An industrial control safety defense method and system based on multi-twinship cooperation

Abstract

The application discloses an industrial control safety defense method and system based on multiple twin cooperation, acquires multiple-source operation data of an industrial control system, constructs a physical twin model embedded with physical constraints and capable of being updated online, and obtains a physical state prediction result; a rule twin model is constructed in combination with control logic rules and physical event rules to realize consistency verification and abnormality determination of an operation state; a behavior twin model is constructed based on normal operation samples to deduce and verify a safety response strategy; a geometric twin model is constructed based on device topology, device state and control logic identification to realize three-dimensional visual display of an abnormality and a disposal process; and a target safety response strategy is executed and feedback data is fed back to update each twin model. The application can realize integrated safety defense of abnormality detection, strategy deduction, visual display and closed-loop feedback of the industrial control system, and improve real-time performance, interpretability and interactivity of the industrial control safety defense.

Description

Technical Field

[0001] This invention relates to the fields of industrial control security and digital twin technology, and in particular to an industrial control security defense method and system based on multi-twin collaboration. Background Technology

[0002] Industrial control systems are widely used in critical infrastructure sectors such as power, petrochemicals, water treatment, and rail transportation. With the deep integration of industrial control systems and information networks, while enhancing automation and remote operation and maintenance capabilities, these systems also face security threats such as network attacks, malicious command tampering, and abnormal control behaviors.

[0003] Existing industrial control system (ICS) security protection measures mainly include network intrusion detection, industrial firewalls, protocol auditing, static simulation platforms, and ICS test ranges. These solutions typically focus on the network layer or offline simulation, making it difficult to simultaneously characterize the physical processes, control logic, and dynamic behavior within the ICS system, and also difficult to reflect the actual impact of attacks on physical equipment and process conditions.

[0004] Furthermore, existing anomaly detection methods often lack interpretability, and security response strategies lack mechanisms for simulation and verification before actual execution, easily leading to false alarms, missed alarms, or inappropriate responses. Meanwhile, existing visualization methods primarily rely on alarm lists or topology diagrams, making it difficult to intuitively present the impact of attacks and the handling process.

[0005] Therefore, there is an urgent need for an industrial control system security defense method and system that can integrate physical processes, control rules, behavioral evolution and three-dimensional visualization to improve the real-time performance, accuracy, interpretability and interactivity of industrial control system security protection. Summary of the Invention

[0006] To address these issues, this invention provides an industrial control system security defense method and system based on multi-twin collaboration, which solves the above problems.

[0007] In a first aspect, the present invention provides an industrial control system security defense method based on multi-twin collaboration, comprising:

[0008] S1. Obtain multi-source operating data from the industrial control system, wherein the multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, device topology data, device status data, and control logic identifiers;

[0009] S2. Construct a physical twin model based on the multi-source operating data, and embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system;

[0010] S3. Based on the physical state prediction results, control logic rules and physical event rules, construct a rule twin model, and use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain the anomaly judgment result and physical state deviation.

[0011] S4. Construct a behavioral twin model based on normal operation samples. The behavioral twin model is used to characterize the behavioral evolution range of the industrial control system under different operating conditions. After obtaining the anomaly determination result, use the behavioral twin model to deduce at least one safety response strategy, and verify the physical feasibility of the safety response strategy based on the physical twin model to obtain the target safety response strategy.

[0012] S5. Construct a geometric twin model based on the device topology data, device status data, and control logic identifier in the multi-source operation data, and map the anomaly determination result and the target safety response strategy to the geometric twin model for three-dimensional visualization.

[0013] S6. Execute the target security response strategy and send the feedback data after execution back to at least one of the physical twin model, the rule twin model, the behavioral twin model, and the geometric twin model to update the corresponding model.

[0014] Furthermore, a physical twin model is constructed based on the multi-source operational data, and the physical constraints of the industrial control system are embedded into the model training and online update process of the physical twin model. This includes: constructing physical control equations to describe the continuous evolution relationship of state variables according to the technological process and physical mechanism of the industrial control system. The physical control equations include at least one of the mass conservation equation, energy conservation equation, momentum conservation equation, and reaction kinetic equation; performing numerical approximation and parameter learning on the physical control equations based on a physical information neural network; training the physical twin model by using the residuals of the physical control equations, initial condition errors, boundary condition errors, and operational data fitting errors as constraints in the loss function; and incrementally updating or fine-tuning the physical twin model based on real-time operational data within a sliding time window during the operation of the industrial control system to ensure that the physical twin model remains consistent with the current operational state of the industrial control system.

[0015] Furthermore, a rule twin model is constructed based on the physical state prediction results, control logic rules, and physical event rules. This rule twin model is then used to perform physical consistency verification and control behavior verification of the industrial control system's operating state. This includes: parsing the programmable logic controller program, control logic file, or process flow specification in the industrial control system to obtain a control logic rule library; defining at least one of actuator state changes, control command switching, control mode switching, and process stage transitions as physical events; configuring allowed triggering conditions, triggering order, and corresponding physical response ranges for each physical event to obtain a physical event rule library; matching real-time observation data with the physical state prediction results, the control logic rule library, and the physical event rule library within a sliding time window; and generating an anomaly determination result when the deviation between the real-time observation data and the physical state prediction results exceeds a physical consistency threshold, or when the physical event does not meet the corresponding allowed triggering conditions, triggering order, or physical response range. The anomaly determination result includes the anomaly type, anomaly device identifier, and the reason for rule violation.

[0016] Furthermore, constructing a behavioral twin model based on normal operation samples includes: extracting state variables, control quantities, and operating condition parameters from the normal operation samples; obtaining an analytical expression between the state variables, control quantities, and operating condition parameters through symbolic regression; generating a behavioral benchmark range of the industrial control system under normal operating conditions based on the analytical expression and the statistical fluctuation range of the normal operation samples; and using the behavioral benchmark range as a behavioral space constraint of the behavioral twin model to limit the state evolution boundary during the safety response strategy deduction process.

[0017] Furthermore, after obtaining the anomaly determination result, at least one safety response strategy is deduced using the behavioral twin model, and the physical feasibility of the safety response strategy is verified based on the physical twin model. This includes: using the current state of the industrial control system, the anomaly determination result, and the physical state deviation as the state space of the reinforcement learning agent; using at least one of control command adjustment, control mode switching, device isolation, network link blocking, parameter rollback, and safe shutdown as the action space of the reinforcement learning agent; constructing the interaction environment of the reinforcement learning agent based on the behavioral twin model, and deducing multiple candidate safety response strategies in the interaction environment; constructing a reward function based on at least two of recovery time, physical consistency deviation, anomaly impact range, and secondary risks, and evaluating the candidate safety response strategies; and determining the candidate safety response strategy that satisfies the safe operating trajectory or stable interval defined by the physical twin model and whose reward function evaluation value meets preset conditions as the target safety response strategy.

[0018] Furthermore, a geometric twin model is constructed based on the equipment topology data, equipment status data, and control logic identifiers in the multi-source operational data. This includes: uniformly encoding at least two of the sensor status data, actuator status data, equipment topology data, control logic identifiers, equipment operating status, and historical maintenance records to obtain a multimodal feature representation; performing three-dimensional geometric reconstruction based on the multimodal feature representation, and introducing multi-view consistency constraints during the reconstruction process to ensure consistency in spatial layout, equipment size, and relative positional relationships corresponding to different viewpoints, different time slices, or different data sources; introducing industrial structure prior constraints during the three-dimensional geometric reconstruction process, which include at least one of equipment type constraints, process flow topology relationships, spatial layout rules, and equipment connection logic; and generating a three-dimensional industrial scene model corresponding to the industrial control system based on the multi-view consistency constraints and the industrial structure prior constraints, as the geometric twin model.

[0019] Furthermore, the anomaly determination result and the target safety response strategy are mapped to the geometric twin model for three-dimensional visualization, including: locating the corresponding three-dimensional device object in the geometric twin model based on the anomaly device identifier in the anomaly determination result; updating the display state of the three-dimensional device object based on the anomaly type, physical state deviation, and rule violation reason, wherein the display state includes at least one of color, transparency, alarm identifier, operating posture, and influence range; displaying changes in device state, network connection, or process flow state before and after strategy execution in the geometric twin model according to the target safety response strategy; receiving confirmation, adjustment, or abort commands input by the user based on the geometric twin model, and controlling the execution process of the target safety response strategy according to the confirmation, adjustment, or abort commands.

[0020] Secondly, the present invention provides an industrial control security defense system based on multi-twin collaboration, comprising:

[0021] The data acquisition module is used to acquire multi-source operating data of the industrial control system. The multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, equipment topology data, equipment status data, and control logic identifiers.

[0022] The physical twin module is used to construct a physical twin model based on the multi-source operational data, and to embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system.

[0023] The rule twin module is used to construct a rule twin model based on the physical state prediction results, control logic rules and physical event rules, and to use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system, so as to obtain the anomaly judgment result and physical state deviation.

[0024] The behavioral twin module is used to construct a behavioral twin model based on normal operation samples, and after obtaining the anomaly determination result, use the behavioral twin model to deduce at least one security response strategy, and perform physical feasibility verification of the security response strategy based on the physical twin model to obtain the target security response strategy.

[0025] The geometric twin module is used to construct a geometric twin model based on the device topology data, device status data and control logic identifiers in the multi-source operation data, and to map the anomaly judgment results and the target safety response strategy to the geometric twin model for three-dimensional visualization.

[0026] The closed-loop feedback module is used to execute the target security response strategy and send the executed feedback data back to at least one of the physical twin module, the rule twin module, the behavior twin module, and the geometric twin module to update the corresponding model.

[0027] Thirdly, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the industrial control security defense method based on multi-twin collaboration according to any embodiment of the present invention.

[0028] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the steps of the industrial control security defense method based on multi-twin collaboration according to any embodiment of the present invention.

[0029] The industrial control security defense method and system based on multi-twin collaboration of the present invention has the following beneficial effects:

[0030] 1. By constructing a collaborative model of physical twins, rule twins, behavioral twins, and geometric twins, a unified modeling of the physical state, control logic, behavioral evolution, and spatial scene of the industrial control system can be achieved.

[0031] 2. By embedding physical constraints and using online update mechanisms, the accuracy of physical state prediction and the model's adaptability to changes in operating conditions are improved.

[0032] 3. By using a rule twin model, the interpretable determination of abnormal behavior can be achieved, and the abnormal type, abnormal device, and reason for rule violation can be output.

[0033] 4. By using behavioral twin models to simulate and verify the physical feasibility of security response strategies, the risk of misoperation caused by directly executing response strategies can be reduced.

[0034] 5. Achieve 3D visualization of abnormal states and defense processes through geometric twin models, thereby improving the efficiency of industrial control security situational awareness and human-computer interaction. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A flowchart illustrating an industrial control security defense method based on multi-twin collaboration, as provided in an embodiment of the present invention;

[0037] Figure 2 The present invention provides a structural block diagram of an industrial control security defense system based on multi-twin collaboration, according to an embodiment of the present invention.

[0038] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] Please see Figure 1 The diagram shows a flowchart of an industrial control security defense method based on multi-twin collaboration according to the present invention.

[0041] Execute step S1 to obtain multi-source operating data of the industrial control system. The multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, device topology data, device status data, and control logic identifiers.

[0042] Real-time acquisition of multi-source operational data from industrial control networks and physical devices. Data acquisition can employ methods such as active acquisition, passive monitoring, mirror port acquisition, log access, OPC interface reading, database synchronization, or edge gateway forwarding.

[0043] In one embodiment, for a power substation industrial control system, the acquired data may include: current and voltage sample values ​​from the merging unit; switch status and protection action signals from the protection and control device; and data related to power substation industrial control, such as operation tickets, remote control commands, and alarm records from the monitoring backend.

[0044] In one embodiment of a water treatment industrial control system, the acquired data may include: water tank level, inlet and outlet flow rates, pump frequency, valve opening degree; process topology between pump stations, pipelines, valves and sensors; equipment operating status and historical fault records, and other data related to water treatment industrial control.

[0045] After acquiring the data, a timestamp, device identifier, data type identifier, and source identifier are configured for each data entry, and time synchronization processing is performed to enable data from different devices to be analyzed under a unified time reference.

[0046] Step S2 is executed, a physical twin model is constructed based on the multi-source operating data, and the physical constraints of the industrial control system are embedded in the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system.

[0047] Specifically, including:

[0048] Based on the technological process and physical mechanism of the industrial control system, physical control equations are constructed to describe the continuous evolution relationship of state variables. The physical control equations include at least one of the following: mass conservation equation, energy conservation equation, momentum conservation equation, and reaction kinetic equation.

[0049] The physical control equations are numerically approximated and their parameters are learned based on a physical information neural network.

[0050] The physical twin model is trained by using the physical control equation residuals, initial condition errors, boundary condition errors, and running data fitting errors as constraints in the loss function.

[0051] During the operation of the industrial control system, the physical twin model is incrementally updated or fine-tuned online based on real-time operating data within a sliding time window, so that the physical twin model is consistent with the current operating state of the industrial control system.

[0052] In one embodiment, the system constructs a physical twin model based on multi-source operational data and the physical mechanisms of the industrial control system. The physical twin model is used to predict the normal evolution trajectory of key state variables of the industrial control system and to provide a physical consistency benchmark for anomaly detection and safety response strategy verification.

[0053] When constructing the physical control equations, physical control equations describing the continuous evolution relationship of state variables are established according to the specific industrial control scenario. The physical control equations can be ordinary differential equations, partial differential equations, or a system of algebraic differential equations.

[0054] Then, modeling is performed based on a Physical Information Neural Network (PINN). The PINN can be used to numerically approximate and learn the parameters of the physical control equations. The PINN takes state variables, control variables, operating parameters, and time parameters as inputs, and predicts the state variables as outputs.

[0055] During the operation of the industrial control system, the system continuously receives real-time operating data and uses a sliding time window to update the physical twin model online.

[0056] For example, assuming a sliding time window of [tk, t], the system acquires sensor status data, actuator status data, and control command data within this time window, and calculates the deviation between the model's predicted values ​​and the actual observed values. When the deviation continuously exceeds a preset deviation threshold but does not reach an anomaly detection threshold, the system determines that there may be equipment aging, load changes, or operating condition adjustments, and initiates incremental learning or online fine-tuning mechanisms to update the physical twin model parameters.

[0057] In one specific embodiment, online updates may include:

[0058] Read real-time running data within the sliding time window;

[0059] Calculate the prediction error of the physical twin model;

[0060] Determine whether the prediction error meets the model update trigger condition;

[0061] If satisfied, update the model parameters based on the window data;

[0062] The physical control equation residuals were recalculated after the update.

[0063] The update is considered valid when the updated model satisfies both the data fitting error and physical residual constraints.

[0064] Step S3 is executed, a rule twin model is constructed based on the physical state prediction results, control logic rules and physical event rules, and the rule twin model is used to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain the anomaly judgment result and physical state deviation.

[0065] Specifically, including:

[0066] The programmable logic controller program, control logic file, or process flow specification in the industrial control system are parsed to obtain a control logic rule base.

[0067] At least one of the following is defined as a physical event: actuator state change, control command switching, control mode switching, and process stage transition;

[0068] Configure the allowed triggering conditions, triggering order, and corresponding physical response range for the physical events to obtain the physical event rule base;

[0069] Within the sliding time window, real-time observation data is matched with the physical state prediction results, the control logic rule base, and the physical event rule base;

[0070] When the deviation between the real-time observation data and the physical state prediction result exceeds the physical consistency threshold, or when the physical event does not meet the corresponding allowed triggering conditions, triggering order, or physical response range, an anomaly determination result is generated. The anomaly determination result includes the anomaly type, the anomaly device identifier, and the reason for the rule violation.

[0071] In one embodiment, a control logic rule base is first constructed. The PLC program, control logic file, ladder diagram, structured text, function block diagram, or process flow specification in the industrial control system are parsed to extract control conditions, execution actions, interlocking relationships, and timing constraints.

[0072] For example, the start / stop control logic of a water pump can be expressed as follows: when the liquid level is below the lower threshold, the water pump is prohibited from starting; when the liquid level is above the upper threshold, the water pump is started; when the outlet valve is not open, the water pump is prohibited from starting; if the flow rate does not increase within a preset time after the pump starts, it is determined to be an execution abnormality.

[0073] The above logic is converted into rule entries in the rule twin model. Each rule includes at least a rule number, triggering condition, execution action, constraint object, time constraint, and exception type.

[0074] Then, a physical event rule base is constructed. Discrete operations such as actuator state changes, control command switching, control mode switching, and process stage transitions are defined as physical events.

[0075] For example, a valve switches from closed to open; a water pump switches from stopped to running; a circuit breaker switches from open to closed; the control mode switches from automatic control to manual control; and the process stage switches from heating to cooling.

[0076] For each type of physical event, the system configuration allows for triggering conditions, triggering sequence, and the corresponding physical response range. For example, after a water pump start-up event is triggered, the outflow rate should increase to the corresponding range within a preset time; after a circuit breaker closing event is triggered, the relevant current, voltage, or power status should meet the expected change range.

[0077] Then, physical consistency verification is performed based on a sliding time window. The rule-based twin model verifies the real-time observation data within the sliding time window. Verification methods may include: comparing the real-time observation data with the prediction results of the physical twin model; determining whether the state variables satisfy the evolutionary relationship defined by the physical control equations; determining whether the control behavior satisfies the control logic rules; and determining whether the physical events satisfy the triggering conditions, triggering order, and response range.

[0078] Step S4 is executed to construct a behavioral twin model based on normal operation samples. The behavioral twin model is used to characterize the behavioral evolution range of the industrial control system under different operating conditions. After obtaining the anomaly determination result, at least one safety response strategy is deduced using the behavioral twin model, and the physical feasibility of the safety response strategy is verified based on the physical twin model to obtain the target safety response strategy.

[0079] Specifically, behavioral twin models are constructed based on normal operating samples, including:

[0080] State variables, control quantities, and operating parameters are extracted from the normal operation sample. State variables may include temperature, pressure, liquid level, flow rate, voltage, current, etc. Control quantities may include valve opening degree, pump frequency, circuit breaker status, set value, etc. Operating parameters may include load level, process stage, ambient temperature, equipment operation mode, etc.

[0081] The analytical expression between the state variable, the control quantity, and the operating condition parameter is obtained through symbolic regression.

[0082] Based on the analytical expression and the statistical fluctuation range of the normal operation samples, the behavioral benchmark range of the industrial control system under normal operating conditions is generated;

[0083] The behavioral benchmark range is used as the behavioral space constraint of the behavioral twin model to limit the state evolution boundary in the process of security response strategy deduction.

[0084] Specifically, the physical feasibility of the security response strategy is verified based on the physical twin model, including:

[0085] The current state of the industrial control system, the anomaly determination result, and the physical state deviation are used as the state space of the reinforcement learning agent. In a specific embodiment, the state space may include: the current state of the industrial control system, the anomaly determination result, the physical state deviation, the equipment operation mode, the network communication status, and the spatial association information of the corresponding equipment in the geometric twin model.

[0086] The action space of the reinforcement learning agent includes at least one of the following: control command adjustment, control mode switching, device isolation, network link blocking, parameter rollback, and safe shutdown. In a specific embodiment, the action space may include: adjusting control commands, switching control modes, isolating abnormal devices, blocking abnormal network links, switching to a safe operating mode, starting backup devices, and safe shutdown.

[0087] The interaction environment of the reinforcement learning agent is constructed based on the behavioral twin model, and multiple candidate security response strategies are deduced in the interaction environment.

[0088] The candidate security response strategies are evaluated by constructing a reward function based on at least two of the following: recovery time, physical consistency deviation, scope of anomaly impact, and secondary risks.

[0089] Candidate safety response strategies that satisfy the safe operating trajectory or stable range defined by the physical twin model and whose reward function evaluation values ​​meet preset conditions are determined as the target safety response strategy.

[0090] Step S5 is executed, a geometric twin model is constructed based on the device topology data, device status data and control logic identifier in the multi-source operation data, and the anomaly determination result and the target safety response strategy are mapped to the geometric twin model for three-dimensional visualization.

[0091] Specifically, constructing a geometric twin model includes:

[0092] At least two types of sensor status data, actuator status data, equipment topology data, control logic identifiers, equipment operating status, and historical maintenance records are uniformly encoded to obtain multimodal feature representations;

[0093] Three-dimensional geometric reconstruction is performed based on the multimodal feature representation, and multi-view consistency constraints are introduced during the reconstruction process to ensure consistency in spatial layout, equipment size, and relative positional relationships across different viewpoints, time slices, or data sources. For example, in industrial settings, some equipment may not be fully identifiable from a single viewpoint due to occlusion. By fusing camera views, laser scanning point clouds, CAD models, equipment ledgers, and topological connections, consistency constraints on equipment position and shape can be applied, reducing occlusion, misalignment, and structural distortion issues.

[0094] In the 3D geometric reconstruction process, prior constraints on industrial structures are introduced. These constraints include at least one of the following: equipment type constraints, process flow topology relationships, spatial layout rules, and equipment connection logic. In one embodiment, equipment type constraints may include corresponding structural templates for equipment such as switchgear, pumps, valves, pipelines, reactors, and transformers; process flow topology relationships may include directional connections between pumps, valves, pipelines, and water tanks; spatial layout rules may include safety distances for high-voltage equipment, pipeline layout rules, and operating channel rules; and equipment connection logic may include the requirement that sensors be attached to corresponding process nodes and actuators be connected to corresponding control loops. Through these prior constraints, the system can generate 3D industrial scene models that better conform to real engineering specifications and physical feasibility.

[0095] Based on the multi-view consistency constraint and the prior constraint of the industrial structure, a three-dimensional industrial scene model corresponding to the industrial control system is generated as the geometric twin model.

[0096] Specifically, this involves 3D visualization, including:

[0097] Based on the abnormal device identifier in the anomaly determination result, locate the corresponding three-dimensional device object in the geometric twin model;

[0098] Based on the anomaly type, physical state deviation, and rule violation reason, update the display status of the 3D device object. The display status includes: highlighting the abnormal device, changing the color according to the risk level, displaying alarm indicators, showing changes in the device's operating posture, displaying the range of influence with a transparent area, replaying the physical state changes caused by the attack in the form of animation, and displaying abnormal network connections with changes in link color.

[0099] According to the target security response strategy, the geometric twin model displays changes in equipment status, network connectivity, or process flow status before and after the strategy execution. In one embodiment, when a network segment is blocked, the geometric twin model can turn the corresponding communication link red or gray; when a device is isolated, the 3D model can display an isolation indicator; when the opening degree of a valve changes, the 3D model can display the valve's action process.

[0100] The system receives confirmation, adjustment, or abort commands from the user based on the geometric twin model, and controls the execution of the target security response strategy according to these commands. For example, when the system recommends automatically disconnecting a network link, security personnel can confirm the operation in the 3D interface, or adjust it to isolate only a specific terminal device.

[0101] Step S6 is executed, the target security response strategy is executed, and the feedback data after execution is sent back to at least one of the physical twin model, the rule twin model, the behavioral twin model, and the geometric twin model to update the corresponding model.

[0102] The following describes the practical application of this method using a controlled verification scenario based on an equivalent process in the P1 raw water supply and storage stage of a SWAT system. In this embodiment, a verification system is built in an experimental environment isolated from the actual production network, employing a soft-polar network XMZS7-300 industrial control-water treatment process simulation platform, an S300 industrial control-water treatment simulation controller, and an XMZS7-300 industrial control-water treatment process demonstration platform. The inlet electric valve, flow meter, raw water tank, level gauge, main delivery pump, and standby delivery pump functionally correspond to MV101, FIT101, T101, LIT101, P101, and P102 in the P1 stage of the SWAT system, respectively. The aforementioned platforms and models are for illustrative purposes only and do not constitute a limitation on the scope of protection of this invention.

[0103] During data acquisition, the system simultaneously collects the control commands and actual status of the inlet electric valve, flow meter readings, raw water tank level, main and standby delivery pump status, network communication data from the S300 simulation controller, and equipment topology data, and assigns a unified timestamp and device identifier to each data point. When the raw water tank reaches the preset high level condition, and the normal control logic should close the inlet electric valve, the controlled verification terminal alters the inlet electric valve control command output by the S300 simulation controller from the closed state to the open state, causing the inlet electric valve to remain abnormally open. This verification is conducted only in an isolated and authorized simulation environment.

[0104] The physical twin model predicts the liquid level change under normal control conditions based on the mass conservation relationship between the inlet and outlet flow rates and the liquid level change in the raw water tank. When the inlet electric valve abnormally remains open, the flow meter detects continuous water inflow, and the physical twin model predicts that the liquid level in the raw water tank will continue to rise and approach the unsafe range, thus obtaining the deviation between the actual operating state and the normal physical state. The system uses real-time flow and liquid level data within a sliding time window to update the physical twin model online.

[0105] The rule twin model stores the control logic rule that "the inlet electric valve should be closed when the raw water tank reaches a high liquid level," and the physical event rule that "the flow rate should change accordingly after the inlet electric valve is opened." The actual control command requires the inlet electric valve to be opened, which is inconsistent with the current high liquid level condition, and the changes in flow rate and liquid level indicate that the command has already acted on the physical process. Therefore, the rule twin model generates an anomaly determination result, identifying the anomaly type as a control command anomaly, the abnormal device as the inlet electric valve, and the reason for the rule violation as the inlet electric valve still being required to be opened under high liquid level conditions.

[0106] The behavioral twin model uses the current liquid level, physical state deviation, anomaly judgment results, inlet electric valve status, and network communication status as the basis for strategy inference to generate candidate safety response strategies, such as reissuing the shutdown command, closing the inlet electric valve and blocking the abnormal control link, and switching to a safe control mode and isolating the source of abnormal control. The physical twin model predicts the flow rate and liquid level changes after each candidate strategy is executed, eliminates strategies that may cause the liquid level to continue to rise or generate secondary risks, and determines the candidate strategy that can stop the inlet water and keep the raw water tank within a safe range as the target safety response strategy.

[0107] The geometric twin model locates the S300 simulation controller, inlet electric valve, flow meter, raw water tank, level gauge, main transfer pump, and standby transfer pump in the 3D scene based on equipment identification, and highlights abnormal equipment, abnormal control links, and predicted risk ranges. The process display platform simultaneously displays the tampered start command, the normally executed stop command, the actual liquid level curve, the physical twin predicted curve, and the target safety response strategy, and shows the status of the inlet electric valve and the change in the raw water tank level before and after the strategy execution, allowing safety personnel to confirm, adjust, or terminate the strategy.

[0108] After receiving execution confirmation, the closed-loop feedback module issues a command to close the inlet electric valve and blocks the abnormal control link. It then collects the actual status of the inlet electric valve, flow meter readings, and raw water tank level as execution feedback. When the feedback indicates that the inlet electric valve is closed, the inlet flow rate has decreased, and the raw water tank level no longer rises, the system confirms the effectiveness of the target safety response strategy and sends the feedback data back to the physical twin model, rule twin model, behavioral twin model, and geometric twin model to update the model status and complete the closed-loop safety defense verification through multi-twin collaboration.

[0109] In one embodiment, an industrial control security defense system based on multi-twin collaboration includes a physical entity layer, a data transmission and mapping layer, a digital twin core layer, and an application service layer.

[0110] The physical entity layer includes the actual operating industrial control equipment, sensors, actuators, and network infrastructure. For example, in power industrial control scenarios, the physical entity layer may include transformers, circuit breakers, disconnect switches, protection and control devices, intelligent terminals, merging units, IED devices, industrial switches, and scheduling or station control layer servers. In chemical or water treatment scenarios, the physical entity layer may include reaction vessels, water pumps, motors, valves, level sensors, temperature sensors, pressure sensors, flow meters, PLC controllers, and host computers.

[0111] The data transmission and mapping layer is used to collect multi-source operational data from the physical entity layer and map this multi-source operational data to each twin model. The multi-source operational data may include: sensor status data, actuator status data, control command data, network communication data, etc. The data transmission and mapping layer can unify data from different sources, time scales, and formats into a data format that the twin models can process through methods such as protocol parsing, time synchronization, data cleaning, missing value compensation, outlier removal, label mapping, and unit normalization.

[0112] The core layer of digital twins includes physical twin models, rule twin models, behavioral twin models, and geometric twin models. The physical twin model describes the continuous state evolution of key physical processes in the industrial control system; the rule twin model describes control logic, safety interlock rules, process constraints, and physical event rules; the behavioral twin model describes the dynamic behavioral evolution of the system under normal operating conditions, abnormal operating conditions, and attack scenarios, and deduces safety response strategies; and the geometric twin model constructs a 3D model of the industrial scenario and visualizes anomaly detection results, physical state deviations, and safety response processes.

[0113] The application service layer provides functions such as anomaly detection, security situation awareness, attack impact assessment, security response strategy recommendation, 3D visualization, human-computer interaction confirmation, and closed-loop defense verification.

[0114] In one embodiment, when the system detects that a certain control command may cause physical process instability, the rule twin model outputs the cause of the anomaly, the behavior twin model infers multiple response schemes, and the geometric twin model displays the affected equipment and the scope of risk spread in the three-dimensional scene. Finally, the system automatically executes or the target safety response strategy is executed after confirmation by safety personnel.

[0115] Please see Figure 2 The diagram illustrates a structural block diagram of an industrial control security defense system based on multi-twin collaboration according to the present invention.

[0116] like Figure 2As shown, an industrial control security defense system based on multi-twin collaboration includes: a data acquisition module 200, a physical twin module 210, a rule twin module 220, a behavior twin module 230, a geometric twin module 240, and a closed-loop feedback module 250.

[0117] The data acquisition module 200 is used to acquire multi-source operating data of the industrial control system. The multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, equipment topology data, equipment status data, and control logic identifiers.

[0118] The physical twin module 210 is used to construct a physical twin model based on the multi-source operating data, and to embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system.

[0119] The rule twin module 220 is used to construct a rule twin model based on the physical state prediction results, control logic rules and physical event rules, and use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain anomaly judgment results and physical state deviation.

[0120] The behavioral twin module 230 is used to construct a behavioral twin model based on normal operation samples, and after obtaining the anomaly determination result, use the behavioral twin model to deduce at least one security response strategy, and perform physical feasibility verification of the security response strategy based on the physical twin model to obtain the target security response strategy.

[0121] The geometric twin module 240 is used to construct a geometric twin model based on the device topology data, device status data and control logic identifier in the multi-source operation data, and to map the anomaly judgment result and the target safety response strategy to the geometric twin model for three-dimensional visualization.

[0122] The closed-loop feedback module 250 is used to execute the target security response strategy and send the executed feedback data back to at least one of the physical twin module, the rule twin module, the behavior twin module, and the geometric twin module to update the corresponding model.

[0123] It should be understood that Figure 2 The modules and references described in the document Figure 1 The steps described in the text correspond to those in the method described above. Therefore, the operations, features, and corresponding technical effects described above also apply to the method described in the text. Figure 2 The various modules in the document will not be described in detail here.

[0124] In other embodiments, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the industrial control security defense method based on multi-twin collaboration in any of the above method embodiments.

[0125] S1. Obtain multi-source operating data from the industrial control system, wherein the multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, device topology data, device status data, and control logic identifiers;

[0126] S2. Construct a physical twin model based on the multi-source operating data, and embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system;

[0127] S3. Based on the physical state prediction results, control logic rules and physical event rules, construct a rule twin model, and use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain the anomaly judgment result and physical state deviation.

[0128] S4. Construct a behavioral twin model based on normal operation samples. The behavioral twin model is used to characterize the behavioral evolution range of the industrial control system under different operating conditions. After obtaining the anomaly determination result, use the behavioral twin model to deduce at least one safety response strategy, and verify the physical feasibility of the safety response strategy based on the physical twin model to obtain the target safety response strategy.

[0129] S5. Construct a geometric twin model based on the device topology data, device status data, and control logic identifier in the multi-source operation data, and map the anomaly determination result and the target safety response strategy to the geometric twin model for three-dimensional visualization.

[0130] S6. Execute the target security response strategy and send the feedback data after execution back to at least one of the physical twin model, the rule twin model, the behavioral twin model, and the geometric twin model to update the corresponding model.

[0131] Computer-readable storage media may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created based on the use of the multi-twin collaborative industrial control security defense system, etc. Furthermore, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include memory remotely configured relative to the processor, and these remote memories can be connected to the multi-twin collaborative industrial control security defense system via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0132] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 3 As shown, the device includes a processor 310 and a memory 320. The electronic device may also include an input device 330 and an output device 340. The processor 310, memory 320, input device 330, and output device 340 can be connected via a bus or other means. Figure 3 Taking a bus connection as an example, the memory 320 is the computer-readable storage medium described above. The processor 310 executes various server functions and data processing by running non-volatile software programs, instructions, and modules stored in the memory 320, thereby implementing the industrial control security defense method based on multi-twin collaboration described in the above embodiment. The input device 330 can receive input digital or character information and generate key signal inputs related to user settings and function control of the multi-twin collaboration-based industrial control security defense system. The output device 340 may include a display screen or other display device.

[0133] The aforementioned electronic device can execute the method provided in the embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the method provided in the embodiments of the present invention.

[0134] In one implementation, the above-described electronic device is applied to an industrial control security defense system based on multi-twin collaboration, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:

[0135] S1. Obtain multi-source operating data from the industrial control system, wherein the multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, device topology data, device status data, and control logic identifiers;

[0136] S2. Construct a physical twin model based on the multi-source operating data, and embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system;

[0137] S3. Based on the physical state prediction results, control logic rules and physical event rules, construct a rule twin model, and use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain the anomaly judgment result and physical state deviation.

[0138] S4. Construct a behavioral twin model based on normal operation samples. The behavioral twin model is used to characterize the behavioral evolution range of the industrial control system under different operating conditions. After obtaining the anomaly determination result, use the behavioral twin model to deduce at least one safety response strategy, and verify the physical feasibility of the safety response strategy based on the physical twin model to obtain the target safety response strategy.

[0139] S5. Construct a geometric twin model based on the device topology data, device status data, and control logic identifier in the multi-source operation data, and map the anomaly determination result and the target safety response strategy to the geometric twin model for three-dimensional visualization.

[0140] S6. Execute the target security response strategy and send the feedback data after execution back to at least one of the physical twin model, the rule twin model, the behavioral twin model, and the geometric twin model to update the corresponding model.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A security defense method for industrial control systems based on multi-twin collaboration, characterized in that, Includes the following steps: S1. Obtain multi-source operating data from the industrial control system, wherein the multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, device topology data, device status data, and control logic identifiers; S2. Construct a physical twin model based on the multi-source operating data, and embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system; S3. Based on the physical state prediction results, control logic rules and physical event rules, construct a rule twin model, and use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system to obtain the anomaly judgment result and physical state deviation. S4. Construct a behavioral twin model based on normal operation samples. The behavioral twin model is used to characterize the behavioral evolution range of the industrial control system under different operating conditions. After obtaining the anomaly determination result, use the behavioral twin model to deduce at least one safety response strategy, and verify the physical feasibility of the safety response strategy based on the physical twin model to obtain the target safety response strategy. S5. Construct a geometric twin model based on the device topology data, device status data, and control logic identifier in the multi-source operation data, and map the anomaly determination result and the target safety response strategy to the geometric twin model for three-dimensional visualization. S6. Execute the target security response strategy and send the feedback data after execution back to at least one of the physical twin model, the rule twin model, the behavioral twin model, and the geometric twin model to update the corresponding model.

2. The industrial control system security defense method based on multi-twin collaboration according to claim 1, characterized in that, A physical twin model is constructed based on the multi-source operational data, and the physical constraints of the industrial control system are embedded into the model training and online update process of the physical twin model, including: Based on the technological process and physical mechanism of the industrial control system, physical control equations are constructed to describe the continuous evolution relationship of state variables. The physical control equations include at least one of the following: mass conservation equation, energy conservation equation, momentum conservation equation, and reaction kinetic equation. The physical control equations are numerically approximated and their parameters are learned based on a physical information neural network. The physical twin model is trained by using the physical control equation residuals, initial condition errors, boundary condition errors, and running data fitting errors as constraints in the loss function. During the operation of the industrial control system, the physical twin model is incrementally updated or fine-tuned online based on real-time operating data within a sliding time window, so that the physical twin model is consistent with the current operating state of the industrial control system.

3. The industrial control system security defense method based on multi-twin collaboration according to claim 1, characterized in that, Based on the physical state prediction results, control logic rules, and physical event rules, a rule twin model is constructed. This rule twin model is then used to perform physical consistency verification and control behavior verification of the industrial control system's operating state, including: The programmable logic controller program, control logic file, or process flow specification in the industrial control system are parsed to obtain a control logic rule base. At least one of the following is defined as a physical event: actuator state change, control command switching, control mode switching, and process stage transition; Configure the allowed triggering conditions, triggering order, and corresponding physical response range for the physical events to obtain the physical event rule base; Within the sliding time window, real-time observation data is matched with the physical state prediction results, the control logic rule base, and the physical event rule base; When the deviation between the real-time observation data and the physical state prediction result exceeds the physical consistency threshold, or when the physical event does not meet the corresponding allowed triggering conditions, triggering order, or physical response range, an anomaly determination result is generated. The anomaly determination result includes the anomaly type, the anomaly device identifier, and the reason for the rule violation.

4. The industrial control system security defense method based on multi-twin collaboration according to claim 1, characterized in that, A behavioral twin model is constructed based on normal operating samples, including: Extract state variables, control quantities, and operating parameters from the normal operation samples; The analytical expression between the state variable, the control quantity, and the operating condition parameter is obtained through symbolic regression. Based on the analytical expression and the statistical fluctuation range of the normal operation samples, the behavioral benchmark range of the industrial control system under normal operating conditions is generated; The behavioral benchmark range is used as the behavioral space constraint of the behavioral twin model to limit the state evolution boundary in the process of security response strategy deduction.

5. The industrial control system security defense method based on multi-twin collaboration according to claim 1, characterized in that, After obtaining the anomaly determination result, at least one security response strategy is deduced using the behavioral twin model, and the physical feasibility of the security response strategy is verified based on the physical twin model, including: The current state of the industrial control system, the anomaly determination result, and the physical state deviation are used as the state space of the reinforcement learning agent. The action space of the reinforcement learning agent is defined by at least one of the following: control command adjustment, control mode switching, device isolation, network link blocking, parameter rollback, and safe shutdown. The interaction environment of the reinforcement learning agent is constructed based on the behavioral twin model, and multiple candidate security response strategies are deduced in the interaction environment. The candidate security response strategies are evaluated by constructing a reward function based on at least two of the following: recovery time, physical consistency deviation, scope of anomaly impact, and secondary risks. Candidate safety response strategies that satisfy the safe operating trajectory or stable range defined by the physical twin model and whose reward function evaluation values ​​meet preset conditions are determined as the target safety response strategy.

6. The industrial control system security defense method based on multi-twin collaboration according to claim 1, characterized in that, A geometric twin model is constructed based on the device topology data, device status data, and control logic identifiers in the multi-source operational data, including: At least two types of sensor status data, actuator status data, equipment topology data, control logic identifiers, equipment operating status, and historical maintenance records are uniformly encoded to obtain multimodal feature representations; Three-dimensional geometric reconstruction is performed based on the multimodal feature representation, and multi-view consistency constraints are introduced during the reconstruction process to ensure that the spatial layout, device size and relative positional relationship corresponding to different viewpoints, different time slices or different data sources remain consistent. In the process of 3D geometric reconstruction, prior constraints on industrial structures are introduced. These prior constraints include at least one of equipment type constraints, process flow topology relationships, spatial layout rules, and equipment connection logic. Based on the multi-view consistency constraint and the prior constraint of the industrial structure, a three-dimensional industrial scene model corresponding to the industrial control system is generated as the geometric twin model.

7. The industrial control system security defense method based on multi-twin collaboration according to claim 3, characterized in that, The anomaly determination result and the target security response strategy are mapped to the geometric twin model for three-dimensional visualization, including: Based on the abnormal device identifier in the anomaly determination result, locate the corresponding three-dimensional device object in the geometric twin model; Based on the anomaly type, physical state deviation, and rule violation reason, update the display state of the 3D device object. The display state includes at least one of color, transparency, alarm indicator, running posture, and influence range. Based on the target security response strategy, the geometric twin model displays the changes in equipment status, network connectivity, or process flow status before and after the strategy is executed. The system receives confirmation, adjustment, or abort commands from the user based on the geometric twin model, and controls the execution of the target security response strategy according to the confirmation, adjustment, or abort commands.

8. An industrial control system security defense system based on multi-twin collaboration, used to implement the method described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to acquire multi-source operating data of the industrial control system. The multi-source operating data includes at least sensor status data, actuator status data, control command data, network communication data, equipment topology data, equipment status data, and control logic identifiers. The physical twin module is used to construct a physical twin model based on the multi-source operational data, and to embed the physical constraints of the industrial control system into the model training and online update process of the physical twin model to obtain the physical state prediction result of the industrial control system. The rule twin module is used to construct a rule twin model based on the physical state prediction results, control logic rules and physical event rules, and to use the rule twin model to perform physical consistency verification and control behavior verification on the operating state of the industrial control system, so as to obtain the anomaly judgment result and physical state deviation. The behavioral twin module is used to construct a behavioral twin model based on normal operation samples, and after obtaining the anomaly determination result, use the behavioral twin model to deduce at least one security response strategy, and perform physical feasibility verification of the security response strategy based on the physical twin model to obtain the target security response strategy. The geometric twin module is used to construct a geometric twin model based on the device topology data, device status data and control logic identifiers in the multi-source operation data, and to map the anomaly judgment results and the target safety response strategy to the geometric twin model for three-dimensional visualization. The closed-loop feedback module is used to execute the target security response strategy and send the executed feedback data back to at least one of the physical twin module, the rule twin module, the behavior twin module, and the geometric twin module to update the corresponding model.

9. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method according to any one of claims 1 to 7.

Images