Industrial control security detection method and system based on digital twin credible data flow

Abstract

This specification discloses an industrial control safety detection method and system based on trusted digital twin data flow. The method includes extracting operational stage characteristics, process constraints, and material coupling structures from the control loop to determine a digital twin process semantic model; determining communication points and characteristics based on control system configuration information to determine a digital twin communication data flow model; determining effective state sequences and dynamic response characteristics based on the digital twin communication data flow model to generate a communication and control state transition model; extracting cross-process coupling constraints to determine a global coupling constraint model; configuring compliance boundary conditions based on each model to generate a trusted digital twin data flow model; generating an event flow based on the communication and control state transition model; and verifying the trusted digital twin data flow model and the global coupling constraint model to obtain safety detection data. This specification improves the reliability, security, and intelligence level of industrial control systems.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of industrial control network security technology, specifically to an industrial control security detection method and system based on digital twin trusted data streams. Background Technology

[0002] With the advancement of intelligent manufacturing, continuous and process industries such as petrochemicals, coal chemicals, water conservancy, and power generation have gradually achieved network integration based on automation systems such as DCS and PLCs. However, while control networks improve efficiency, they also face increasingly severe cybersecurity threats. For example, attackers can inject illegal commands, tamper with setpoints, forge sensor data, or bypass safety interlocks through the network, causing abnormal process parameters, equipment malfunctions, and in severe cases, shutdowns, leaks, or even safety accidents.

[0003] Currently, traditional industrial control system (ICS) security primarily relies on general IT security technologies such as perimeter firewalls, intrusion detection systems (IDS), and access control. These technologies mainly rely on network layer or protocol formats for judgment, lacking an understanding of the logic of the control operations themselves. Furthermore, process industries are characterized by strong coupling: each stage is interconnected through material and energy flows, with upstream outputs often serving as downstream inputs, and some unreacted materials returning to preceding stages via loops. This forward flow and reverse circulation structure allows local anomalies to propagate or amplify within the system. Existing detection methods based on flow statistics or single-point behavioral baselines typically focus only on the communication behavior of individual devices or loops, failing to establish physical constraint models such as material balance, component conservation, or pressure gradients across stages. This makes it difficult to detect hidden problems where local compliance is achieved but global anomalies are present. Meanwhile, current digital twin applications are mostly concentrated on visual monitoring or performance simulation, rarely structurally linking control logic, operating procedures, and communication behavior. The lack of modeling for the dynamic response relationships of setpoints, operational outputs, and measured values ​​at specific operational stages makes it difficult to effectively identify abnormal scenarios such as setpoints being modified but actuators not responding, or measured values ​​being frozen for extended periods. Therefore, there is an urgent need to establish an industrial control security detection method based on digital twin trusted data streams that can achieve accurate and reliable security detection of control business interaction behavior. Summary of the Invention

[0004] This specification provides an industrial control security detection method and system based on digital twin trusted data streams, the technical solution of which is as follows:

[0005] Firstly, embodiments of this specification provide an industrial control security detection method based on a trusted data stream of digital twins, including: acquiring several process sections and control loops within those sections based on process information from the process industry; extracting operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different process sections, to determine a digital twin process semantic model; acquiring control system configuration information of the control loops; determining communication points corresponding to measured values, setpoints, and operation control commands based on the control system configuration information; extracting communication features of the communication points in industrial control messages to determine a digital twin communication data stream model describing the mapping relationship between communication points and industrial control messages; and based on the digital twin communication data stream model, determining the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used for... The process involves several steps: First, establishing closed-loop regulation consistency relationships to generate a communication and control state transition model. Second, identifying material coupling structures and physicochemical constraints between different work sections based on a digital twin process semantic model to extract cross-work section coupling constraints and determine a global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges. Third, configuring compliance boundary conditions for related measured values, setpoints, and operation control commands based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model to determine a structured multidimensional compliance rule set and generate a trusted digital twin data flow model. Fourth, acquiring and parsing current industrial control messages, determining the corresponding work section, control loop, and operation stage based on the communication and control state transition model to generate an event flow. Fifth, validating the event flow using the trusted digital twin data flow model and the global coupling constraint model to obtain safety detection data.

[0006] Secondly, embodiments of this specification provide an industrial control safety detection system based on a digital twin trusted data stream, including a process semantic module for acquiring several work sections and control loops within those sections based on process information from the process industry, extracting operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different work sections, to determine a digital twin process semantic model; a communication data stream parsing module for acquiring control system configuration information of the control loops, determining communication points corresponding to measured values, setpoints, and operation control commands based on the control system configuration information, and extracting communication features of the communication points in the industrial control messages to determine a digital twin communication data stream model describing the mapping relationship between communication points and industrial control messages; and a state transition module for determining the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data stream model and the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used for... The system comprises the following modules: a closed-loop regulation consistency relationship is determined to generate a communication and control state transition model; a coupling constraint module is used to identify the material coupling structure and physicochemical constraints between different work sections based on the digital twin process semantic model, to extract cross-work section coupling constraints, and to determine a global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges; a trusted rule configuration module is used to configure compliance boundary conditions for related measured values, setpoints, and operation control commands based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model, to determine a structured multidimensional compliance rule set and generate a digital twin trusted data flow model; and a safety detection module is used to acquire and parse the current industrial control message, determine the corresponding work section, control loop, and operation stage based on the communication and control state transition model, and generate an event flow; the event flow is verified according to the digital twin trusted data flow model and the global coupling constraint model to obtain safety detection data.

[0007] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0008] This specification's embodiments are designed for continuous and process industry scenarios. They precisely map the process flow, operation stages, control loop logic, and industrial control protocol points, elevating safety detection from protocol compliance to business semantic compliance. This can effectively identify malicious operations that are legally formatted but technologically dangerous, achieving a deep integration of process semantics and communication behavior.

[0009] Furthermore, the embodiments of this specification can also determine the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data flow model and the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate a communication and control state transition model. That is, the embodiments of this specification can construct a triplet state sequence between setpoints, operation outputs, and measured values ​​on a unified time axis based on historical normal data and process mechanisms, and establish dynamic response rules oriented towards the operation stage. This can effectively detect hidden faults or attack behaviors that are difficult to detect by traditional methods, such as commands being issued but actuators not responding, measured values ​​being frozen, and controller outputs being abnormal, with high detection accuracy.

[0010] Furthermore, the embodiments in this specification can also construct a global coupling constraint model with work sections as nodes, explicitly expressing the upstream and downstream dependencies of material flow, energy flow, and control signals. Based on cross-work section coupling constraints, when the system performs safety checks, it not only verifies the compliance of single control loops, but also checks whether cross-work section data meets physical constraints such as material conservation, component balance, and pressure gradient, which can effectively prevent the spread of systemic risks caused by local tampering.

[0011] The embodiments in this specification are designed for continuous and process industry scenarios. By constructing several models, including a control digital twin trusted data flow model, they address the pain points of traditional industrial control systems in terms of data trustworthiness and operational compliance, and significantly improve the reliability, security and intelligence level of industrial control systems. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram illustrating the application scenarios of the industrial control safety detection system provided in this manual.

[0014] Figure 2 This is a flowchart illustrating the industrial control safety testing method provided in this manual.

[0015] Figure 3 This is a schematic diagram of the industrial control safety detection system provided in this manual. Detailed Implementation

[0016] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings.

[0017] The terms "first," "second," etc., in the description, claims, and accompanying drawings are used to distinguish different objects and not to describe a particular order. Furthermore, the term "comprising" and any variations thereof are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0018] Before this specification elaborates on the industrial control security detection method based on digital twin trusted data stream in conjunction with one or more embodiments, it first introduces the application scenarios of the industrial control security detection system based on digital twin trusted data stream.

[0019] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of the industrial control security detection system based on digital twin trusted data flow provided in this embodiment of the invention. In this embodiment, the industrial control security detection system 100 based on digital twin trusted data flow can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer (PC); the server can be a single server or a server cluster composed of multiple servers.

[0020] In some embodiments, the industrial control security detection system 100 based on digital twin trusted data flow can also be integrated into multiple electronic devices. For example, the industrial control security detection system 100 can be integrated into multiple servers, and the industrial control security detection method based on digital twin trusted data flow of this application can be implemented by multiple servers.

[0021] In some embodiments, the server may also be implemented as a terminal. The terminal may be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer (PC), etc. The terminal includes a central processing unit (CPU), a graphics processing unit (GPU), memory, storage devices, a network communication module, sensors, a display screen, a battery and power management module, etc.

[0022] For example, refer to Figure 1The electronic device may include a server 110, a storage terminal 120, etc. The storage terminal 120 stores process information of the process industry, etc. The server 110 and the storage terminal 120 communicate with each other, which will not be described in detail here.

[0023] The server 110 may include a processor and memory. Based on process industry information, the server 110 can acquire several work sections and control loops within those sections, extracting operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different work sections, to determine a digital twin process semantic model. It can also acquire control system configuration information for the control loops, determine the communication points corresponding to measured values, setpoints, and operational control commands based on this information, and extract the communication characteristics of these points in the industrial control messages to determine a digital twin communication data flow model describing the mapping relationship between communication points and industrial control messages. Based on this digital twin communication data flow model, it determines the effective state sequences of measured values, setpoints, and operational control commands, as well as dynamic response characteristics, based on the process and control baseline information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate communication... The system incorporates several key technologies: a control state transition model; a digital twin process semantic model to identify material coupling structures and physicochemical constraints between different work sections, extracting cross-work section coupling constraints and determining a global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges; a digital twin communication data flow model, communication and control state transition model, and global coupling constraint model to configure compliance boundary conditions for related measured values, setpoints, and operation control commands, determining a structured multidimensional compliance rule set to generate a trusted digital twin data flow model; acquisition and parsing of current industrial control messages, determining the corresponding work section, control loop, and operation stage based on the communication and control state transition model to generate an event flow; and verification of the event flow based on the trusted digital twin data flow model and the global coupling constraint model to obtain safety detection data.

[0024] It should be noted that, Figure 1 The schematic diagram of the industrial control security detection system based on digital twin trusted data stream shown is merely an example. The industrial control security detection system and scenario based on digital twin trusted data stream described in this embodiment of the invention are for the purpose of more clearly illustrating the technical solutions of this embodiment of the invention, and do not constitute a limitation on the technical solutions provided by this embodiment of the invention. As those skilled in the art will know, with the evolution of industrial control security detection systems based on digital twin trusted data stream and the emergence of new scenarios, the technical solutions provided by this embodiment of the invention are also applicable to similar technical problems.

[0025] Please see Figure 2 , Figure 2This is a flowchart illustrating an industrial control security detection method based on trusted digital twin data streams provided in an embodiment of the present invention. This industrial control security detection method based on trusted digital twin data streams can be... Figure 1 The industrial control security detection system 100 based on digital twin trusted data stream, as shown, is executed. This system 100 can be a server, etc. The industrial control security detection method based on digital twin trusted data stream may include at least the following steps:

[0026] 200. Based on process information from the process industry, acquire several work sections and control loops within those sections, extract the operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different work sections, in order to determine the semantic model of the digital twin process.

[0027] In some embodiments, based on process information from the process industry, several process segments and control loops within those segments are acquired. The operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different process segments, are extracted to determine a digital twin process semantic model. This includes: acquiring process information from the process industry and dividing the process flow into several process segments based on the process information, each segment including at least one control loop; extracting operational stage characteristics and process constraints of the control loops, where operational stage characteristics at least include monitoring requirements for key process variables at the corresponding operational stage, adjustment logic of operational control commands, and control mode dependencies; acquiring the material coupling structure between different process segments, where the material coupling structure at least includes: a forward flow relationship where the output of the upstream process segment serves as the input of the downstream process segment; and a reverse circulation relationship where unreacted materials or intermediate products are returned to the preceding process segment; and establishing a digital twin process semantic model using a structured expression based on the process segments, control loops, operational stage characteristics, process constraints, and material coupling structure.

[0028] In some embodiments, the structured expression may include at least step descriptions, structured lists, causal dependency graphs, etc.; wherein, the causal dependency graph uses process variables, operation control instructions and process equipment status as nodes, and causal influence relationships, logical dependencies and safety constraints as directed edges, explicitly expressing the dynamic influence paths between variables and the preconditions for operation.

[0029] In some embodiments, key process variables may include at least: temperature, pressure, flow rate, liquid level, component concentration, etc.; corresponding operation stages may include at least: setting, monitoring, adjustment, steady-state maintenance, transient control, etc.; monitoring requirements may include at least: target values, allowable fluctuation ranges, alarm thresholds, rate of change limits, etc. for key process variables; operation control commands may include at least: adjustment of valve opening, pump start / stop, etc.; control mode dependencies may include at least: switching logic between automatic control mode and manual control mode, etc.

[0030] This embodiment can divide the process into sections and identify control loops based on the process information of the process industry. It can extract the key process variables of each control loop under the corresponding operation stage, the monitoring requirements of the operation control command, the adjustment logic of the operation control command, the control mode dependency, the process constraints, and the material coupling structure between different sections, that is, simultaneously identify the material and energy coupling relationship between upstream and downstream of cross-sections and construct a digital twin process semantic model.

[0031] In this embodiment, within a process industry scenario, the production process can include a series of continuously operating, mutually coupled physical or chemical processes. These processes may include at least stages such as raw material feeding, reaction synthesis, separation and purification, heat exchange and cooling, product refining, and safety venting. They are widely used in petrochemical, coal chemical, and water conservancy industries. Industrial processes share common characteristics such as continuous material flow, dynamic energy exchange, control objectives primarily based on variable adjustment, and strong safety and process constraints. The stable operation of a production process highly depends on the coordinated consistency of the operational logic, control behavior, and material and energy flow among the various process subsystems. To construct a highly reliable digital twin trusted data flow model and support subsequent security detection, this embodiment can first establish a clearly structured and semantically complete digital twin process semantic model as the logical foundation of the entire system.

[0032] In this embodiment, the process information of the process industry may include the chemical and physical reaction principles, process flow diagrams, safety interlock logic, and operating procedures of the process industry.

[0033] This embodiment divides the overall process into multiple segments based on process industry information. Each segment corresponds to a process subsystem with clearly defined material or energy boundaries and independent functional objectives, ensuring the system possesses relative closure and functional integrity in both physical structure and control logic. Furthermore, this embodiment identifies the control loops contained within each segment. A control loop is a basic control unit that implements specific adjustment functions, formed by controlling key process variables such as temperature, pressure, flow rate, liquid level, and component concentration. Simultaneously, this embodiment can identify the material and energy coupling relationships between upstream and downstream segments, i.e., the material coupling structure between different segments. Based on the characteristics of segments, control loops, operational stages, process constraints, and material coupling structures, a digital twin process semantic model is established using a structured representation.

[0034] For example, taking a typical methanol synthesis process in the coal chemical industry as an example, this paper elaborates on the construction process of a digital twin process semantic model for a business process segment.

[0035] First, based on the chemical and physical reaction principles of methanol synthesis, the main reaction mechanism involves using syngas (primarily composed of CO and H2) as raw material, undergoing an exothermic reaction to produce methanol under the action of a catalyst. According to conventional process flow diagrams, safety interlock logic, and operating procedures, the methanol synthesis section is divided into four sections: the synthesis reaction section, the reaction gas cooling section, the gas-liquid separation section, and the circulating gas compression section. Each section has clearly defined material and energy boundaries and independent functional objectives. For example, the synthesis reaction section uses the methanol synthesis reactor as its core equipment, with syngas (fresh CO, CO2, H2) and circulating gas (unreacted H2, CO, and inert gases such as CH4 and N2) as inputs, and outputs high-temperature reaction gas (containing methanol vapor, unreacted gas, and byproducts). Under the action of a catalyst, the syngas is efficiently and safely converted into methanol, while precisely controlling the reaction temperature and pressure to avoid catalyst sintering or exacerbation of side reactions.

[0036] Subsequently, control loops were identified within each process section, and for each control loop, typical operating stages were determined, including setting, monitoring, adjustment, steady-state maintenance, and transient control. For specific operating stages, monitoring targets for key process variables such as temperature, pressure, flow rate, liquid level, and component concentration were extracted; adjustment logic for control commands such as regulating valve opening and pump start / stop was defined; control mode dependencies were established; and loop-level process constraints were identified. For example, in the synthesis reaction section, typical control loops include temperature control loop TIC-1101, pressure control loop PIC-1102, and fresh syngas feed flow control loop FIC-1103. For temperature control loop TIC-1101, taking the "steady-state maintenance" operation stage as an example, the extracted process variable monitoring target is "temperature variable value of 220°C~250°C," the operation control command adjustment logic is "in automatic mode, the cooling water valve opening is automatically adjusted via PID; in manual mode, the operator directly sets the valve position," the control mode dependency is "PID output is enabled in automatic mode; in manual mode, the operator issues control commands," and the process constraint is "the cooling water valve opening change rate must not exceed 8% / min," etc.

[0037] Simultaneously, the coupling relationships across sub-processes, i.e., material coupling structures, are identified. For example, the material flow relationship between upstream and downstream processes includes: the high-temperature outlet gas from the synthesis reaction section is fed into the reaction gas cooling section as input; the cooled gas-liquid mixture enters the gas-liquid separation section; the separated unreacted gas is pressurized by the circulating gas compression section and returned to the inlet of the synthesis reaction section, forming a typical "forward flow + reverse circulation" coupling structure. Based on the above coupling structure, key constraints can be extracted, such as "fresh synthesis gas feed rate + circulating gas flow rate = total reactor feed rate", "the CH4 concentration in the circulating gas must not continuously exceed 15%", and "the outlet pressure of the circulating compressor must be higher than the reactor operating pressure", etc.

[0038] Next, taking a causal dependency graph as an example, typical nodes are defined, and the construction process of the digital twin process semantic model is constructed. This includes: “TIC-1101.SP (temperature control loop setpoint)”, “TIC-1101.OP (temperature control loop operation control command)”, “TT-1101.PV (thermocouple temperature measurement value)”, and “reactor operating status”, etc.; directed edges include: “TIC-1101.OP → TIC-1101.PV (operation control impact measurement)”, “TT-1101.PV > 280°C → trigger emergency pressure relief (safety constraint)”, etc. Combining all nodes and directed edges, a complete digital twin trusted data flow process semantic model is constructed.

[0039] 210. Obtain the control system configuration information of the control loop, determine the communication points corresponding to the measured values, set values ​​and operation control commands based on the control system configuration information, extract the communication features of the communication points in the industrial control messages, and determine the digital twin communication data flow model used to describe the mapping relationship between the communication points and the industrial control messages.

[0040] In this embodiment, the control system may include at least a DCS system, a PLC system, etc. The control system configuration information may include at least the control system configuration point table, protocol configuration document, and process control logic. The communication characteristics of communication points in industrial control messages may include at least network communication identifiers, protocol control information, message interaction relationships, and point data content. The network communication identifier may include at least the source IP address, destination IP address, source MAC address, destination MAC address, and port; the protocol control information may include at least the industrial control protocol type and function code; the message interaction relationship may include at least the correspondence between request messages, response messages, and acknowledgment messages; and the point data content may include at least the communication point number and communication point value.

[0041] In this embodiment, the communication point can be a logical mapping of the measured value, set value and operation control command in the control loop in the industrial control communication message, and can at least include the point number, register address and communication characteristic information.

[0042] In some embodiments, the communication points corresponding to measured values, setpoints, and operation control commands are determined based on the control system configuration information. The communication features of these communication points in the industrial control messages are extracted to determine a digital twin communication data flow model describing the mapping relationship between the communication points and the industrial control messages. This includes: determining the communication points corresponding to measured values, setpoints, and operation control commands based on the control system configuration information; the communication points at least include measured value points of key process variables, controller setpoint read / write points, and operation control command output points; extracting the communication features of the communication points in the industrial control messages based on a preset industrial control protocol specification; the communication features at least include network communication identifiers, protocol control information, message interaction relationships, and point data content; and establishing a digital twin communication data flow model using a structured expression form based on the communication points and communication features.

[0043] In this embodiment, the types of industrial control protocols may include at least Modbus, CIP, S7, OPC UA, DNP3, etc.

[0044] This embodiment can combine the configuration and protocol specifications of DCS or PLC systems to map the communication points and message characteristics of key process variables' measured values ​​(PV), setpoints (SP), and operation instructions (OP) to establish a digital twin communication data flow model.

[0045] For each control loop identified in the digital twin trusted data flow process semantic model, and combining the configuration point table of the DCS or PLC system, industrial control protocol configuration documents, and process control logic, the specific communication points of key process variables such as temperature, pressure, flow rate, liquid level, and component concentration involved in the control loop are defined in the control system. Communication points can at least include measured values ​​(PV), controller setpoints (SP), and operation control commands (OP). Measured values ​​are collected by field sensors and uploaded periodically; setpoints define the target values ​​of the controlled variables and support read and write operations; operation control commands include valve opening commands, pump start / stop commands, etc., issued by the controller or operator to drive actuators. Each communication point has a unique identifier in the control system and can exist in the form of register address, information object address, or node path.

[0046] This embodiment can determine the communication characteristics related to each communication point based on the industrial control protocol specifications adopted by the actual deployment system (including but not limited to Modbus, CIP, S7, OPC UA, DNP3, etc.). These characteristics may include: the source MAC address and IP address, destination MAC address and IP address, port number, protocol type and function code of the communication message, and the interaction logic and correspondence between request, response, and acknowledgment messages. Simultaneously, it determines the field information of the point in the message, such as key features like the point number. Next, this embodiment can precisely bind the semantic model of the digital twin trusted data flow process with the communication semantics, forming a structured mapping relationship. Then, it constructs the digital twin communication data flow model using step descriptions, structured lists, or causal dependency graphs.

[0047] For example, taking the temperature control loop TIC-1101 in the methanol synthesis section as an example, according to the digital twin trusted data flow process semantic model, this control loop is used to control the bed temperature of the methanol synthesis reactor. Its key process variables include: Measured value (PV): the reactor hot spot temperature, acquired by thermocouple TT-1101; Setpoint (SP): the target temperature set by the operator or the upper-level system; Operation control command (OP): the opening command of the cooling water regulating valve TV-1101, output by the controller. By looking up the configuration point table of the DCS, the relevant information of the points shown in Table 1 can be obtained:

[0048] Table 1. Relevant point information for the temperature control loop TIC-1101

[0049]

[0050] Assuming the DCS system uses the Modbus TCP protocol to communicate with remote I / O modules, the protocol configuration information, including source MAC address and IP address, destination MAC address and IP address, port number, protocol type, and function code, is as follows:

[0051] 1) DCS control station (master station): IP = 192.168.20.10, MAC = 00:1A:2B:3C:4D:5E, port = 502; 2) I / O module (slave station): IP = 192.168.20.20, MAC = 00:1A:2B:3C:4D:5F, port = 502; 3) The point register mapping structure is shown in Table 2.

[0052] Table 2. Mapping of relevant point registers for the temperature control loop TIC-1101

[0053]

[0054] Based on the process control logic and DCS operation mechanism, the communication behavior of each point is illustrated below:

[0055] 1) PV value upload: The DCS actively polls the I / O module every 1 second, sending a Modbus request message: [Src:192.168.20.10:502→Dst: 192.168.20.20:502, FC=04, Reg=30001, Qty=1]. The I / O module returns a response message carrying the 32-bit floating-point value of TT-1101.PV; 2) SP read / write: Read: The DCS polls the SP value every 2 seconds (FC=03, Reg=40001); Write: When the operator modifies the setting value, the DCS sends a write request: [FC=06, Reg=40001,Value=240.0]. The I / O module returns the same content as confirmation; 3) OP output: In automatic mode, the controller updates the OP value every 1 second, and the DCS sends a write request to Reg=40002. The above information is organized into a structured communication data flow model, represented in list form as shown in Table 3, thus forming a digital twin communication data flow model.

[0056] Table 3. Structured Communication Data Flow Model of Temperature Control Loop TIC-1101

[0057]

[0058] 220. Based on the digital twin communication data flow model, the effective state sequence of measured values, set values ​​and operation control commands, as well as dynamic response characteristics, are determined according to the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship in order to generate a communication and control state transition model.

[0059] This embodiment utilizes historical normal data and control logic to construct an effective state sequence of measured values, setpoints, and operational control commands on a unified timeline, modeling the closed-loop regulation consistency relationship at different operational stages, thus forming a communication and control state transition model. In process industries, the stable operation of a process depends on a closed-loop feedback control system composed of setpoints, operational control commands, and measured values. Based on a digital twin communication data flow model, this embodiment integrates design-state knowledge and operational-state historical data to summarize a structured communication and control state transition model capable of representing normal control behavior in an offline phase.

[0060] In some embodiments, based on a digital twin communication data flow model, the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, are determined according to the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate a communication and control state transition model. This includes: acquiring process and control reference information under normal operating conditions of the control system, which at least includes the corresponding normal operating history data of the control system, controller configuration parameters, process mechanism model, and operating procedure data; and using the process and control reference information as the behavioral boundary of normal operating conditions based on the communication points and their corresponding control loops defined in the communication data flow model. The system establishes a valid state sequence of measured values, setpoints, and operation control command output states in each control loop in chronological order; it obtains each operation stage and its corresponding control mode based on the digital twin process semantic model, and parses the operation source information from the industrial control message based on the digital twin communication data flow model; it determines the dynamic response characteristics of the measured values ​​to the setpoints and operation control command output states based on each operation stage, its corresponding control mode, and the operation source information; it establishes a closed-loop regulation consistency relationship under each operation stage based on the dynamic response characteristics, and the closed-loop regulation consistency relationship is used to determine the association rules corresponding to each operation stage; and it establishes a communication and control state transition model representing normal process control behavior based on the association rules.

[0061] In this embodiment, the association rules may include at least the preset value range of the set value, the response interval of the operation control command, the dynamic change rate limit of the measured value, and the allowable deviation tolerance during steady-state operation.

[0062] In this embodiment, the dynamic response characteristic can be the dynamic change curve of the measured value relative to the setpoint and the output state of the operation control command when the setpoint changes or is subjected to external disturbances during the operation of the control loop. The closed-loop regulation consistency relationship can be the dynamic matching rules that the setpoint, the output state of the operation control command, and the measured value should satisfy under normal automatic control mode. The dynamic matching rules can include directional consistency, time delay constraints, amplitude matching, steady-state matching, etc. Directional consistency means that the direction of change of the output state of the operation control command should be consistent with the sign of the deviation between the setpoint and the measured value; time delay constraints mean that the response lag time of the measured value should be within the inherent dynamic response delay range of the process unit; amplitude matching means that the amplitude of change of the output state of the operation control command should match the magnitude of the deviation between the setpoint and the measured value; steady-state matching means that in steady state, the measured value should be stable within the allowable deviation range near the setpoint.

[0063] This embodiment can obtain each operation stage and its corresponding control mode based on the process semantic model. Combined with the operation source information parsed from communication messages, it analyzes the dynamic response characteristics between measured values, setpoints, and the output status of operation control commands. The operation source information can be information parsed from the source IP address or source MAC address of the industrial control message, and can include at least one of the following: operator station, automatic controller, remote maintenance terminal, or host system. The operation source information can be used to distinguish the output status of operation control commands from different sources, and different operation sources correspond to different dynamic response characteristic analysis rules.

[0064] This embodiment can reconstruct the effective state sequences of SP, OP, and PV of each control loop on a unified time axis based on the point-to-point communication behavior and control loop structure defined in the digital twin communication data flow model, combined with the normal operation history data stored in the DCS or PLC system, controller configuration parameters (such as the gain, integral and derivative time constants of the PID control algorithm), process mechanism models (including physical and chemical principles such as material balance, energy conservation, and reaction kinetics), and operating procedures. Specifically, the states of SP and OP are updated when their corresponding communication events (such as setpoint writing and control valve opening output updates) occur. If no event occurs, the most recent valid value is retained, thus forming a continuous and complete logical time sequence, avoiding state gaps caused by communication sparsity.

[0065] Furthermore, this embodiment can also systematically analyze the dynamic response characteristics of PV to SP and OP by combining the current operation stage (including setting, monitoring, adjustment, steady-state maintenance or transition control, etc.), control mode (automatic or manual) and operation source information (e.g., operator station, remote maintenance terminal, etc.), including key indicators such as response start time, rate of change, overshoot, settling time and steady-state deviation. Through statistical analysis and mechanism verification of a large number of normal operation segments, the closed-loop regulation consistency relationship of SP, OP and PV under specific operation stages is summarized and modeled, forming a set of structured association rules oriented towards operation stages, specifically including: 1) Reasonable range of joint setpoints: The setpoints must be within the range allowed by process safety and equipment capacity, for example, the temperature should not be lower than the catalyst activation temperature and not higher than the material tolerance limit; 2) Response range of operation outputs: Operation commands (e.g., valve opening, pump start-stop frequency) should show a reasonable adjustment range with the change of SP and PV deviations to avoid hysteresis or over-response; 3) Limitation of the dynamic change rate of measured values: The change rate of process variables is constrained by heat transfer, mass transfer and fluid inertia, and should not exceed the physically achievable range; 4) Allowable deviation tolerance during steady-state operation: In the steady-state stage, the deviation between PV and SP should be maintained within the range allowed by control accuracy and process requirements.

[0066] In this embodiment, the closed-loop regulation consistency relationship must satisfy basic control logic constraints: Under normal automatic control mode, the direction of change in the process parameter output driven by the operation control command should be consistent with the sign of the deviation between the set value and its measured value. For example, when SP > PV, the control system should output an operation command that increases the controlled variable (such as opening the heating valve and closing the cooling valve); and vice versa. If the operation direction is opposite to the deviation sign, it indicates that the control logic has been tampered with, the actuator is faulty, or the mode is misconfigured.

[0067] In this embodiment, the response lag time of the measured value should be within the dynamic response delay constraint range of the process unit. This delay is determined by process mechanisms such as equipment volume, material flow rate, heat transfer coefficient, and reaction rate. If the PV shows no response trend within the expected delay window after the SP change, a problem exists.

[0068] This embodiment integrates association rules with state transition logic to form a communication and control state transition model that can characterize normal process control behavior. This model uses the operation stage as the state node and the consistency relationship between SP-PV-OP as the transition condition to construct the communication and control state transition model.

[0069] For example, taking the temperature control loop TIC-1101 of the synthesis reaction section in the methanol synthesis unit as an example, based on the 12 months of normal operation history data stored in the DCS system, the controller's PID parameters, process mechanism model, and operating procedure constraints (such as steady-state temperature range: 220.0–250.0℃; upper limit of heating rate: 5.0℃ / min, etc.), and based on the digital twin communication data flow model, the SP-OP-PV triplet sequence is reconstructed with a unified 1-second time axis. This embodiment can combine the current operating stage (such as "steady-state maintenance" or "heating transition"), control mode (automatic or manual), and operation source information (such as "HMI operator" or "automatic load scheduling program") to analyze the dynamic response characteristics between measured values, setpoints, and operation control command output states.

[0070] Taking "steady-state load fine-tuning" as an example: Assume that at t = 0, the operator increases the SP from 240.0℃ to 250.0℃ via the HMI; the system is in automatic mode, and the operation source is the local operator station. Subsequently, the controller immediately reduces the opening of the cooling water valve TV-1101 (e.g., OP decreases from 45.0% to 40.0%) to reduce the cooling intensity; the PV value begins to show an upward trend after t = 30 seconds, increasing at an average rate of 4.2℃ / min, and reaches 249.8℃ at t = 150 seconds, entering a new steady state, with a final deviation of |250.0 – 249.8| = 0.2℃. Through statistical analysis of hundreds of similar normal events, the following closed-loop control consistency association rules for TIC-1101 during the "steady-state maintenance" phase were summarized: the reasonable range of the setpoint is 220.0–250.0℃; when |SP – PV| > 2.0℃, the OP change rate should not be less than 0.5% / min; the dynamic heating rate of PV should not exceed 5.0℃ / min; the steady-state deviation tolerance is ±1.0℃. Simultaneously, the basic control logic constraints were verified: in this event, SP > PV (deviation of +10.0℃), OP decreased (cooling weakened), causing PV to rise, with the operation direction consistent with the deviation sign; and PV began to respond within 30 seconds and reached steady state within 150 seconds, with the response lag time falling within the reactor's inherent 30–180 second dynamic delay window, consistent with the expected process mechanism.

[0071] Furthermore, during the "heating transition" operation phase, the rules are adjusted accordingly: SP increases at a ramp rate of 5.0℃ / min, OP should continuously decrease monotonically, and the PV response start time should be ≤ 60 seconds; if OP shows reverse fluctuations or the PV response delay exceeds 100 seconds, it is considered abnormal.

[0072] This embodiment integrates association rules with state transition logic to construct a communication and control state transition model with operation phases as state nodes and SP-PV-OP consistency as the transition condition, as detailed below:

[0073] Construct a state machine using operation phases as state nodes and consistency rules as transition conditions:

[0074] 1) State: Steady state maintained

[0075] Condition: SP changes and direction / delay constraints are met.

[0076] Transfer to: Adjusting the transition

[0077] 2) State: Adjustment Transition

[0078] Condition: PV remains stable within tolerance for 300 consecutive seconds.

[0079] Shift to: Steady-state maintenance

[0080] When the system is in the "steady-state maintenance" state, if a change in SP is detected and the direction consistency and time delay constraints are met, the transition to the "adjustment transition" state is allowed; after the adjustment is completed, if PV remains stable within the tolerance for 300 consecutive seconds, the system returns to the "steady-state maintenance" state.

[0081] 230. Based on the semantic model of the digital twin process, identify the material coupling structure and physicochemical constraints between different work sections, so as to extract the cross-work section coupling constraints of different work sections and determine the global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges.

[0082] In some embodiments, based on the semantic model of a digital twin process, the material coupling structure and physicochemical constraints between different work sections are identified to extract cross-work section coupling constraints and determine a global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges. This includes: determining the material coupling structure between different work sections based on each work section in the digital twin process semantic model; determining the physicochemical constraints between different work sections based on the material coupling structure, wherein the physicochemical constraints are required to include at least flow matching constraints, component conservation constraints, and pressure balance constraints; determining the cross-work section coupling constraints between different work sections based on the physicochemical constraints between different work sections; and determining the global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges.

[0083] In this embodiment, the cross-section coupling constraints may include at least the material balance constraints corresponding to flow matching constraints or component conservation constraints, the safety interlock constraints corresponding to pressure balance constraints, and the cascade or feedforward control consistency constraints.

[0084] In continuous and process industries, process units within a process system are tightly coupled organic wholes through material flow, energy flow, and control signals. An anomaly in a single process segment can propagate rapidly through the coupling path, triggering a chain reaction of failures. Therefore, it is necessary to construct a global coupling constraint model capable of characterizing the dynamic dependencies across process segments. Based on the process segments in the digital twin process semantic model, the physical and logical coupling relationships between each process segment can be systematically identified and formalized.

[0085] This embodiment first identifies the upstream and downstream supply relationships between different processes based on the segments defined in the digital twin process semantic model. That is, the output of products or intermediate materials from the upstream segment serves as the input for the downstream segment. Simultaneously, it identifies closed-loop paths in the circulation loop, where unreacted materials, byproducts, or intermediate components are processed and returned to the preceding segment to participate in the reaction or be utilized again. This structure constitutes a complex forward flow and reverse circulation network. Based on this, cross-segment coupling constraints are obtained from the material coupling structure:

[0086] 1) Material balance constraint: This constraint describes the matching relationship between upstream unit discharge and downstream unit feed in terms of flow rate and time. Considering factors such as pipeline transmission delay, equipment accumulation, and evaporation / condensation losses in actual systems, this constraint, after compensating for delays and losses, sets the upstream and downstream flow rate difference to be less than a preset engineering error range (e.g., ±2%).

[0087] 2) Cascade or feedforward control consistency constraints: These describe the cooperative control relationship where the output value of one controller is used as the setpoint of the next-level controller. For example, the output of the main flow controller is used as the setpoint of the branch flow controller. The two should maintain numerical consistency during steady-state or dynamic processes, and their difference should be less than a preset tolerance threshold (e.g., ±1%).

[0088] 3) Safety interlock logic constraints: These are used to describe the cross-section linkage actions that should be automatically triggered when an abnormal state such as overpressure, overtemperature, low liquid level, or high component concentration occurs in a certain section. These actions include closing the upstream feed valve, starting the downstream relief valve, and stopping the associated pump or compressor to block the path of danger propagation.

[0089] Furthermore, this embodiment can formalize cross-section coupling constraints into a graph model structure: with sections as nodes and material balance constraints, cascade control consistency constraints, and safety interlocking logic constraints as directed edges, a global coupling constraint model is constructed. Each directed edge identifies the coupling direction (e.g., "combined section → separated section"), and also embeds specific logical rules.

[0090] For example, taking the four sub-sections of the methanol synthesis section as an example (synthesis reaction section: U1, reaction gas cooling section: U2, gas-liquid separation section: U3, circulating gas compression section: U4), the upstream and downstream and circulation paths are as follows:

[0091] 1) Forward flow: Outlet of synthesis reaction section (high temperature reaction gas) → Inlet of reaction gas cooling section; Outlet of reaction gas cooling section (condensed gas-liquid mixture) → Inlet of gas-liquid separation section;

[0092] 2) Circulating flow: Gas phase outlet (unreacted gas) of gas-liquid separation section → compressed in circulating gas compression section → returned to the inlet of synthesis reaction section and mixed with fresh synthesis gas.

[0093] Based on upstream and downstream and loop paths, extract cross-section coupling constraints:

[0094] 1) Material balance constraints, for example: (a) Total discharge flow rate of U1 = Feed flow rate of U2 (assuming transmission delay τ = 5 seconds, pipeline accumulation can be ignored); the corresponding constraint rule is: |FU1,out(t−5)−FU2,in(t)| ≤2%×Fnominal; (b) Discharge of U2 = Feed of U3 (complete condensation, no phase change loss); Liquid phase extraction of U3 + gas phase circulation = Total discharge of U2; the corresponding constraint rule is: if the liquid level of U3 rises abnormally but the gas phase circulation flow rate does not decrease, then the balance is violated.

[0095] 2) Cascade control consistency constraints, for example: (a) The output of FIC-1102 (U1 fresh gas feed) is used as the feedforward setpoint of FIC-1103 (U4 circulating gas) to maintain a constant total feed; the corresponding constraint rule is: |FIC-102.OP−FIC-103.SP|≤1.5 kmol / h (tolerance threshold); (b) If the output of FIC-1102 is 80, but the setting of FIC-1103 is still 60, then the cascade is determined to be broken, which may be due to the setting being tampered with.

[0096] 3) Safety interlock logic constraints, for example: (a) When the temperature of reactor U1 is >280℃ (overheating), the feed shut-off valve HV-1101 of U1 will be closed and the vent valve PV-1101 of U1 will be opened; (b) When the liquid level of separator U3 is <10% (low liquid level), the crude methanol pump P-1101 will be stopped to prevent the pump from running dry; (c) When the outlet pressure of compressor U4 is <4.8 MPa (insufficient circulation), the reaction load of U1 will be reduced.

[0097] Based on upstream and downstream, circulation paths and cross-section coupling constraints, the global coupling constraint model is represented in the form of a graph structure, for example: (1) Nodes: U1, U2, U3, U4; (2) Directed edges: U1→U2: material balance edge, embedded with a delay of 5 seconds and an error of ±2%; U3→U1: circulating material edge, containing component constraints (CH4≤15%); FIC-1102→FIC-1103: cascade control edge, with a tolerance of 1.5 kmol / h; U1 (over-temperature)→HV-101 / PV-101: safety interlock edge, with clear action conditions.

[0098] 240. Based on the digital twin communication data flow model, communication and control state transition model and global coupling constraint model, configure compliance boundary conditions for related measurement values, set values ​​and operation control commands, determine a structured multidimensional compliance rule set, and generate a digital twin trusted data flow model.

[0099] This embodiment can generate a multi-dimensional compliance rule set of binding sections, loops, operation stages and various constraints based on the digital twin communication data flow model, communication and control state transition model and global coupling constraint model, thus forming a trusted data flow model.

[0100] In some embodiments, based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model, compliance boundary conditions for related measured values, setpoints, and operation control commands are configured to determine a structured multidimensional compliance rule set, thereby generating a trusted digital twin data flow model. This includes: configuring compliance boundary conditions for related measured values, setpoints, and operation control commands within the control loops of each sub-section based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model; determining a structured multidimensional compliance rule set based on the compliance boundary conditions, where each compliance rule in the structured multidimensional compliance rule set is bound to the corresponding section, control loop, applicable operation stage, and associated cross-section coupling constraints; and determining the trusted digital twin data flow model based on the structured multidimensional compliance rule set.

[0101] In some embodiments, compliance boundary conditions may include at least numerical range, rate of change, time window, legality of operation phase, and consistency requirements across sub-segments; compliance boundary conditions are self-learned and calibrated based on historical normal operation data, and constraints are modified in conjunction with process safety boundaries; the multi-dimensional compliance rule set includes value range rules, time sequence rules, logical rules, and coupling rules; value range rules are used to constrain the effective measurement range of process parameters; time sequence rules are used to constrain the range of change of process parameters within a specific time interval; logical rules are used to constrain operation control under preset conditions; coupling rules are used to constrain the mapping constraints between process parameters that have coupling relationships between different process units, etc.

[0102] This embodiment can systematically configure compliance boundary conditions for related measured values, setpoints, and operational control commands within each process segment based on a digital twin communication data flow model, a communication and control state transition model, and a global coupling constraint model. These compliance boundary conditions include: 1) Numerical range (value domain): for example, the temperature must not be lower than the catalyst activation temperature, nor exceed the material limits of the equipment; 2) Rate of change (dynamic constraint): for example, the heating rate is limited by thermal stress, and flow rate changes are limited by pump characteristics; 3) Time window (timing constraint): for example, after a setpoint change, the measured value should show a trend within the inherent response delay of the process unit; 4) Operational stage legality: for example, opening the feed valve is only permitted during the 'feeding stage,' and load increases are prohibited during the 'shutdown stage'; 5) Consistency requirements across sub-process segments: for example, the upstream discharge flow rate and the downstream feed flow rate must meet material balance, and the cascade controller output must match the lower-level setpoint.

[0103] This embodiment can determine a multi-dimensional compliance rule set based on compliance boundary conditions. Each compliance rule can be bound to several key metadata, including: the specific process section, the control loop it belongs to, the applicable operating stage, and associated cross-process coupling constraints (such as material balance, cascade control, or safety interlocks). This embodiment can divide the multi-dimensional compliance rule set into several different types of rules according to function, including value range rules, timing rules, logic rules, and coupling rules. Value range rules are used to constrain the effective measurement or operating range of process parameters to prevent over-limit operation; timing rules are used to constrain the variation amplitude or response delay of process parameters within a specific time interval, reflecting the dynamic characteristics of the system; logic rules are used to constrain the allowed operational control behavior under specific preconditions; coupling rules are used to constrain the mapping relationship between parameters with physical or control coupling relationships between different process units, such as flow matching, component conservation, and pressure gradient.

[0104] In this embodiment, the parameters (such as error threshold, response delay, and tolerance range) in different rule types can be self-calibrated based on historical normal operation data without manual setting. By statistically analyzing a large number of SP-PV-OP sequences under steady-state and transient operating conditions, typical behavior intervals are automatically extracted. Simultaneously, the self-learning results are constrained and corrected by combining process safety boundaries (such as equipment design pressure and reaction thermal runaway threshold) to avoid the model overfitting abnormal historical data that did not trigger alarms. The multi-dimensional compliance rule set formed in this embodiment can constitute the core component of the digital twin trusted data flow model.

[0105] For example, taking the methanol synthesis section as an example, it is divided into four sections (synthesis reaction section: U1, reaction gas cooling section: U2, gas-liquid separation section: U3, and circulating gas compression section: U4), which include control loops such as TIC-1101, PIC-1101, FIC-1102, and LIC-1103. In this embodiment, the following multi-dimensional compliance rule set can be constructed, as shown in Table 4.

[0106] Table 4 Examples of Multidimensional Compliance Rule Sets

[0107]

[0108] 10,000 hours of normal operation data were extracted from the historical database of the DCS system for self-learning and constraint correction. Taking the temperature control of TIC-1101 as an example, assuming that the steady-state deviation of TIC-1101 is statistically analyzed and the 95th quantile is 0.8℃ after self-learning, the initial tolerance is set at 1.0℃; the process safety boundary requirement is that "the catalyst hot spot should not exceed 260℃", so the upper limit hard constraint is 260.0℃; the cascade deviation of FIC-102 and FIC-103 is analyzed, assuming that the self-learning tolerance is 1.2 kmol / h, and combined with the control accuracy requirements, it is finally set to 1.5 kmol / h.

[0109] This embodiment can bind metadata to each rule based on a multi-dimensional compliance rule set. For example, for a temperature change rate rule, its rule ID is marked as "R_TIC1101_TempRate", and the rule content is "dT / dt ≤ 5.0 ℃ / min". It is bound to the following key metadata: subdivision section (U1); control loop (TIC-1101); operation stage (temperature rise transition); and rule type (time sequence rule). This embodiment can form a trusted data flow model of continuous and process industry digital twins based on the multi-dimensional compliance rule set and the bound metadata.

[0110] 250. Acquire and parse the current industrial control message, determine the corresponding work section, control loop and operation stage based on the communication and control state transition model, and generate an event stream; verify the event stream according to the digital twin trusted data stream model and the global coupling constraint model to obtain safety detection data.

[0111] In some embodiments, the current industrial control message is acquired and parsed, and the corresponding work section, control loop, and current operation stage are determined based on the communication and control state transition model to generate an event stream. The event stream is then verified according to the digital twin trusted data stream model and the global coupling constraint model to obtain security detection data. This includes: acquiring communication messages in the industrial control network to obtain the current industrial control message, parsing the communication parameters corresponding to the current industrial control message; identifying the corresponding work section, control loop, and operation stage based on the communication parameters according to the communication and control state transition model, and generating an event stream in chronological order; performing multi-level verification on the event stream, and outputting security detection data.

[0112] In some embodiments, multi-level verification includes at least: verifying whether the event stream meets the corresponding compliance rules in the digital twin trusted data stream model; aggregating events from different segments in the event stream to obtain an aggregated event sequence; and verifying whether the aggregated event sequence meets the cross-segment constraints in the global coupling constraint model.

[0113] In some embodiments, the output security detection data includes at least events that violate the corresponding rules of the multi-level verification after performing multi-level verification on the event stream, and at least the corresponding alarm information, abnormal propagation path, affected work section, and handling suggestions are output based on the events that violate the corresponding rules of the multi-level verification.

[0114] In this embodiment, for safety monitoring in the process industry, communication messages in the industrial control network can be collected in real time using a data acquisition device, covering mainstream protocols such as Modbus TCP, S7, OPC UA, and CIP. For each message, key parameters such as source / destination IP address, MAC address, transmission port, protocol type, function code, and point number (such as register address or information object address) are parsed, and the timestamp is extracted to establish a precise timing sequence. Subsequently, based on the communication and control state transition model established in step S3, the system automatically identifies the sub-section, control loop, and current operation stage corresponding to the message. Multiple related messages are aggregated in chronological order to form a multi-dimensional event stream.

[0115] For each event stream, the system in this embodiment can execute a two-level verification mechanism: The first level verifies whether the event meets the following conditions based on the multi-dimensional compliance rule set (including value range rules, timing rules, and logic rules) bound to the sub-segment, control loop, and operation stage in the trusted data flow model: 1) Whether the data value is within the allowed range (value range compliance); 2) Whether the parameter change meets the rate or response delay requirements (timing compliance); 3) Whether the operation instruction meets the preconditions and control logic (logic compliance).

[0116] The second level aggregates relevant events across sub-segments (such as upstream discharge flow rate and downstream feed flow rate, cascade controller output and lower-level setpoint), and verifies whether they satisfy the global coupling constraint model: 1) material-energy-component conservation relationship (such as mass balance, component concentration matching); 2) circulation loop flow balance (such as total feed = fresh gas + circulating gas); 3) pressure gradient consistency (such as compressor outlet pressure must be higher than reactor operating pressure).

[0117] In this embodiment, the system immediately triggers an alarm for any behavior that violates the value range, timing, control logic, or cross-process coupling constraints. Simultaneously, the system uses a causal dependency graph and coupling constraint model to associate upstream or downstream process units, identifying whether the anomaly was caused by a neighboring unit or has spread to other units. This embodiment can also combine operating procedures and safety strategies to generate structured handling suggestions, such as "check if the U1 feed valve is leaking," "switch to the standby compressor," or "start the emergency pressure relief procedure."

[0118] This specification's embodiments are designed for continuous and process industry scenarios. They precisely map the process flow, operation stages, control loop logic, and industrial control protocol points, elevating safety detection from protocol compliance to business semantic compliance. This can effectively identify malicious operations that are legally formatted but technologically dangerous, achieving a deep integration of process semantics and communication behavior.

[0119] Furthermore, the embodiments of this specification can also determine the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data flow model and the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate a communication and control state transition model. That is, the embodiments of this specification can construct a triplet state sequence between setpoints, operation outputs, and measured values ​​on a unified time axis based on historical normal data and process mechanisms, and establish dynamic response rules oriented towards the operation stage. This can effectively detect hidden faults or attack behaviors that are difficult to detect by traditional methods, such as commands being issued but actuators not responding, measured values ​​being frozen, and controller output being abnormal.

[0120] Furthermore, the embodiments in this specification can also construct a global coupling constraint model with work sections as nodes, explicitly expressing the upstream and downstream dependencies of material flow, energy flow, and control signals. Based on cross-work section coupling constraints, when the system performs safety checks, it not only verifies the compliance of single control loops, but also checks whether cross-work section data meets physical constraints such as material conservation, component balance, and pressure gradient, which can effectively prevent the spread of systemic risks caused by local tampering.

[0121] The embodiments in this specification are designed for continuous and process industry scenarios. By constructing several models, including a control digital twin trusted data flow model, they address the pain points of traditional industrial control systems in terms of data trustworthiness and operational compliance, and significantly improve the reliability, security and intelligence level of industrial control systems.

[0122] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired data. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired data. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0123] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of an industrial control security detection system based on digital twin trusted data stream, provided as an embodiment of this specification.

[0124] like Figure 3As shown, the industrial control security detection system based on digital twin trusted data flow can include at least a process semantic module 300, a communication data flow parsing module 310, a state transition module 320, a coupling constraint module 330, a trusted rule configuration module 340, and a security detection module 350, wherein:

[0125] The process semantic module 300 is used to acquire several process sections and control loops in the process sections based on process information of the process industry, extract the operation stage characteristics and process constraints of the control loops, as well as the material coupling structure between different process sections, in order to determine the digital twin process semantic model.

[0126] The communication data stream parsing module 310 is used to obtain the control system configuration information of the control loop, determine the communication points corresponding to the measured values, set values ​​and operation control commands based on the control system configuration information, extract the communication features of the communication points in the industrial control message, and determine the digital twin communication data stream model used to describe the mapping relationship between the communication points and the industrial control message.

[0127] The state transition module 320 is used to determine the effective state sequence of measured values, set values ​​and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data flow model and the process and control reference information under the normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship in order to generate the communication and control state transition model.

[0128] The coupling constraint module 330 is used to identify the material coupling structure and physicochemical constraints between different work sections based on the digital twin process semantic model, so as to extract the cross-work section coupling constraints of different work sections and determine the global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges.

[0129] The trusted rule configuration module 340 is used to configure compliance boundary conditions of related measurement values, set values ​​and operation control commands based on the digital twin communication data flow model, communication and control state transition model and global coupling constraint model, and to determine a structured multidimensional compliance rule set to generate a digital twin trusted data flow model.

[0130] The safety detection module 350 is used to acquire and parse the current industrial control message, determine the work section, control loop and operation stage corresponding to the current industrial control message based on the communication and control state transition model, and generate an event stream; the event stream is verified according to the digital twin trusted data stream model and the global coupling constraint model to obtain safety detection data.

[0131] In some embodiments, the process semantic module 300 includes a process semantic submodule, which is used to: acquire process information of the process industry and divide the process flow into several segments based on the process information, each segment including at least one control loop; extract the operational stage characteristics and process constraints of the control loop, the operational stage characteristics including at least the monitoring requirements of key process variables under the corresponding operational stage, the adjustment logic of the operation control command, and the control mode dependency relationship; acquire the material coupling structure between different segments, the material coupling structure including at least: the positive flow relationship formed by the output of the upstream segment as the input of the downstream segment; and the reverse circulation relationship formed by the return of unreacted materials or intermediate products to the preceding segment; and establish a digital twin process semantic model in a structured expression form based on the segments, control loops, operational stage characteristics, process constraints, and material coupling structure.

[0132] In some embodiments, the structured representation includes at least a step description, a structured list, and a causal dependency graph; key process variables include at least temperature, pressure, flow rate, liquid level, and component concentration; corresponding operation stages include at least setting, monitoring, adjustment, steady-state maintenance, and transient control; monitoring requirements include at least target values, allowable fluctuation ranges, alarm thresholds, and rate of change limits for key process variables; operation control commands include at least valve opening adjustment and pump start / stop; and control mode dependencies include at least the switching logic between automatic and manual control modes.

[0133] In some embodiments, the communication data stream parsing module 310 includes a parsing submodule, which is used to: determine the communication points corresponding to the measured values, set values, and operation control commands based on the control system configuration information, wherein the communication points include at least the measured value points of key process variables, the controller set value read / write points, and the operation control command output points; extract the communication features of the communication points in the industrial control messages based on the preset industrial control protocol specifications, wherein the communication features include at least the network communication identifier, protocol control information, message interaction relationship, and point data content; and establish a digital twin communication data stream model based on the communication points and communication features using a structured expression form.

[0134] In some embodiments, the state transition module 320 includes a state transition submodule, which is used to: acquire process and control reference information under normal operating conditions of the control system, wherein the process and control reference information includes at least the normal operating history data of the control system, controller configuration parameters, process mechanism model, and operating procedure data; based on the communication points and their respective control loops defined in the communication data flow model, and using the process and control reference information as the behavioral boundary of normal operating conditions, establish a valid state sequence of measured values, set values, and operation control command output states in each control loop in chronological order; and acquire each operation stage and its corresponding control mode according to the digital twin process semantic model. Based on the digital twin communication data flow model, the system parses operation source information from industrial control messages; according to each operation stage and its corresponding control mode, as well as the operation source information, it determines the dynamic response characteristics of the measured value to the set value and the output state of the operation control command; based on the dynamic response characteristics, it establishes a closed-loop regulation consistency relationship under each operation stage, which is used to determine the association rules corresponding to each operation stage; based on the association rules, it establishes a communication and control state transition model that characterizes normal process control behavior; the association rules include at least the preset value range of the set value, the response interval of the operation control command, the dynamic change rate limit of the measured value, and the allowable deviation tolerance during steady-state operation.

[0135] In some embodiments, the coupling constraint module 330 includes a coupling constraint submodule, which is used to: determine the material coupling structure between different work sections based on each work section in the digital twin process semantic model; determine the physicochemical constraints between different work sections according to the material coupling structure, wherein the physicochemical constraints are required to include at least flow matching constraints, component conservation constraints, and pressure balance constraints; determine the cross-work section coupling constraints between different work sections according to the physicochemical constraints between different work sections; determine the global coupling constraint model with work sections as nodes and cross-work section coupling constraints as directed edges; the cross-work section coupling constraints include at least the material balance constraints corresponding to the flow matching constraints or component conservation constraints, the safety interlock constraints corresponding to the pressure balance constraints, and the cascade or feedforward control consistency constraints.

[0136] In some embodiments, the trusted rule configuration module 340 includes a configuration submodule, which is used to: configure compliance boundary conditions for related measured values, setpoints, and operation control commands within the control loop of each sub-segment based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model; determine a structured multidimensional compliance rule set based on the compliance boundary conditions, wherein each compliance rule in the structured multidimensional compliance rule set is bound to the corresponding segment, control loop, applicable operation stage, and associated coupling constraints; and determine the digital twin trusted data flow model based on the structured multidimensional compliance rule set.

[0137] In some embodiments, compliance boundary conditions include at least numerical range, rate of change, time window, legality of operation phase, and consistency requirements across sub-segments; compliance boundary conditions are self-learned and calibrated based on historical normal operation data, and constraints are modified in conjunction with process safety boundaries; the multi-dimensional compliance rule set includes value range rules, time sequence rules, logical rules, and coupling rules; value range rules are used to constrain the effective measurement range of process parameters; time sequence rules are used to constrain the range of change of process parameters within a specific time interval; logical rules are used to constrain operation control under preset conditions; coupling rules are used to constrain the mapping constraints between process parameters that have coupling relationships between different process units.

[0138] In some embodiments, the security detection module 350 includes a detection submodule, which is used to: collect communication messages in the industrial control network to obtain the current industrial control message, and parse the communication parameters corresponding to the current industrial control message; based on the communication and control state transition model, identify the work section, control loop and operation stage corresponding to the current industrial control message according to the communication parameters, and generate an event stream in chronological order; perform multi-level verification on the event stream and output security detection data; the multi-level verification includes at least: verifying whether the event stream meets the corresponding compliance rules in the digital twin trusted data stream model; aggregating events from different work sections in the event stream to obtain an aggregated event sequence, and verifying whether the aggregated event sequence meets the cross-work section constraints in the global coupling constraint model; and outputting security detection data, which includes at least the events that violate the corresponding rules of the multi-level verification after multi-level verification of the event stream, and outputting at least the corresponding alarm information, abnormal propagation path, affected work section and handling suggestions according to the events that violate the corresponding rules of the multi-level verification.

[0139] Based on the content of the industrial control security detection system based on digital twin trusted data flow in multiple embodiments of this specification, it can be seen that the embodiments of this specification, targeting continuous and process industry scenarios, accurately map the process flow, operation stage, control loop logic, and industrial control protocol points, thereby elevating security detection from protocol compliance to business semantic compliance. This can effectively identify malicious operations that are legally formatted but technologically dangerous, achieving deep integration of process semantics and communication behavior. Furthermore, the embodiments of this specification can also determine the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data flow model and the process and control baseline information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate a communication and control state transition model. That is, the embodiments of this specification can construct a triplet state sequence between setpoints, operation outputs, and measured values ​​on a unified time axis based on historical normal data and process mechanisms, and establish dynamic response rules oriented towards the operation stage. This can effectively detect hidden faults or attack behaviors that are difficult to detect using traditional methods, such as commands being issued but actuators not responding, measured values ​​being frozen, and controller output anomalies. Furthermore, the embodiments in this specification can also construct a global coupling constraint model with work sections as nodes, explicitly expressing the upstream and downstream dependencies of material flow, energy flow, and control signals. Based on cross-work section coupling constraints, when the system performs safety checks, it not only verifies the compliance of single control loops but also checks whether cross-work section data meets physical constraints such as material conservation, component balance, and pressure gradient, effectively preventing the propagation of systemic risks caused by local tampering. The embodiments in this specification, targeting continuous and process industry scenarios, address the pain points of traditional industrial control systems in terms of data reliability and operational compliance by constructing several models, including a control digital twin trusted data flow model, significantly improving the reliability, security, and intelligence level of industrial control systems.

[0140] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the embodiment of the industrial control security detection system based on digital twin trusted data stream is relatively simple in description because it is fundamentally similar to the embodiment of the industrial control security detection method based on digital twin trusted data stream; relevant parts can be referred to the description of the method embodiment.

[0141] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this specification is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0142] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0143] The above embodiments are merely preferred embodiments described in this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. An industrial control security detection method based on digital twin trusted data stream, characterized in that, include: Based on process information from the process industry, several process sections and control loops in the process sections are obtained. The operational stage characteristics and process constraints of the control loops, as well as the material coupling structure between different process sections, are extracted to determine the semantic model of the digital twin process. The system configuration information of the control loop is obtained, and the communication points corresponding to the measured values, set values ​​and operation control commands are determined according to the system configuration information. The communication features of the communication points in the industrial control message are extracted to determine a digital twin communication data stream model for describing the mapping relationship between the communication points and the industrial control message. Based on the digital twin communication data flow model, the effective state sequence of measured values, set values ​​and operation control commands, as well as dynamic response characteristics, are determined according to the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship in order to generate a communication and control state transition model. Based on the digital twin process semantic model, the material coupling structure and physicochemical constraints between different work sections are identified, so as to extract the cross-work section coupling constraints of different work sections and determine the global coupling constraint model with work sections as nodes and the cross-work section coupling constraints as directed edges. Based on the aforementioned digital twin communication data flow model, communication and control state transition model, and global coupling constraint model, compliance boundary conditions for related measurement values, set values, and operation control commands are configured to determine a structured multidimensional compliance rule set, thereby generating a trusted digital twin data flow model. The current industrial control message is acquired and parsed. Based on the communication and control state transition model, the corresponding work section, control loop, and operation stage of the current industrial control message are determined to generate an event stream. The event stream is verified according to the digital twin trusted data stream model and the global coupling constraint model to obtain safety detection data.

2. The method according to claim 1, characterized in that, Based on process industry information, several process segments and control loops within those segments are acquired. The operational stage characteristics and process constraints of these control loops, as well as the material coupling structure between different process segments, are extracted to determine a digital twin process semantic model, including: The process information of the process industry is obtained, and the process flow is divided into several sections based on the process information, wherein each section includes at least one control loop. Extract the operational stage characteristics and process constraints of the control loop. The operational stage characteristics include at least the monitoring requirements of key process variables under the corresponding operational stage, the adjustment logic of the operation control command, and the control mode dependency. Obtain the material coupling structure between different processes, wherein the material coupling structure includes at least: a positive flow relationship formed by the output of the upstream process serving as the input of the downstream process; and a reverse circulation relationship formed by the return of unreacted materials or intermediate products to the preceding process. Based on the process section, the control loop, the characteristics of the operation stage, the process constraints, and the material coupling structure, a digital twin process semantic model is established using a structured expression.

3. The method according to claim 2, characterized in that, The structured representation includes at least a step description, a structured list, and a causal dependency graph; The key process variables include at least: temperature, pressure, flow rate, liquid level, and component concentration; the corresponding operation stages include at least: setting, monitoring, adjustment, steady-state maintenance, and transition control; the monitoring requirements include at least: target values, allowable fluctuation ranges, alarm thresholds, and rate of change limits for the key process variables; the operation control commands include at least: adjusting valve opening and starting / stopping pumps; the control mode dependency includes at least: switching logic between automatic control mode and manual control mode.

4. The method according to claim 1, characterized in that, The step of determining the communication points corresponding to the measured values, set values, and operation control commands based on the control system configuration information, and extracting the communication features of the communication points in the industrial control messages to determine a digital twin communication data stream model for describing the mapping relationship between the communication points and the industrial control messages includes: Based on the control system configuration information, the communication points corresponding to the measured values, set values, and operation control commands are determined. The communication points include at least the measured value points of key process variables, the controller set value read / write points, and the operation control command output points. Based on the preset industrial control protocol specifications, the communication features of the communication points in the industrial control messages are extracted. The communication features include at least network communication identifiers, protocol control information, message interaction relationships, and point data content. Based on the communication points and communication characteristics, a digital twin communication data flow model is established using a structured representation.

5. The method according to claim 1, characterized in that, The digital twin communication data flow model determines the effective state sequence of measured values, setpoints, and operation control commands, as well as dynamic response characteristics, based on the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship to generate a communication and control state transition model, including: Obtain process and control baseline information under normal operating conditions of the control system. The process and control baseline information includes at least the normal operating history data of the control system, controller configuration parameters, process mechanism model and operating procedure data. Based on the communication points and control loops defined in the communication data flow model, and taking the process and control reference information as the behavioral boundary of normal operating conditions, an effective state sequence of measured values, set values ​​and operation control command output states in each control loop is established in chronological order. The operation stages and corresponding control modes are obtained according to the digital twin process semantic model, and the operation source information is parsed from the industrial control message based on the digital twin communication data flow model. Based on each operation stage and its corresponding control mode, as well as the operation source information, determine the dynamic response characteristics of the measured value to the set value and the output state of the operation control command; Based on the dynamic response characteristics, a closed-loop adjustment consistency relationship is established for each operation stage. The closed-loop adjustment consistency relationship is used to determine the association rules corresponding to each operation stage. A communication and control state transition model representing normal process control behavior is established based on the aforementioned association rules; The association rules include at least the preset value range of the set value, the response interval of the operation control command, the dynamic change rate limit of the measured value, and the allowable deviation tolerance during steady-state operation.

6. The method according to claim 1, characterized in that, The process based on the digital twin process semantic model identifies the material coupling structure and physicochemical constraints between different work sections, extracts cross-work section coupling constraints, and determines a global coupling constraint model with work sections as nodes and the cross-work section coupling constraints as directed edges, including: Based on each work segment in the digital twin process semantic model, the material coupling structure between different work segments is determined; Based on the material coupling structure, the physicochemical constraints between different processes are determined. The physicochemical constraints are required to include at least flow matching constraints, component conservation constraints, and pressure balance constraints. Based on the physicochemical constraints between the different work sections, determine the cross-work section coupling constraints of the different work sections; A global coupling constraint model is determined using work sections as nodes and the cross-work section coupling constraints as directed edges; The cross-section coupling constraints include at least the material balance constraints corresponding to the flow matching constraints or the component conservation constraints, the safety interlock constraints corresponding to the pressure balance constraints, and the cascade or feedforward control consistency constraints.

7. The method according to claim 1, characterized in that, The process, based on the digital twin communication data flow model, communication and control state transition model, and global coupling constraint model, configures compliance boundary conditions for correlated measurement values, setpoints, and operation control commands, and determines a structured multidimensional compliance rule set to generate a trusted digital twin data flow model, including: Based on the aforementioned digital twin communication data flow model, communication and control state transition model, and global coupling constraint model, compliance boundary conditions for the related measured values, set values, and operation control commands within the control loop of each subdivided section are configured. Based on the aforementioned compliance boundary conditions, a structured multidimensional compliance rule set is determined. Each compliance rule in the structured multidimensional compliance rule set is bound to the corresponding work section, control loop, applicable operation stage, and associated coupling constraints. The trusted data flow model for the digital twin is determined based on the structured multidimensional compliance rule set.

8. The method according to claim 7, characterized in that, The compliance boundary conditions include at least numerical range, rate of change, time window, legality of operation stage, and consistency requirements across sub-segments; the compliance boundary conditions are self-learned and calibrated based on historical normal operation data, and constrained and corrected in conjunction with process safety boundaries; the multi-dimensional compliance rule set includes value range rules, time sequence rules, logical rules, and coupling rules; the value range rules are used to constrain the effective measurement range of process parameters; the time sequence rules are used to constrain the range of change of process parameters within a specific time interval; the logical rules are used to constrain the operation control under preset conditions; and the coupling rules are used to constrain the mapping constraints between process parameters that have coupling relationships between different process units.

9. The method according to claim 1, characterized in that, The process involves acquiring and parsing the current industrial control message, determining the work section, control loop, and current operation stage corresponding to the current industrial control message based on the communication and control state transition model, and generating an event stream. The event flow is verified based on the digital twin trusted data flow model and the global coupling constraint model to obtain security detection data, including: Collect communication packets in the industrial control network to obtain the current industrial control packet, and parse the communication parameters corresponding to the current industrial control packet; Based on the aforementioned communication and control state transition model, the work section, control loop, and operation stage corresponding to the current industrial control message are identified according to the communication parameters, and an event stream is generated in chronological order. The event stream is subjected to multi-level verification, and security detection data is output. The multi-level verification includes at least: verifying whether the event stream meets the corresponding compliance rules in the digital twin trusted data stream model; aggregating events from different work segments in the event stream to obtain an aggregated event sequence, and verifying whether the aggregated event sequence meets the cross-work segment constraints in the global coupling constraint model. The output of the security detection data includes at least the events that violate the corresponding rules of the multi-level verification after performing multi-level verification on the event stream, and at least the corresponding alarm information, abnormal propagation path, affected work section, and handling suggestions are output according to the events that violate the corresponding rules of the multi-level verification.

10. An industrial control security detection system based on digital twin trusted data stream, characterized in that, include: The process semantic module is used to obtain several process sections and control loops in the process sections based on process information of the process industry, extract the operation stage characteristics and process constraints of the control loops, as well as the material coupling structure between different process sections, in order to determine the digital twin process semantic model. The communication data stream parsing module is used to obtain the control system configuration information of the control loop, determine the communication points corresponding to the measured values, set values ​​and operation control commands based on the control system configuration information, and extract the communication features of the communication points in the industrial control message to determine a digital twin communication data stream model for describing the mapping relationship between the communication points and the industrial control message. The state transition module is used to determine the effective state sequence of measured values, set values ​​and operation control commands, as well as dynamic response characteristics, based on the digital twin communication data flow model and the process and control reference information under normal operating conditions of the control system. The dynamic response characteristics are used to determine the closed-loop regulation consistency relationship in order to generate the communication and control state transition model. The coupling constraint module is used to identify the material coupling structure and physicochemical constraints between different work sections based on the digital twin process semantic model, so as to extract the cross-work section coupling constraints of different work sections and determine the global coupling constraint model with work sections as nodes and the cross-work section coupling constraints as directed edges. The trusted rule configuration module is used to configure compliance boundary conditions of related measurement values, set values ​​and operation control commands based on the digital twin communication data flow model, communication and control state transition model and global coupling constraint model, and to determine a structured multidimensional compliance rule set to generate a digital twin trusted data flow model. The security detection module is used to acquire and parse the current industrial control message, determine the work section, control loop and operation stage corresponding to the current industrial control message based on the communication and control state transition model, and generate an event stream; verify the event stream according to the digital twin trusted data stream model and the global coupling constraint model to obtain security detection data.

Images