An industrial computer network intrusion identification method based on data feature analysis

Abstract

The application relates to the technical field of industrial control information security, and discloses an industrial computer network intrusion identification method based on data feature analysis, which comprises the following steps: firstly, acquiring network message multidimensional data and calculating time truncation difference and normalized probability; then, combining the load length and the time truncation difference to calculate the nonlinear impact intensity score, and extracting the periodic flow damping coefficient by using the average time interval; then, calculating the load information entropy gradient, and generating the port difference joint penalty score by fusing the port difference; for the multi-network card architecture, the time sequence jitter compensation coefficient is calculated by using the hardware interrupt time difference; finally, the nonlinear impact intensity score, the periodic flow damping coefficient, the port difference joint penalty score and the square value of the time sequence jitter compensation coefficient are fused to generate a comprehensive intrusion identification index, and a robust adaptive security threshold is constructed based on the median and the median absolute deviation of the comprehensive index sequence; the index is compared with the threshold to execute blocking.

Description

Technical Field

[0001] This invention relates to the field of industrial control information security technology, specifically to a method for identifying network intrusions into industrial control computers based on data feature analysis. Background Technology

[0002] With the deep integration of industrial control networks and power monitoring systems, the network security defense of industrial control computers under high concurrency architecture with multiple network cards faces severe challenges. Current common network intrusion detection technologies mostly rely on static rule matching or a single traffic length threshold for judgment. However, in the actual complex industrial control scenarios, such conventional technologies are difficult to deal with highly covert and adversarial network attacks.

[0003] First, conventional static threshold detection cannot accurately capture sudden bursts of traffic, easily leading to missed detections of high-frequency malicious payloads. Second, industrial control computer networks typically contain a large number of legitimate, periodic control polling traffic. Traditional anomaly detection mechanisms are prone to misjudging such high-frequency polling as attacks, causing serious false alarm risks. Furthermore, advanced persistent threats often evade detection by sending malicious beacons that perfectly disguise themselves as legitimate polling at specific time intervals; conventional methods cannot break through this temporal disguise by addressing the statistical heterogeneity of the payload content. Additionally, industrial control networks contain a large number of small, single-byte status code messages, which can cause legitimate endpoints to miss detection. When the interface jumps, it can cause abrupt changes in local features. Traditional methods lack a smoothing mechanism for joint spatial mapping, which can easily lead to singularity divergence and make it difficult to effectively amplify the features of malicious lateral scanning. More challenging is that modern industrial control computers often adopt heterogeneous concurrent architectures with multiple network cards. When the kernel schedules requests from different network cards, there will inevitably be timing jitter, resulting in severe distortion of time differences at the software level. Existing technologies often ignore this underlying hardware-level time drift. Finally, existing security baseline calibration methods often use extreme values ​​or variances, which are easily contaminated by occasional environmental noise or outliers from early slow scans, leading to an erroneous increase in the overall defense benchmark.

[0004] Therefore, there is a need for an industrial control computer network intrusion identification method based on data feature analysis to address the many shortcomings of the existing technologies. Summary of the Invention

[0005] This invention provides a method for identifying network intrusions in industrial control computers based on data feature analysis, which helps to solve the problems mentioned in the background art.

[0006] This invention provides the following technical solution: a method for identifying network intrusion in industrial control computers based on data feature analysis, comprising:

[0007] The system arrives at the current data packet, and obtains the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency. Based on the obtained data, the time truncation difference and normalized probability are calculated.

[0008] By combining the load length with the cutoff difference, the nonlinear impact strength score is calculated using the balancing factor.

[0009] Calculate the historical average time interval, determine the coherence coefficient between the current difference and that interval, and generate the periodic flow damping coefficient.

[0010] The regularized load information entropy is calculated using the smoothing constant and the normalized probability, and the gradient of the load information entropy is obtained.

[0011] Calculate the absolute value of the difference between the destination port number of the current data packet and the previous data packet, multiply it by the payload information entropy gradient and add the smoothing baseline constant to generate a joint port difference penalty score;

[0012] Determine the network card identifier; if they are the same, set the compensation coefficient to a fixed value; if they are different, calculate the timing compensation coefficient using the interrupt difference.

[0013] The comprehensive intrusion identification index is generated by multiplying the impact score, damping coefficient, penalty score, and the squared term of the compensation coefficient.

[0014] The median and median absolute deviation of the index of the calibrated sequence are extracted to generate a threshold. The current index is then compared with this threshold to perform blocking.

[0015] Optionally, the step of acquiring the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency of the current data packet, and calculating the time truncation difference and normalized probability based on the acquired data, specifically includes:

[0016] During the system initialization phase, bypass probes are set at the bottom layer of the industrial control computer's network protocol stack and at the hardware interrupt controller.

[0017] For multi-NIC architectures, a precise time protocol is used to achieve global synchronization of the underlying hardware clocks of each NIC;

[0018] During the initial calibration period, the first specified number of normal state data packets after system startup are recorded as a security baseline calibration sequence.

[0019] For data packets received globally and sequentially by the operating system's network protocol stack, extract and record the amount of underlying data that is directly measured;

[0020] The underlying data includes the system arrival timestamp, the globally unique identifier of the hardware network card that received the data packet, the hardware network card interrupt timestamp based on global synchronization, the payload length, the destination port number, and the frequency of each byte value in the payload.

[0021] For a non-first received data packet with a payload length greater than zero, calculate the time difference between the system arrival timestamp of the current data packet and the system arrival timestamp of the previous data packet;

[0022] The time difference is compared with the set system clock precision truncation constant, and the maximum value of the two is extracted as the time truncation difference.

[0023] Divide the frequency of each byte value in the payload by the payload length to obtain the normalized probability of each byte value.

[0024] Optionally, the step of combining the load length with the cutoff difference and calculating the nonlinear impact strength score using a balancing factor specifically includes:

[0025] Divide the payload length by the time truncation difference to obtain the equivalent transmission rate;

[0026] Calculate the square of the equivalent transmission rate;

[0027] Multiply the load length, the square of the equivalent transmission rate, and the set numerical balancing constant to obtain the product result;

[0028] Dividing the product by a constant two yields the nonlinear impact strength score.

[0029] Optionally, the step of obtaining the historical average time interval, calculating the coherence coefficient between the current difference and that interval, and generating the periodic flow damping coefficient specifically includes:

[0030] Determine whether the sequence number of the currently received data packet is greater than the set sliding window constant;

[0031] When the sequence number of the received data packet is greater than the sliding window constant, the corresponding number of time truncation differences are extracted from the preceding sequence. The extracted time truncation differences are summed and then divided by the corresponding number of time intervals to obtain the average time interval.

[0032] The coherence ratio is obtained by dividing the time truncation difference of the current data packet by the average time interval.

[0033] The coherence ratio is continuously multiplied by pi and the constant 2 to obtain the coherence angle;

[0034] Calculate the cosine value of the coherence angle as the coherence coefficient;

[0035] Calculate the squared value of the coherence coefficient;

[0036] Multiply the square of the coherence coefficient by the set attenuation control coefficient constant, and take its negative as the exponent.

[0037] The periodic flow damping coefficient is calculated using the natural constant as the base and the exponent term as the exponent.

[0038] When the sequence number of the received data packet is not greater than the sliding window constant, the periodic flow damping coefficient is fixed at a constant of one.

[0039] Optionally, the step of calculating the regularized load information entropy using a smoothing constant and a normalized probability, and obtaining the load information entropy gradient, specifically includes:

[0040] The normalized probability is added to the set regularization smoothing constant to obtain the smoothed probability;

[0041] Calculate the natural logarithm of the smoothed probability;

[0042] Multiply the natural logarithm value by the corresponding normalized probability to obtain a single-byte probability feature value;

[0043] The single-byte probability feature values ​​corresponding to all possible byte values ​​are summed, and the negative of the sum is taken as the regularized payload information entropy of the current data packet.

[0044] Calculate the difference between the regularized payload information entropy of the current data packet and the regularized payload information entropy of the previous data packet, and take the absolute value of the difference.

[0045] Dividing the absolute value by the time truncation difference yields the load information entropy gradient.

[0046] Optionally, the step of calculating the absolute value of the difference between the destination port number of the current data packet and the previous data packet, multiplying it by the payload information entropy gradient, and adding a smoothing baseline constant to generate a joint port difference penalty score specifically includes:

[0047] Calculate the difference between the destination port number of the current data packet and the destination port number of the previous data packet, and take the absolute value of the difference as the network port hop distance;

[0048] Multiply the network port hop distance by the load information entropy gradient to obtain the basic penalty product;

[0049] The base penalty product is added to the set smoothing baseline constant to obtain the port difference joint penalty score.

[0050] Optionally, the determination of network card identifiers, if they are the same, sets the compensation coefficient to a fixed value; if they are different, the timing compensation coefficient is calculated using the interrupt difference, specifically including:

[0051] Compare the receiving network interface card (NIC) identifier of the current data packet with the receiving NIC identifier of the previous data packet;

[0052] When the receiving network card identifier of the current data packet is the same as the receiving network card identifier of the previous data packet, the timing jitter compensation coefficient is fixed to a constant of one.

[0053] When the receiving network card identifier of the current data packet is different from the receiving network card identifier of the previous data packet, calculate the time difference between the hardware network card interrupt timestamp of the current data packet and the hardware network card interrupt timestamp of the previous data packet, and take the absolute value of the time difference to obtain the hardware interrupt time difference.

[0054] The smoothed hardware time difference is obtained by adding the hardware interrupt time difference to a set minimum constant.

[0055] The timing jitter compensation coefficient is obtained by dividing the time truncation difference by the smoothed hardware time difference.

[0056] Optionally, the step of multiplying the impact score, damping coefficient, penalty score, and the squared term of the compensation coefficient to generate a comprehensive intrusion identification index specifically includes:

[0057] Calculate the squared value of the timing jitter compensation coefficient;

[0058] Multiply the nonlinear impact strength score, the periodic flow damping coefficient, the square value, and the port difference joint penalty score together;

[0059] The result of the multiplication is used as the comprehensive intrusion identification index of the current data packet.

[0060] Optionally, the step of extracting the median and median absolute deviation of the index of the calibrated sequence to generate a threshold, and comparing the current index with the threshold to perform blocking, specifically includes:

[0061] At the end of the initial calibration period, the comprehensive intrusion identification index corresponding to the normal state data packets in the security benchmark calibration sequence that have the conditions for differential calculation is obtained, and a comprehensive index sequence is formed.

[0062] Extract the median of the composite index sequence as the composite index median;

[0063] Calculate the difference between each element in the composite index sequence and the median of the composite index, and take the absolute value of each difference to form an absolute deviation sequence;

[0064] Extract the median of the absolute deviation sequence as the median absolute deviation;

[0065] Multiplying the median absolute deviation by a configurable robust amplification factor constant yields the adaptive float.

[0066] The robust adaptive safety threshold is obtained by adding the median of the composite index to the adaptive floating amount.

[0067] The comprehensive intrusion identification index of the current data packet acquired in real time is compared with the robust adaptive security threshold.

[0068] If the overall intrusion detection index of the current data packet is greater than the robust adaptive security threshold, then it is determined that there is abnormal network behavior and a blocking action is performed;

[0069] If the overall intrusion detection index of the current data packet is not greater than the robust adaptive security threshold, then the current network data is determined to be within the statistical security range and the data packet is allowed to pass.

[0070] The present invention has the following beneficial effects:

[0071] 1. This solution proposes a network intrusion detection method based on data feature analysis for industrial control computer (ICS) networks with multi-NIC architectures. In this specific environment, ICS networks exhibit a large amount of legitimate periodic polling traffic and small status code messages. Concurrent reception by multiple NICs can easily cause time ratio distortion between the system software scheduling layer and the hardware receiving layer, making it difficult for detection methods relying solely on static thresholds to simultaneously address both sudden anomaly detection and legitimate periodic traffic filtering. This solution collects underlying data such as system arrival timestamps, hardware NIC interrupt timestamps, receiving NIC identifiers, destination port numbers, payload length, and byte frequency. These data are then used to form time truncation differences, normalized probabilities, nonlinear impact strength scores, periodic flow damping coefficients, regularized payload information entropy gradients, port difference joint penalty scores, timing jitter compensation coefficients, and a comprehensive intrusion detection index. Nonlinear impact intensity scoring is used to characterize short-term sudden load impacts; periodic flow damping coefficient is used to numerically suppress legitimate polling traffic with strong periodic coherence; regularized load information entropy gradient is used to characterize the change of load statistical structure over time; port difference joint penalty scoring is used to fuse port jump distance and load entropy change characteristics; timing jitter compensation coefficient is used to correct the proportional deviation between software arrival time difference and hardware interruption time difference in cross-NIC reception scenarios; finally, a robust adaptive security threshold is generated based on the median absolute deviation of the comprehensive intrusion identification index in the calibration sequence, enabling the current packet blocking or release decision to simultaneously combine multiple features such as sudden impacts, periodic background, load statistical changes, port jumps, and cross-NIC timing compensation, thereby helping to reduce the risk of false alarms and missed alarms in complex industrial control network scenarios;

[0072] 2. By comparing the system arrival time difference between the current data packet and the previous data packet with a set system clock precision truncation constant, and extracting the maximum value as the time truncation difference, a clear lower bound can be established for subsequent calculations involving the time difference denominator. In scenarios of highly concentrated burst traffic or flood attacks, or when the system is in a high-concurrency reception state, the system arrival timestamps of adjacent data packets may be the same or extremely close. In this case, if the original time difference is directly used to participate in the nonlinear impact intensity scoring and load information entropy gradient calculation, the denominator is likely to approach zero and cause division overflow or numerical divergence. This step introduces a system clock precision truncation constant to ensure that the time truncation difference is not lower than the effective resolution boundary allowed by the underlying physical link and the system's high-precision timer, so that subsequent feature calculations based on the time difference remain arithmetically stable, and the quantization results of burst traffic are within the numerical range that can continue to participate in the fusion calculation.

[0073] 3. By dividing the payload length by the time truncation difference to obtain the equivalent transmission rate, and combining the payload length, the square of the equivalent transmission rate, and the numerical balancing coefficient constant to construct a nonlinear impact strength score, a more significant numerical response can be generated in the score for data packets that arrive in a concentrated period of time and have a large payload size. This processing differs from setting thresholds solely based on payload length or arrival frequency. Instead, it incorporates both payload size and arrival density into the same nonlinear calculation chain, thus widening the difference between short-term burst traffic and ordinary periodic background traffic in the impact strength score. At the same time, the numerical balancing coefficient constant, as a dimensionless basic proportional term, balances the overall magnitude of the nonlinear score, allowing the score results to continue to participate in the subsequent fusion calculation of the comprehensive intrusion identification index within a suitable range of processor floating-point calculations.

[0074] 4. By determining whether the sequence number of the received data packet is greater than the set sliding window constant, and when the condition is met, multiple time truncation differences formed by the current data packet as the endpoint and overwriting a specified number of received data packets are extracted. These differences are then summed to obtain the average time interval. This allows the extraction of the background time rhythm during the industrial control protocol communication process based on the most recent continuous received traffic. The sliding window includes the time truncation difference between the current data packet and the previous data packet, thus enabling the arrival rhythm of the current data packet to participate in the formation of the average time interval. By setting an appropriate window length, the average time interval can simultaneously reflect the time distribution of multiple normal communication rounds and smooth out occasional physical jitter or isolated delays. When the polling frequency of legitimate services changes, the average time interval can gradually change with the update of the sliding window, providing a continuous time reference basis for the generation of subsequent coherence ratios and periodic flow damping coefficients.

[0075] 5. By calculating the coherence ratio between the current time truncation difference and the average time interval, converting this coherence ratio into a coherence angle, and then performing cosine operations, a periodic flow damping coefficient is generated based on the squared value of the coherence coefficient and the constant attenuation control coefficient. This mechanism can numerically suppress data packets that show a strong coherence relationship between the time interval and the historical average interval. This mechanism uses a periodic mapping relationship to characterize the degree of coherence between the current packet arrival rhythm and the background polling rhythm, and converts the degree of coherence into a damping weight through a negative exponential attenuation model. When the coherence relationship is strong, the periodic flow damping coefficient has a more significant suppressive effect on the corresponding packet score in the comprehensive intrusion identification index, thereby reducing the risk of legitimate high-frequency polling traffic being amplified individually due to dense load or short time intervals. When the coherence relationship is weak, the damping effect is correspondingly weakened, so that abnormal sudden or non-periodic changes can still retain a high score contribution in the subsequent comprehensive index.

[0076] 6. By introducing a set regularization smoothing constant on top of the normalized probability, performing a natural logarithmic operation on the smoothed probability, and then combining it with the original normalized probability to generate a regularized payload information entropy, the payload content of a single data packet can be statistically characterized from the degree of dispersion of the byte probability distribution. The regularization smoothing constant, as a boundary numerical stability constant, is used to smooth the probability inputs participating in the natural logarithmic operation, ensuring that byte values ​​with a probability of zero have computable inputs when participating in entropy calculation. Since the value of this smoothing constant is on a small order of magnitude, its effect is concentrated at the calculation boundary and will not replace the weight of the original normalized probability in entropy calculation. Based on this, the regularized payload information entropy of the current data packet is differiating from that of the previous data packet, and combined with time-truncated difference to generate a payload information entropy gradient, which can provide a characteristic quantity of the payload statistical structure changing over time for subsequent port difference joint penalty scoring.

[0077] 7. By calculating the absolute value of the difference between the destination port number of the current data packet and the previous data packet, the network port hop distance is obtained. Then, the network port hop distance is multiplied by the load information entropy gradient and a smoothing benchmark constant is added to generate a port difference joint penalty score. This can cross-integrate the load statistical change characteristics in the time domain with the hop characteristics in the port dimension. When the load information entropy gradient is high and the network port hop distance is large, the product of the two can make a higher numerical contribution to the joint penalty score, making it easier for load abrupt changes accompanying port switching or scanning behavior to enter the comprehensive intrusion identification index. When the network port hop distance is 0, the product term no longer provides additional contribution. At this time, the smoothing benchmark constant provides a non-zero basic term for the port difference joint penalty score, preventing the joint penalty score from becoming zero as a whole due to the port hop distance being 0, so that the score can serve as a stable component in the subsequent fusion of the comprehensive intrusion identification index.

[0078] 8. When receiving network interface card (NIC) identifiers differ, the system calls the globally synchronized hardware NIC interrupt timestamp to calculate the hardware interrupt time difference between the current data packet and the previous data packet. The system arrival time truncation difference is then divided by the hardware interrupt time difference, which incorporates a very small constant, to obtain the timing jitter compensation coefficient. This corrects the proportional deviation between the software system arrival time difference and the hardware interrupt time difference in multi-NIC concurrent reception scenarios. During cross-NIC reception, the arrival time difference recorded by the system software scheduling layer may be affected by scheduling order and kernel processing delays. The underlying hardware interrupt timestamp, after global synchronization, provides another time reference. This step uses this hardware time reference to proportionally correct the software time difference. Furthermore, when receiving continuously on the same NIC, the timing jitter compensation coefficient is fixed to a constant 1, ensuring that continuous packets from the same NIC do not introduce additional compensation due to minor scheduling differences.

[0079] 9. By multiplying and fusing the nonlinear impact intensity score, the periodic flow damping coefficient, the squared term of the timing jitter compensation coefficient, and the port difference joint penalty score, a comprehensive intrusion identification index is generated. This index unifies multiple dimensions of features, such as short-term load impact, periodic background suppression, cross-NIC timing ratio correction, and port and entropy gradient joint penalty, into a single judgment index. This fusion method makes it difficult for a single feature to independently determine the final judgment result; instead, a comprehensive score is formed under the combined effect of multiple features. Among them, the timing jitter compensation coefficient participates in the fusion in the form of a squared term, so that the timing ratio deviation caused by the inconsistency between the software arrival time difference and the hardware interruption time difference in cross-NIC scenarios is corrected in the comprehensive intrusion identification index. Through this comprehensive index, real-time data packets can be compared with the security threshold formed in the calibration period within the same numerical framework.

[0080] 10. By extracting the median of the composite index corresponding to the security benchmark calibration sequence, calculating the absolute deviation of each element in the composite index sequence relative to the median, and then extracting the median of the absolute deviation sequence to generate a robust adaptive security threshold, a blocking decision boundary based on the statistical distribution of the calibration sequence can be constructed. Compared with the threshold method of directly using the maximum, minimum or variance statistics, the median and the absolute deviation of the median do not require the composite index sequence to follow a normal distribution, and are less sensitive to a small number of outlier samples. Even if a small number of early slow scan packets are mixed in during the initial calibration period or affected by environmental electromagnetic noise, this statistical method can weaken the rise or disturbance of the overall benchmark by individual abnormal samples. After generating an adaptive floating amount with the robust amplification factor constant, the final robust adaptive security threshold can be used as the decision boundary for subsequent real-time comprehensive intrusion identification index blocking or allowing comparison. Attached Figure Description

[0081] Figure 1 This is a schematic diagram of the overall process of the present invention.

[0082] Figure 2 This is a schematic diagram of the bypass acquisition and hardware clock synchronization structure for a multi-NIC industrial control computer.

[0083] Figure 3 This is a schematic diagram illustrating the extraction of underlying data and the formation of basic features in the data packet of this invention.

[0084] Figure 4 This is a schematic diagram illustrating the coupling of nonlinear impact scoring and periodic flow damping in this invention.

[0085] Figure 5 This is a flowchart of the robust security threshold generation and blocking determination process of the present invention. Detailed Implementation

[0086] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0087] Example 1, refer to Figure 1 A method for identifying network intrusion in industrial control computers based on data feature analysis, comprising:

[0088] The system arrives at the current data packet, and obtains the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency. Based on the obtained data, the time truncation difference and normalized probability are calculated.

[0089] By combining the load length with the cutoff difference, the nonlinear impact strength score is calculated using the balancing factor.

[0090] Calculate the historical average time interval, determine the coherence coefficient between the current difference and that interval, and generate the periodic flow damping coefficient.

[0091] The regularized load information entropy is calculated using the smoothing constant and the normalized probability, and the gradient of the load information entropy is obtained.

[0092] Calculate the absolute value of the difference between the destination port number of the current data packet and the previous data packet, multiply it by the payload information entropy gradient and add the smoothing baseline constant to generate a joint port difference penalty score;

[0093] Determine the network card identifier; if they are the same, set the compensation coefficient to a fixed value; if they are different, calculate the timing compensation coefficient using the interrupt difference.

[0094] The comprehensive intrusion identification index is generated by multiplying the impact score, damping coefficient, penalty score, and the squared term of the compensation coefficient.

[0095] The median and median absolute deviation of the index of the calibrated sequence are extracted to generate a threshold. The current index is then compared with this threshold to perform blocking.

[0096] The process of acquiring the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency of the current data packet, and calculating the time truncation difference and normalized probability based on the acquired data, specifically includes:

[0097] During the system initialization phase, bypass probes are set at the bottom layer of the industrial control computer's network protocol stack and at the hardware interrupt controller.

[0098] For multi-NIC architectures, a precise time protocol is used to achieve global synchronization of the underlying hardware clocks of each NIC;

[0099] During the initial calibration period, the first specified number of normal state data packets after system startup are recorded as a security baseline calibration sequence.

[0100] For data packets received globally and sequentially by the operating system's network protocol stack, extract and record the amount of underlying data that is directly measured;

[0101] The underlying data includes the system arrival timestamp, the globally unique identifier of the hardware network card that received the data packet, the hardware network card interrupt timestamp based on global synchronization, the payload length, the destination port number, and the frequency of each byte value in the payload.

[0102] For a non-first received data packet with a payload length greater than zero, calculate the time difference between the system arrival timestamp of the current data packet and the system arrival timestamp of the previous data packet;

[0103] The time difference is compared with the set system clock precision truncation constant, and the maximum value of the two is extracted as the time truncation difference.

[0104] Divide the frequency of each byte value in the payload by the payload length to obtain the normalized probability of each byte value.

[0105] The method of combining the load length with the cutoff difference and calculating the nonlinear impact strength score through the balancing factor specifically includes:

[0106] Divide the payload length by the time truncation difference to obtain the equivalent transmission rate;

[0107] Calculate the square of the equivalent transmission rate;

[0108] Multiply the load length, the square of the equivalent transmission rate, and the set numerical balancing constant to obtain the product result;

[0109] Dividing the product by a constant two yields the nonlinear impact strength score.

[0110] The process of obtaining the historical average time interval, calculating the coherence coefficient between the current difference and that interval, and generating the periodic flow damping coefficient specifically includes:

[0111] Determine whether the sequence number of the currently received data packet is greater than the set sliding window constant;

[0112] When the sequence number of the received data packet is greater than the sliding window constant, the corresponding number of time truncation differences are extracted from the preceding sequence. The extracted time truncation differences are summed and then divided by the corresponding number of time intervals to obtain the average time interval.

[0113] The coherence ratio is obtained by dividing the time truncation difference of the current data packet by the average time interval.

[0114] The coherence ratio is continuously multiplied by pi and the constant 2 to obtain the coherence angle;

[0115] Calculate the cosine value of the coherence angle as the coherence coefficient;

[0116] Calculate the squared value of the coherence coefficient;

[0117] Multiply the square of the coherence coefficient by the set attenuation control coefficient constant, and take its negative as the exponent.

[0118] The periodic flow damping coefficient is calculated using the natural constant as the base and the exponent term as the exponent.

[0119] When the sequence number of the received data packet is not greater than the sliding window constant, the periodic flow damping coefficient is fixed at a constant of one.

[0120] The calculation of regularized load information entropy using a smoothing constant and normalized probability, and the determination of the load information entropy gradient, specifically includes:

[0121] The normalized probability is added to the set regularization smoothing constant to obtain the smoothed probability;

[0122] Calculate the natural logarithm of the smoothed probability;

[0123] Multiply the natural logarithm value by the corresponding normalized probability to obtain a single-byte probability feature value;

[0124] The single-byte probability feature values ​​corresponding to all possible byte values ​​are summed, and the negative of the sum is taken as the regularized payload information entropy of the current data packet.

[0125] Calculate the difference between the regularized payload information entropy of the current data packet and the regularized payload information entropy of the previous data packet, and take the absolute value of the difference.

[0126] Dividing the absolute value by the time truncation difference yields the load information entropy gradient.

[0127] The process of calculating the absolute value of the difference between the destination port number of the current data packet and the previous data packet, multiplying it by the payload information entropy gradient, and adding a smoothing baseline constant to generate a joint port difference penalty score specifically includes:

[0128] Calculate the difference between the destination port number of the current data packet and the destination port number of the previous data packet, and take the absolute value of the difference as the network port hop distance;

[0129] Multiply the network port hop distance by the load information entropy gradient to obtain the basic penalty product;

[0130] The base penalty product is added to the set smoothing baseline constant to obtain the port difference joint penalty score.

[0131] The determination of network card identifiers involves several steps. If the identifiers are the same, the compensation coefficient is set to a fixed value; otherwise, the timing compensation coefficient is calculated using the interrupt difference. Specifically, this includes:

[0132] Compare the receiving network interface card (NIC) identifier of the current data packet with the receiving NIC identifier of the previous data packet;

[0133] When the receiving network card identifier of the current data packet is the same as the receiving network card identifier of the previous data packet, the timing jitter compensation coefficient is fixed to a constant of one.

[0134] When the receiving network card identifier of the current data packet is different from the receiving network card identifier of the previous data packet, calculate the time difference between the hardware network card interrupt timestamp of the current data packet and the hardware network card interrupt timestamp of the previous data packet, and take the absolute value of the time difference to obtain the hardware interrupt time difference.

[0135] The smoothed hardware time difference is obtained by adding the hardware interrupt time difference to a set minimum constant.

[0136] The timing jitter compensation coefficient is obtained by dividing the time truncation difference by the smoothed hardware time difference.

[0137] The process of multiplying the impact score, damping coefficient, penalty score, and the squared term of the compensation coefficient to generate a comprehensive intrusion identification index specifically includes:

[0138] Calculate the squared value of the timing jitter compensation coefficient;

[0139] Multiply the nonlinear impact strength score, the periodic flow damping coefficient, the square value, and the port difference joint penalty score together;

[0140] The result of the multiplication is used as the comprehensive intrusion identification index of the current data packet.

[0141] The step of extracting the median and median absolute deviation of the index of the calibrated sequence to generate a threshold, and comparing the current index with the threshold to perform blocking, specifically includes:

[0142] At the end of the initial calibration period, the comprehensive intrusion identification index corresponding to the normal state data packets in the security benchmark calibration sequence that have the conditions for differential calculation is obtained, and a comprehensive index sequence is formed.

[0143] Extract the median of the composite index sequence as the composite index median;

[0144] Calculate the difference between each element in the composite index sequence and the median of the composite index, and take the absolute value of each difference to form an absolute deviation sequence;

[0145] Extract the median of the absolute deviation sequence as the median absolute deviation;

[0146] Multiplying the median absolute deviation by a configurable robust amplification factor constant yields the adaptive float.

[0147] The robust adaptive safety threshold is obtained by adding the median of the composite index to the adaptive floating amount.

[0148] The comprehensive intrusion identification index of the current data packet acquired in real time is compared with the robust adaptive security threshold.

[0149] If the overall intrusion detection index of the current data packet is greater than the robust adaptive security threshold, then it is determined that there is abnormal network behavior and a blocking action is performed;

[0150] If the comprehensive intrusion detection index of the current data packet is not greater than the robust adaptive security threshold, then the current network data is determined to be within the statistical security range and the data packet is allowed to pass. This solution proposes a network intrusion detection method based on data feature analysis for industrial control computer network environments with multi-NIC architectures. In this specific environment, industrial control networks have a large amount of legitimate periodic polling traffic and small status code messages. Concurrent reception by multiple NICs can easily cause time ratio distortion between the system software scheduling layer and the hardware receiving layer, making it difficult for detection methods relying solely on static thresholds to simultaneously address both sudden anomaly identification and legitimate periodic traffic filtering. This solution collects underlying data such as system arrival timestamps, hardware NIC interrupt timestamps, receiving NIC identifiers, destination port numbers, payload length, and byte frequency, and sequentially forms time truncation difference, normalized probability, nonlinear impact strength score, periodic flow damping coefficient, regularized payload information entropy gradient, port difference joint penalty score, timing jitter compensation coefficient, and comprehensive intrusion detection index. Nonlinear impact intensity scoring is used to characterize short-term sudden load impacts; periodic flow damping coefficient is used to numerically suppress legitimate polling traffic with strong periodic coherence; regularized load information entropy gradient is used to characterize the change of load statistical structure over time; port difference joint penalty scoring is used to fuse port jump distance and load entropy change characteristics; timing jitter compensation coefficient is used to correct the proportional deviation between software arrival time difference and hardware interruption time difference in cross-NIC reception scenarios; finally, a robust adaptive security threshold is generated based on the median absolute deviation of the comprehensive intrusion identification index in the calibration sequence, enabling the current packet blocking or release decision to simultaneously combine multiple features such as sudden impacts, periodic background, load statistical changes, port jumps, and cross-NIC timing compensation, thereby helping to reduce the risk of false alarms and missed alarms in complex industrial control network scenarios.

[0151] Example 2: A method for identifying network intrusion in industrial control computers based on data feature analysis, further comprising:

[0152] Step one, which involves acquiring the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency of the current data packet, and calculating the time truncation difference and normalized probability based on the acquired data, specifically includes:

[0153] like Figure 2 As shown, during the system initialization phase, bypass probes are set at the bottom layer of the industrial control computer network protocol stack and at the hardware interrupt controller; for multi-NIC architecture, the underlying hardware clock of each NIC is globally synchronized through a precision time protocol or an equal clock synchronization mechanism, so that the hardware timestamps output by different NICs are under the same time base.

[0154] During the initial calibration period, the first specified number of normal state data packets after the system has stabilized are recorded as a safety benchmark calibration sequence. The specified number is more than 500 and less than 5000 normal state data packets, preferably the number of data packets covering a complete startup stabilization cycle and several normal polling cycles. The specified number is predetermined based on the large sample stability requirements of the median absolute deviation and the readiness requirements after the industrial control computer system starts up. When the specified number is too large, the calibration period takes longer, and the calibration sequence may be mixed with early slow scan data or environmental noise data. When the specified number is too small, the calibration sequence is difficult to cover the complete normal polling cycle and occasional jitter of the industrial control network, and the stability of the statistical boundary generated subsequently based on the calibration sequence is insufficient.

[0155] like Figure 3 As shown, for data packets received globally and sequentially by the operating system network protocol stack, the amount of underlying data directly measured is extracted and recorded; the amount of underlying data includes the system arrival timestamp, the globally unique identifier of the hardware network card that received the data packet, the hardware network card interrupt timestamp based on global synchronization, the payload length, the destination port number, and the frequency of each of the 256 possible byte values ​​in the payload.

[0156] For the first received data packet, it is recorded only as the zero point of time and is not included in subsequent differential calculations; for data packets that are not the first received data packets and whose payload length is greater than 0, the time difference between the system arrival timestamp of the current data packet and the system arrival timestamp of the previous data packet is calculated; this time difference is compared with a pre-set system clock precision truncation constant, and the larger value is used as the time truncation difference of the current data packet.

[0157] The system clock precision truncation constant is between 0.0000001 seconds and 0.0001 seconds, preferably 0.000001 seconds. The system clock precision truncation constant is determined based on the minimum frame interval of the underlying physical link and the resolution of the high-precision timer of the operating system kernel, and serves as the lower bound for time difference processing. When the constant value is too large, the time difference of densely arriving data packets is excessively inflated. When the constant value is too small, the constant may be lower than the effective resolution boundary of the system clock.

[0158] The frequency of each of the 256 possible byte values ​​in the current data packet payload is counted, and the sum of the frequencies of all byte values ​​is made consistent with the payload length. The frequency of each byte value is divided by the payload length of the current data packet to obtain the normalized probability of each byte value in the current payload. The time truncation difference and normalized probability are used as the output results of this step and are passed to the subsequent impact intensity calculation, information entropy calculation and timing compensation processing.

[0159] By comparing the system arrival time difference between the current data packet and the previous data packet with a set system clock precision truncation constant, and extracting the maximum value as the time truncation difference, a clear lower bound can be established for subsequent calculations involving the time difference denominator. In scenarios of highly concentrated burst traffic or flood attacks, or when the system is in a high-concurrency reception state, the system arrival timestamps of adjacent data packets may be the same or extremely close. In such cases, if the original time difference is directly used to participate in the nonlinear impact intensity scoring and load information entropy gradient calculation, the denominator is likely to approach zero and cause division overflow or numerical divergence. This step introduces a system clock precision truncation constant to ensure that the time truncation difference is not lower than the effective resolution boundary allowed by the underlying physical link and the system's high-precision timer, so that subsequent feature calculations based on the time difference remain arithmetically stable and that the quantization results of burst traffic are within a numerical range that can continue to participate in fusion calculations.

[0160] Step two, which involves combining the load length with the cutoff difference and calculating the nonlinear impact strength score using a balancing factor, specifically includes:

[0161] like Figure 4 As shown, the current data packet payload length and time truncation difference obtained in step one are called. The current data packet payload length is first divided by the aforementioned time truncation difference to obtain the equivalent transmission rate used to characterize the change in payload size per unit time.

[0162] The equivalent transmission rate is squared to obtain the squared value of the equivalent transmission rate; the current data packet payload length, the squared value of the equivalent transmission rate, and a preset numerical balancing constant are multiplied to obtain the impact intensity product; the impact intensity product is then scaled by half to obtain the nonlinear impact intensity score of the current data packet.

[0163] The numerical balancing coefficient constant is a dimensionless basic proportional term greater than 0 and not exceeding 10, preferably 1; the numerical balancing coefficient constant serves as a magnitude balancing term in the nonlinear characteristic function; when its value is too large, the nonlinear impact intensity score of all data packets is synchronously amplified; when its value approaches 0, the numerical difference between normal traffic and burst traffic in this score is compressed; the nonlinear impact intensity score generated in this step serves as the impact characteristic quantity of the current data packet under the coupled conditions of load scale and arrival density, and is transferred to the comprehensive intrusion identification index calculation step;

[0164] By dividing the payload length by the time truncation difference to obtain the equivalent transmission rate, and combining the payload length, the square of the equivalent transmission rate, and the numerical balancing coefficient constant to construct a nonlinear impact strength score, a more significant numerical response can be generated in the score for data packets that arrive in a concentrated period of time and have a large payload size. This processing differs from setting thresholds solely based on payload length or arrival frequency; instead, it incorporates both payload size and arrival density into the same nonlinear calculation chain, thus widening the difference between short-term burst traffic and ordinary periodic background traffic in the impact strength score. At the same time, the numerical balancing coefficient constant, as a dimensionless basic proportional term, balances the overall magnitude of the nonlinear score, allowing the score results to continue to participate in the subsequent fusion calculation of the comprehensive intrusion identification index within a suitable range of processor floating-point calculations.

[0165] Step three, which involves obtaining the historical average time interval, calculating the coherence coefficient between the current difference and that interval, and generating the periodic flow damping coefficient, specifically includes:

[0166] Determine whether the sequence number of the currently received data packet is greater than a preset sliding window constant; when the sequence number of the currently received data packet is not greater than the sliding window constant, directly fix the periodic flow damping coefficient of the current data packet to a constant of 1, and output the result as this step.

[0167] When the sequence number of the currently received data packet is greater than the sliding window constant, a sliding window is extracted with the current data packet as the endpoint and covering a specified number of received data packets in advance; within this sliding window, multiple time truncation differences formed between adjacent data packets are extracted according to the receiving order, and the multiple time truncation differences include the time truncation difference between the current data packet and the previous data packet; the extracted multiple time truncation differences are accumulated and summed, and the accumulated result is divided by the corresponding number of time intervals to obtain the average time interval within the sliding window;

[0168] By determining whether the sequence number of the received data packet is greater than a set sliding window constant, and when the condition is met, extracting multiple time-truncation differences formed by the current data packet as the endpoint and overwriting a specified number of received data packets, summing them, and then calculating the average time interval, the background time rhythm of the industrial control protocol communication process can be extracted based on the most recent continuous received traffic. This sliding window includes the time-truncation difference between the current data packet and the previous data packet, thus enabling the arrival rhythm of the current data packet to participate in the formation of the average time interval. By setting an appropriate window length, the average time interval can simultaneously reflect the time distribution of multiple normal communication rounds and smooth out occasional physical jitter or isolated delays. When the polling frequency of legitimate services changes, the average time interval can gradually change with the update of the sliding window, providing a continuous time reference basis for the generation of subsequent coherence ratios and periodic flow damping coefficients.

[0169] The sliding window constant is between 50 and 500, preferably 100; the sliding window constant is preset according to the Nyquist sampling coverage requirements of common fixed polling cycles in industrial control protocols, and is used to limit the range of data packets participating in the average time interval calculation; when the constant value is too large, the average time interval lags in responding to changes in the polling frequency of legitimate services; when the constant value is too small, the average time interval is sensitive to occasional physical jitter.

[0170] Divide the current data packet time truncation difference generated in step one by the aforementioned average time interval to obtain the coherence ratio of the current time interval relative to the historical average interval; multiply the coherence ratio by pi and the constant 2 consecutively to obtain the coherence angle; perform cosine operation on the coherence angle to obtain the coherence coefficient of the current data packet.

[0171] The coherence coefficient is squared to obtain the squared value of the coherence coefficient; the squared value of the coherence coefficient is multiplied by a pre-set attenuation control coefficient constant, and the negative of the product is taken as the exponent of the negative exponential attenuation model; exponential mapping is performed with the natural constant as the base and the exponent as the exponent to obtain the periodic flow damping coefficient of the current data packet.

[0172] The attenuation control coefficient constant is between 1 and 5, preferably 2; the attenuation control coefficient constant is determined based on the steepness control requirements of the negative exponential attenuation function, and is used to limit the influence of the square value of the coherence coefficient on the periodic flow damping coefficient; when the constant value is too large, the damping mapping is more sensitive to changes in the coherence coefficient, and the suppression of highly coherent flow increases accordingly; when the constant value is too small, the damping mapping is more gradual to changes in the coherence coefficient, and the suppression of periodic background flow decreases accordingly; the periodic flow damping coefficient generated in this step is used as a damping characteristic between the current data packet and the historical periodic reception rhythm, and is passed to the comprehensive intrusion identification index calculation step;

[0173] By calculating the coherence ratio between the current time truncation difference and the average time interval, converting this coherence ratio into a coherence angle, and then performing cosine operations, a periodic flow damping coefficient is generated based on the squared value of the coherence coefficient and a constant attenuation control coefficient. This mechanism can numerically suppress data packets that show a strong coherence relationship between the time interval and the historical average interval. The mechanism uses a periodic mapping relationship to characterize the degree of coherence between the current packet arrival rhythm and the background polling rhythm, and converts the degree of coherence into a damping weight through a negative exponential attenuation model. When the coherence relationship is strong, the periodic flow damping coefficient has a more significant suppressive effect on the corresponding packet score in the comprehensive intrusion identification index, thereby reducing the risk of legitimate high-frequency polling traffic being amplified individually due to dense loads or short time intervals. When the coherence relationship is weak, the damping effect is correspondingly weakened, allowing abnormal sudden or non-periodic changes to still retain a high score contribution in the subsequent comprehensive index.

[0174] Step four, which involves calculating the regularized load information entropy using the smoothing constant and the normalized probability, and obtaining the load information entropy gradient, specifically includes:

[0175] Call the normalized probability of each of the 256 possible byte values ​​in the current data packet obtained in step one, and add each normalized probability to a pre-set regularization smoothing constant to obtain the smoothed probability of the corresponding byte value; perform natural logarithm operation on each smoothed probability to obtain the logarithmic probability feature of the corresponding byte value.

[0176] Multiply the logarithmic probability feature of each byte value by its corresponding original normalized probability to obtain the single-byte probability feature value; sum the single-byte probability feature values ​​corresponding to the 256 possible byte values ​​and take the negative of the sum to obtain the regularized payload information entropy of the current data packet.

[0177] The regularized load information entropy of the previous data packet is called, the regularized load information entropy of the current data packet is subtracted from the regularized load information entropy of the previous data packet, and the absolute value of the difference is taken to obtain the load information entropy change magnitude between adjacent data packets; the load information entropy change magnitude is divided by the current data packet time truncation difference generated in step one to obtain the load information entropy gradient of the current data packet.

[0178] The regularization smoothing constant is between 0.00000001 and 0.00001, preferably 0.000001; the regularization smoothing constant is a boundary numerical stability constant used to smooth the probability inputs participating in the natural logarithm operation; when the value of this constant is too large, the original statistical differences in the probability distribution of the payload bytes are compressed; when the value of this constant is too small, the boundary smoothing effect on zero-probability byte values ​​is insufficient; the payload information entropy gradient generated in this step is used as a feature quantity of the current data packet payload statistical structure changing over time, and is passed to the joint penalty score calculation step;

[0179] By introducing a set regularization smoothing constant on top of the normalized probability, and performing a natural logarithmic operation on the smoothed probability, and then combining it with the original normalized probability to generate a regularized payload information entropy, the payload content of a single data packet can be statistically characterized from the perspective of the discreteness of the byte probability distribution. The regularization smoothing constant, as a boundary numerical stability constant, is used to smooth the probability inputs participating in the natural logarithmic operation, ensuring that byte values ​​with a probability of zero have computable inputs when participating in entropy calculation. Since the value of this smoothing constant is on a small order of magnitude, its effect is concentrated at the calculation boundary and does not replace the weight of the original normalized probability in entropy calculation. Based on this, the regularized payload information entropy of the current data packet is differiated from that of the previous data packet, and combined with time-truncated difference to generate a payload information entropy gradient, which can provide a characteristic quantity of the payload statistical structure changing over time for subsequent port difference joint penalty scoring.

[0180] Step five, calculating the absolute value of the difference between the destination port number of the current data packet and the previous data packet, multiplying it by the payload information entropy gradient and adding a smoothing baseline constant, generates a joint port difference penalty score, specifically including:

[0181] The current data packet destination port number and the previous data packet destination port number obtained in step one are called, the two are subtracted and the absolute value is taken to obtain the network port hop distance; the network port hop distance is used to characterize the discrete difference between adjacent data packets in the destination port dimension;

[0182] The load information entropy gradient generated in step four is called, and the load information entropy gradient is multiplied by the network port hop distance to obtain the basic penalty product; the basic penalty product is added to the pre-set smoothing benchmark constant to obtain the port difference joint penalty score of the current data packet.

[0183] The smoothing baseline constant is between 0.5 and 2, preferably 1; the smoothing baseline constant is used to provide a non-zero base term for the port difference joint penalty score when the network port hop distance is 0; when the constant value is too large, the multiplicative effect of the port hop distance on the port difference joint penalty score is relatively diluted; when the constant value is too small, the influence of the port hop distance on the port difference joint penalty score increases; the port difference joint penalty score generated in this step is used as a joint feature quantity of the time domain load mutation feature and the port spatial hop feature, and is passed to the comprehensive intrusion identification index calculation step;

[0184] By calculating the absolute value of the difference between the destination port number of the current data packet and the previous data packet, the network port hop distance is obtained. This network port hop distance is then multiplied by the load information entropy gradient and a smoothing baseline constant is added to generate a port difference joint penalty score. This allows for the cross-fusion of the load statistical change characteristics in the time domain and the hop characteristics in the port dimension. When the load information entropy gradient is high and the network port hop distance is large, the product of the two can contribute more numerically to the joint penalty score, making it easier for load abrupt changes accompanying port switching or scanning behavior to enter the comprehensive intrusion identification index. When the network port hop distance is 0, the product term no longer provides additional contribution. At this time, the smoothing baseline constant provides a non-zero basic term for the port difference joint penalty score, preventing the joint penalty score from becoming zero due to the port hop distance being 0, thus enabling the score to serve as a stable component in the subsequent fusion of the comprehensive intrusion identification index.

[0185] Step six involves determining the network card identifier. If the identifiers are the same, the compensation coefficient is set to a fixed value; if they are different, the timing compensation coefficient is calculated using the interrupt difference. Specifically, this includes:

[0186] Call the current data packet receiving network card identifier and the previous data packet receiving network card identifier obtained in step one, and compare the two for consistency; when the current data packet receiving network card identifier is the same as the previous data packet receiving network card identifier, fix the timing jitter compensation coefficient of the current data packet to a constant 1.

[0187] When the network card identifier for receiving the current data packet is different from that for receiving the previous data packet, the hardware network card interrupt timestamp based on global synchronization of the current data packet and the previous data packet is called to calculate the time difference between the two, and the absolute value of the time difference is taken to obtain the hardware interrupt time difference.

[0188] Add the hardware interrupt time difference to a preset minimum constant to obtain the smoothed hardware time difference; divide the current data packet time truncation difference generated in step one by the smoothed hardware time difference to obtain the timing jitter compensation coefficient of the current data packet.

[0189] The minimum constant is between 0.00000001 and 0.00001, preferably 0.000001; the minimum constant is a boundary value stable constant used to smooth the denominator of the hardware interrupt time difference involved in the division process; when the value of the constant is too large, the true minimum difference in the hardware interrupt time difference is compressed; when the value of the constant is too small, the denominator smoothing effect is insufficient when the hardware interrupt time difference is 0 or close to 0; the timing jitter compensation coefficient generated in this step is used as a proportional correction feature between the software system arrival time difference and the cross-NIC hardware interrupt time difference, and is passed to the comprehensive intrusion identification index calculation step;

[0190] When receiving network interface card (NIC) identifiers differ, the system calls the globally synchronized hardware NIC interrupt timestamp to calculate the hardware interrupt time difference between the current data packet and the previous data packet. The system arrival time truncation difference is then divided by the hardware interrupt time difference, which incorporates a very small constant, to obtain the timing jitter compensation coefficient. This corrects the proportional deviation between the software system arrival time difference and the hardware interrupt time difference in multi-NIC concurrent reception scenarios. During cross-NIC reception, the arrival time difference recorded by the system software scheduling layer may be affected by scheduling order and kernel processing delays, while the underlying hardware interrupt timestamp, after global synchronization, provides another time reference. This step uses this hardware time reference to proportionally correct the software time difference and fixes the timing jitter compensation coefficient to a constant 1 when receiving continuously on the same NIC, ensuring that continuous packets from the same NIC do not introduce additional compensation due to minor scheduling differences.

[0191] Step seven, which involves multiplying the impact score, damping coefficient, penalty score, and the squared term of the compensation coefficient to generate a comprehensive intrusion identification index, specifically includes:

[0192] Call the timing jitter compensation coefficient generated in step six and square it to obtain the squared term of the timing jitter compensation coefficient; call the nonlinear impact intensity score generated in step two, the periodic flow damping coefficient generated in step three, and the port difference joint penalty score generated in step five.

[0193] The nonlinear impact intensity score, the periodic flow damping coefficient, the squared term of the timing jitter compensation coefficient, and the port difference joint penalty score are continuously multiplied together to obtain the comprehensive intrusion identification index of the current data packet.

[0194] The comprehensive intrusion identification index is a fusion judgment feature formed by the current data packet under the combined effects of load impact, periodic damping, cross-NIC timing compensation and port entropy joint penalty. The comprehensive intrusion identification index generated within the initial calibration period is written into the comprehensive index sequence corresponding to the security benchmark calibration sequence. The comprehensive intrusion identification index generated in the real-time detection stage is passed to the threshold comparison and blocking control steps.

[0195] By multiplying and fusing the nonlinear impact intensity score, the periodic flow damping coefficient, the squared term of the timing jitter compensation coefficient, and the port difference joint penalty score, a comprehensive intrusion identification index is generated. This index unifies multiple dimensions of features, such as short-term load impact, periodic background suppression, cross-NIC timing ratio correction, and port and entropy gradient joint penalty, into a single judgment index. This fusion method makes it difficult for a single feature to independently determine the final judgment result; instead, a comprehensive score is formed under the combined effect of multiple features. Among them, the timing jitter compensation coefficient participates in the fusion in the form of a squared term, so that the timing ratio deviation caused by the inconsistency between the software arrival time difference and the hardware interruption time difference in cross-NIC scenarios is corrected in the comprehensive intrusion identification index. Through this comprehensive index, real-time data packets can be compared with the security threshold formed in the calibration period within the same numerical framework.

[0196] Step eight, the extraction of the median and median absolute deviation of the index of the calibrated sequence to generate a threshold, and the comparison of the current index with the threshold to perform blocking, specifically includes:

[0197] like Figure 5 As shown, at the end of the initial calibration period, the comprehensive intrusion identification index corresponding to the normal state data packets with differential calculation conditions in the security benchmark calibration sequence is obtained to form a comprehensive index sequence; the comprehensive index sequence is derived from the fusion judgment feature quantity generated for each normal state data packet in step seven within the calibration period;

[0198] The median of the composite index sequence is extracted to obtain the composite index median; each element in the composite index sequence is subtracted from the composite index median, and the absolute value of each difference is taken to form an absolute deviation sequence; the median absolute deviation is extracted from the absolute deviation sequence.

[0199] The median absolute deviation is multiplied by a pre-set robust amplification factor constant to obtain an adaptive float; the median of the composite index is added to the adaptive float to obtain a robust adaptive safety threshold; the robust amplification factor constant is 3 to 10, preferably 5; the robust amplification factor constant is set based on the parameterless statistical boundary of the median absolute deviation; when the constant value is too large, the robust adaptive safety threshold is further away from the statistical baseline of the calibration sequence; when the constant value is too small, the robust adaptive safety threshold is closer to the statistical baseline of the calibration sequence.

[0200] During the real-time detection phase, the comprehensive intrusion identification index of the current data packet generated in step seven is called and compared with the robust adaptive security threshold. If the comprehensive intrusion identification index of the current data packet is greater than the robust adaptive security threshold, it is determined that there is abnormal network behavior and a blocking action is performed. If the comprehensive intrusion identification index of the current data packet is not greater than the robust adaptive security threshold, it is determined that the current network data is within the statistical security range and the current data packet is allowed to pass.

[0201] By extracting the median of the composite index corresponding to the security benchmark calibration sequence, calculating the absolute deviation of each element in the composite index sequence relative to this median, and then extracting the median of the absolute deviation sequence to generate a robust adaptive security threshold, a blocking decision boundary based on the statistical distribution of the calibration sequence can be constructed. Compared with thresholding methods that directly use maximum, minimum, or variance-type statistics, the median and median absolute deviation do not require the composite index sequence to follow a normal distribution and are less sensitive to a small number of outliers. Even if a small number of early slow scan packets are mixed in during the initial calibration period or affected by environmental electromagnetic noise, this statistical method can weaken the rise or disturbance of the overall benchmark by individual abnormal samples. After generating an adaptive floating amount with a robust amplification factor constant, the final robust adaptive security threshold can be used as the decision boundary for subsequent real-time composite intrusion identification index blocking or allowing comparison.

[0202] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0203] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for identifying network intrusion in industrial control computers based on data feature analysis, characterized in that, include: The system arrives at the current data packet, and obtains the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency. Based on the obtained data, the time truncation difference and normalized probability are calculated. By combining the load length with the time cutoff difference, the nonlinear impact strength score is calculated using the numerical balancing coefficient constant. When the sequence number of the currently received data packet is greater than the set sliding window constant, a sliding window is extracted with the current data packet as the endpoint and covering a specified number of received data packets ahead. Within this sliding window, multiple time truncation differences between adjacent data packets are extracted according to the receiving order. These multiple time truncation differences include the time truncation difference between the current data packet and the previous data packet. The multiple time truncation differences are summed and divided by the corresponding number of time intervals to obtain the average time interval. The coherence coefficient between the time truncation difference of the current data packet and the average time interval is calculated to generate a periodic flow damping coefficient. When the sequence number of the currently received data packet is not greater than the sliding window constant, the periodic flow damping coefficient is set to a constant. The regularized load information entropy is calculated using the regularization smoothing constant and the normalized probability, and the gradient of the load information entropy is obtained. Calculate the absolute value of the difference between the destination port number of the current data packet and the previous data packet, and multiply the absolute value by the payload information entropy gradient to obtain the basic penalty product; The base penalty product is added to the set smoothing baseline constant to generate a port difference joint penalty score; Compare the current data packet with the receiving network interface card identifier of the previous data packet; If they are the same, the timing jitter compensation coefficient is set to a fixed value; If they are different, the timing jitter compensation coefficient is calculated based on the difference between the hardware network card interrupt timestamp of the current data packet and the previous data packet. Calculate the square of the timing jitter compensation coefficient, and multiply the nonlinear impact intensity score, the periodic flow damping coefficient, the port difference joint penalty score, and the square of the timing jitter compensation coefficient together to generate the comprehensive intrusion identification index of the current data packet; At the end of the initial calibration period, the comprehensive intrusion identification index corresponding to the normal state data packets with differential calculation conditions in the security benchmark calibration sequence is obtained to form a comprehensive index sequence. The security benchmark calibration sequence consists of the first specified number of normal state data packets after system startup. The median of the comprehensive index sequence is extracted as the comprehensive index median, and the median of the absolute deviation between each element in the comprehensive index sequence and the comprehensive index median is extracted as the median absolute deviation. A robust adaptive security threshold is generated based on the comprehensive index median and the median absolute deviation. The comprehensive intrusion identification index of the current data packet is compared with the robust adaptive security threshold to perform blocking.

2. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, The process of acquiring the system arrival timestamp, hardware network card interrupt timestamp, receiving network card identifier, destination port number, payload length, and byte frequency of the current data packet, and calculating the time truncation difference and normalized probability based on the acquired data, specifically includes: During the system initialization phase, bypass probes are set at the bottom layer of the industrial control computer's network protocol stack and at the hardware interrupt controller. For multi-NIC architectures, a precise time protocol is used to achieve global synchronization of the underlying hardware clocks of each NIC; During the initial calibration period, the first specified number of normal state data packets after system startup are recorded as a security baseline calibration sequence. For data packets received globally and sequentially by the operating system's network protocol stack, extract and record the amount of underlying data that is directly measured; The underlying data includes the system arrival timestamp, the receiving network card identifier, the hardware network card interrupt timestamp based on global synchronization, the payload length, the destination port number, and the frequency of each byte value in the payload; the receiving network card identifier is a globally unique identifier of the hardware network card that received the data packet. For a non-first received data packet with a payload length greater than zero, calculate the time difference between the system arrival timestamp of the current data packet and the system arrival timestamp of the previous data packet; The time difference is compared with the set system clock precision truncation constant, and the maximum value of the two is extracted as the time truncation difference. Divide the frequency of each byte value in the payload by the payload length to obtain the normalized probability of each byte value.

3. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, The method of combining the load length with the time truncation difference and calculating the nonlinear impact strength score using a numerical balancing coefficient constant specifically includes: Divide the payload length by the time truncation difference to obtain the equivalent transmission rate; Calculate the square of the equivalent transmission rate; Multiply the load length, the square of the equivalent transmission rate, and the set numerical balancing constant to obtain the product result; Dividing the product by a constant two yields the nonlinear impact strength score.

4. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, When the sequence number of the currently received data packet is greater than the sliding window constant, the calculation of the coherence coefficient between the time truncation difference of the current data packet and the average time interval, and the generation of the periodic flow damping coefficient, specifically includes: The coherence ratio is obtained by dividing the time truncation difference of the current data packet by the average time interval. The coherence ratio is continuously multiplied by pi and the constant 2 to obtain the coherence angle; Calculate the cosine value of the coherence angle as the coherence coefficient; Calculate the squared value of the coherence coefficient; Multiply the square of the coherence coefficient by the set attenuation control coefficient constant, and take its negative as the exponent. The periodic flow damping coefficient is calculated using the natural constant as the base and the exponent term as the exponent.

5. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, The calculation of the regularized load information entropy using the regularized smoothing constant and the normalized probability, and the determination of the load information entropy gradient, specifically includes: The normalized probability is added to the set regularization smoothing constant to obtain the smoothed probability; Calculate the natural logarithm of the smoothed probability; Multiply the natural logarithm value by the corresponding normalized probability to obtain a single-byte probability feature value; The single-byte probability feature values ​​corresponding to all possible byte values ​​are summed, and the negative of the sum is taken as the regularized payload information entropy of the current data packet. Calculate the difference between the regularized payload information entropy of the current data packet and the regularized payload information entropy of the previous data packet, and take the absolute value of the difference. Dividing the absolute value by the time truncation difference yields the load information entropy gradient.

6. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, The comparison of the receiving network card identifier of the current data packet and the previous data packet is performed. If they are the same, the timing jitter compensation coefficient is set to a fixed value. If they are different, the timing jitter compensation coefficient is calculated based on the difference between the hardware network card interrupt timestamps of the current data packet and the previous data packet. Specifically, this includes: Compare the receiving network interface card (NIC) identifier of the current data packet with the receiving NIC identifier of the previous data packet; When the receiving network card identifier of the current data packet is the same as the receiving network card identifier of the previous data packet, the timing jitter compensation coefficient is fixed to a constant of one. When the receiving network card identifier of the current data packet is different from the receiving network card identifier of the previous data packet, calculate the time difference between the hardware network card interrupt timestamp of the current data packet and the hardware network card interrupt timestamp of the previous data packet, and take the absolute value of the time difference to obtain the hardware interrupt time difference. The smoothed hardware time difference is obtained by adding the hardware interrupt time difference to a set minimum constant. The timing jitter compensation coefficient is obtained by dividing the time truncation difference by the smoothed hardware time difference.

7. The industrial control computer network intrusion identification method based on data feature analysis according to claim 1, characterized in that, The step of generating a robust adaptive security threshold based on the median of the comprehensive index and the absolute deviation of the median, and comparing the comprehensive intrusion detection index of the current data packet with the robust adaptive security threshold to perform blocking, specifically includes: Multiplying the median absolute deviation by a configurable robust amplification factor constant yields the adaptive float. The robust adaptive safety threshold is obtained by adding the median of the composite index to the adaptive floating amount. The comprehensive intrusion identification index of the current data packet acquired in real time is compared with the robust adaptive security threshold. If the overall intrusion detection index of the current data packet is greater than the robust adaptive security threshold, then it is determined that there is abnormal network behavior and a blocking action is performed. If the overall intrusion detection index of the current data packet is not greater than the robust adaptive security threshold, then the current network data is determined to be within the statistical security range and the data packet is allowed to pass.

Images