A threat hunting method, system, device and medium based on an industrial control system

Abstract

The present application relates to the technical field of industrial software security protection, in particular to a threat hunting method, system, device and medium based on an industrial control system; a multi-dimensional behavior baseline model is established through unsupervised learning, an active threat hunting engine based on the ATT&CK ICS framework is designed, cumulative detection of small baseline deviations is realized in combination with CUSUM cumulative sum test, an attack chain visualization reduction is realized by introducing a threat behavior graph, the APT attack detection rate is improved, the average threat discovery time is shortened, and the false positive rate is reduced.

Description

Technical Field

[0001] This invention relates to the field of industrial software security protection technology, and more specifically, to a threat hunting method, system, device, and medium based on industrial control systems. Background Technology

[0002] With the deepening of industrial digital transformation, industrial software systems such as Manufacturing Execution Systems (MES), Enterprise Resource Planning (ERP), Supply Chain Management (SCM), and Product Lifecycle Management (PLM) have become core operating platforms for modern manufacturing enterprises. These systems carry sensitive core assets such as production process data, financial data, supply chain data, and intellectual property data. Once attacked, they may cause serious consequences such as production interruption, data leakage, and leakage of trade secrets.

[0003] In recent years, advanced persistent threat (APT) attacks targeting industrial software systems have become increasingly rampant. According to publicly available research data released by authoritative institutions in the field of industrial control system security, such as MITRE and Mandiant, APT attackers in the industrial control system field generally adopt a "low, slow, and stealthy" attack strategy. They lurk in target systems for a long time through gradual penetration, lateral movement, and data theft, with an average incubation period of more than 180 days, making them difficult to detect effectively using traditional security detection methods.

[0004] Meanwhile, the development of Industry 4.0 and intelligent manufacturing has led to an increasing complexity of industrial software systems, more frequent system interactions, and more diversified user behavior patterns, further posing new challenges to safety inspection. (1) The system generates a huge amount of log data, which is difficult to analyze; (2) The boundary between normal operation and abnormal behavior is becoming increasingly blurred; (3) Cross-system attack chains are difficult to trace and reconstruct. Summary of the Invention

[0005] This invention addresses the problems of existing detection methods, such as difficulties in analysis, ambiguous behavioral boundaries, and difficulty in tracing and reconstructing attack chains. It proposes a threat hunting method, system, device, and medium based on industrial control systems. By establishing a multi-dimensional behavioral baseline model through unsupervised learning, an active threat hunting engine based on the ATT&CK ICS framework is designed. The cumulative detection of small baseline deviations is achieved by combining CUSUM accumulation and verification. Threat behavior graphs are introduced to achieve visual reconstruction of attack chains, thereby improving the APT attack detection rate, shortening the average threat discovery time, and reducing the false alarm rate.

[0006] The specific implementation details of this invention are as follows: A threat hunting method based on industrial control systems specifically includes the following steps: Step S1: Preprocess the collected raw log data; Step S2: Based on the preprocessed raw log data, construct a multidimensional behavioral baseline model, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score; Step S3: Based on the constructed hunting hypothesis, the comprehensive anomaly score is used as the basis for targeted retrieval to generate a list of suspected threat events; Step S4: Based on the list of suspected threat events, call CUSUM to accumulate and generate threat events; Step S5: Construct a threat behavior graph by treating threat events as entities, and obtain the optimal attack chain reconstruction result by combining temporal path splicing and shortest attack path search.

[0007] To better realize the present invention, the raw log data collected in step S1 further includes: operation instruction sequence data, user behavior pattern data, and data access pattern data.

[0008] To better realize the present invention, step S2 further includes the following steps: Step S21: Based on the acquired operation instruction sequence data, construct the state transition probability matrix, calculate the log-likelihood probability, and normalize it to obtain the first anomaly score; Step S22: Based on the acquired user behavior pattern data, construct a weighted directed graph by taking users as nodes, the access relationship between users and modules as edge sets, and the access frequency as edge weights, and call the graph embedding method to obtain the second anomaly score. Step S23: Based on the acquired data access pattern data, call the moving average model to construct the data access time series model, obtain the predicted value, calculate the relative deviation between the predicted value and the acquired actual observation value, and normalize to obtain the third anomaly score; Step S24: Based on the set weights, the first abnormal score, the second abnormal score, and the third abnormal score, a weighted fusion is performed to obtain a comprehensive abnormal score.

[0009] To better realize the present invention, step S3 further includes the following steps: Step S31: Generate hunting hypotheses based on the ATT&CK ICS industrial control attack matrix; Step S32: Use the comprehensive anomaly score as the basis for targeted retrieval, transform the hunting hypothesis into retrieval rules, and obtain a list of suspected threat events.

[0010] To better realize the present invention, step S31 further includes the following steps: Step S311: Construct a hunting hypothesis based on the attack technique ID, behavioral characteristic description, and data dimension indication; Step S312: Parse the behavioral feature descriptions in the hunting hypothesis into field matching conditions and populate them into the rule templates of the corresponding data dimensions to generate retrieval rules.

[0011] To better realize the present invention, step S32 further includes the following steps: Step S321: Calculate the initial screening threshold based on the moving average of historical abnormal scores for the current data dimension, the moving standard deviation of historical abnormal scores for the current data dimension, and the set adjustment coefficient; Step S322: If the overall anomaly score of the current dimension is greater than the initial screening threshold, it is marked as an initial screening match and a list of suspected threat events is generated.

[0012] To better realize the present invention, step S5 further includes the following steps: Step S51: Treat threat behaviors as entities, construct a threat behavior graph based on the defined relationship types between entities, and obtain a sequence of candidate attack events; Step S52: Identify the first occurrence of a high-confidence anomalous event based on the set high-confidence threshold; Step S53: Select high-confidence anomaly events as candidate attack entry points and the tampered critical assets as candidate attack targets. Combine the set constraints to perform a time-constrained depth-first search in the threat behavior graph to obtain candidate attack paths. Step S54: Calculate the path confidence score based on the number of path nodes, the comprehensive anomaly score of the candidate attack paths, and the set weight coefficients. The path with the highest path confidence score is taken as the optimal attack chain restoration result.

[0013] Based on the aforementioned threat hunting method based on an industrial control system, in order to better realize the present invention, a threat hunting system based on an industrial control system is further proposed to execute the aforementioned threat hunting method based on an industrial control system; including a preprocessing unit, an anomaly score calculation unit, a threat hunting hypothesis generation and retrieval unit, a hunting clue accumulation verification and anomaly detection unit, and an attack chain reconstruction unit. The preprocessing unit is used to preprocess the collected raw log data; The anomaly score calculation unit is used to construct a multi-dimensional behavior baseline model based on the preprocessed raw log data, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score. The threat hunting hypothesis generation and retrieval unit is used to generate a list of suspected threat events based on the constructed hunting hypotheses and the comprehensive anomaly score as the basis for targeted retrieval. The hunting clue accumulation verification and anomaly detection unit is used to call CUSUM accumulation based on the list of suspected threat events to generate threat events; The attack chain reconstruction unit is used to construct a threat behavior graph by treating threat events as entities, and obtain the optimal attack chain reconstruction result by combining time-series path splicing and shortest attack path search.

[0014] Based on the aforementioned threat hunting method for industrial control systems, and to better realize this invention, an electronic device is further proposed, comprising a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the aforementioned threat hunting method for industrial control systems is implemented.

[0015] Based on the aforementioned threat hunting method for industrial control systems, and to better realize this invention, a computer-readable storage medium is further proposed, wherein computer instructions are stored on the computer-readable storage medium; when the computer instructions are executed on the aforementioned electronic device, the aforementioned threat hunting method for industrial control systems is realized.

[0016] The present invention has the following beneficial effects: (1) This invention improves the detection rate of APT attacks against industrial software systems by using multidimensional behavioral baseline joint modeling and CUSUM cumulative detection mechanism, and effectively discovers advanced persistent threats that have been lurking for a long time.

[0017] (2) This invention actively searches for threats lurking in MES / ERP / SCM and other systems, shortens the average threat detection time, and significantly improves security response efficiency. Attached Figure Description

[0018] Figure 1 This is a schematic flowchart of the threat hunting method based on an industrial control system provided by the present invention.

[0019] Figure 2 A schematic diagram of the overall architecture of the threat hunting system for industrial software systems provided by this invention. Detailed Implementation

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments, and therefore should not be regarded as a limitation on the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "set up," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0022] Example 1: This embodiment proposes a threat hunting method based on industrial control systems, which specifically includes the following steps: Step S1: Preprocess the collected raw log data; The raw log data collected in step S1 includes: operation instruction sequence data, user behavior pattern data, and data access pattern data.

[0023] Step S2: Based on the preprocessed raw log data, construct a multidimensional behavioral baseline model, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score; Step S2 specifically includes the following steps: Step S21: Based on the acquired operation instruction sequence data, construct the state transition probability matrix, calculate the log-likelihood probability, and normalize it to obtain the first anomaly score; Step S22: Based on the acquired user behavior pattern data, construct a weighted directed graph by taking users as nodes, the access relationship between users and modules as edge sets, and the access frequency as edge weights, and call the graph embedding method to obtain the second anomaly score. Step S23: Based on the acquired data access pattern data, call the moving average model to construct the data access time series model, obtain the predicted value, calculate the relative deviation between the predicted value and the acquired actual observation value, and normalize to obtain the third anomaly score; Step S24: Based on the set weights, the first abnormal score, the second abnormal score, and the third abnormal score, a weighted fusion is performed to obtain a comprehensive abnormal score.

[0024] Step S3: Based on the constructed hunting hypothesis, the comprehensive anomaly score is used as the basis for targeted retrieval to generate a list of suspected threat events; Step S3 specifically includes the following steps: Step S31: Generate hunting hypotheses based on the ATT&CK ICS industrial control attack matrix; Step S31 specifically includes the following steps: Step S311: Construct a hunting hypothesis based on the attack technique ID, behavioral characteristic description, and data dimension indication; Step S312: Parse the behavioral feature descriptions in the hunting hypothesis into field matching conditions and populate them into the rule templates of the corresponding data dimensions to generate retrieval rules.

[0025] To better realize the present invention, step S32 further includes the following steps: Step S321: Calculate the initial screening threshold based on the moving average of historical abnormal scores for the current data dimension, the moving standard deviation of historical abnormal scores for the current data dimension, and the set adjustment coefficient; Step S322: If the overall anomaly score of the current dimension is greater than the initial screening threshold, it is marked as an initial screening match and a list of suspected threat events is generated.

[0026] Step S32: Use the comprehensive anomaly score as the basis for targeted retrieval, transform the hunting hypothesis into retrieval rules, and obtain a list of suspected threat events.

[0027] Step S4: Based on the list of suspected threat events, call CUSUM to accumulate and generate threat events; Step S5: Construct a threat behavior graph by treating threat events as entities, and obtain the optimal attack chain reconstruction result by combining temporal path splicing and shortest attack path search.

[0028] Step S5 specifically includes the following steps: Step S51: Treat threat behaviors as entities, construct a threat behavior graph based on the defined relationship types between entities, and obtain a sequence of candidate attack events; Step S52: Identify the first occurrence of a high-confidence anomalous event based on the set high-confidence threshold; Step S53: Select high-confidence anomaly events as candidate attack entry points and the tampered critical assets as candidate attack targets. Combine the set constraints to perform a time-constrained depth-first search in the threat behavior graph to obtain candidate attack paths. Step S54: Calculate the path confidence score based on the number of path nodes, the comprehensive anomaly score of the candidate attack paths, and the set weight coefficients. The path with the highest path confidence score is taken as the optimal attack chain restoration result.

[0029] Working principle: This embodiment establishes a multidimensional behavioral baseline model through unsupervised learning, designs an active threat hunting engine based on the ATT&CKICS framework, combines CUSUM accumulation and verification to achieve cumulative detection of small baseline deviations, and introduces threat behavior graphs to achieve visual reconstruction of attack chains, thereby improving the APT attack detection rate, shortening the average threat discovery time, and reducing the false alarm rate.

[0030] Example 2: This embodiment is based on the above embodiment 1, such as... Figure 1 , Figure 2 As shown, a specific embodiment will be described in detail.

[0031] Step S1: Data acquisition and preprocessing; The system collects three types of core data from industrial software systems in real time, processes them according to standardization, and outputs them to the baseline modeling module: Operation instruction sequence data: Menu operation sequences, data query SQL statements, and business process call interface sequences of users in MES / ERP / SCM and other systems, with a sampling frequency of event-driven; User behavior pattern data: user login time distribution (weekdays / weekends, working hours / non-working hours), operation frequency (number of operations per minute, total number of operations per day), functional module access preferences (percentage of access frequency for each module), data access scope (data tables, fields, file paths accessed). Data access patterns: database query patterns (query frequency, query complexity, result set size), API call frequency (interval between each interface call, concurrency), and file access permission change records (change time, change type, change operator).

[0032] Data preprocessing includes: log parsing (converting raw logs into structured data), timestamp alignment (using UTC timestamps), missing value imputation (using forward imputation or mean imputation), feature standardization (Z-score standardization), and outlier filtering (based on the 3σ criterion).

[0033] Step S2: Multidimensional behavioral baseline modeling and anomaly score calculation.

[0034] Three models are used in conjunction to calculate the single-dimensional anomaly score, which is then merged into a comprehensive anomaly score to construct a complete baseline of normal behavior. Instruction Sequence Markov Chain Model: A k-order Markov chain is constructed to learn the state transition probability matrix P(st|st-1,st-2,...,st-k) of the normal operation instruction sequence, where st represents the operation instruction at time t; the matrix row vectors are historical continuous instruction combinations of length k [s_{tk},...,s_{t-2},s_{t-1}], the matrix column vectors are the possible operation instructions s_t at the next time step, and the matrix cell values ​​are the statistical frequency normalized probabilities of the corresponding historical instruction combination jumping to the current instruction. The sum of all probability rows is 1, completely storing the jump patterns between all instructions in the normal business scenario of the industrial control system. The model training uses maximum likelihood estimation, and the value of k is determined through cross-validation (usually 2-5). Anomaly score calculation: For a new instruction sequence, calculate its log-likelihood probability LL relative to a k-order Markov chain baseline model that has been trained and stores normal instruction jump patterns. The log-likelihood probability LL is the log sum of the step-by-step jump probabilities of the entire instruction sequence under test. The closer the sequence is to normal business operations, the larger the LL value. Normalize it to an anomaly score in the 0-1 range: score1 = 1 - LL / LL max. The higher the score, the greater the degree to which the sequence deviates from the normal pattern. If the score is below a preset threshold, it is judged as an anomaly.

[0035] User behavior pattern graph model: Construct a weighted directed graph G=(V,E,W), where V is the set of nodes (users, functional modules, data objects), E is the set of edges (access relationships between users and modules, and between modules and data), and W is the edge weight (access frequency, access duration). A graph embedding method (such as Node2Vec) is used to convert the graph structure into a low-dimensional vector representation. The vector values ​​fully carry the topological features of users, functional modules, access frequencies, and access relationships. Anomaly score calculation: First, the average of the embedding vectors of the historical full-scale normal business behavior graph is calculated to generate a unique baseline standard vector. This vector represents the standard normal access topology features of the industrial control system. The cosine distance between the real-time collected current behavior graph embedding vector and the baseline standard vector is calculated. The distance is normalized to an anomaly score score2 in the 0-1 interval; the larger the distance, the greater the degree to which the access path and frequency deviate from the normal topology.

[0036] Data access time series model: An autoregressive integrated moving average (ARIMA) model or a long short-term memory (LSTM) network is used to model database query frequency, API call intervals, and permission change cycles. The model input is the time series features within a sliding window, and the output is the predicted behavior value. Anomaly score calculation: The relative deviation between the predicted value y^t and the actual observed value xt is calculated, and the deviation is normalized to an anomaly score score3 in the 0-1 interval. The larger the deviation, the greater the degree to which the time series behavior deviates from the normal pattern.

[0037] Model fusion and comprehensive anomaly score: A weighted fusion strategy is adopted to combine the anomaly scores of the three models in a weighted manner to obtain a comprehensive anomaly score: Scoretotal=w1*score1+w2*score2+w3*score3, where the weights are determined by optimization using the AUC metric on the validation set. The comprehensive score serves as the basis for subsequent hunting retrieval and anomaly detection. Step S2 synchronously outputs a complete multidimensional behavioral baseline, including three types of baseline carriers: the state transition probability matrix of the instruction sequence Markov chain, the standard vector of the user behavior topology baseline, and the training weights and mean / standard deviation statistical parameters of the data access time series model. The three types of baselines are used together for dynamic threshold calculation in step S3 and CUSUM bias solution in step S4.

[0038] Step S3: Threat hunting hypothesis generation and retrieval based on the ATT&CK ICS framework; Positioning: The core of proactive hunting, inheriting the complete multi-dimensional behavioral baseline and anomaly score output by S2, and outputting suspected threat clues to S4 for verification; Based on the ATT&CK ICS industrial control attack matrix, hunting hypotheses are automatically generated through a standardized mapping mechanism, realizing the transformation from "passively waiting for alarms" to "actively seeking threats". The specific generation and execution process is as follows: Framework Mapping: Based on the 12 attack tactics officially defined by ATT&CK ICS (Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Suppress Response Functionality, Disrupt Process Control, Impact), these 12 tactics serve as the top-level classification basis for the hunting assumptions in this embodiment. The standardized mapping mechanism is a pre-set three-layer association rule base: the first layer binds the 12 tactics, the second layer binds all attack technology IDs under each tactic, and the third layer binds the typical malicious behavior characteristics corresponding to that technology. Finally, it matches to three data dimensions: instruction sequence, user behavior, and data access, automatically establishing a structured correspondence between attack technology, behavioral characteristics, and data dimensions, thus achieving automatic association between tactics and raw log data. The specific attack techniques under each tactic are mapped to the three behavioral data dimensions (instruction sequence, user behavior, data access) of the industrial control system, establishing a correspondence between attack technology, behavioral characteristics, and data dimensions.

[0039] Execution: Detects malicious macro execution (abnormal Office file operations), script execution (abnormal PowerShell / CMD commands), and suspicious process creation.

[0040] Hypothesis Generation: Verifiable Hunting Hypothesis Derivation: For each mapped attack technique, combined with the normal behavior baseline of the industrial control system, standardized verifiable hunting hypotheses are automatically generated. Overall generation logic summary: Based on the ATT&CK ICS attack technique, the corresponding data dimensions are matched, the normal behavior boundary is defined based on the multi-dimensional behavior baseline, and the malicious deviation conditions exceeding the boundary are defined to form standardized hunting hypotheses that can be quantitatively verified through the original log data. The general logic is: if the attacker executes this attack technique, a baseline deviation that conforms to a specific pattern will appear on the corresponding data dimension.

[0041] Rule instantiation and targeted retrieval: Each hunting hypothesis is transformed into an executable data retrieval rule. The comprehensive anomaly score (Scoretotal) calculated in step S2 is used as the core filtering criterion for targeted retrieval. Matches are searched in the full historical behavioral data and real-time data stream to output a list of suspected threat events. The specific implementation consists of the following three sub-steps: 1. Structured Parsing and Rule Template Population of Hunting Hypotheses. Each hunting hypothesis consists of three core elements: {Attack Technique ID, Behavioral Feature Description, Data Dimension Pointer}. The Attack Technique ID is taken from the official MITRE ATT&CKICS attack technique standard number; the Behavioral Feature Description is a typical malicious operation of the attack technique as described in the official documentation; and the Data Dimension Pointer is pre-bound by the standardized mapping mechanism mentioned above, fixedly belonging to one of the three categories: instruction sequence, user behavior, or data access. The system pre-sets general retrieval rule templates for the three data dimensions (instruction sequence, user behavior, and data access). The templates define the set of fields to be matched, logical operator combinations, and time window parameters. During instantiation, the system parses the behavioral feature description in the hunting hypothesis into specific field matching conditions and populates them into the rule template of the corresponding data dimension, generating an executable retrieval rule. For example, for the "abnormal login" hypothesis under the "initial access" tactic, the generated rule after template population is: {Dimension: User behavior, Condition: (Login location NOT IN historical location set) OR (Login time NOT IN working time window), Time window: Past 24 hours}.

[0042] 2. Setting and Dynamic Association of the Initial Screening Anomaly Score Threshold. The initial screening threshold for targeted retrieval is not a fixed value, but is directly associated with the three-dimensional weighted fusion comprehensive anomaly score (Scoretotal) calculated in step S2. The specific setting method is as follows: For each instantiated retrieval rule, the system, based on the data dimension (instruction sequence / user behavior / data access) pointed to by the rule, reads the historical anomaly score distribution statistics (mean μ) of that dimension within the current time window from the corresponding dimension baseline model constructed in step S2. i and standard deviation σ i), where i is the dimension number, i=1 corresponds to the instruction sequence dimension, corresponding to the single-dimensional anomaly score score1; i=2 corresponds to the user behavior dimension, corresponding to the single-dimensional anomaly score score2; i=3 corresponds to the data access dimension, corresponding to the single-dimensional anomaly score score3, μ i σ i All scores are calculated from the corresponding historical sequences of score1 / score2 / score3. Initial screening threshold θ rule Calculate θ using the following formula: rule =μ i +α×σ i ; Where, μ i σ is the moving average of historical outlier scores for this dimension. i θ is the moving standard deviation of historical outlier scores for this dimension, and α is an adjustment coefficient (default value is 2.5–3.0, which can be adjusted according to the sensitivity requirements of the industrial control system's security strategy). This setting method ensures that the threshold and Scoretotal are of the same origin—because Scoretotal is a weighted fusion of outlier scores from the three dimensions (Scoretotal = w1×score1 + w2×score2 + w3×score3), while θ rule It is calculated directly based on the historical statistics of the same set of scores1 / score2 / score3, and the two have a consistent mathematical benchmark. When the outlier score (score1 / score2 / score3) of a data record in this dimension exceeds θ, it is considered an anomaly. rule When the threshold is set, it is marked as a preliminary match. The dynamic nature of this threshold allows it to adaptively follow the slow evolution of the normal behavior pattern of the industrial control system, avoiding the degradation of detection capability caused by a fixed threshold.

[0043] 3. Multi-dimensional Joint Targeted Retrieval and Suspected Event List Generation. The instantiated retrieval rules are deployed to the data retrieval execution engine, performing retrieval on full historical behavioral data (the backtracking period is configurable, defaulting to 90 days) and real-time data streams. The retrieval process employs a parallel multi-dimensional retrieval strategy: for each retrieval rule, the system simultaneously performs targeted matching on three data sources: the instruction sequence log index, the user behavior log index, and the data access log index. During the matching process, each matched record carries its corresponding dimension's real-time anomaly score (score1 / score2 / score3) and a comprehensive anomaly score (Scoretotal). The retrieval results are sorted from highest to lowest by Scoretotal, generating a preliminary list of suspected threat events. Each record in the list includes: event timestamp, data dimension, anomaly score details (score1, score2, score3, Scoretotal), the matching ATT&CK technology ID, and the corresponding behavioral characteristic description. This list is then sent to the anomaly detection module in step S4 for further verification and confirmation using CUSUM cumulative sum testing.

[0044] Examples of hunting rules corresponding to the 12 types of tactics: Initial access: Detect abnormal logins (login from different locations, outside of working hours, successful login after multiple failures), phishing attachment operations, abnormal access to removable media, and abnormal access to external services.

[0045] Execution: Detects abnormal script execution, command line calls, abnormal API calls, and abnormal modifications to controller tasks.

[0046] Persistence: Detects abnormal firmware modifications, unauthorized program tampering, project file infection, and the use of default / hardcoded credentials.

[0047] Privilege escalation: Detecting and exploiting vulnerabilities such as privilege escalation, hook injection, and unauthorized permission changes.

[0048] Avoidance: Detection log clearing, disguised operations, rootkit behavior, execution of system binary agents, and unauthorized message sending.

[0049] Discovery: Detection of network port scanning, system information detection, network sniffing, and wireless signal detection.

[0050] Lateral movement: Detects abnormal access to remote services, abnormal program downloads, lateral tool transfers, and credential reuse.

[0051] Collection: Detection of large-scale data export, I / O image reading, process status monitoring, screen capture, and man-in-the-middle data theft.

[0052] Command and Control: Detects abnormal outbound connections, proxy communications, and abnormal traffic in standard application layer protocols.

[0053] Suppression response functions: detection alarm suppression, communication blocking, abnormal activation of firmware update mode, and service stoppage.

[0054] Disruption of process control: Detection of violent I / O operations, illegal parameter modification, controller message tampering, and malicious firmware modification.

[0055] Impact: Destruction of testing data, equipment shutdown, tampering with production controls, theft of operational information, and loss of availability.

[0056] Step S4: Cumulative verification and anomaly detection of hunting clues based on CUSUM; Positioning: The precise verification stage of hunting results, receiving the list of suspected threat events output by S3, and outputting confirmed threat events to the S5 map module; The list of suspected threat events output by S3 is the initial screening and matching result, which may contain false positives due to occasional fluctuations. This step uses CUSUM cumulative sum verification to backtrack and accumulate the historical deviations of the corresponding dimensions of the clues, verifying whether the deviations are long-term and continuous attack behaviors, and solving the problem of difficulty in identifying the "slow, slow and stealthy" behavior of APTs. The two steps are a progressive relationship of "hypothesis retrieval - verification confirmation". Clue Dimension Matching: For each suspected threat event output by S3, locate its corresponding behavioral dimension (command sequence / user behavior / data access) and retrieve the baseline deviation data for the corresponding time period of that dimension.

[0057] Bias calculation: For each detection dimension (instruction sequence, user behavior, data access), calculate the bias between the current observation and the baseline model prediction. .

[0058] Sliding window statistics: Using a sliding window of size w (w = 24 hours or w = 100 events), the mean μ of the deviation within the window is calculated. t and standard deviation σ t .

[0059] Cumulative sum calculation of CUSUM: using a two-sided CUSUM test: S t + =max(0,S t-1 + +(d t -μ0-k)), S t - =max(0,S t-1 - -(d t -μ0-k)), where μ0 is the average deviation under normal conditions and k is a reference value (usually taken as 1 / 2 of the minimum detectable offset).

[0060] Alarm triggered: When St + >h or S t - An alarm is triggered when the value exceeds h, where h is the detection threshold (determined by the average running length of historical normal data, typically requiring an average running length of ≥200 events). Only when the cumulative CUSUM statistic continuously exceeds the threshold and the deviation within the window is persistent, excluding single occasional fluctuations, is it determined to be a real threat behavior. This event is then aggregated to generate a standardized, traceable list of confirmed threat behavior events, which is sent to the threat behavior graph module.

[0061] Step S5: Threat behavior graph construction and attack chain reconstruction; Positioning: The visualization output stage of hunting results, receiving confirmed threat events from S4, and completing the final source tracing; Using the confirmed threat behavior events output by S4 as the core input, and the list of suspected threat events output by S3 as auxiliary correlation clues, this is used to supplement the edge behavior nodes in the knowledge graph that are missing from the data collection or have not passed CUSUM verification but have correlation relationships. A threat behavior graph is constructed based on knowledge graph technology. Entity definition: Defines the entity types in the threat behavior graph, including users, hosts, processes, files, network connections, attack tactics, attack techniques, etc.

[0062] Relationship definition: Define the types of relationships between entities, including "Execution" (user → process), "Access" (process → file), "Connection" (host → host), "Belong" (technology → tactical), etc.

[0063] Graph Construction: Automatically extracts detected threat behavior events and maps them to graph nodes and edges. Employs an incremental construction strategy, supporting real-time updates.

[0064] Attack Chain Reconstruction: Using the confirmed threat behavior events output in step S4 as the core input, and based on the constructed threat behavior graph, the complete attack chain path is reconstructed through a combination of temporal path concatenation and shortest attack path search, identifying the attack entry point, lateral movement path, and attack target. The specific implementation consists of the following three sub-steps: 1. Timeline aggregation and sequential sorting of attack events. Using the threat behavior events confirmed in step S4 as seed nodes, all entities and events directly or indirectly related to these events (such as "execution," "access," and "connection") are extracted from the threat behavior graph and globally sorted by timestamp to form a candidate attack event sequence. For isolated nodes in the graph caused by missing data collection or attacker reverse attribution operations, the system uses prior knowledge of attack phases based on the ATT&CK ICS framework to complete the sequence. That is, based on the attack tactical phase to which the isolated node belongs (such as "initial access" must be followed by "execution" or "persistence"), reasonable phase transition nodes are inserted into the candidate sequence.

[0065] 2. Attack path enumeration and scoring based on depth-first search. Based on the sequence of candidate attack events, the system uses the first high-confidence anomaly (Scoretotal exceeds the preset high-confidence threshold, default 0.85) as the first candidate attack entry point and the critical assets that are ultimately tampered with or destroyed (such as PLC parameters, database tables, core configuration files) as the candidate attack targets. It performs a time-constrained depth-first search (DFS) in the threat behavior graph. During the search, the path expansion follows the following constraints: (1) Time unidirectionality - the timestamp of the subsequent node must be later than the previous node; (2) Stage progression - the evolution of the attack tactical stages in the path must conform to the logical order of the ATT&CK ICS framework (such as initial access, execution, persistence, lateral movement, impact); (3) Relationship validity - the jump between nodes must be based on the relationship type defined in the graph. After enumerating all candidate attack paths that meet the constraints, the system calculates the path confidence score for each path: PathScore = (1 / N)×Σ(Scoretotal_nodeᵢ)+λ×StageMatchRatio; Where N is the number of path nodes, Scoretotal_nodeᵢ is the comprehensive anomaly score of the i-th node on the path, StageMatchRatio is the matching ratio between the attack stage sequence of the path and the ATT&CK ICS standard stage sequence, and λ is the weighting coefficient (default 0.3). The path with the highest confidence score is selected as the optimal attack chain reconstruction result.

[0066] 3. Identification and output of attack entry points, lateral movement paths, and attack targets. Based on the optimal attack chain reconstruction results, the system automatically labels three types of key information: (1) Attack entry point - the entity corresponding to the node with the earliest timestamp in the path and the attack tactical stage is "initial access" (such as abnormal login user accounts, external source IPs accessed by phishing emails); (2) Lateral movement path - a sequence of consecutive nodes in the path whose attack tactical stage is "lateral movement", output in the form of a jump chain of "source entity, target entity" (such as host A, host B, engineer station C); (3) Attack target - the key assets corresponding to the terminal nodes in the path whose attack tactical stage is "impact" or "disrupt process control" (such as tampered control parameters, stolen data tables). The above identification results are presented in a visual form in the threat behavior graph interface, supporting security personnel to locate attack entry points, highlight lateral movement paths, and focus on attack target nodes with one click, realizing a complete source tracing analysis of the attack chain.

[0067] Visualization: Provides an interactive graph visualization interface, supporting functions such as node filtering, path highlighting, and timeline playback.

[0068] Working Principle: This embodiment designs a joint modeling framework of an operation instruction sequence Markov chain model, a user behavior pattern graph model, and a data access timing model to achieve a comprehensive characterization of the normal behavior of industrial software systems. It constructs an automated generation chain for attack tactics, technical items, behavioral characteristics, hunting hypotheses, and retrieval rules, achieving standardized proactive threat search based on 12 types of industrial control attack tactics (ATT & CKICS). Unlike traditional passive alarm modes, it possesses a systematic and scalable hunting capability. It combines CUSUM cumulative sum verification with sliding window statistics as a post-verification step in threat hunting, accumulating and detecting small deviations over a long period for initial hunting clues. This improves the detection rate of APT covert attacks and significantly reduces false alarms.

[0069] This embodiment designs a method for dynamically calculating the initial screening threshold based on the historical anomaly score statistics (mean and standard deviation) of each dimension in step S2. It establishes a homology association mechanism between the comprehensive anomaly score (Scoretotal) and the hunting retrieval threshold, enabling the retrieval threshold to adaptively track the evolution of the system's normal behavior pattern. This solves the technical problem of missed or false alarms caused by fixed thresholds. Based on confirmed threat behavior events, a knowledge graph is constructed to automatically connect discrete alarms and attack behaviors, realizing the automatic construction and visualization of attack chains, and supporting in-depth source tracing analysis of industrial control security events.

[0070] The other parts of this embodiment are the same as those in Embodiment 1 above, so they will not be described again.

[0071] Example 3: Based on any one of Embodiments 1-2 above, this embodiment proposes a threat hunting system based on an industrial control system, used to execute the aforementioned threat hunting method based on an industrial control system; it includes a preprocessing unit, an anomaly score calculation unit, a threat hunting hypothesis generation and retrieval unit, a hunting clue accumulation verification and anomaly detection unit, and an attack chain reconstruction unit; The preprocessing unit is used to preprocess the collected raw log data; The anomaly score calculation unit is used to construct a multi-dimensional behavior baseline model based on the preprocessed raw log data, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score. The threat hunting hypothesis generation and retrieval unit is used to generate a list of suspected threat events based on the constructed hunting hypotheses and the comprehensive anomaly score as the basis for targeted retrieval. The hunting clue accumulation verification and anomaly detection unit is used to call CUSUM accumulation based on the list of suspected threat events to generate threat events; The attack chain reconstruction unit is used to construct a threat behavior graph by treating threat events as entities, and obtain the optimal attack chain reconstruction result by combining time-series path splicing and shortest attack path search.

[0072] This embodiment also proposes an electronic device, including a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements the above-described threat hunting method based on an industrial control system.

[0073] This embodiment also proposes a computer-readable storage medium storing computer instructions; when the computer instructions are executed on the aforementioned electronic device, the aforementioned threat hunting method based on an industrial control system is implemented.

[0074] The other parts of this embodiment are the same as any one of the above embodiments 1-2, so they will not be described again.

[0075] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A threat hunting method based on industrial control systems, characterized in that, Specifically, the following steps are included: Step S1: Preprocess the collected raw log data; Step S2: Based on the preprocessed raw log data, construct a multidimensional behavioral baseline model, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score; Step S3: Based on the constructed hunting hypothesis, the comprehensive anomaly score is used as the basis for targeted retrieval to generate a list of suspected threat events; Step S4: Based on the list of suspected threat events, call CUSUM to accumulate and generate threat events; Step S5: Construct a threat behavior graph by treating threat events as entities, and obtain the optimal attack chain reconstruction result by combining temporal path splicing and shortest attack path search.

2. The threat hunting method based on an industrial control system according to claim 1, characterized in that, The raw log data collected in step S1 includes: operation instruction sequence data, user behavior pattern data, and data access pattern data.

3. The threat hunting method based on an industrial control system according to claim 2, characterized in that, Step S2 specifically includes the following steps: Step S21: Based on the acquired operation instruction sequence data, construct the state transition probability matrix, calculate the log-likelihood probability, and normalize it to obtain the first anomaly score; Step S22: Based on the acquired user behavior pattern data, construct a weighted directed graph by taking users as nodes, the access relationship between users and modules as edge sets, and the access frequency as edge weights, and call the graph embedding method to obtain the second anomaly score. Step S23: Based on the acquired data access pattern data, call the moving average model to construct the data access time series model, obtain the predicted value, calculate the relative deviation between the predicted value and the acquired actual observation value, and normalize to obtain the third anomaly score; Step S24: Based on the set weights, the first abnormal score, the second abnormal score, and the third abnormal score, a weighted fusion is performed to obtain a comprehensive abnormal score.

4. The threat hunting method based on an industrial control system according to claim 3, characterized in that, Step S3 specifically includes the following steps: Step S31: Generate hunting hypotheses based on the ATT&CK ICS industrial control attack matrix; Step S32: Use the comprehensive anomaly score as the basis for targeted retrieval, transform the hunting hypothesis into retrieval rules, and obtain a list of suspected threat events.

5. A threat hunting method based on an industrial control system according to claim 4, characterized in that, Step S31 specifically includes the following steps: Step S311: Construct a hunting hypothesis based on the attack technique ID, behavioral characteristic description, and data dimension indication; Step S312: Parse the behavioral feature descriptions in the hunting hypothesis into field matching conditions and populate them into the rule templates of the corresponding data dimensions to generate retrieval rules.

6. The threat hunting method based on an industrial control system according to claim 5, characterized in that, Step S32 specifically includes the following steps: Step S321: Calculate the initial screening threshold based on the moving average of historical abnormal scores for the current data dimension, the moving standard deviation of historical abnormal scores for the current data dimension, and the set adjustment coefficient; Step S322: If the overall anomaly score of the current dimension is greater than the initial screening threshold, it is marked as an initial screening match and a list of suspected threat events is generated.

7. A threat hunting method based on an industrial control system according to claim 6, characterized in that, Step S5 specifically includes the following steps: Step S51: Treat threat behaviors as entities, construct a threat behavior graph based on the defined relationship types between entities, and obtain a sequence of candidate attack events; Step S52: Identify the first occurrence of a high-confidence anomalous event based on the set high-confidence threshold; Step S53: Select high-confidence anomaly events as candidate attack entry points and the tampered critical assets as candidate attack targets. Combine the set constraints to search in the threat behavior graph to obtain candidate attack paths. Step S54: Calculate the path confidence score based on the number of path nodes, the comprehensive anomaly score of the candidate attack paths, and the set weight coefficients. The path with the highest path confidence score is taken as the optimal attack chain restoration result.

8. A threat hunting system based on an industrial control system, used to execute the threat hunting method based on an industrial control system as described in claim 1; characterized in that, It includes a preprocessing unit, an anomaly score calculation unit, a threat hunting hypothesis generation and retrieval unit, a hunting clue accumulation verification and anomaly detection unit, and an attack chain reconstruction unit; The preprocessing unit is used to preprocess the collected raw log data; The anomaly score calculation unit is used to construct a multi-dimensional behavior baseline model based on the preprocessed raw log data, calculate the single-dimensional anomaly score, and obtain the comprehensive anomaly score. The threat hunting hypothesis generation and retrieval unit is used to generate a list of suspected threat events based on the constructed hunting hypotheses and the comprehensive anomaly score as the basis for targeted retrieval. The hunting clue accumulation verification and anomaly detection unit is used to call CUSUM accumulation based on the list of suspected threat events to generate threat events; The attack chain reconstruction unit is used to construct a threat behavior graph by treating threat events as entities, and obtains the optimal attack chain reconstruction result by combining time-series path splicing and shortest attack path search.

9. An electronic device, characterized in that, It includes a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, it implements a threat hunting method based on an industrial control system as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device as described in claim 9, they implement a threat hunting method based on an industrial control system as described in any one of claims 1-7.

Images