: network traffic probes connected to critical links in the industrial control network (such as switches deployed between the monitoring master station and the controlled equipment), servers and workstations running monitoring software and operating systems (for generating system logs), and simulation servers executing simulations of hydroelectric power generation physical processes. The time synchronization protocol typically employs the IEEE 1588 Precision Time Protocol (PTP), which boasts higher accuracy than the general NTP protocol. This protocol can achieve sub-microsecond synchronization accuracy in a local area network environment. The configuration process involves specifying a highly stable clock source in the network as the PTP master clock (Grandmaster Clock). This clock typically uses GPS or BeiDou signals for timing to ensure absolute time accuracy. All other data acquisition nodes within the platform act as PTP slave clocks, maintaining synchronization with the master clock by exchanging PTP protocol messages. During implementation, it is necessary to ensure that the network switch supports PTP transparent clock or boundary clock functions to compensate for errors caused by network transmission latency. For example, when configuring data acquisition agents for turbine governor PLCs and gate controller PLCs, it is necessary to ensure that their operating system kernel supports the PTP protocol stack and that they are correctly configured to belong to a unified PTP clock domain, thereby establishing a unified timing system across the entire platform based on the master clock.

[0119] Step S302: When collecting data, obtain the precise timestamp of each network traffic data, system log data, and operating status data based on the reference time.

[0120] For network traffic data, a timestamp is typically added by the probe's operating system kernel or dedicated network card hardware the instant the data packet is captured. This timestamp comes directly from the synchronized local PTP clock. For system log data, the operating system or application's log service (such as syslog or Windows EventLog) calls a high-precision time API to obtain the current time and writes it to the log entry when a log event occurs. For the operational status data of the hydropower physical process simulation model, a timestamp is obtained from the simulation server's synchronized clock at each calculation cycle of the simulation engine or at the moment of state variable update, and recorded along with the status data (such as water level, flow rate, power, valve opening, etc.). The accuracy of the timestamp is usually required to be at the millisecond level or higher, for example, using the Unix timestamp format and including millisecond or microsecond decimal places. To ensure the reliability of the timestamp, consistency checks are performed during the acquisition process. For example, the offset between the local clock of each acquisition node and the master clock is periodically verified. If the offset exceeds a preset threshold (such as 1 millisecond), an alarm is recorded and possible corrections are made in subsequent data preprocessing.

[0121] Accordingly, please refer to Figure 2 The second aspect of this invention provides a device for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario, comprising: Platform construction module 1 is used to build a simulation test platform for hydropower station monitoring business scenarios. The simulation test platform includes at least a simulated monitoring master station, an industrial control network and several key controlled devices, and a controlled simulation model of the hydropower generation physical process.

[0122] Attack simulation module 2 is used to inject an attack payload based on the semantics of the hydropower station industrial control protocol into the simulation test platform, and execute the attack behavior according to the preset multi-stage chain attack process. The preset multi-stage chain attack is a complete attack sequence consisting of multiple attack stages that are logically continuous and have a causal relationship.

[0123] Data acquisition module 3 is used to synchronously collect network traffic data, system log data, and operating status data of the simulation test platform during and after the execution of the attack behavior, and obtain raw data records.

[0124] The dataset generation module 4 is used to label the original data records based on a preset multi-stage chain attack process, so as to obtain an attack dataset with attack stage labels and attack type labels.

[0125] Accordingly, a third aspect of the present invention provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute the above-described method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario.

[0126] Accordingly, a fourth aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario.

[0127] This invention aims to protect a method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios, which has the following effects: 1. By constructing a highly realistic simulation test platform for hydropower station monitoring operations, and orchestrating and executing multi-stage chain attacks based on protocol semantics and with stage dependencies on this platform, we have achieved accurate reproduction of advanced persistent threat (APT) attack chains in the real world. This solves the problem that traditional datasets cannot effectively simulate the real tactical intentions of attackers' gradual infiltration and lateral movement due to the single attack scenario and isolated attack behavior. It provides a crucial data foundation for training and testing next-generation security models capable of detecting complex and chain attacks. 2. By parsing the semantics of the target industrial control protocol, a compliant yet malicious attack payload is constructed. The injection parameters for the next stage can be dynamically adapted based on the execution results of the previous attack stage (such as the permissions obtained and the topology discovered), achieving a high degree of adaptability between the attack behavior and the business environment context. This solves the problems of rigidity and disconnection from the target system state in previous attack injection methods, thereby generating more covert and targeted attack traffic. This enables the defense model trained on this dataset to more effectively identify precise attacks based on semantic understanding and contextual changes. 3. Through a high-precision time synchronization protocol, the synchronous collection and time-series alignment of multi-dimensional data such as network traffic, system logs, and physical process operation status were achieved. Based on the attack chain description file, the data was labeled with precise tags down to the attack stage (including attack technology tags and business function impact tags). This solved the problems of existing datasets having single data dimensions, coarse labeling granularity, and lack of attack tactical background information. It provides unprecedented refined data support for studying the chain reaction of attack behavior at different system levels (network, host, physical process), developing detection algorithms based on multi-source information fusion, and assessing the actual impact of attacks on business functions.

[0128] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0129] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0130] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0131] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario, characterized in that, Includes the following steps: A simulation test platform for monitoring business scenarios of hydropower stations is constructed. The simulation test platform includes at least a simulated monitoring master station, an industrial control network and several key controlled devices, and a controlled simulation model of the physical process of hydropower generation. On the simulation test platform, an attack payload based on the semantic construction of the hydropower station industrial control protocol is injected, and the attack behavior is executed according to the preset multi-stage chain attack process. The preset multi-stage chain attack is a complete attack sequence consisting of multiple attack stages that are logically continuous and have a causal relationship. Simultaneously collect network traffic data, system log data, and operating status data of the simulation test platform during and after the execution of the attack behavior to obtain raw data records; Based on the preset multi-stage chain attack process, the original data records are labeled to obtain an attack dataset with attack stage labels and attack type labels.

2. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios according to claim 1, characterized in that, The injected attack payload is constructed based on the semantics of the hydropower station industrial control protocol, and the attack behavior is executed according to a preset multi-stage chain attack process, including: Based on the communication specifications of the target industrial control protocol, attack payload units with malicious business logic semantics are generated. Multiple attack payload units are arranged according to a preset attack logic to form a multi-stage attack chain with stage dependencies. The multi-stage attack chain is executed on the simulation test platform, wherein the injection parameters of the attack payload are dynamically adapted according to the execution results of the current stage and the previous stage of the multi-stage attack chain. Obtain multi-dimensional response data generated by the simulation test platform during the attack execution process.

3. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios according to claim 2, characterized in that, The communication specification based on the target industrial control protocol generates an attack payload unit with malicious business logic semantics, including: Parse the message structure and function code definition of the target industrial control protocol to establish a compliant message generation template; Based on the hydropower station monitoring business logic, obtain the aforementioned key controlled equipment and corresponding safe operation thresholds; The malicious semantic rules corresponding to the key controlled device are mapped to the compliant message generation template to generate a communication message that conforms to the protocol syntax specification but carries the malicious semantic rules, thereby obtaining the attack payload unit and performing protocol syntax compliance verification.

4. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios according to claim 3, characterized in that, The step of arranging multiple attack payload units according to preset attack logic to form a multi-stage attack chain with stage dependencies includes: Based on the multiple consecutive attack stages included in the multi-stage attack chain, at least one attack payload unit is allocated to each attack stage. Based on the preset attack logic, establish the dependency relationship between different attack stages; Based on the aforementioned dependencies, the triggering conditions and execution parameters of the corresponding attack payload unit are configured for each attack phase. Based on the attack phase, the allocated attack payload unit, the dependencies, and the triggering conditions, an attack chain description file that can be parsed and executed by the attack injection engine is generated.

5. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring scenarios according to claim 2, characterized in that, The injection parameters of the attack payload are dynamically adapted based on the execution results of the current stage and the previous stage of the multi-stage attack chain, including: Obtain the execution result of the previous attack stage in the multi-stage attack chain, the execution result including successfully obtained access permissions for industrial control equipment or identified network topology information; Based on the execution result, the runtime context of the multi-stage attack chain is updated. The runtime context is used to characterize the currently accessible set of industrial control devices and the known system state. Based on the updated runtime context and the target of the current stage, the target device address, protocol function code, and payload content parameters of the attack payload to be injected are dynamically parsed and determined. The parameters determined by the analysis are adapted to the corresponding attack payload unit and injected into the simulation test platform.

6. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring business scenarios according to any one of claims 1-5, characterized in that, The method involves labeling the original data records based on the preset multi-stage chain attack process to obtain an attack dataset with attack stage labels and attack type labels, including: The network traffic data, system log data, and operating status data in the original data records are time-series aligned and correlated based on the reference time. The attack chain description file corresponding to the preset multi-stage chain attack process is parsed to obtain the start timestamp, end timestamp and corresponding attack type identifier of each attack stage. Based on the start and end timestamps of the attack phase, the network traffic data, system log data, and running status data within the corresponding time period are tagged with the corresponding attack phase labels on the time-aligned original data records. The attack type identifier associated with the attack stage label is assigned as an attack type label to the corresponding data record; The attack dataset is generated by integrating all data records with attack stage and attack type labels.

7. The method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario according to claim 6, characterized in that, The step of parsing the attack chain description file corresponding to the preset multi-stage chain attack process to obtain the start timestamp, end timestamp, and corresponding attack type identifier of each attack stage includes: Identify several attack stages and their configuration information in the attack chain description file; Preset time plan information is extracted from the configuration information of each attack phase. The preset time plan information includes a start time and an end time defined based on absolute time or relative time to the attack chain start time. Based on the time plan information, calculate the start and end timestamps of each attack phase when the multi-stage attack chain is actually executed. Based on the configuration information of each attack stage, an attack type identifier representing the attack technique attributes is obtained through parsing. The logic performs consistency verification on the start timestamp, the end timestamp, and the attack type identifier.

8. The method for constructing a dataset for industrial control network attacks and defenses in hydropower station monitoring business scenarios according to claim 7, characterized in that, The attack type identifier includes attack technique tags and business function impact tags; The parsing yields attack type identifiers that characterize the attack technique attributes, including: Based on the attack stage configuration information in the attack chain description file, the classification identifier defined according to the preset attack technology classification system is extracted as the attack technology label. Based on the key controlled equipment targeted in the attack phase, and combined with the functions of the key controlled equipment in the hydropower station monitoring business, the affected function category identifiers are used as business function impact labels. The attack technique tag and the business function impact tag are associated with the corresponding attack stage.

9. The method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario according to claim 8, characterized in that, After associating the attack technique tag with the business function impact tag to the corresponding attack stage, the method further includes: Obtain information on proactive defense measures triggered by the simulation testing platform during the execution of the attack, and tag the data records within the corresponding time period with defense measures. Using attack events as an index, the tagged network traffic data, system log data, operational status data, and defense measure tags are associated to generate a defense dataset.

10. The method for constructing a dataset for industrial control network attacks and defenses in a hydropower station monitoring business scenario according to claim 1, characterized in that, Before synchronously collecting network traffic data, system log data, and operational status data of the simulation test platform during and after the execution of the attack, the method further includes: Configure a high-precision time synchronization protocol for all data acquisition nodes in the simulation test platform to establish a reference time; When collecting data, the precise timestamp of each network traffic data, system log data, and operating status data is obtained based on the reference time.

Images