Information leakage evaluation and fuzzy reinforcement control method and system of cyber-physical system

Abstract

The application relates to the technical field of information security, and discloses a method and system for information leakage evaluation and fuzzy reinforcement control of an information physical system. The method comprises the following steps: firstly, a fuzzy timed automaton model is constructed; state fuzziness and time uncertainty are uniformly depicted through a Z-type membership degree satisfaction operator; a closed upper bound unit and a bounded time transition operator are used to abstract a continuous-time state space into a finite-state fuzzy Tick automaton, so that the state space explosion problem is relieved; secondly, unobservable events are filtered through an attacker observation ability threshold; and a subset construction method is used to generate a deterministic belief automaton; and thirdly, a global fuzzy timed current position opacity measurement value in a [0, 1] interval is calculated based on a Goedel fuzzy implication operator, so that continuous quantitative evaluation of information leakage risk is realized, and the system can meet the safety protection requirements without interrupting the business. The application can be used for information protection of typical CPSs such as intelligent transportation, intelligent manufacturing and communication systems.

Description

Technical Field

[0001] This invention belongs to the field of cyber-physical systems (CPS) security technology, specifically relating to a CPS information leakage quantitative assessment and fuzzy reinforcement control method and system based on fuzzy timed automata (FTA), applicable to information security assessment and proactive protection in critical information infrastructure fields such as industrial control systems, smart grids and intelligent manufacturing. Background Technology

[0002] Cyber-Physical Systems (CPS) are a new type of complex system that integrates computing, communication, and physical processes. With the large-scale deployment of industrial control equipment, sensor networks, and edge computing platforms, CPS have been widely applied in critical infrastructure sectors of the national economy and social operations. Because the systems operate with a large amount of sensitive state information, control strategy information, and business data, the leakage of this sensitive information could lead to serious security incidents, causing huge economic losses and even threatening public safety.

[0003] Opacity theory is an important formal method for information flow security analysis. Its core idea is to analyze whether an attacker, given only partial observation of system behavior, can infer whether the system has performed secret actions or reached secret states. Classical opacity analysis techniques typically employ formal models such as finite automata (FA) and Petri nets, utilizing state observer construction and linguistic analysis methods to verify whether the system meets opacity requirements. As CPS security requirements continue to increase, researchers have further employed models such as timed automata (TA) to describe time-constrained behavior and proposed various timed opacity analysis methods. Some research has introduced fuzzy logic and probabilistic analysis to attempt to quantify the degree of leakage. However, most existing studies focus on one aspect of time constraints, fuzzy uncertainty, or quantitative assessment, lacking a unified analytical framework to address all these issues.

[0004] Overall, existing methods have the following shortcomings:

[0005] (1) It is difficult to uniformly handle state fuzziness and time constraint uncertainty. In actual CPS, factors such as sensor measurement error, equipment parameter fluctuation, and network communication delay cause the system state and time constraint to have fuzzy characteristics at the same time. Existing technologies lack methods that can characterize both in a unified framework, and there is a large deviation between theoretical models and physical systems.

[0006] (2) Information leakage assessment results lack continuous quantification capabilities. Most existing methods adopt a binary judgment method of satisfying or not satisfying, which cannot quantitatively describe the magnitude and severity of leakage risks, and is difficult to provide fine-grained decision-making basis for subsequent system security optimization design and risk management.

[0007] (3) Existing information leakage protection mechanisms are limited to the classic Opacity model. In complex models that combine state fuzziness, time constraints and continuous quantitative evaluation, there is currently no systematic research or engineering application on how to conduct effective and flexible proactive intervention. Most existing methods can only passively alert complex models to risks and lack adaptive proactive defense measures. Summary of the Invention

[0008] To address the shortcomings of the existing technologies, this invention proposes a method and system for information leakage assessment and fuzzy reinforcement control in CPS, aiming to simultaneously solve problems such as unified modeling of state fuzziness and time uncertainty, continuous quantitative assessment of information leakage risk, and the lack of proactive defense mechanisms.

[0009] This invention provides the following technical solution:

[0010] A method for assessing and reinforcing CPS information leakage includes the following steps:

[0011] S1: Obtain the physical device operating status and network communication timing parameters of the target CPS, construct an FTA model, and formally define it as a six-tuple. and initialize security assessment parameters (fuzzy secret location set vector) Fuzzy non-secret location set vector ) and attacker observation parameters (observable event set, discrete observation threshold) );

[0012] S2: Extract the maximum correlation boundary of each clock variable in the FTA model, divide the continuous-time state space into equivalent grids using closed supremum units, truncate the overbounded clock assignments using a bounded time shift operator, and alternately perform time shift expansion and discrete event migration expansion using a breadth-first forward search. A finite-state fuzzy Tick automaton is generated through a maximum-minimum fuzzy matrix composite operation. ;

[0013] S3: Traverse the system action set, removing actions with observability lower than... Actions are categorized into the unobservable event set. and the fuzzy Tick automaton All marked as Replace the transition edges of internal events with empty transition markers to generate a nondeterministic state machine with empty transitions. ;

[0014] S4: Using subset construction method for nondeterministic state machines Deterministic processing is performed, using the set of all possible fuzzy state pairs that the system can reach under a given sequence of observable events as macro-nodes of belief states, to construct a deterministic belief automaton. ;

[0015] S5: Traversing Deterministic Belief Automata Each attainable belief state Calculate the local secret confidence level respectively. Local non-secret confidence Local opacity is calculated based on Gödel's fuzzy implication operator. Take all attainable belief states of The global minimum value serves as a measure of the opacity of the current position in the global fuzzy time assignment (FTCLO). To quantitatively assess the risk of information leakage in the system;

[0016] S6: Set the global FTCLO metric. With preset safety protection threshold In comparison, if Then, extract the set of illegal belief states, locate the key high-risk states of the Tick automaton in each illegal belief state, execute the maximum-minimum composite truncation control law on the controllable action transition matrix of its predecessor node, and adaptively suppress the confidence of high-risk transitions; after applying control, reconstruct the automaton and recalculate the global metric value. If the protection threshold is reached, the control is strengthened successfully; otherwise, step S6 is executed repeatedly until the target is met.

[0017] The present invention also provides a CPS information leakage assessment and fuzzy reinforcement control system for implementing the method, characterized in that it includes:

[0018] The FTA modeling module is used to collect the device operating status and timing parameters of the target CPS, construct the FTA model, and initialize the fuzzy secret location set vector, the fuzzy non-secret location set vector, and the attacker's observation capability parameters.

[0019] The time finite abstraction module is used to extract the maximum correlation boundary of each clock variable. It uses the closed supremum unit and the bounded time transition operator to perform equivalent partitioning of the continuous time state space. It uses breadth-first search to alternately execute time transition extension and discrete event migration extension to generate a finite state fuzzy Tick automaton.

[0020] The observation filtering module is used to extract the set of unobservable events based on the attacker's observation capability threshold, replace the relevant transition edges with empty transitions, and generate a nondeterministic state machine with empty transitions.

[0021] The Belief Automaton Construction Module is used to determinize nondeterministic state machines using the subset construction method, and to construct deterministic belief automata using belief state sets as macro nodes.

[0022] The FTCLO evaluation module is used to traverse all reachable belief states of the belief automaton, calculate the local secret confidence, local non-secret confidence and local opacity of each belief state based on Gödel fuzzy implication operators, and output the global FTCLO metric.

[0023] The fuzzy reinforcement control module is used to compare the global FTCLO metric with the safety protection threshold. When the metric fails to meet the standard, it extracts the set of violation states, locates the key high-risk states, backtracks the predecessor nodes, and executes the maximum-minimum composite truncation control law on the controllable action transition matrix. It then reconstructs the automaton for cyclic verification until the global FTCLO metric reaches the safety protection threshold.

[0024] The beneficial effects of the method and system provided by this invention include at least the following:

[0025] (1) Joint modeling of state fuzziness and time constraint uncertainty was achieved. The constructed FTA model, by introducing fuzzy membership vector and Z-type satisfaction operator, can accurately characterize the actual operating characteristics of CPS under complex environments such as sensor measurement error and communication delay, and greatly eliminate the deviation between theoretical model and physical system.

[0026] (2) Breaking through the limitations of traditional binary judgment, continuous quantitative information leakage assessment in the [0,1] interval is realized. By calculating the local-global two-level opacity based on Gödel fuzzy implication operator, a refined quantitative decision-making basis is provided for system security classification, dynamic adjustment of protection strategy and risk optimization. At the same time, by using bounded time shift operator and closed supremum unit technology, the unbounded continuous time state space is abstracted into finite discrete state, ensuring the computability and engineering feasibility of the assessment process.

[0027] (3) Innovatively, a fuzzy reinforcement control mechanism is introduced. When the evaluation result fails to meet the standard, it can automatically trace and locate the high-risk state. By performing a maximum-minimum composite truncation operation on the controllable action transfer matrix, the risk of information leakage is flexibly blocked without destroying the normal business logic of the system. It also supports cyclic verification of compliance and realizes the closed-loop linkage of evaluation-decision-control. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the overall flow of the control method in an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram illustrating the information leakage assessment and security enhancement scenario of the AGV physical system in a highly confidential smart factory in Example 2.

[0030] Figure 3 The fuzzy Tick automaton generated in Embodiment 2 of the present invention A structural diagram (containing 15 discrete states and 5 fuzzy position branches).

[0031] Figure 4 The deterministic belief automaton generated in Embodiment 2 of the present invention A structural diagram (containing 12 sets of belief states);

[0032] Figure 5 The Tick automaton reconstructed after fuzzy enhancement control in Embodiment 2 of the present invention A schematic diagram of the structure;

[0033] Figure 6 The belief automaton reconstructed after fuzzy reinforcement control in Embodiment 2 of the present invention A structural diagram. Detailed Implementation

[0034] Please see Figures 1 to 6 The technical solution of the present invention will be described in detail below with reference to the embodiments.

[0035] This invention details, through several embodiments, how the information leakage assessment and fuzzy reinforcement control method using CPS specifically addresses the problem of quantitative assessment of information leakage when the system state has fuzzy semantics and time constraints are uncertain. The key focus of this invention is to construct an FTA model and utilize finite-state abstraction techniques and belief automata to achieve quantitative calculation and reinforcement control of the continuous information leakage risk of the system, namely, Fuzzy Timed Current-Location Opacity (FTCLO).

[0036] Example 1:

[0037] This embodiment provides a basic example describing the detailed implementation process of FTCLO quantization calculation and enhanced control for a CPS. It details the specific implementation process of FTCLO metric quantization calculation and enhanced control for a given CSP, which mainly includes the following six steps:

[0038] Step S1: Construct the CPS FTA model and initialize the parameters.

[0039] First, obtain the physical device operating status and network communication timing parameters of the target CPS. Based on this, first, construct a fuzzy time constraint system with time fault tolerance capabilities, and then establish an FTA model that integrates state fuzziness and time uncertainty on the clock variable set. The specific implementation steps are as follows:

[0040] 1) Constructing fuzzy time constraints:

[0041] make Indicates a finite clock The complete set of fuzzy time constraints constructed above is defined by the following syntactic rules:

[0042]

[0043] in, These are the time constant and the preset fuzzy fault tolerance boundary, respectively; For clock variables; This is a clock relational operator.

[0044] The clock valuation function is defined as follows: Used for each clock variable Assign a natural number For a given clock constraint Assigning values ​​to clock Define its satisfaction operator for Continuous values ​​within the interval are used to quantify the degree to which time constraints are dynamically satisfied.

[0045]

[0046] Among them, the atomic satisfaction operator A Z-type membership function is used to refine the characterization of time uncertainty. The specific piecewise function form is defined as follows:

[0047]

[0048] In the above formula, the binary operator Follow the following mapping rules: if relational operators ,but Corresponding to the plus sign If relational operators ,but Corresponding to the minus sign .

[0049] 2) Constructing an FTA model

[0050] Fuzzy time constraint set based on the above definition We construct an FTA model that can simultaneously characterize the evolution of physical state membership and temporal fuzzy boundaries, formally defined as a six-tuple:

[0051]

[0052] The definitions of each tuple are as follows:

[0053] · It is a finite set of Crisp Locations, representing the discrete physical operating modes of the system.

[0054] · For a finite set of clock variables, each clock variable There is a corresponding clock assignment .

[0055] · This is a set of fuzzy locations. Each fuzzy location is represented by a row vector. This indicates its components. This indicates that the system is currently in a clearly defined physical location. Fuzzy membership degree.

[0056] · The initial fuzzy position vector of the system; the real-time evolution state of the entire CPS is determined by fuzzy state pairs. Unified formal representation.

[0057] · This represents a finite set of actions (discrete events). For each action... Each of them has a corresponding fuzzy clock constraint set. and a clock reset set .

[0058] · This is a set of fuzzy transition relation matrices. Matrix elements. This indicates that the clock constraint is satisfied and the action is executed. At that time, the system from a clear location Transferred to The confidence level of the state transition.

[0059] 3) Initialization of security parameters and attacker observation capabilities:

[0060] Define a fuzzy secret location set vector representing the secret state of the system. and fuzzy non-secret location set vector Define a fuzzy set of observable events for external attackers. and observation threshold .

[0061] Step S2: Generate a Tick automaton based on time discretization using bounded time shift operators and closed supremum units.

[0062] To address the problem of the infinite state space caused by continuous time, a finite-time abstraction technique is introduced to transform the dynamic evolution of the system into a finite-state fuzzy Tick automaton.

[0063]

[0064] in For a set of states, This is the initial state. For event sets, This represents a state transition relationship.

[0065] Based on the bounded time transition and state equivalence determination, the specific implementation rules for discretization expansion are as follows:

[0066] 1) Clock limit Determination:

[0067] Extract each clock variable in the system Maximum correlation boundary This boundary is defined as all instances involving clocks. The supremum of comparison boundaries appearing in the fuzzy clock constraint. Specifically, for each atomic fuzzy constraint... Its associated boundary is defined as follows:

[0068]

[0069] Furthermore, the clock Maximum correlation boundary Defined as the maximum value of all relevant constraint boundaries appearing in the system:

[0070]

[0071] The upper limit defined by this segmentation precisely distinguishes between strict and non-strict inequalities, as well as fuzzy fault-tolerant intervals, and calibrates the clock variable. The absolute limit critical point that can cause a change in the evolutionary logic of a system.

[0072] 2) Equivalence determination of time states and clock space aggregation:

[0073] Based on the rigorously defined maximum correlation boundary, the infinite clock assignment space is represented by the closed supremum unit. Perform equivalent mesh generation. Based on the monotonically convergent property of fuzzy constraints, when any clock... The evolution value exceeds its upper limit (i.e. When ), the result of its satisfaction calculation for all time constraints will remain constant.

[0074] Therefore, when time evolution causes the clock assignment to be greater than or equal to the maximum boundary... At that time, the bounded time transition operator is used. The clock state is forcibly truncated and confined to a finite grid region. This mechanism maintains the finite state abstraction while ensuring the semantic equivalence of system behavior logic and FTCLO evaluation.

[0075] 3) Expand the search to determine the set of states and their jump relationships :

[0076] Using a breadth-first search strategy, starting from the initial state Start alternating between the following two expansions, and put the resulting new states and new transitions into sets respectively. and until no new state is generated:

[0077] a) Time-lapse extension: Position remains unchanged The clock updates in units of time. Triggering a synchronization clock event Generate transfer:

[0078]

[0079] b) Discrete event migration extension: When the system responds to external events... At that time, combined with the current position vector Transition matrix and the current clock constraint satisfaction Calculate the fuzzy position vector at the next moment: And generate a transfer:

[0080]

[0081] in, This represents the maximum-minimum composite operator in fuzzy logic. This indicates that an upper bound truncation operation is performed on each element of the result vector, i.e. The clock variable is reset and updated according to the reset set: If a zero-fuzzy position vector is generated Then branch pruning will be performed.

[0082] Step S3: Unobservable event elimination and implicit transfer transformation based on observation capability threshold

[0083] Based on the eavesdropper observation behavior preset in step S1, the finite-state fuzzy Tick automaton generated in step S2 is... Perform event-level filtering and abstraction.

[0084] 1) Extracting the set of unobservable events:

[0085] Iterate through the system action set and classify all events with observability below a preset observation capability threshold into an unobservable event set. :

[0086]

[0087] in This indicates that the attacker successfully observed the event. The degree of membership of capabilities.

[0088] 2) Construct a nondeterministic empty transition state machine:

[0089] Fuzzy Tick automata transfer relationship All belonging to the unobservable set event tags (i.e.) Replace all with empty transfer markers This transforms the original automaton into a nondeterministic state machine with empty transitions. .

[0090] Step S4: Generation of a deterministic belief automaton based on subset construction method

[0091] External attackers cannot directly perceive unobservable events (implicit migration). The specific fuzzy state evolution within the ) can only be observed through the reception of observable events. The belief automaton is a sequence of parameters used to estimate the possible current states of the system (i.e., the so-called belief states). The belief automaton describes the estimation of the system state by an external attacker.

[0092] 1) Deterministic state of automata:

[0093] Using subset construction method for nondeterministic state machines Perform deterministic mapping to generate a deterministic finite automaton as a belief automaton.

[0094] .

[0095] 2) Constructing a set of belief states:

[0096] Automaton Each macro node in Defined as a "belief state set". This set contains the set of all possible fuzzy state pairs that the system can reach under a given external observation timeline, formally represented as:

[0097]

[0098] It fully maps the system's "maximum knowledge domain" that an attacker can grasp based on the current observation sequence.

[0099] Step S5: Perform an information leakage assessment based on the current location and calculate the global FTCLO metric.

[0100] Traversing Belief Automata Each set of belief states Calculate the fuzzy semantic overlap at the current position of the system and output the global FTCLO metric.

[0101] 1) Quantifying the confidence level of local secrets:

[0102] Regarding the current state of belief Extract the fuzzy position vectors of all possible state pairs. and the preset fuzzy secret location set vector Perform a max-min inner product operation and take the maximum value among all possible state pairs as the secret confidence. :

[0103]

[0104] 2) Quantifying local non-secret confidence:

[0105] Similarly, the fuzzy position vector With the preset fuzzy non-secret location set vector Perform a max-min inner product operation and take the maximum value as the non-secret confidence level. :

[0106]

[0107] 3) Computational Belief Automata Single state Local FTCLO below:

[0108] In fuzzy logic, the core security semantics of system opacity can be mapped to a conditional implication rule: if an external attacker infers from current observations that the system may be in a secret state (antecedent, confidence level 1), then... Then the system must also possess an equivalent or stronger illusion to make it appear to be in a non-secret state (the consequent, with a confidence level of ). ).

[0109] To precisely quantify the validity of this logical relationship, this invention introduces the Gödel fuzzy implication operator to assess the local opacity of the current belief state. Perform the calculation:

[0110]

[0111] The basic principle of this operator is explained as follows:

[0112] a) Absolute cover conditions ( When the confidence level of local secrets Less than or equal to the local non-secret confidence level This means that within the attacker's current observation domain, the strength of the "cover signal" provided by the secure and legitimate non-secret state is sufficient to completely cover or drown out the "exposure signal" caused by the secret state. Under this game-theoretic situation, the above implied logic holds true. The system determines that the attacker cannot distinguish between secret actions and legitimate security interference, and since no information leakage has occurred at the current location, therefore... .

[0113] b) Quantitative penalty conditions ( When the confidence level of local secrets Strictly greater than the local non-secret confidence level At this point, the salience of the clandestine activity has breached the upper limit of the existing security state's cover. The implication of security semantics is broken, and information leakage occurs in the system. According to Gödel's penalty mechanism, opacity is downgraded and directly depends on the value of the consequent (i.e., Therefore, a quantization leak occurred in the system, causing... .

[0114] 4) Calculate and output the global FTCLO:

[0115] Extract the local opacity of the set of all reachable belief states in the belief automaton. The global minimum value is taken as the final output metric. :

[0116]

[0117] The final output global metric The dynamic labeling system identifies the highest global risk of CPS being reverse-engineered by an external attacker at its current location, revealing its core secrets. The smaller the value, the greater the potential for system information leakage.

[0118] Step S6: If the metric value does not meet the standard, the fuzzy enhancement control module is activated to achieve global FTCLO enhancement compliance.

[0119] Obtain the global opacity metric output in step S5. Next, check whether the predetermined protection lower limit has been reached. If not, implement a dynamic reinforcement control strategy, which includes:

[0120] 1) Risk assessment and violation status extraction:

[0121] global metrics Compared with the system's preset security protection threshold Compare. If The system was determined to have a risk of information leakage. All unmet belief states (i.e., local opacity) were extracted from the belief automaton. status ), which constitute a set of states of violation of beliefs.

[0122] 2) Key Positioning state:

[0123] For each unmet belief state Perform the following operations: Extract the state that has been solved in step S5. Local secret confidence and local non-secret confidence .exist Includes all fuzzy Tick automata In the state, filter out the key factors that trigger the limit exceedance. state The criteria for determining this state are: the degree to which the state exposes the secret location not only exceeds the current security cover limit, but also exceeds the degree of membership to the non-secret location, i.e., it satisfies... and .

[0124] 3) Precursor state backtracking and control strategy design:

[0125] For each key state ,exist Reverse search for its non-automaton in an automaton Precursor state of the event That is, to find controllable actions. , making Designing a fuzzy reinforcement control law This strategy does not directly disable events. Instead, it controls the fuzzy transfer relationship, making Controlled actions Transition matrix satisfy:

[0126]

[0127] in, All elements are of Order constraint matrix, It is a maximum-minimum composite operator. The physical essence of this control strategy is: to transform the original transition matrix... All values ​​greater than the non-secret confidence level High-risk transfer membership forced modification .

[0128] 4) Local and global FTCLO verification:

[0129] After implementing this enhanced control strategy, the original critical state Replaced to a controlled state The controlled position vector All its components are subject to The upper limit suppression reduces the local secret confidence of the new state. According to the properties of Gödel's implication operator, the local opacity after control will jump to [value missing]. ,Right now This ensures that the local opacity metric meets the standard. The automaton is reconstructed, and the global FTCLO is checked. If the system protection threshold is met, the reinforcement process ends; otherwise, step S6 is re-executed.

[0130] This embodiment also provides a CPS information leakage assessment and fuzzy reinforcement control system for the aforementioned control method, which includes:

[0131] The FTA modeling module is used to collect the device operating status and timing parameters of the target CPS, construct the FTA model, and initialize the fuzzy secret location set vector, the fuzzy non-secret location set vector, and the attacker's observation capability parameters.

[0132] The time finite abstraction module is used to extract the maximum correlation boundary of each clock variable. It uses the closed supremum unit and the bounded time transition operator to perform equivalent partitioning of the continuous time state space. It uses breadth-first search to alternately execute time transition extension and discrete event migration extension to generate a finite state fuzzy Tick automaton.

[0133] The observation filtering module is used to extract the set of unobservable events based on the attacker's observation capability threshold, replace the relevant transition edges with empty transitions, and generate a nondeterministic state machine with empty transitions.

[0134] The Belief Automaton Construction Module is used to determinize nondeterministic state machines using the subset construction method, and to construct deterministic belief automata using belief state sets as macro nodes.

[0135] The FTCLO evaluation module is used to traverse all reachable belief states of the belief automaton, calculate the local secret confidence, local non-secret confidence and local opacity of each belief state based on Gödel fuzzy implication operators, and output the global FTCLO metric.

[0136] The fuzzy reinforcement control module is used to compare the global FTCLO metric with the safety protection threshold. When the metric fails to meet the standard, it extracts the set of violation states, locates the key high-risk states, backtracks the predecessor nodes, and executes the maximum-minimum composite truncation control law on the controllable action transition matrix. It then reconstructs the automaton for cyclic verification until the global FTCLO metric reaches the safety protection threshold.

[0137] Example 2

[0138] This embodiment provides a method and system for assessing information leakage and enhancing security in a highly confidential intelligent factory AGV logistics system.

[0139] To facilitate understanding of the technical solution and engineering application value of this invention, based on Embodiment 1, a simplified model of the Automated Guided Vehicle (AGV) logistics system in a classified intelligent factory is used as the research object to further explain the information leakage assessment and intelligent reinforcement control method based on FTA proposed in this invention.

[0140] In this smart factory, AGVs are responsible for transporting critical materials between production workshops. Some of these transport tasks involve core products, key components, or classified process materials. When AGVs perform such transport tasks, they need to enter core classified assembly areas. Therefore, whether an AGV is performing a classified transport task constitutes important confidential information that the system needs to protect.

[0141] Attackers cannot directly obtain the AGV's internal control information. Instead, they attempt to infer whether the AGV is currently performing a classified transportation task by monitoring the wireless communication between the AGV and the dispatch center, analyzing the sequence of events, and the communication time intervals. Once an attacker can accurately deduce the classified task based on the observed sequence, it indicates that information has been leaked into the system.

[0142] Meanwhile, in actual industrial environments, due to factors such as positioning errors, sensor noise, and overlapping factory boundaries, the state of AGVs at the boundary between public logistics areas and confidential assembly areas is difficult to characterize precisely in a deterministic manner, and is more suitable for fuzzy membership representation. On the other hand, latency, jitter, and link congestion in wireless communication make the timing of events uncertain. Therefore, this embodiment uses FTA to uniformly characterize state fuzziness and time uncertainty, and uses FTCLO to continuously quantify and assess the risk of information leakage. When the FTCLO is lower than a preset threshold, an intelligent control strategy will be triggered to implement enhanced control for high-risk states, thereby improving the system's FTCLO and achieving proactive protection against information leakage. The scenario in this embodiment is as follows. Figure 2 As shown, the control method specifically includes the following steps:

[0143] Step S1: Establish FTA model and initialize parameters

[0144] First, obtain the operating parameters of the AGV logistics system and construct an FTA model. The specific parameter settings for this embodiment are as follows:

[0145] 1) Physical location and initial state:

[0146] Location set ,in: This indicates that the AGV is located in a public logistics transportation area; This indicates that the AGV is located in the core, confidential assembly area. Since the AGV initially stops at a public logistics channel, the initial fuzzy position vector of the system is set as follows: This indicates that the AGV is completely in a public area.

[0147] 2) Clock variable:

[0148] The system contains a single set of clock variables. clock variable This indicates the cumulative running time of the AGV since its most recent successful status communication with the scheduling center, in minutes.

[0149] 3) Action specifications, time constraints, and state transitions:

[0150] This embodiment includes the following two typical actions: ,in

[0151] Action a: Indicates a status broadcast action.

[0152] After the status broadcast action is completed, the dispatch center successfully receives the data, and the system restarts the next round of communication timing, resetting the clock variable. Assume that through statistical analysis of the system, its corresponding fuzzy transition matrix is ​​obtained as follows:

[0153]

[0154] Due to the ambiguous transition zone formed by positioning errors between the public logistics area and the classified assembly area, when an AGV is near the boundary, although it still mainly belongs to the public area, it has a high probability of entering the classified area, and vice versa. Broadcast actions require wireless communication, so eavesdroppers may be able to detect their occurrence. This action must be completed within a short period after the most recent communication, and its corresponding fuzzy time constraint is defined as:

[0155]

[0156] This means the system should, in principle, complete status broadcasting within one minute, while allowing for a one-minute tolerance period due to network jitter. After the action is executed, the clock variable set... Perform a reset.

[0157] Action b: Indicates a local autonomous navigation action.

[0158] When an AGV enters an underground workshop, a metal-shielded area, or a wireless coverage blind spot, it can no longer maintain real-time communication with the dispatch center. At this point, the AGV enters local autonomous navigation mode and continues to perform its transportation task according to a pre-planned path. Since the entire navigation process does not involve wireless communication, it is difficult for an attacker to directly observe this event. Through statistical analysis of the system, its state transition matrix is ​​derived:

[0159]

[0160] This action typically occurs after the AGV has been out of scheduling communication for a period of time, therefore fuzzy time constraints are used:

[0161]

[0162] This indicates that the system will trigger this action after approximately 3 minutes of cumulative offline operation, with a 2-minute tolerance period allowed. Since the communication connection is not re-established throughout the process, the clock variable is not reset after the action is executed.

[0163] 4) Safety assessment benchmark parameters:

[0164] The security objective of this embodiment is to prevent attackers from accurately determining whether the AGV is performing a classified transportation task. Since performing a classified transportation task requires entering a core classified assembly area, the set of secret locations is defined as follows:

[0165]

[0166] Public logistics areas serve as a legal cover, and their set of non-secret locations is defined as follows:

[0167]

[0168] 5) Attacker's observation capabilities:

[0169] Assume the attacker can only deploy wireless eavesdropping devices around the factory perimeter, and their observation capability is affected by communication distance, signal power, and environmental noise. Let the attacker's observation capability threshold be:

[0170]

[0171] Due to periodic state broadcast events Using high-power wireless communication, the eavesdropper has a high degree of membership in the observation, which is set as... .because therefore This is an observable event; a local autonomous navigation event. The entire process is completed within the AGV's local controller, without wireless communication. This results in low observability for eavesdroppers, and therefore, it is set as follows: .because ,therefore It is an unobservable event.

[0172] Step S2: Achieve bounded discretization of time by closing the supremum unit, and generate a fuzzy Tick automaton.

[0173] By using the closed supremum unit partitioning and the bounded time transition operator, the continuous-time state space of the above-mentioned FTA is discretized to generate a finite-state fuzzy Tick automaton. In this process, positional evolution is combined with the passage of time (using...) The event simulation (physically corresponding to the time shift when the AGV is out of communication) is used for extrapolation. The generated fuzzy Tick automaton is calculated according to the detailed steps described in Example 1. like Figure 3 As shown.

[0174] The automaton contains 15 discrete states. The main structure is as follows:

[0175] 1) Time-based Tick events The evolutionary chain (x represents the clock value):

[0176] a) Location : State 0 ( ) State 1 ( ) State 3 ( ) State 6 ( ) State 6 ( )

[0177] b) Location State 2 ( ) State 4 ( ) State 8 ( ) State 12 ( ) State 12 ( )

[0178] c) Location State 5 ( ) State 9 ( ) State 13 ( ) State 14 ( ) State 14 ( )

[0179] d) Location Status 7 ( ) State 11 ( ) State 11 ( )

[0180] e) Location Status 10 ( ) State 10 ( )

[0181] 2) Cross-location transfer based on discrete events a and b:

[0182] a) Action a triggers a transition: State 0 State 2; State 1 State 2; State 2 State 5; State 4 State 5; State 5 State 5; State 9 Status 5.

[0183] b) Action b triggers transition: State 3 State 7; State 6 State 10; State 7 State 7; State 8 State 7; State 10 State 10; State 11 State 11; State 12 State 14; State 13 State 7; State 14 Status 14.

[0184] Step S3: Filter out unobservable events and construct an empty transition nondeterministic state machine.

[0185] Based on the observation threshold of external eavesdroppers Filter the action set:

[0186] a) Due to Action 'a' is determined to be an observable event.

[0187] b) Due to Action b is determined to be an unobservable event, i.e., a hidden behavior.

[0188] Fuzzy Tick automata Replace all transition edges marked as 'b' with empty transition edges. Generate a nondeterministic state machine with null transitions. In engineering terms, this means that external eavesdroppers can only intercept the AGV's status broadcast events, but are completely unaware of the AGV's autonomous navigation behavior within the shielded blind zone. This creates a blind zone of event perception (i.e., empty transition) in the eavesdropper's observation sequence. ).

[0189] Step S4: Generate a deterministic finite automaton (belief automaton) )

[0190] right A subset construction method is used to process empty transition closures, generating a deterministic belief automaton from the attacker's perspective. Since action b has been converted When an attacker observes the same observable trajectory, the system may be in multiple states simultaneously as a result of executing b.

[0191] This means that when an eavesdropper intercepts a series of communication broadcasts (including time intervals) outside the factory area, they cannot determine whether the AGV has experienced a brief period of autonomous offline shuttle movement during that time. Therefore, the attacker can only infer that the AGV may be simultaneously in a set of multiple location states (i.e., belief states). The calculated belief automaton... ,like Figure 4 As shown.

[0192] This belief automaton It contains 12 sets of belief states, with specific mapping and transition relationships (belief automata). Status The original state set is shown in Table 2 below:

[0193] Table 2

[0194]

[0195] Belief automata Tick ​​chain: ; ; Observational shift of action a: , , , , , .

[0196] Step S5: Iterate through each belief state, calculate and output the global metric FTCLO.

[0197] For belief automata Each belief state in the process, using pre-defined... and Calculate the local secret confidence level respectively. non-secret confidence And by comparison, the local opacity is obtained. The specific evaluation results for each belief state are shown in Table 3 below (belief automata). The local FTCLO calculation process for each state is shown in the table below:

[0198] Table 3

[0199] 0.0 1.0 1.0 0.0 1.0 1.0 0.8 0.6 0.6 0.5 1.0 1.0 0.8 0.6 0.6 0.6 1.0 1.0 0.7 1.0 1.0 0.8 0.6 0.6 0.6 1.0 1.0 0.6 1.0 1.0 0.8 0.6 0.6 0.6 1.0 1.0

[0200] After calculating the local opacity of all reachable belief states, the global minimum value is extracted as the final output metric. :

[0201]

[0202] Therefore, the global FTCLO metric of this embodiment is 0.6. This quantification result indicates that, given the fuzzy time constraints and observer capability threshold, when an eavesdropper hears a specific AGV status broadcast sequence, their confidence in inferring that the AGV has entered the core confidential assembly area can reach a maximum of 0.8, while the system can only provide a legal public area cover of 0.6, and the system's minimum security cover is 0.6 (unable to reach the absolutely opaque state of 1.0). This FTCLO metric provides a precise quantitative basis for the system's subsequent dynamic adjustment of security threshold alarms and AGV communication strategies.

[0203] Step S6: Fuzzy Enhancement Control and Transition Matrix Pruning under Unsatisfactory Conditions

[0204] 1) Identify critical states and precursors: Set safety protection thresholds Due to the current system global metric value Initiate enhanced control measures. Identify a high-risk belief state. (That Extract the key from within them. State: State Its secrecy confidence level is rather than secret confidence level Only Tracing back, it was found that this state was formed by a predecessor state. Through action It was transferred from elsewhere.

[0205] 2) Implement fuzzy matrix pruning: For automata status Actions at state 1 Apply reinforcement control. The fuzzy reinforcement control system executes a matrix pruning strategy:

[0206]

[0207] At the physical engineering implementation level, the dispatch center adopts a proactive defense strategy for key boundary areas with leakage risks: when an AGV is located at the boundary between the public logistics area and the confidential assembly area, its status broadcast (action) is forcibly reduced. The radio transmission power of the device, or the location camouflage noise artificially injected into the communication message, thereby making the action appear as if it is a signal. This results in the state transition suppressing the confidence level of the eavesdropper to #imgpt405#.

[0208] 3) Validation: Action #imgpt406# is still allowed to be triggered, thus maintaining system business continuity, but the secret confidence level for reaching the new state after being controlled decreases to #imgpt407#. At this point #imgpt408#. The local opacity of this belief state #imgpt409# is increased to #imgpt410# according to Gödel's semantic reinforcement. The entire graph is reconstructed using the Tick automaton #imgpt411# and the corresponding belief automaton #imgpt412# (the reconstructed Tick automaton #imgpt413# and belief automaton #imgpt414# are respectively as follows...). Figure 5 and Figure 6 As shown in the figure, the global metric value of the system #imgpt415# can be recalculated, thus the fuzzy reinforcement control is successful.

[0209] The information leakage assessment and fuzzy reinforcement control method and system for cyber-physical systems provided in the above embodiments of the present invention first construct a fuzzy time-based automaton model, uniformly characterizes state fuzziness and time uncertainty through a Z-type membership satisfaction operator, and abstracts the continuous-time state space into a finite-state fuzzy Tick automaton using closed supremum units and bounded time transition operators to alleviate the state space explosion problem; then, it filters unobservable events through an attacker's observation capability threshold and generates a deterministic belief automaton using a subset construction method; furthermore, it calculates the global fuzzy time-based current position opacity metric within the [0,1] interval based on Gödel's fuzzy implication operator to achieve continuous quantitative assessment of information leakage risk; if the metric is lower than the safety threshold, it automatically identifies the illegal belief state and locates the key high-risk state precursors, implements flexible active defense by performing a maximum-minimum composite truncation operation on the controllable action transition matrix, and iteratively verifies until the global FTCLO metric reaches the standard, ensuring that the system meets security protection requirements without interrupting business; it can be widely applied to information protection of typical CPS such as intelligent transportation, intelligent manufacturing, and communication systems.

[0210] It should be noted that although the above embodiments are described using an intelligent AGV logistics system as an application scenario, the technical solutions of the present invention are also applicable to industrial robots, intelligent warehousing, unmanned delivery systems, intelligent transportation systems, and other cyber-physical systems with event-driven and time-constrained characteristics, and can achieve the technical effects described in the present invention.

[0211] Therefore, the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. All conventional selections, equivalent substitutions, and improvements made based on the technical solutions of the present invention are within the scope of protection of the present invention.

Claims

1. A method for assessing information leakage and implementing fuzzy reinforcement control in a cyber-physical system, characterized in that, Includes the following steps: S1: Obtain the physical equipment operating status and network communication timing parameters of the target information physical system. Based on the finite set of clear physical locations, the set of clock variables, the fuzzy location vector, the set of action specifications, and the fuzzy transition relation matrix, construct a fuzzy timing automaton model. At the same time, initialize the fuzzy secret location set vector, the fuzzy non-secret location set vector, and the observable event set and discrete observation threshold of the external attacker. S2: Extract the maximum correlation boundary of each clock variable in the fuzzy timing automaton model, divide the continuous time state space into equivalent grids using closed supremum units, truncate the overbounded clock assignments using the bounded time shift operator, perform time shift expansion and discrete event migration expansion using breadth-first forward search, and generate a finite-state fuzzy Tick automaton through the maximum-minimum fuzzy matrix composite operation. S3: Traverse the system action set, classify actions with observability below the preset observation threshold into the unobservable event set, and replace all transition edges in the fuzzy Tick automaton that belong to the unobservable event set with empty transition markers to generate a nondeterministic state machine with empty transitions. S4: The nondeterministic state machine is determinized using the subset construction method. The set of all possible fuzzy state pairs that the system can reach under a given observable sequence of events is used as the macro nodes of the belief state to construct a deterministic belief automaton. S5: Traverse each reachable belief state in the deterministic belief automaton, calculate the local secret confidence and local non-secret confidence respectively, solve the local opacity according to Gödel fuzzy implication operator, extract the global minimum of the local opacity of all reachable belief states, and output it as the opacity metric of the current position of global fuzzy time-assigned system to quantitatively assess the information leakage risk of the system. S6: Compare the global metric with the preset security protection threshold. If it is lower than the threshold, extract the set of violation belief states, locate the key high-risk states that satisfy the condition that the local secret confidence exceeds the local non-secret confidence, backtrack the non-Tick event precursor node, perform a maximum-minimum composite truncation operation on the fuzzy transition matrix of controllable actions and the local non-secret confidence constraint matrix, and adaptively suppress the high-risk transition confidence. After applying control, reconstruct the automaton and recalculate the global metric. If the protection threshold is reached, the reinforcement ends. Otherwise, repeat step S6 until the target is met.

2. The method according to claim 1, characterized in that, The fuzzy time-assigned automaton model described in step S1 is formally defined as a six-tuple. ,in: It is a finite set of clear physical locations, representing the discrete physical operating modes of the system; For a finite set of clock variables, each clock variable Corresponding clock assignment It is a natural number; For a set of fuzzy locations, each fuzzy location is represented by a row vector. Indicates, component This indicates that the system is in a clear position. Fuzzy membership degree; This is the initial blurred position vector; For a finite set of actions, each action Corresponding to a fuzzy clock constraint and clock reset set ; This is a set of fuzzy transition relation matrices, with matrix elements... Indicates the execution of an action The time system from a clear position Transferred to The confidence level of the physical state transition; the real-time evolution state of the entire cyber-physical system is transformed from fuzzy state pairs. Unified formal representation, in which Assign a vector to the clock.

3. The method according to claim 2, characterized in that, The fuzzy clock constraint described in step S1 uses a Z-type membership degree satisfaction operator to quantify time uncertainty for atomic constraints. ( For relational operators, It is a time constant. (For preset fuzzy fault tolerance boundaries): when the relation When fully satisfied, the satisfaction degree of the fuzzy clock constraint is 1; when the clock value enters the range of 1, the satisfaction degree of the fuzzy clock constraint is 1. With center length as Within the fault tolerance band, the satisfaction level decreases non-linearly according to a Z-shaped function; when the clock value crosses the fault tolerance boundary, the satisfaction level becomes 0, where, when the relational operator... for" "or" "At that time, fault-tolerant operators" Take the plus sign, when the relational operator... for" "or" "When the time is minus, for composite constraints, the conjunction is min and the disjunction is max, and recursive combination operations are performed to achieve a fine characterization of the fuzziness of the system state boundary." 4. The method according to claim 2, characterized in that, Extract the clock variable in step S2 Maximum correlation boundary The rule is: scan all clock-related data. Atomic fuzzy constraints Its associated boundary Take the clock boundary in the non-strict greater than constraint. Under strict greater than constraint, take In the less-than constraint, the sum of the clock boundary and the fault tolerance boundary is taken. The Last Clock Maximum correlation boundary Defined as the boundary of all relevant constraints The supremum of time. The bounded time shift operator is defined as: when the clock is assigned a value... After a unit of time, exceeding Then it will be forcibly truncated to ,Right now This compresses the unbounded continuous clock state space into a finite discrete grid, ensuring the enumerability of the time state space.

5. The method according to claim 4, characterized in that, The breadth-first forward search described in step S2 starts from the initial state. Starting from this point, proceed with the following two types of expansions until no new states are generated: (1) Time-lapse extension: Triggering synchronous Tick events Generate time-shifted transitions while keeping its physical location unchanged; clock variables The operator is updated according to bounded time progression. ; (2) Discrete event migration extension: When the system responds to external events At that time, combined with the current fuzzy position vector Transition matrix The next fuzzy position vector is calculated using the maximum-minimum composite operator. And perform a check on each component with the current clock constraint satisfaction level. A truncation operation with an upper limit; For clock variables Perform a zeroing update; if If the vector is zero, branch pruning is performed, and no new state is generated.

6. The method according to claim 5, characterized in that, The method for extracting the unobservable event set in step S3 is as follows: assuming the attacker successfully observes the event... The ability membership degree is Traverse the system action set To satisfy all ( Actions for setting a discrete observation threshold Classified into the set of unobservable events Fuzzy Tick automata All marked as Replace all transition edges of the event with empty transition markers. Generate a nondeterministic state machine with empty transitions. This prevents attackers from being aware of the internal state evolution caused by unobservable actions, and allows them to only receive observable event sequences.

7. The method according to claim 1, characterized in that, In step S4, each belief state in the deterministic belief automaton is defined as a macronode set, which contains all possible fuzzy positions and clock assignment state pairs that the system can currently reach given a sequence of observable events; the initial belief state consists of the initial state and its... - Closure construction; Subset construction method takes all successor states after processing each observable event. - Closure, a complete mapping of the maximum knowledge domain that an attacker can grasp based on the current observation sequence; The belief automaton only records macro nodes that can be reached from the initial belief state; unreachable macro nodes are pruned.

8. The method according to claim 7, characterized in that, The specific process for calculating the opacity metric of the current position in step S5 of global fuzzy timing is as follows: Step 5.1: Belief State Extract the fuzzy position vectors of all fuzzy state pairs and compare them with the fuzzy secret position set vector. Perform a max-min inner product operation on the transpose of the expression, and take the maximum value as the local secret confidence level. ; Step 5.2: Combine the fuzzy location vector with the fuzzy non-secret location set vector. Perform a max-min inner product operation on the transpose of the expression, and take the maximum value as the local non-secret confidence level. This refers to the level of security provided by the system for the current observation; Step 5.3: Calculate local opacity based on Gödel's fuzzy implication operator :when hour, (Absolute cover condition: the secret confidence level is completely covered by the non-secret confidence level); when hour, (Quantify penalty conditions, reduce opacity to the upper limit of security cover); Step 5.4: Extract all reachable belief states Local opacity The global minimum value is used as the FTCLO metric. The smaller the value, the higher the risk of system information leakage. The global minimum value marks the highest risk point at which the system's core secrets can be reverse-engineered by attackers.

9. The method according to claim 1, characterized in that, The specific steps of the fuzzy enhancement control described in step S6 are as follows: (1) Risk assessment and violation status extraction: extract global metrics With safety protection threshold In comparison, if If an information leakage risk is identified, then all illegal belief states with local opacity (i.e., local opacity) in the belief automaton are extracted. The state of the group constitutes a violation. (2) Key state identification: for each state of violation of belief Calculate the local non-secret confidence level. and confidence level of partial secrecy Then, from all the Tick automata states it contains, filter out the critical high-risk states that meet the following conditions. This state exposes a secret location to a level greater than the security cover limit and also to a degree of membership in a non-secret location. and ; (3) Precursor backtracking: Searching for critical high-risk states in reverse in the Tick automaton. Non-Tick event precursor state and controllable actions This makes existence from through arrive The transfer; (4) Fuzzy matrix pruning: Design a fuzzy reinforcement control law for the preceding state. Controllable actions Transition matrix Exert control, With all elements The constraint matrix is ​​operated on using the maximum-minimum composite operator, adaptively truncating all values ​​greater than 1. The high-risk transfer confidence level is achieved at the physical level by introducing actuator noise or privilege downgrading, etc. (5) Cyclic Target Verification: After applying control, reconstruct the fuzzy Tick automaton and belief automaton, and recalculate the global FTCLO metric. If the control is successfully strengthened, then the process will continue in a loop until the global metric reaches the target.

10. A cyber-physical system information leakage assessment and fuzzy reinforcement control system, characterized in that, The method for implementing any one of claims 1 to 9 comprises: The FTA modeling module is used to collect the equipment operating status and timing parameters of the target cyber-physical system, construct the FTA model, and initialize the fuzzy secret location set vector, the fuzzy non-secret location set vector, and the attacker's observation capability parameters. The time finite abstraction module is used to extract the maximum correlation boundary of each clock variable. It uses the closed supremum unit and the bounded time transition operator to perform equivalent partitioning of the continuous time state space. It uses breadth-first search to alternately execute time transition extension and discrete event migration extension to generate a finite state fuzzy Tick automaton. The observation filtering module is used to extract the set of unobservable events based on the attacker's observation capability threshold, replace the relevant transition edges with empty transitions, and generate a nondeterministic state machine with empty transitions. The Belief Automaton Construction Module is used to determinize nondeterministic state machines using the subset construction method, and to construct deterministic belief automata using belief state sets as macro nodes. The FTCLO evaluation module is used to traverse all reachable belief states of the belief automaton, calculate the local secret confidence, local non-secret confidence and local opacity of each belief state based on Gödel fuzzy implication operators, and output the global FTCLO metric. The fuzzy reinforcement control module is used to compare the global FTCLO metric with the safety protection threshold. When the metric fails to meet the standard, it extracts the set of violation states, locates the key high-risk states, backtracks the predecessor nodes, and executes the maximum-minimum composite truncation control law on the controllable action transition matrix. It then reconstructs the automaton for cyclic verification until the global FTCLO metric reaches the safety protection threshold.

Images