A dynamic event-triggered compensation control method under a hybrid network attack

Abstract

The application relates to a dynamic event-triggered compensation control method and system under a hybrid network attack, computer equipment and a storage medium. The method comprises the following steps: establishing a linear state space model of a network control system; defining a hybrid attack model comprising a DoS attack and a DAS attack; dividing an attack-free interval and an attack interval based on the existence of the DoS attack; designing a full-order switching observer for gain switching according to the interval; constructing a dynamic event-triggered mechanism according to the interval, and adjusting the data transmission frequency by using different trigger conditions; designing a compensation control mechanism for the attack interval to replace the missing feedback signal with a compensation control signal; establishing a closed-loop switching system model based on the interval division, the observer, the trigger mechanism and the compensation mechanism; and executing dynamic event-triggered compensation control by using the observer gain, the controller gain and the event-triggered parameters which are collaboratively designed. The application can guarantee the exponential stability of the system and improve the channel utilization rate under the hybrid attack.

Description

Technical Field

[0001] This application relates to the field of network detection technology, and in particular to a dynamic event triggering compensation control method, system, computer device and storage medium under promiscuous network attacks. Background Technology

[0002] With the rapid rise of the Internet of Things (IoT) and Cyber-Physical Systems (CPS), networked control systems composed of physical information systems have gradually become an important technological means in fields such as smart grids, smart manufacturing, and autonomous driving. By utilizing open communication networks, such as wireless sensor networks and 5G, a high degree of data interoperability and linkage has been established between various components, greatly improving the intelligence and efficiency of the entire system.

[0003] However, open communication networks also bring significant security threats. Denial-of-Service (DoS) attacks, by blocking or interfering with communication channels, prevent control systems from acquiring data from sensors or sending control commands to actuators, leading to system performance degradation or even instability. Similar to DoS attacks, Delay-and-Alteration Attack (DAS) attacks also exploit network vulnerabilities, but are more covert and complex: without severing the communication link, they artificially introduce unpredictable communication delays or maliciously tamper with data packets, causing the controller to receive incorrect or outdated status information, thus generating erroneous control commands. DAS attacks are not immediately detected by traditional detection mechanisms, but can distort system dynamics for a long time, causing decreased control accuracy, actuator malfunctions, and even inducing system oscillations or instability.

[0004] When a system simultaneously faces communication disruptions caused by DoS attacks and data distortions caused by DAS attacks, existing control methods are often designed only for a single attack type, lacking unified modeling and collaborative response capabilities for mixed attack scenarios. For example, in the face of communication disruptions caused by DoS attacks, without an active compensation mechanism, the system will operate in open loop due to the lack of feedback signals, resulting in a sharp deterioration in performance. Conversely, in the face of data tampering caused by DAS attacks, if the observer cannot switch gain according to the attack state, state estimation will be biased, thus affecting control decisions. Furthermore, traditional periodic sampling consumes a large amount of scarce communication bandwidth, while existing event triggering mechanisms do not dynamically adjust triggering conditions according to different attack intervals, making it difficult to effectively conserve network resources while ensuring control performance. Summary of the Invention

[0005] Therefore, it is necessary to provide a dynamic event-triggered compensation control method, system, computer equipment, and storage medium under promiscuous network attacks that can cope with promiscuous attacks of DoS and DAS, realize proactive compensation control, and optimize the utilization of communication resources, in order to address the above-mentioned technical problems.

[0006] Firstly, this application provides a dynamic event-triggered compensation control method for promiscuous network attacks. The method includes: Establish a linear state-space model for the networked control system; A promiscuous network attack model is defined, which includes: DoS attacks and DAS attacks; Based on the presence or absence of the DoS attack, the operating time axis of the network control system is divided into an attack-free interval and an attack interval, and a full-order switching observer is designed based on the linear state-space model; wherein, in the attack-free interval, the network control system is at risk of being subjected to the DAS attack; the full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. A dynamic event triggering mechanism is constructed based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. Based on the attack range, a compensation control mechanism is designed, which is used to replace the feedback signal missing due to the DoS attack with a compensation control signal. Based on the division of the non-attack zone and the attack zone, the full-order switching observer, the dynamic event triggering mechanism, and the compensation control mechanism, a closed-loop switching system model describing the dynamic behavior of the network control system under the DoS attack and the DAS attack is established. Based on the closed-loop switching system model, the dynamic event triggering mechanism and the compensation control mechanism are executed using co-designed observer gain, controller gain, and event triggering parameters.

[0007] In one embodiment, the model of the DAS attack includes: based on Bernoulli random variables Characterizing whether the DAS attack occurred, and based on sector conditions. The attack capability is constrained; and the observer state affected by the DAS attack is represented as follows: in, This is the attack function; The observer state is in the no-attack zone; The data was compromised; and Given a scalar; This is for attacking and tampering with functions.

[0008] In one embodiment, the dynamic event triggering mechanism includes: In the no-attack zone, the triggering condition is: in, , This refers to the state of the full-order switching observer in the attack-free region. It is a positive definite weight matrix. For settable conditional thresholds, It is an adjustable parameter. For internal dynamic variables, The sampling period is The most recent event trigger time, For the first Each sampling time; The triggering condition within the attack range is: in, , This is the observer state dedicated to the attack zone.

[0009] In one embodiment, the compensation control mechanism includes: Within the attack range, a full-order observer designed specifically for the attack range is used to estimate the system state. The model of the full-order observer is as follows: in, , and These are the system matrix, input matrix, and output matrix of the linear state-space model, respectively. To control the input, For system output, The observer gain is designed for the attack range. For the observer state, This is the output of the observer.

[0010] In one embodiment, the closed-loop switching system model is as follows: in, To augment the state vector to time The derivative of the augmented state vector, the transpose of which is defined as... ; For observation error, ; This is a piecewise delay function used to describe the time delay from the lag time to the current time in the system state; This is the piecewise error function, used to describe the deviation of the observer state between sampling times; This is the system matrix corresponding to the no-attack zone; This is the system matrix corresponding to the DoS attack zone; , The input matrix corresponds to the gain matrix of the system when it receives control input in the absence of DoS attacks. , The input matrix corresponds to the gain matrix of the system when receiving control input during a DoS attack period; For the external perturbation matrix, These are the gain matrices for controlling whether or not a DoS attack is present.

[0011] In one embodiment, executing the dynamic event triggering mechanism and the compensation control mechanism includes: Construct a piecewise Lyapunov-Krasovskii functional and determine the exponential stability of the system based on the following conditions: There exists a symmetric positive definite dimension matrix , , , , It is a 2n-dimensional matrix. Let be an n-dimensional matrix, such that the following matrix inequalities are satisfied: in, They are respectively and The matrix obtained by applying Shur's theorem , For switching gain index, The exponential decay rate; The segmented Lyapunov-Krasovskii functional satisfies: The piecewise Lyapunov-Krasovskii functional, when differentiated with respect to time t, satisfies the following inequality: From the inequality , , , , and ,Will Represented as ,have to: Among them, parameters = ,when Shi De According to Lyapunov stability theory, the closed-loop switching system is exponentially stable under the DoS attack and the DAS attack.

[0012] In one embodiment, dividing the network control system's operating timeline into attack-free and attack-prone intervals based on the presence or absence of the DoS attack includes: For all Total attack duration satisfy ,in , ; For all Number of attacks satisfy ,in , ; in, This is the initial offset for the total duration of the attack. To limit the long-term frequency of attacks, This is the initial offset for the number of times the attack switch has been toggled. This is a constant used to limit the frequency of attack state switching.

[0013] Secondly, this application also provides a dynamic event-triggered compensation control system for promiscuous network attacks. The system includes: The spatial model building module is used to build a linear state-space model of the network control system. An attack model definition module is used to define promiscuous network attack models, which include DoS attacks and DAS attacks. An adaptive observer module is used to divide the operating time axis of the network control system into an attack-free interval and an attack interval based on the presence or absence of the DoS attack, and to design a full-order switching observer based on the linear state-space model; wherein, in the attack-free interval, the network control system is at risk of being subjected to the DAS attack; the full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. An event triggering mechanism construction module is used to construct a dynamic event triggering mechanism based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. The compensation control mechanism design module is used to design a compensation control mechanism based on the attack range. The compensation control mechanism is used to replace the feedback signal missing due to the DoS attack with a compensation control signal. The closed-loop system model building module is used to build a closed-loop switching system model describing the dynamic behavior of the network control system under the DoS attack and the DAS attack based on the division between the no-attack zone and the attack zone, the full-order switching observer, the dynamic event triggering mechanism, and the compensation control mechanism. The control execution module is used to execute the dynamic event triggering mechanism and the compensation control mechanism based on the closed-loop switching system model and using co-designed observer gain, controller gain and event triggering parameters.

[0014] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the aforementioned dynamic event-triggered compensation control method under promiscuous network attacks.

[0015] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, implements the aforementioned dynamic event-triggered compensation control method under promiscuous network attacks.

[0016] The aforementioned dynamic event-triggered compensation control method, system, computer equipment, and storage medium for promiscuous network attacks define a promiscuous network attack model that simultaneously includes DoS and DAS attacks, achieving a unified description of complex attack scenarios and providing a model foundation for subsequent differentiated responses. By dividing the system's operating timeline into attack-free and attack intervals based on the presence or absence of a DoS attack, and designing a full-order switching observer that switches gain according to these intervals, the problem of state estimation bias caused by the inability of existing observers to adaptively adjust according to the attack state is solved, achieving accurate estimation of the system state in both attack-free and attack intervals. By constructing a dynamic event-triggered mechanism based on the current interval type, different trigger conditions are used to dynamically adjust the data transmission frequency in attack-free and attack intervals, overcoming the shortcomings of traditional periodic sampling consuming excessive bandwidth and existing event-triggered mechanisms failing to distinguish attack intervals, leading to resource waste, and improving channel utilization while ensuring control performance. By designing a compensation control mechanism for attack intervals, replacing the feedback signal missing due to DoS attacks with a compensation control signal, the problem of open-loop system operation and drastic performance degradation caused by the lack of active compensation during communication interruptions in existing methods is solved, achieving active fault-tolerant control during attacks. Furthermore, based on the above-mentioned division, observer, triggering mechanism and compensation mechanism, a closed-loop switching system model is established, and control is performed by using co-designed observer gain, controller gain and event triggering parameters. This can ensure the exponential stability of the system under DoS and DAS promiscuous attacks, thus solving the problem that existing technologies are difficult to achieve stable control and resource optimization in promiscuous attack environments. Attached Figure Description

[0017] Figure 1 This is a diagram illustrating the application environment of a dynamic event-triggered compensation control method under promiscuous network attacks in one embodiment. Figure 2 This is a flowchart illustrating a dynamic event-triggered compensation control method under promiscuous network attacks in one embodiment. Figure 3 This is a block diagram of a dynamic event-triggered compensation control system under promiscuous network attacks in one embodiment. Figure 4 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. First, to facilitate understanding of the technical solutions provided by the embodiments of this application, the background technology involved in the embodiments of this application will be described below.

[0019] With industrial development and the rapid rise of the Internet of Things (IoT) and cyber-physical systems (CPS), networked control systems composed of physical information systems have gradually become an important technological means in fields such as smart grids, smart manufacturing, and autonomous driving. Utilizing open communication networks, such as wireless sensor networks and 5G, a high degree of data interoperability and linkage has been established between various components, greatly improving the intelligence and efficiency of the entire system.

[0020] However, while open communication networks can make many communication systems more convenient and faster, they also bring significant security threats. Denial-of-Service (DoS) attacks, in particular, block or interfere with communication channels, preventing control systems from acquiring data from sensors or sending control commands to actuators. This damages system performance and, in extreme cases, can cause system instability and ultimately lead to accidents. To address DoS attacks, Chinese patent application CN121283765A proposes a dynamic event-triggered fault detection method under DoS network attacks. This method, through the design of a full-order observer with gain switching according to the attack interval and a dynamic event triggering mechanism, achieves fault detection and reduces communication resource consumption in a single DoS attack scenario.

[0021] However, the aforementioned existing technologies only focus on DoS attack scenarios where communication links are completely disrupted, neglecting another equally serious security threat: Delay-and-Alteration Attack (DAS) attacks. Unlike DoS attacks, DAS attacks do not directly block communication links. Instead, they exploit the vulnerabilities of open networks, artificially introducing unpredictable communication delays or maliciously tampering with transmitted data packets. This causes the controller to receive incorrect or outdated status information, leading to erroneous control commands. DAS attacks do not immediately sever communication, making them more difficult to detect using traditional detection mechanisms. However, they can gradually distort the dynamic behavior of the system over a long period, resulting in decreased control accuracy, actuator malfunctions, and even inducing system oscillations or instability. Compared to the brutal disruption of DoS attacks, DAS attacks are more like a chronic threat, seriously threatening the integrity and real-time performance of networked control systems.

[0022] In real-world network environments, DoS and DAS attacks often coexist or alternate, creating promiscuous attack scenarios. When a system suffers a promiscuous attack, the communication link may be completely interrupted due to a DoS attack, or the data transmitted may be tampered with or delayed by a DAS attack even if the link is not interrupted. Existing single DoS attack response solutions cannot effectively handle this complex scenario: on the one hand, their observer design does not consider the impact of DAS attacks on data authenticity, leading to biased state estimation; on the other hand, their event triggering conditions and control strategies lack differentiated response capabilities for different attack types, and do not provide a mechanism to proactively compensate for missing or erroneous signals when an attack occurs.

[0023] Therefore, in order to achieve accurate estimation of system state, on-demand scheduling of communication resources, and active compensation of control signals in a promiscuous network environment where both DoS and DAS attacks exist, thereby ensuring the exponential stability of the system, this application provides a dynamic event-triggered compensation control method, system, computer device, and storage medium under promiscuous network attacks.

[0024] The dynamic event-triggered compensation control method under promiscuous network attacks provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, the controlled object 102 communicates with the controller 104 via a network. A data storage system can store the data that the controller 104 needs to process. The data storage system can be integrated into the controller 104 or placed in the cloud or on another network server. The controlled object 102 sends its operating status data to the controller 104. The controller 104 establishes a linear state-space model based on the received status data, defines a hybrid attack model including DoS attacks and DAS attacks, divides the DoS attack into no-attack and attack intervals, designs a full-order switching observer with gain switching, constructs a dynamic event triggering mechanism based on the interval type to adjust the data transmission frequency, designs a compensation control mechanism for the attack interval to replace the missing feedback signal, establishes a closed-loop switching system model, executes dynamic event triggering compensation control using co-designed parameters, and finally sends the generated control commands to the controlled object 102. The controlled object 102 can be, but is not limited to, various industrial robots, programmable logic controllers (PLCs), smart sensors, actuators, autonomous vehicles, remote terminal units (RTUs) in smart grids, IoT devices (such as smart meters and smart water meters), or portable smart terminals. The controller 104 can be a standalone embedded controller, an industrial computer, an edge computing gateway, or a server cluster or cloud control platform consisting of multiple servers.

[0025] Firstly, in a hybrid network attack environment, existing control methods struggle to simultaneously address communication disruptions caused by DoS attacks and data distortions caused by DAS attacks. Furthermore, they lack proactive compensation mechanisms and differentiated event triggering strategies for different network segments, resulting in poor system stability and low channel utilization. Therefore, in one embodiment, such as... Figure 2 As shown, a dynamic event-triggered compensation control method under promiscuous network attacks is provided, which is then applied to... Figure 1 Taking the controlled object 102 as an example, the following steps are included: S1: Establish a linear state-space model of the network control system; S2: Define a promiscuous network attack model, which includes DoS attacks and DAS attacks; S3: Based on the presence or absence of DoS attacks, the operating time axis of the network control system is divided into an attack-free interval and an attack interval, and a full-order switching observer is designed based on a linear state-space model; in the attack-free interval, the network control system is at risk of being attacked by DAS; the full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. S4: Construct a dynamic event triggering mechanism based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. S5: Based on the attack range, a compensation control mechanism is designed. The compensation control mechanism is used to replace the feedback signal that is missing due to the DoS attack with the compensation control signal. S6: Based on the division of attack-free and attack zones, full-order switching observer, dynamic event triggering mechanism, and compensation control mechanism, a closed-loop switching system model is established to describe the dynamic behavior of the network control system under DoS and DAS attacks. S7: Based on the closed-loop switching system model, it uses co-designed observer gain, controller gain, and event triggering parameters to execute a dynamic event triggering mechanism and a compensation control mechanism.

[0026] Specifically, when establishing a linear state-space model of a network control system, state-space description methods known in the field can be used. For example, the specific values ​​of the system matrix, input matrix, and output matrix can be determined based on the physical characteristics of the controlled object (such as mechanical motion equations, circuit equations, etc.) or the system identification results. When defining a promiscuous network attack model, it is necessary to clarify that a DoS attack manifests as a complete blockage of the communication link (no data packets arrive), while a DAS attack manifests as data packets being delayed or tampered with, but the link is not interrupted. The time axis is divided based on the presence or absence of a DoS attack, which can be achieved by detecting the connection or disconnection of the communication link or the timeout of data packets: when no valid data arrives within several consecutive sampling periods, it is marked as the start of the attack interval; when valid data is received again, it is marked as the start of the no-attack interval. When designing a full-order switching observer based on the linear state-space model, its structure is a conventional Romberg observer, but the gain matrix takes different values ​​in the two intervals; the gain value can be pre-calculated by solving linear matrix inequalities or pole placement methods. The dynamic event triggering mechanism is constructed based on the current interval type, meaning that different comparison thresholds are used in non-attack and attack intervals. These thresholds depend on the weighted norm of the observer output and an internal dynamic variable in the corresponding interval. The compensation control mechanism can be implemented using zero-order hold (i.e., holding the last successfully received control signal), model-based predictive control, or observer-based state feedback control. When establishing the closed-loop switching system model, the mathematical expressions of the above parts are combined to obtain a differential equation (or difference equation) system characterized by interval switching. Finally, by solving a set of linear matrix inequalities offline, the observer gain, controller gain, and event triggering parameters are collaboratively determined and written into the controller program. During online operation, the system automatically switches the observer gain and triggering conditions according to the currently detected attack state and enables compensation control in the attack interval.

[0027] Based on the above, this embodiment distinguishes between attack-free and attack-prone intervals, designing different observer gains, trigger conditions, and compensation strategies for each. This allows the system to maintain control using compensation signals when communication is interrupted by a DoS attack, and to reduce false alarms by switching observer gains and trigger thresholds when data distortion occurs due to a DAS attack. Simultaneously, a dynamic event triggering mechanism adjusts the data transmission frequency according to the interval type, reducing network traffic without degrading control performance. Ultimately, this ensures exponential stability of the system under mixed DoS and DAS attacks and improves network channel utilization.

[0028] For the defined promiscuous attack model, traditional methods lack mathematical characterization of the randomness of DAS attacks and the tampering energy limit, causing the observer to be unable to distinguish between normal data and tampered data, resulting in decreased state estimation accuracy. Therefore, in one embodiment, the DAS attack model includes: a Bernoulli-based random variable... Characterizing whether a DAS attack has occurred, and based on sector conditions. Constrained attack capabilities; and, the observer state affected by a DAS attack is represented as follows: in, This is the attack function; The observer state is in the no-attack zone; The data was compromised; and Given a scalar; This is for attacking and tampering with functions.

[0029] Specifically, Bernoulli random variables It is a discrete random variable that takes only 0 or 1, used to represent whether a DAS attack exists at any given time. In a real-world system, its probability distribution can be assumed to be known (e.g., by obtaining the frequency of attacks through long-term statistics), or it can be estimated in real time using an online attack detection algorithm. The value of . When When the communication link is uninterrupted and the data is not tampered with, the observer state remains the true estimate under the attack-free interval. ;when When this occurs, it indicates that a DAS attack has taken place, and the state received by the observer has been maliciously altered, with its value being changed. Sector conditions describe the attacker's non-linear tampering behavior, and the attack tampering function. Restricted to passing through the origin, with slopes of respectively and Between two straight lines. Common functions that satisfy the sector condition include saturation functions and dead-zone functions. and It is a known constant that can be obtained by analyzing the upper limit of an attacker's capabilities or by fitting experimental data. The tampering signal actually applied to the observer state can depend on time, system state, or other variables. The corrected observer state. It is the state quantity used in the attack-free interval triggering condition of the subsequent dynamic event triggering mechanism. It combines the influence of the real observer state and possible tampering attacks.

[0030] Based on the above, the DAS attack model uses Bernoulli random variables to characterize the randomness and uncertainty of DAS attacks, and sector conditions to limit the energy of the attack tampering function, allowing the system to consider the worst-case tampering impact when designing observers and event triggering conditions. Using this model, sufficient conditions to guarantee system stability can be derived in theoretical analysis using stochastic system theory and sector nonlinear theory, thereby enhancing the system's robustness against DAS attacks.

[0031] Traditional event triggering mechanisms, when used in conjunction with dynamic events, often employ static thresholds or fail to differentiate between attack zones, leading to unreasonable triggering frequencies or wasted resources. Therefore, in one embodiment, the dynamic event triggering mechanism includes: In the no-attack zone, the trigger condition is: in, , To switch the observer's state in the no-attack zone at full order, It is a positive definite weight matrix. For settable conditional thresholds, It is an adjustable parameter. For internal dynamic variables, The sampling period is The most recent event trigger time, For the first Each sampling time.

[0032] Internal dynamic variables Satisfies the differential equation: Within the attack range, the trigger condition is: , This is the observer state specifically for the attack zone.

[0033] Internal dynamic variables Satisfies the differential equation: Specifically, sampling period It is a preset fixed time interval (e.g.) (seconds), the controller calculates the difference between the current observer state and the observer state at the most recent trigger time at each sampling time. And calculate the weighted quadratic form of the difference. Positive definite weight matrix The threshold coefficient is used to adjust the relative importance of different state components and can be taken as the identity matrix or designed according to the dynamic characteristics of the system. It is a constant between 0 and 1, the larger the value. This will lead to more frequent triggering, and smaller... This will reduce the number of triggers but may decrease control performance. Parameters Controlling the influence of internal dynamic variables on the threshold. Internal dynamic variables According to the evolution of the above differential equation, where Decision made The decay rate; this differential equation guarantees that when the system state tends to stabilize, It will tend towards a small non-negative value, thus preventing the triggering condition from never being met. Initial condition This ensures the triggering mechanism functions correctly from the outset. The two triggering conditions are identical in form, but rely on different observer states, reflecting the idea of ​​interval-based differentiated design. In the actual implementation, when the error term exceeds a threshold, a new event is triggered, the current observer state is sent out via the communication network, and the most recent trigger time is updated. and the value of the internal dynamic variable at that moment ; then reset Continue monitoring at the next sampling time.

[0034] Based on the above, this triggering mechanism uses dynamic internal variables to allow the threshold to adaptively adjust according to changes in the system state, avoiding the "jitter" or long-term non-triggering problems that may be caused by static thresholds. Simultaneously, since different observer states are used in the no-attack and attack intervals, it can adapt to the differences in state estimation accuracy between the two intervals, thereby further reducing unnecessary communication and improving channel utilization while ensuring control performance.

[0035] Traditional compensation control mechanisms employ zero-order hold or simple open-loop prediction during communication interruptions, resulting in poor estimation accuracy and limited compensation effectiveness. Therefore, in one embodiment, the compensation control mechanism includes: Within the attack range, a full-order observer designed specifically for the attack range is used to estimate the system state. The model of the full-order observer is as follows: in, , and These are the system matrix, input matrix, and output matrix of the linear state-space model, respectively. To control the input, For system output, Observer gain designed for the attack range, For the observer state, This is the output of the observer.

[0036] Specifically, this observer has the same structure as the attack-free region observer, but with different gain. It can be designed independently. Within the attack range, due to the potential for DoS attacks... Unable to reach the controller, or a DAS attack may result. The feedback item has been tampered with. It may be unreliable. One implementation is: when output data is detected to be unavailable, ... Setting it to zero degenerates the observer into a pure model prediction. When output data is available but suspected of being tampered with, the amount of data can be reduced. The gain is increased to reduce the confidence in the measurement. Another approach is to design a switching-based observer: using a fixed, robust gain within the attack interval, and ensuring that the observation error remains bounded in the event of missing or tampered output by solving linear matrix inequalities. Observer state The initial value can be taken as the value of the observer state at the end of the no-attack interval. Compensation control signal Based on Construction, for example, using state feedback ,in This is a pre-designed controller gain. In a practical system, a buffer can also be introduced to store historical observation data, which can be extrapolated or retained using the last correctly received observation value when a DoS attack occurs.

[0037] Based on the above, this observer is specifically designed for attack zones and can perform state estimation based on the system model and control input even when feedback signals are missing or corrupted. This is achieved through reasonable gain design. This ensures the convergence or boundedness of the estimation error, thus providing reliable state information for compensatory control. This prevents the controller from completely losing its awareness of the system state due to communication interruptions or data tampering, and is a key technology for maintaining system stability.

[0038] Based on the established modules, there is a lack of a unified mathematical model to describe the integrated dynamic behavior of promiscuous attacks, observer switching, event triggering, and compensation control, making rigorous stability analysis and parameter co-design impossible. Therefore, in one embodiment, the closed-loop switching system model is as follows: in, To augment the state vector to time The derivative of the augmented state vector, the transpose of the augmented state vector, is defined as follows: ; For observation error, ; This is a piecewise delay function used to describe the time delay from the lag time to the current time in the system state; This is the piecewise error function, used to describe the deviation of the observer state between sampling times; This is the system matrix corresponding to the no-attack zone; This is the system matrix corresponding to the DoS attack zone; , The input matrix corresponds to the gain matrix of the system when it receives control input in the absence of DoS attacks. , The input matrix corresponds to the gain matrix of the system when receiving control input during a DoS attack period; For the external perturbation matrix, These are the gain matrices for controlling whether or not a DoS attack is present.

[0039] Specifically, the augmented state vector Viewer state and observation error By merging them, the original system dynamics and the observer error dynamics are unified into a single higher-order system. Piecewise time delay function. This describes the communication latency caused by the event triggering mechanism, and its value range is typically [value range missing]. ( (Maximum allowable delay). Piecewise error function. Indicates in Within the interval, since no new events occur, the observer state differs from the state at the most recent trigger moment. The specific form of these functions depends on the event trigger sequence and network transmission characteristics. In the attack-free interval... The model contains elements from... and Described DAS attack items; within the attack range Internally, since the communication link is completely interrupted and no data packets are transmitted, the DAS attack no longer has any effect (the attacker cannot tamper with non-existent data packets), and the model simplifies to a pure switching system. Matrix and In , These represent the observer gains in the no-attack and attack ranges, respectively. This represents the controller gain for the corresponding interval. External disturbance matrix. External disturbances Introducing the system. Output. It is the signal to be estimated, such as certain performance indicators or fault indicators, and its expression also switches depending on the range.

[0040] Based on the above, this model unifies the complex hybrid attack scenarios, event triggering mechanisms, observer switching, and compensation control into a switching system, enabling stability analysis using switching system theory and time-delay system theory. By establishing this model, previously intractable nonlinear, stochastic, and time-varying problems can be transformed into a solvability problem of a set of linear matrix inequalities, providing a theoretical framework for subsequent controller / observer co-design.

[0041] Based on the established closed-loop switching system model, there is a lack of a calculable stability criterion and parameter design method. Traditional stability analysis struggles to handle random switching and latency issues under promiscuous attacks. Therefore, in one embodiment, a dynamic event triggering mechanism and a compensation control mechanism are implemented, including: Construct a piecewise Lyapunov-Krasovskii functional and determine the exponential stability of the system based on the following conditions: There exists a symmetric positive definite dimension matrix , , , , It is a 2n-dimensional matrix. Let be an n-dimensional matrix such that the following matrix inequalities are satisfied: in, They are respectively and The matrix obtained by applying Shur's theorem , For switching gain index, The exponential decay rate; The piecewise Lyapunov-Krasovskii functional satisfies: The piecewise derivative of the Lyapunov-Krasovskii functional with respect to time t satisfies the following inequality: From the inequality , , , , and ,Will Represented as ,have to: Among them, parameters = ,when Shi De According to Lyapunov stability theory, the closed-loop switching system is exponentially stable under DoS and DAS attacks.

[0042] Specifically, to analyze the exponential stability of the system, two different Lyapunov-Krasovskii functionals were constructed. and These are used for the no-attack region and the attack region, respectively. The functional includes augmented states. quadratic terms Delay integral term and double integral terms . , , Let be the symmetric positive definite matrix to be solved, with dimensions of 2n×2n, n×n, and n×n respectively. Exponential decay rate. and These are positive numbers to be designed; they determine the convergence rate of the system in each interval. Switching gain exponent. and Used to describe the jumps that may occur in a Lyapunov functional at the moment of switching. Through the The coefficient matrix of the linear matrix inequality (LMI) obtained by amplification and application of Schur's complement lemma. and Is with Related constants, and Let represent the length boundaries of the attack interval and the dormancy interval, respectively. By solving the above system of linear matrix inequalities, if there exists a positive definite matrix satisfying all inequalities... and parameters , , , Then the system is exponentially stable, and the exponential decay rate is determined by... The given information is provided. In practical design, numerical solutions can be obtained using software such as MATLAB's LMI toolbox or YALMIP. Furthermore, , .when hour ,and and Bounded, therefore ultimately .

[0043] Based on the above, this stability analysis method provides system designers with specific and calculable decision conditions. By solving a set of linear matrix inequalities, not only can the stability of given parameters be verified, but observer gain can also be co-designed through optimization algorithms. , Controller gain , The event triggering parameters ε, δ, and μ ensure that the system achieves the desired exponential stability margin while meeting the constraints of DoS attack frequency and duration. This guarantees that the closed-loop system remains stable and exhibits good dynamic performance even under severe promiscuous attacks during actual operation.

[0044] The lack of quantitative constraints on attack frequency and duration in the DoS attack interval division makes it impossible to verify the average dwell time condition in stability analysis, potentially leading to unfeasible attack scenarios with infinitely frequent or persistent attacks. Therefore, in one embodiment, based on the presence or absence of a DoS attack, the network control system's operating timeline is divided into attack-free and attack intervals, including: For all Total attack duration satisfy ,in , ; For all Number of attacks satisfy ,in , ; in, This is the initial offset for the total duration of the attack. To limit the long-term frequency of attacks, This is the initial offset for the number of times the attack switch has been toggled. This is a constant used to limit the frequency of attack state switching.

[0045] Specifically, these two constraints limit the total duration of a DoS attack and the number of attacks, respectively. Total Attack Duration It refers to all attack intervals from time 0 to time t. The sum of lengths; inequality This indicates that the total duration of the attack increases linearly over time, with a growth rate not exceeding [a certain percentage]. That is, the long-term average duty cycle does not exceed .parameter Allowing for a limited amount of additional attack time within the initial period, which can be taken This represents the most severe scenario. Number of attacks occurred. This refers to the attack interval from time 0 to time t. The number of inequalities; The frequency of attack switching is limited, meaning that the average number of attacks per unit time does not exceed [a certain number]. . The larger the value, the lower the allowed attack switching frequency. In practical applications, network monitoring tools can be used to analyze long-term attack data to estimate the frequency of attacks. and The appropriate value is then selected and used as a known condition in solving the linear matrix inequality. For example, in industrial control system security standards, the system may be required to withstand DoS attacks with a duty cycle not exceeding 10% and switching no more than 6 times per minute. Therefore, the appropriate value could be selected. , (If t is in minutes). These parameters are used in stability analysis to ensure that the mean dwell time condition of the switching system is met.

[0046] Based on the above, this constraint transforms an unrestricted DoS attack into an attack model with limitations on average frequency and duration. This allows the system to be robustly controlled for realistically achievable attack scenarios, rather than being designed to counter arbitrary malicious attacks (such as infinitely frequent switching or infinitely long blocking). By introducing these two constraints, the stability condition becomes solvable, and the system is guaranteed to remain exponentially stable under any aperiodic DoS attack that satisfies these constraints. This reflects both the physical limitations of real-world network attacks and provides actionable design metrics for engineering implementation.

[0047] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0048] Secondly, based on the same inventive concept, this application also provides a system for implementing the dynamic event-triggered compensation control method under promiscuous network attacks as described above. The solution provided by this system is similar to the implementation described in the above method; therefore, the specific limitations in one or more system embodiments provided below can be found in the limitations of the dynamic event-triggered compensation control method under promiscuous network attacks described above, and will not be repeated here.

[0049] In one embodiment, such as Figure 3 As shown, the system includes: a spatial model building module, an adaptive observer module, an event triggering mechanism construction module, a compensation control mechanism design module, a closed-loop system model building module, and a control execution module. Among them: The spatial model building module is used to build a linear state-space model of the network control system. The attack model definition module is used to define promiscuous network attack models, which include DoS attacks and DAS attacks. The adaptive observer module is used to divide the runtime axis of the network control system into an attack-free interval and an attack interval based on the presence or absence of a DoS attack, and designs a full-order switching observer based on a linear state-space model. In the attack-free interval, the network control system is at risk of being attacked by DAS. The full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. The event triggering mechanism construction module is used to construct a dynamic event triggering mechanism based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. The compensation control mechanism design module is used to design a compensation control mechanism based on the attack range. The compensation control mechanism is used to replace the feedback signal that is missing due to the DoS attack with a compensation control signal. The closed-loop system model building module is used to build a closed-loop switching system model that describes the dynamic behavior of the network control system under DoS and DAS attacks, based on the division of attack-free and attack-free zones, full-order switching observers, dynamic event triggering mechanisms, and compensation control mechanisms. The control execution module is used to execute dynamic event triggering mechanism and compensation control mechanism based on the closed-loop switching system model, using co-designed observer gain, controller gain and event triggering parameters.

[0050] In one embodiment, the attack model definition module includes a DAS attack model definition unit.

[0051] The DAS attack model definition unit is used for Bernoulli random variables. Characterizing whether a DAS attack has occurred, and based on sector conditions. Constrained attack capabilities; and, the observer state affected by a DAS attack is represented as follows: .

[0052] In one embodiment, the event triggering mechanism building module includes a triggering mechanism definition unit.

[0053] The trigger mechanism definition unit is used to determine whether to trigger within the no-attack zone based on the following trigger conditions: in, , This refers to the state of the full-order switching observer in the attack-free region. It is a positive definite weight matrix. For settable conditional thresholds, It is an adjustable parameter. For internal dynamic variables, The sampling period is The most recent event trigger time, For the first Each sampling time point. The trigger mechanism definition unit is used to determine whether to trigger within the attack range based on the following trigger conditions: in, , This is the observer state dedicated to the attack zone.

[0054] In one embodiment, the compensation control mechanism design module includes a control mechanism definition unit.

[0055] The control mechanism definition unit is used to estimate the system state within the attack range using a full-order observer designed for the attack range. The model of the full-order observer is as follows: in, , and These are the system matrix, input matrix, and output matrix of the linear state-space model, respectively. To control the input, For system output, Observer gain designed for the attack range, For the observer state, This is the output of the observer.

[0056] In one embodiment, the closed-loop system model building module includes a closed-loop switching system model definition unit.

[0057] The closed-loop switching system model definition unit is used to define the closed-loop switching system model using the following expression: in, To augment the state vector to time The derivative of the augmented state vector, the transpose of the augmented state vector, is defined as follows: ; For observation error, ; This is a piecewise delay function used to describe the time delay from the lag time to the current time in the system state; This is the piecewise error function, used to describe the deviation of the observer state between sampling times; This is the system matrix corresponding to the no-attack zone; This is the system matrix corresponding to the DoS attack zone; , The input matrix corresponds to the gain matrix of the system when it receives control input in the absence of DoS attacks. , The input matrix corresponds to the gain matrix of the system when receiving control input during a DoS attack period; For the external perturbation matrix, These are the gain matrices for controlling whether or not a DoS attack is present.

[0058] In one embodiment, the control execution module includes a control execution unit.

[0059] The control execution unit is used to construct the piecewise Lyapunov-Krasovskii functional and to determine the exponential stability of the system based on the following conditions: There exists a symmetric positive definite dimension matrix , , , , It is a 2n-dimensional matrix. Let be an n-dimensional matrix, such that the following matrix inequalities are satisfied: in, They are respectively and The matrix obtained by applying Shur's theorem , For switching gain index, The exponential decay rate; The piecewise Lyapunov-Krasovskii functional satisfies: The piecewise derivative of the Lyapunov-Krasovskii functional with respect to time t satisfies the following inequality: From the inequality , , , , and ,Will Represented as ,have to: Among them, parameters = ,when Shi De According to Lyapunov stability theory, the closed-loop switching system is exponentially stable under DoS and DAS attacks.

[0060] In one embodiment, the adaptive observer module includes interval partitioning units.

[0061] The interval partitioning unit is used for all Total attack duration satisfy ,in , For all Number of attacks satisfy ,in , ;in, This is the initial offset for the total duration of the attack. To limit the long-term frequency of attacks, This is the initial offset for the number of times the attack switch has been toggled. This is a constant used to limit the frequency of attack state switching.

[0062] The modules in the dynamic event-triggered compensation control system under the aforementioned promiscuous network attack can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0063] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores all data required for system operation. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a dynamic event-triggered compensation control method under promiscuous network attacks.

[0064] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0065] Thirdly, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described in the above method embodiments.

[0066] Fourthly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of any of the methods described in the above method embodiments.

[0067] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0068] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0069] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A dynamic event-triggered compensation control method under promiscuous network attacks, characterized in that, The method includes: Establish a linear state-space model for the networked control system; A promiscuous network attack model is defined, which includes: DoS attacks and DAS attacks; Based on the presence or absence of the DoS attack, the operating time axis of the network control system is divided into an attack-free interval and an attack interval, and a full-order switching observer is designed based on the linear state-space model; wherein, in the attack-free interval, the network control system is at risk of being subjected to the DAS attack; the full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. A dynamic event triggering mechanism is constructed based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. Based on the attack range, a compensation control mechanism is designed, which is used to replace the feedback signal missing due to the DoS attack with a compensation control signal. Based on the division of the non-attack zone and the attack zone, the full-order switching observer, the dynamic event triggering mechanism, and the compensation control mechanism, a closed-loop switching system model describing the dynamic behavior of the network control system under the DoS attack and the DAS attack is established. Based on the closed-loop switching system model, the dynamic event triggering mechanism and the compensation control mechanism are executed using co-designed observer gain, controller gain, and event triggering parameters.

2. The method according to claim 1, characterized in that, The model for the DAS attack includes: based on Bernoulli random variables. Characterizing whether the DAS attack occurred, and based on sector conditions. The attack capability is constrained; and the observer state affected by the DAS attack is represented as follows: in, This is the attack function; The observer state is in the no-attack zone; The data was compromised; and Given a scalar; This is for attacking and tampering with functions.

3. The method according to claim 1, characterized in that, The dynamic event triggering mechanism includes: In the no-attack zone, the triggering condition is: in, , This refers to the state of the full-order switching observer in the attack-free region. It is a positive definite weight matrix. For settable conditional thresholds, It is an adjustable parameter. For internal dynamic variables, The sampling period is The most recent event trigger time, For the first Each sampling time; The triggering condition within the attack range is: in, , This is the observer state dedicated to the attack zone.

4. The method according to claim 1, characterized in that, The compensation control mechanism includes: Within the attack range, a full-order observer designed specifically for the attack range is used to estimate the system state. The model of the full-order observer is as follows: in, , and These are the system matrix, input matrix, and output matrix of the linear state-space model, respectively. To control the input, For system output, The observer gain is designed for the attack range. For the observer state, This is the output of the observer.

5. The method according to claim 1, characterized in that, The closed-loop switching system model is as follows: in, To augment the state vector to time The derivative of the augmented state vector, the transpose of which is defined as... ; For observation error, ; This is a piecewise delay function used to describe the time delay from the lag time to the current time in the system state; This is the piecewise error function, used to describe the deviation of the observer state between sampling times; This is the system matrix corresponding to the no-attack zone; This is the system matrix corresponding to the DoS attack zone; , The input matrix corresponds to the gain matrix of the system when it receives control input in the absence of DoS attacks. , The input matrix corresponds to the gain matrix of the system when receiving control input during a DoS attack period; For the external perturbation matrix, These are the gain matrices for controlling whether or not a DoS attack is present.

6. The method according to claim 1, characterized in that, The execution of the dynamic event triggering mechanism and the compensation control mechanism includes: Construct a piecewise Lyapunov-Krasovskii functional and determine the exponential stability of the system based on the following conditions: There exists a symmetric positive definite dimension matrix , , , , It is a 2n-dimensional matrix. Let be an n-dimensional matrix, such that the following matrix inequalities are satisfied: in, They are respectively and The matrix obtained by applying Shur's theorem , For switching gain index, The exponential decay rate; The segmented Lyapunov-Krasovskii functional satisfies: The piecewise Lyapunov-Krasovskii functional, when differentiated with respect to time t, satisfies the following inequality: From the inequality , , , , and ,Will Represented as ,have to: Among them, parameters = ,when Shi De According to Lyapunov stability theory, the closed-loop switching system is exponentially stable under the DoS attack and the DAS attack.

7. The method according to claim 1, characterized in that, Based on the presence or absence of the DoS attack, the operating timeline of the network control system is divided into an attack-free period and an attack period, including: For all Total attack duration satisfy ,in , ; For all Number of attacks satisfy ,in , ; in, This is the initial offset for the total duration of the attack. To limit the long-term frequency of attacks, This is the initial offset for the number of times the attack switch has been toggled. This is a constant used to limit the frequency of attack state switching.

8. A dynamic event-triggered compensation control system under promiscuous network attacks, characterized in that, The system includes: The spatial model building module is used to build a linear state-space model of the network control system. An attack model definition module is used to define promiscuous network attack models, which include DoS attacks and DAS attacks. An adaptive observer module is used to divide the operating time axis of the network control system into an attack-free interval and an attack interval based on the presence or absence of the DoS attack, and to design a full-order switching observer based on the linear state-space model; wherein, in the attack-free interval, the network control system is at risk of being subjected to the DAS attack; the full-order switching observer is used to switch the gain according to the attack-free interval or the attack interval. An event triggering mechanism construction module is used to construct a dynamic event triggering mechanism based on the current interval type of the network control system. The dynamic event triggering mechanism includes dynamically adjusting the data transmission frequency of the non-attack interval and the attack interval using different triggering conditions. The compensation control mechanism design module is used to design a compensation control mechanism based on the attack range. The compensation control mechanism is used to replace the feedback signal missing due to the DoS attack with a compensation control signal. The closed-loop system model building module is used to build a closed-loop switching system model describing the dynamic behavior of the network control system under the DoS attack and the DAS attack based on the division between the no-attack zone and the attack zone, the full-order switching observer, the dynamic event triggering mechanism, and the compensation control mechanism. The control execution module is used to execute the dynamic event triggering mechanism and the compensation control mechanism based on the closed-loop switching system model and using co-designed observer gain, controller gain and event triggering parameters.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the dynamic event-triggered compensation control method under promiscuous network attacks as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the dynamic event-triggered compensation control method under promiscuous network attacks as described in any one of claims 1 to 7.

Images