Industrial internet network attack early behavior measurement and characterization method and device

Abstract

This application provides a method and apparatus for measuring and characterizing early-stage attacks on industrial internet networks, belonging to the field of communication technology. The method includes: collecting access behavior data from external networks as raw sample data; preprocessing the raw sample data to obtain standardized sample data; dividing the sample data according to communication protocols; extracting features from the sample data and performing unsupervised clustering within the protocol space to obtain attack behavior semantic labels corresponding to each sample data; sorting the semantic labels of each sample data in chronological order using the source address as an index to obtain an attack sequence; and determining the attack posture and attack source risk of the source address based on the attack sequence. This application achieves accurate characterization of early-stage attack detection behavior and identification of risk posture in industrial internet scenarios without relying on complex protocol parsing and prior knowledge.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for measuring and characterizing early behaviors of industrial internet network attacks. Background Technology

[0002] With the deepening development of the Industrial Internet, a large number of industrial control systems, production management systems, and edge acquisition devices are gradually being connected to public networks or cross-regional dedicated networks, leading to a continuous expansion of the risk exposure of industrial assets. The Industrial Internet environment is characterized by strong device heterogeneity, diverse protocol types, and complex operating environments. Once related systems are subjected to cyberattacks, not only may information be leaked, but production interruptions, equipment malfunctions, and even serious security incidents may occur. In actual attack processes, attackers typically identify and collect information about the target network's open ports, service types, and potential vulnerabilities through scanning, probing, or probing interactions. Such behaviors account for a significant proportion of attack traffic. Therefore, effective observation and analysis of these probing and probing behaviors in the early stages of an attack are of paramount importance for proactively identifying potential threats and ensuring the security of the Industrial Internet.

[0003] Existing attack detection methods typically employ rule-based matching, protocol parsing, or supervised learning models. However, these methods have significant limitations in practical applications: rule-based matching methods rely primarily on known attack characteristics and have limited adaptability to unknown or variant attacks; protocol parsing methods depend on prior knowledge of protocol structures and are limited in their parsing capabilities when faced with unknown protocols or non-standard payloads; supervised learning methods require large amounts of labeled data, making the acquisition of comprehensive and accurate sample data in industrial internet environments costly, and their generalization ability to novel attacks is limited. Furthermore, early-stage attack probing often involves small amounts of interactive data and incomplete sessions, making it difficult to accurately characterize attacker behavior patterns using only a single feature or simple statistical methods. This results in difficulties in comprehensively and accurately monitoring and evaluating early-stage probing activities in open environments.

[0004] Therefore, how to collect probe behaviors with small amounts of interactive data and incomplete sessions in the early stages of an attack without relying on complex business simulation or deep protocol parsing, so as to accurately depict the attack situation and assess the risk of the attack source, has become an urgent technical problem to be solved. Summary of the Invention

[0005] This application provides a method and apparatus for measuring and characterizing early behaviors of industrial internet network attacks, in order to overcome the shortcomings of existing technologies in accurately characterizing and monitoring unknown attacks.

[0006] This application provides a method for measuring and characterizing early-stage behaviors of industrial internet network attacks, including the following steps: Access behavior data from external networks is collected as raw sample data. After data preprocessing, standardized sample data is obtained. After dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. Using the source address as an index, the semantic tags of each sample data are sorted in chronological order to obtain the attack sequence; Based on the attack sequence, the attack posture and attack source risk of the source address are determined.

[0007] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the feature extraction of the sample data includes: Feature extraction is performed on the key structural fields of the sample data to obtain structural feature vectors. The key structural fields include at least one of the following: protocol identification field, version field, interface parameter field, and vulnerability-related field.

[0008] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the step of performing unsupervised clustering within the protocol space to obtain semantic labels of attack behaviors corresponding to each sample data includes: Unsupervised clustering is used to partition the structural pattern of each set of structural feature vectors within the protocol space, resulting in multiple sets of structural patterns within the protocol space. For any of the sample data, determine the structural pattern label based on the set of structural patterns to which it belongs; The structural pattern labels are mapped to attack behavior semantic labels.

[0009] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the data preprocessing of the original sample data includes deduplication of duplicate samples: For raw sample data whose capture time falls within the statistical time window, extract the load data and calculate the load summary fingerprint; Construct a Bloom filter, the Bloom filter comprising l A hash function, l It is a positive integer; The payload digest fingerprint is sequentially input into each of the hash functions to calculate the corresponding bit array index position, and the bit value status of the corresponding index position in the Bloom filter is queried. If at least one bit value is 0 in the index position, the load data is determined to be the first occurrence of the structure type. The bit value of the corresponding index position is updated to 1, and the original sample data is retained for subsequent processing. If all the bit values ​​at the index position are 1, it is determined that the load data has appeared in the historical samples, the original sample data is marked as a repeated detection behavior, and its subsequent processing flow is terminated.

[0010] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, after deduplication of duplicate samples, it also includes filtering of abnormal and invalid samples: For any of the original sample data, count the number of times each byte appears in the payload data and calculate the byte frequency distribution; If the frequency of any byte exceeds the frequency threshold, the original sample data is marked as an abnormal sample, and its subsequent processing is terminated. If the frequency of all bytes does not exceed the frequency threshold, then the information entropy of the original sample data is calculated. If the information entropy is less than the information entropy threshold, the original sample data is marked as an invalid sample, and its subsequent processing is terminated.

[0011] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, after filtering out abnormal and invalid samples, the method further includes constructing a load structured representation: For any of the original sample data, the payload data is matched according to the fingerprint rules of each communication protocol to obtain a matching result, the matching result including one or more communication protocols corresponding to the original sample data.

[0012] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the fingerprint rules include at least one of the following: message start identifier features, key field string features, fixed offset field structure features, and constraints on the relationship between field length and function code.

[0013] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the risk of the attack source is determined based on the following steps: Within the statistical time window, the number of communication protocol types involved in the source address, the number of ports accessed, and the number of structural patterns triggered are counted. Calculate the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns; Calculate the proportion of vulnerability verification behavior occurring in the attack sequence to obtain the vulnerability verification ratio; The attack source risk score is obtained by weighting and aggregating the attack behavior coverage index and the vulnerability verification ratio. The risk level of the attack source is determined based on the attack source risk score.

[0014] According to the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, the calculation of the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns includes: The attack behavior coverage index is obtained by weighting and aggregating the ratios of the number of communication protocol types to the maximum number of communication protocol types, the ratio of the number of ports to the total number of ports, and the ratio of the number of structural patterns to the maximum number of structural patterns.

[0015] This application also provides a device for measuring and characterizing early behaviors of industrial internet network attacks, comprising the following modules: The data processing module is used to: collect access behavior data from external networks as raw sample data, and perform data preprocessing on the raw sample data to obtain standardized sample data. The semantic classification module is used to: divide the sample data according to the communication protocol, extract features from the sample data, and perform unsupervised clustering within the protocol space to obtain the attack behavior semantic labels corresponding to each sample data. The sequence generation module is used to: sort the semantic tags of each sample data in chronological order using the source address as an index to obtain the attack sequence; The risk determination module is used to: determine the attack status and attack source risk of the source address based on the attack sequence.

[0016] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for measuring and characterizing early behaviors of industrial internet network attacks as described above.

[0017] This application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for measuring and characterizing early behaviors of industrial internet network attacks as described above.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method for measuring and characterizing early behaviors of industrial internet network attacks as described above.

[0019] The method and apparatus for measuring and characterizing early-stage attacks on industrial internet networks provided in this application effectively overcome the obstacles of strong device heterogeneity and diverse protocol types in the industrial internet environment by preprocessing and standardizing access behavior data from external networks, thus laying a unified data foundation for subsequent analysis. Furthermore, by employing unsupervised clustering within the protocol space to extract features from sample data, the system can automatically obtain the semantic labels of attack behaviors corresponding to each sample data without needing prior knowledge of the protocol structure or relying on a large amount of labeled data. This effectively solves the problems of poor adaptability and limited generalization ability of traditional methods when facing unknown protocols, non-standard payloads, and new variant attacks. Furthermore, using the source address as an index, the semantic labels of each sample data are sorted chronologically to construct an attack sequence. This systematically correlates and structures the previously isolated, scattered, and small-volume early probing behaviors, overcoming the limitations of relying solely on single features or simple statistical methods to characterize attacker behavior patterns. This allows the system to accurately capture the complete logical flow of attackers conducting full-port scanning or random protocol probing in unknown environments. Furthermore, based on this attack sequence, the attack posture and attack source risk of the source address are determined, achieving comprehensive observation and proactive identification of early-stage attack probing activities, thus enhancing network security protection capabilities in industrial internet scenarios. In summary, this application obtains semantic labels for attack behaviors through standardized data collection and unsupervised clustering, and constructs a time-series-based attack behavior model. This enables accurate characterization of early-stage attack probing behaviors and proactive identification of risk postures in industrial internet scenarios without relying on complex protocol parsing or prior knowledge. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application; Figure 2 This is a schematic diagram of the data collection and honeypot deployment scenario provided in this application; Figure 3 This is a schematic diagram of the layered modeling and analysis of attack behavior provided in this application; Figure 4 This is a schematic diagram of the structure of the industrial internet network attack early behavior measurement and characterization device provided in this application; Figure 5This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0023] It should be noted that in the description of the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. Unless otherwise expressly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly, for example, they can be fixed connections, detachable connections, or integral connections; they can be mechanical connections or electrical connections; they can be direct connections or indirect connections through an intermediate medium; and they can be internal connections between two elements. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0024] The terms "first," "second," etc., used in this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class, without limiting the number of objects; for example, a first object can be one or more. Furthermore, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects have an "or" relationship.

[0025] The following is combined Figures 1-5 This application describes the method and apparatus for measuring and characterizing early behaviors of industrial internet network attacks provided in its embodiments.

[0026] Figure 1 This is a flowchart illustrating the method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application, such as... Figure 1 As shown, the method includes the following: S110, Collect access behavior data from external networks as raw sample data, and perform data preprocessing on the raw sample data to obtain standardized sample data. S120, after dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. S130, using the source address as an index, sort the semantic tags of each sample data in chronological order to obtain the attack sequence; S140, Based on the attack sequence, determine the attack status and attack source risk of the source address.

[0027] In this embodiment, the executing entity of the method for measuring and characterizing early behaviors of industrial internet network attacks can be an industrial internet network attack early behavior measurement and characterization device, which may include, but is not limited to, servers, desktop computers, laptops, tablets, etc. The executing entity of the method can also be an industrial internet network attack early behavior measurement and characterization system, which is a subset of the industrial internet network attack early behavior measurement and characterization device.

[0028] Figure 2 This is a schematic diagram of the data collection and honeypot deployment scenario provided in this application, such as... Figure 2 As shown, the method of this application is deployed in an industrial internet environment exposed to the outside world. The monitoring honeypot system is set at the boundary between the industrial network and the external network to build an independent environment for collecting attack behavior. This honeypot system exposes network ports to receive access requests from the external network and monitors and records attack behavior. The honeypot system is logically isolated from the internal production system, does not carry actual business functions, and is only used to capture the behavior of external attackers.

[0029] In S110, a full-port monitoring honeypot is deployed at the exposed interfaces of the Industrial Internet to collect access behavior data from external networks. The honeypot listens to all network ports, receives connection requests initiated by attackers, and records information such as the attack source address, target port, and the payload of the interactive data sent by the attacker after the connection is established, forming a set of raw sample data for the early stages of the attack. Further, the collected raw sample data undergoes preprocessing, including but not limited to processes such as duplicate sample removal, abnormal data filtering, and payload byte stream normalization. The payload data is then structured, and connection metadata and payload structure information are extracted to construct a unified, standardized sample representation format, providing a consistent data foundation for subsequent attack behavior analysis.

[0030] In practical implementation, full-port traffic access and monitoring are implemented at the industrial internet boundary. A standalone host is deployed as an observation node at the external boundary of the industrial internet. This node is logically isolated from the internal production network, does not carry actual business functions, and is only used to receive connection requests from the external network. To achieve unified collection of access behavior to any target port, a port forwarding policy is configured on the firewall of this standalone host, redirecting external hosts to any port... All inbound connections initiated are redirected to the listening port of the observation node. This allows for the construction of a full-port access model. The observation node listens to the port. Continuously monitor the system. When a connection establishment request is detected, do not return a real business response to the external host; do not establish data interaction with the internal system; only maintain the basic connection state to receive data content sent by the client. If the preset timeout period applies... If no valid payload data is received internally, the connection is deemed invalid and the session is terminated. If the external host closes the connection, the listening is terminated synchronously.

[0031] Furthermore, when an external host initiates a connection and is redirected to the listening port, the system establishes an independent session instance for that connection. It also records session metadata, including: source IP address. The original target port is restored through forwarding rules. Session termination time Define this connection session as During the session's validity period, the system collects all valid probe payload data sent by the external host, concatenates them, and records them as follows: Subsequently, the session metadata and payload data were integrated to construct the original attack sample. ,in Indicates connection session information; This indicates the initial probe payload of the attack. During implementation, the honeypot is deployed for a period of time, defined as the start time. The end time is During the capture time Within the statistical time window All samples The data has been stored and will be used for further analysis of attack behavior.

[0032] In S120, the protocol space refers to the data set that is logically isolated and classified according to the protocol type used in network communication. Attack behavior semantic tags refer to names with business or security meanings assigned to a data cluster after cluster analysis, such as naming a cluster as port scanning, vulnerability detection, brute-force attack, or abnormal heartbeat.

[0033] In this embodiment, the data is divided into multiple independent protocol spaces, such as TCP space and Modbus space, based on the protocol type field in the standardized samples. For the samples in each protocol space, dimensions that can characterize their behavioral features are extracted, such as packet size variance, request frequency, and flag bit combination. Within each protocol space, the samples are grouped using a clustering algorithm, and attack behavior semantic labels are automatically generated by the system or in combination with an expert knowledge base based on the statistical characteristics of each cluster.

[0034] In S130, all samples belonging to the same source IP are extracted using the source IP address as the grouping key and strictly sorted in ascending order according to the timestamp field. The attack behavior semantic tags corresponding to the sorted samples are then concatenated to form a time series of attack behaviors specific to that source IP. By analyzing the attack sequence, the attacker's behavioral progression in the early stages of an attack can be characterized. For example, in a typical attack, the attacker usually first identifies the target service type by identifying the request through the protocol, then performs version enumeration or interface testing, and further attempts vulnerability verification after obtaining sufficient environmental information. Therefore, through the statistical analysis of the attack behavior semantic sequence, the overall behavioral characteristics of the attacker in the target identification, information gathering, and vulnerability verification stages can be reflected.

[0035] In S140, the attack posture and attack source risk refers to the attacker's intent, attack stage, and potential threat level posed by the source address to the target network, as reflected in the attack sequence.

[0036] In this embodiment, by analyzing the length of the attack sequence and the tag combination pattern, the current stage of the attack chain of the attacker is determined, such as whether it is in the early information gathering stage or has entered the vulnerability exploitation stage; by combining the frequency and time density of high-risk semantic tags in the sequence and the importance of the target asset, a comprehensive risk score is calculated, thereby determining the risk level of the attack source.

[0037] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application effectively overcomes the obstacles of strong device heterogeneity and diverse protocol types in the industrial internet environment by preprocessing and standardizing access behavior data of external networks, laying a unified data foundation for subsequent analysis. Furthermore, it uses unsupervised clustering within the protocol space to extract features from sample data, enabling the system to automatically obtain the attack behavior semantic labels corresponding to each sample data without needing to know the protocol structure in advance or rely on a large amount of labeled data. This effectively solves the problems of poor adaptability and limited generalization ability of traditional methods when facing unknown protocols, non-standard loads, and new variant attacks. Furthermore, using the source address as an index, the semantic labels of each sample data are sorted chronologically to construct an attack sequence. This systematically correlates and structures the previously isolated, scattered, and small-volume early probing behaviors, overcoming the limitations of relying solely on single features or simple statistical methods to characterize attacker behavior patterns. This allows the system to accurately capture the complete logical flow of attackers conducting full-port scanning or random protocol probing in unknown environments. Furthermore, based on this attack sequence, the attack posture and attack source risk of the source address are determined, achieving comprehensive observation and proactive identification of early-stage attack probing activities, thus enhancing network security protection capabilities in industrial internet scenarios. In summary, this application obtains semantic labels for attack behaviors through standardized data collection and unsupervised clustering, and constructs a time-series-based attack behavior model. This enables accurate characterization of early-stage attack probing behaviors and proactive identification of risk postures in industrial internet scenarios without relying on complex protocol parsing or prior knowledge.

[0038] In an optional embodiment, the feature extraction of the sample data includes: Feature extraction is performed on the key structural fields of the sample data to obtain structural feature vectors. The key structural fields include at least one of the following: protocol identification field, version field, interface parameter field, and vulnerability-related field.

[0039] Here, key structural fields are specific data bits or blocks in network communication protocols or data payloads that directly reflect communication intent, target service status, interaction logic, and potential security risks. Protocol identification fields identify the type of protocol used in the current communication, such as Ethernet type, IP protocol number, TCP / UDP port number, or industry-specific function codes / identifiers. Version fields indicate protocol, software, or firmware versions, such as HTTP headers, TLS handshake versions, Modbus protocol identifiers, etc. Different versions typically correspond to different sets of known vulnerabilities. Interface parameter fields are parameters in application or control layer instructions that specify the operation object, operation type, and transmitted data, such as URL paths, API interface names, PLC register addresses, read / write instruction parameters, etc. Vulnerability-related fields are specific data patterns in the payload that are highly correlated with known vulnerability exploitation characteristics, such as excessively long strings, specific memory overwrite bytecode, and abnormal formatted strings. Structural feature vectors are multidimensional arrays or tensors formed by combining the extracted key structural fields after numericalization, encoding, or dimensionality reduction processing, and are used as input data for unsupervised clustering algorithms.

[0040] In this embodiment, based on the header information or basic format of the sample data, the protocol identification field, version field, interface parameter field, and vulnerability-related field are located and parsed. These fields are then extracted in a structured manner: fixed-length fields are directly truncated, variable-length fields (such as URLs and interface parameters) are subjected to length statistics or keyword extraction, and binary vulnerability features are subjected to hashing or pattern matching. These heterogeneous field information are then converted into machine-computable numerical or vector data and spliced ​​together to form a structural feature vector.

[0041] In the specific implementation process, the first step is based on the attack samples. Based on the protocol matching results corresponding to the samples, the attack samples are categorized into the corresponding protocol spaces, and attack sample sets are organized within each protocol space. Let the th... The sample set corresponding to the class protocol space is: ; in, Indicates attack sample With the The matching result for the protocol class. When the matching function is set to 1, it indicates that the attack sample belongs to the corresponding protocol space.

[0042] After obtaining the set of attack samples within the protocol space, the system further extracts features from key structural fields in the sample payloads to characterize the detection features of attack requests at the protocol structure level. In the specific implementation, a structural feature vector is constructed for the attack samples, targeting protocol identification fields, version fields, interface parameter fields, and vulnerability-related fields that may be included in the payload. ; in, Indicates protocol identification class features, This indicates version identification characteristics. This indicates the characteristics of the interface or parameter test class. This indicates the result of the vulnerability feature matching.

[0043] Based on the above structural feature vectors, a sample feature set is constructed within each protocol space: .

[0044] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application can clearly identify the attack target and whether the target has known weaknesses based on protocol identification and version fields, thereby enabling targeted probing of specific services; based on interface parameter fields, it can distinguish between normal business requests and malicious interface probes, thereby reducing the probability of misreporting normal high-frequency business as attacks; attackers may directly send requests carrying vulnerability exploit code in a single interaction, and based on vulnerability-related fields, samples containing real attack intentions can be identified.

[0045] In an optional embodiment, the step of performing unsupervised clustering within the protocol space to obtain the attack behavior semantic labels corresponding to each sample data includes: Unsupervised clustering is used to partition the structural pattern of each set of structural feature vectors within the protocol space, resulting in multiple sets of structural patterns within the protocol space. For any of the sample data, determine the structural pattern label based on the set of structural patterns to which it belongs; The structural pattern labels are mapped to attack behavior semantic labels.

[0046] In this embodiment, for each independent protocol space, its internal set of structural feature vectors is used as input, and an unsupervised clustering algorithm is called to perform structural pattern partitioning, thereby obtaining multiple sets of structural patterns within the protocol space, i.e., clusters. For any specific sample data within the protocol space, according to the affiliation of its structural feature vector in the clustering model, it is assigned to the corresponding set of structural patterns and given a corresponding structural pattern label. Then, through preset mapping rules or semantic parsing modules, the abstract structural pattern labels are transformed into semantic labels of attack behaviors with actual security significance, thereby completing the final qualitative analysis of the sample data.

[0047] In some embodiments, the K-Means algorithm is used for structural pattern partitioning. The number of attack behavior categories K is preset, and the feature vector is divided into K structural pattern sets by iteratively calculating the Euclidean distance from the sample to the cluster center.

[0048] In other embodiments, the DBSCAN algorithm is used for structural pattern partitioning. It does not require a preset number of clusters. It automatically discovers a set of structural patterns of arbitrary shapes based on the density connectivity between sample points and can automatically remove noisy data that does not conform to any pattern.

[0049] Figure 3 This is a schematic diagram of the layered modeling and analysis of attack behavior provided in this application, such as... Figure 3 As shown, hierarchical behavioral modeling of attack samples is performed within each protocol space. By analyzing the attack traffic load structure pattern, attack behavior semantics, and attack source behavior sequence layer by layer, the early-stage attack behavior is characterized from three levels: the protocol structure layer, the behavioral semantic layer, and the attack process layer. Specifically, the system uses an unsupervised clustering method to partition the sample feature set into structural patterns within the protocol space, thereby obtaining multiple sets of structural patterns within the protocol space: ; in, Indicates the first Within the protocol space, the first A collection of class structure patterns Different structural patterns reflect the differences in the detection methods of attack payloads at the protocol structure level. For example, different structural patterns may correspond to different types of detection behaviors such as protocol identification requests, version detection requests, or interface enumeration requests.

[0050] For any attack sample If its feature vector belongs to the set of structural patterns Then its structural pattern label is recorded as: ; After obtaining the structural pattern labels, the system further maps the structural patterns to attack behavior semantic labels, thereby constructing a set of attack behavior types: ; Each behavior type corresponds to typical attack detection behaviors such as protocol identification, version enumeration, interface testing, and vulnerability verification. A mapping relationship is established between structural patterns and behavioral semantics: ; This allows each attack sample to be assigned a corresponding attack behavior type, transforming the originally difficult-to-interpret structural patterns into attack behavior semantics with clear security implications.

[0051] Furthermore, by attacking the source address As an index, attack samples are statistically analyzed, and samples from the same attack source are arranged in chronological order to form an attack sequence: ; in Indicates the source of the attack In the time window The first generated internally One attack sample, .

[0052] Simultaneously, the semantic labels of the attack samples are mapped to behavioral sequences: .

[0053] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application determines the attack type through mathematical distribution, thereby enabling the clustering algorithm to automatically classify unknown attacks and variant attacks into the corresponding set of structural patterns without needing any prior knowledge of the attack. This solves the problem of limited adaptability to unknown attacks. Furthermore, the mathematical clustering results are decoupled from semantic logic, so that the upper-layer semantic mapping rules can still be used when the underlying network protocol changes. When a new type of attack occurs, only the mapping dictionary needs to be updated, which improves the reusability of the system.

[0054] In an optional embodiment, the data preprocessing of the original sample data includes deduplication of duplicate samples: For raw sample data whose capture time falls within the statistical time window, extract the load data and calculate the load summary fingerprint; Construct a Bloom filter, the Bloom filter comprising l A hash function, l It is a positive integer; The payload digest fingerprint is sequentially input into each of the hash functions to calculate the corresponding bit array index position, and the bit value status of the corresponding index position in the Bloom filter is queried. If at least one bit value is 0 in the index position, the load data is determined to be the first occurrence of the structure type. The bit value of the corresponding index position is updated to 1, and the original sample data is retained for subsequent processing. If all the bit values ​​at the index position are 1, it is determined that the load data has appeared in the historical samples, the original sample data is marked as a repeated detection behavior, and its subsequent processing flow is terminated.

[0055] Here, the payload digest fingerprint is a unique or nearly unique short string generated by hashing or feature extraction of the application layer payload in the original sample data, such as an MD5 or SHA-256 digest, used to quickly identify the content of the payload. The bit array is the underlying storage structure of the Bloom filter. Initially, all bits are 0. The state of the corresponding bit is set to 1 by calculating the index position through the hash function.

[0056] Here, the number of hash functions l The number of hash functions is determined based on the length m of the bit array and the expected number of elements n to be inserted. l The number of hash functions is directly proportional to the length m of the bit array. l It is inversely proportional to the number of elements n. Specifically, when memory is ample and a low false positive rate is desired, m can be increased, and the value of m can be increased accordingly. l When memory is limited and real-time requirements are high, m can be appropriately reduced, and the corresponding reduction can be applied. l A slightly higher false positive rate is acceptable. In specific implementation, n can be estimated based on the total amount of load fingerprints collected by the honeypot, m can be selected based on available memory, and then the final value can be determined based on m and n. l Preferably, l = (m / n) × ln(2).

[0057] In this embodiment, raw sample data from an external network is captured, and it is determined whether the capture time is within a set statistical time window. For samples within the window, their load data is extracted and a load digest fingerprint is calculated. The system maintains a list containing... l A Bloom filter using a hash function is used to sequentially input the calculated payload digest fingerprint into this... l A hash function is obtained. l The system then queries the Bloom filter for the corresponding bit array index position; l The bit value state at each index position, if this lIf at least one bit in a given location is 0, it indicates that the payload digest fingerprint has never been recorded before, and this is considered a newly encountered structure type. l The bit values ​​at each position are all updated to 1, and the original sample data is retained for subsequent processing; if this l If all the bit values ​​at each position are 1, it means that the payload digest fingerprint has most likely appeared in historical samples. The system judges it as a duplicate detection behavior, discards or marks it directly, and terminates its subsequent processing.

[0058] In the specific implementation process, regarding the capture time Within the statistical time window Internal Samples Extract its load data A Bloom filter is constructed to identify duplicate samples, and the Bloom filter is represented as follows: ; in, The length of the bit array. For the first A hash function. The bit array is initialized to 0 at system startup. When processing raw samples... At that time, the system first extracts its load data. Calculate a summary fingerprint of the payload content: ; The load fingerprint value is then sequentially input into each hash function. The system calculates the corresponding bit array index position and queries the bit value status of the corresponding position in the Bloom filter structure. If at least one bit value is 0 in the index position, the system determines that the load structure is a newly appearing structure type, updates the bit value at the corresponding position to 1, and retains the sample for subsequent processing. If all bit values ​​at the index position are 1, the system determines that the load structure has appeared in historical samples, marks the sample as a duplicate detection behavior, and terminates its subsequent feature modeling processing.

[0059] In the specific implementation, the deduplication judgment is performed only on the load structure and does not depend on the source IP address or time information, thereby achieving rapid filtering of massive duplicate scan packets and allowing subsequent processing to focus on representative detection and attack samples.

[0060] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application utilizes the absolute accuracy of Bloom filters, which are guaranteed to be nonexistent, to ensure that all first-time attack detection behaviors are retained and included in subsequent analysis.

[0061] In an optional embodiment, after deduplication of duplicate samples, filtering of abnormal and invalid samples is further included: For any of the original sample data, count the number of times each byte appears in the payload data and calculate the byte frequency distribution; If the frequency of any byte exceeds the frequency threshold, the original sample data is marked as an abnormal sample, and its subsequent processing is terminated. If the frequency of all bytes does not exceed the frequency threshold, then the information entropy of the original sample data is calculated. If the information entropy is less than the information entropy threshold, the original sample data is marked as an invalid sample, and its subsequent processing is terminated.

[0062] In this embodiment, any original sample data that passes the deduplication detection is traversed, and the occurrence frequency of each of the 256 bytes (0x00-0xFF) in its payload data is counted. Based on this, the byte frequency distribution of the sample is calculated. If the frequency of any byte exceeds the set frequency threshold, it indicates that the data packet has serious malformation or padding characteristics. The system marks it as an abnormal sample and directly terminates its subsequent processing. If the frequency of all bytes does not exceed the threshold, the overall information entropy of the payload data is further calculated. If the calculated information entropy is less than the set information entropy threshold, it indicates that the data is highly regular and lacks randomness, such as plain text echo, simple fixed-format heartbeat packets, or meaningless noise. The system marks it as an invalid sample and terminates its subsequent processing. Only samples that pass these two detections will proceed to the subsequent feature extraction and clustering stages.

[0063] In the specific implementation process, after the deduplication steps described above, the system obtains a set of samples that have not been identified as duplicates. For each sample in this set, the system further performs statistical feature analysis on its payload data to identify anomalous data lacking attack structure semantics. In the specific implementation, let the sample payload data be... The load length is The system first counts the number of times each byte appears in the payload and calculates the byte frequency distribution: ; When the frequency of a certain byte is detected to exceed a preset frequency threshold If the system detects obvious padding in the payload, it determines that the sample contains significant duplicate padding characteristics. Such samples typically exhibit numerous repetitions of single bytes or a few bytes, lacking a clear protocol field structure. The system marks this sample as an anomalous and terminates its subsequent modeling process.

[0064] For samples that do not trigger the above conditions, their information entropy is further calculated: ; When the entropy value is lower than the preset entropy threshold If the load structure is too simple and lacks variability, it indicates a lack of effective field organization features. The system will also classify it as a low-semantic sample and remove it. Only when a sample does not trigger a frequency threshold and its information entropy meets the preset requirements will the system retain the sample for subsequent multi-scale feature modeling.

[0065] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application can eliminate probe packets containing a high proportion of single bytes by using frequency threshold interception; and can eliminate low-information normal business interaction data packets that lack the complexity of attack detection by using information entropy threshold interception.

[0066] In an optional embodiment, following the filtering of abnormal and invalid samples, a load-structured representation construction is further included: For any of the original sample data, the payload data is matched according to the fingerprint rules of each communication protocol to obtain a matching result, the matching result including one or more communication protocols corresponding to the original sample data.

[0067] Here, the fingerprint rules of communication protocols refer to the unique characteristic patterns exhibited by various network protocols in the data payload. These rules typically include specific magic numbers, fixed byte offsets, specific combinations of flag bits, or instruction codes.

[0068] In this embodiment of the application, for any original sample data after filtering out abnormal and invalid samples, the system extracts its application layer load data, loads a pre-set communication protocol fingerprint rule base, matches the extracted load data with each rule in the base one by one or in parallel, outputs the matching result, and clearly identifies one or more communication protocols corresponding to the original sample data.

[0069] In practice, the system performs protocol space mapping on the filtered sample payload data. The system then constructs a protocol fingerprint set. Each type of protocol fingerprint Fingerprint rules are used to characterize the structural features of a protocol or protocol family. These rules may include message start identifier features, key field string features, fixed offset field structural features, and constraints on the relationship between field lengths and function codes. These rules reflect the structural organization of industrial or general protocols at the message level.

[0070] For any load data The system sequentially performs matching and judgment based on the fingerprint rules of each protocol, and generates matching results. For the samples... Load data Define the protocol matching function: ; The matching result can be represented as a protocol matching vector: ; Specifically, the matching result is 1 if the load meets the corresponding protocol fingerprint rule, and 0 otherwise. This indicates the number of protocol types that can be identified. The matching vector is used to characterize the sample's tendency to belong to different protocol spaces, thereby reflecting the attacker's probing behavior characteristics towards specific protocol or service types.

[0071] After completing the protocol space mapping, the system will return the original sample: ; Expanded to structured sample expression The newly added protocol matching information is used for subsequent multi-scale feature extraction and attack stage modeling.

[0072] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application accurately diverts byte streams to their respective independent protocol spaces through fingerprint rule matching, ensuring that subsequent feature extraction can be performed on the syntax and semantics of specific protocols, thereby improving the business distinguishability of structural feature vectors.

[0073] In an optional embodiment, the fingerprint rule includes at least one of the following: message start identifier feature, key field string feature, fixed offset field structure feature, and constraint on the relationship between field length and function code.

[0074] Here, the message start identifier is a specific byte sequence in the header of a communication protocol data unit used to mark the start of a valid message, such as HTTP GET / POST. Key field string characteristics are specific text strings appearing in the application layer payload that have clear business or protocol semantics, such as URL paths, API interface names, XML / JSON tags, etc. Fixed offset field structure characteristics are specific fields (such as version number, checksum, instruction type) in the protocol message whose absolute or relative byte positions in the data stream are fixed. The constraint between field length and function code is a common strong logic verification rule in industrial control protocols; that is, the function code in the message determines the legal length or structure of subsequent data fields. For example, when a function code is "read single register," the length of the subsequent data must be a fixed value; if the length does not match, it is considered a malformed packet or malicious probe.

[0075] In this embodiment, the protocol category of the data stream is determined by quickly screening the message start identifier feature; the specific application layer protocol or instruction type is confirmed by using the key field string feature and the fixed offset field structure feature; the relationship constraint between the field length and the function code is verified. By verifying whether the function code declared in the payload and the actual data length it carries conform to the official specification of the protocol, not only can the protocol be accurately identified, but also whether the message is a malformed probe packet constructed by the attacker can be preliminarily judged at the same time.

[0076] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application can accurately identify these probe packets during the protocol identification stage by verifying the packet start identifier features, key field string features, fixed offset field structure features, and the relationship constraints between field length and function code. This improves the accuracy and robustness of identifying various protocols in complex and heterogeneous industrial internet environments.

[0077] In an optional embodiment, within the statistical time window Internally, attack requests are uniformly statistically analyzed, and the set of attack samples within this time window is defined as follows: ; After obtaining the set of attack samples within the time window, the system further analyzes the distribution of attack traffic across different protocol spaces. Let the protocol clusters be... The set of attack requests corresponding to the time window is as follows: ; Based on the number of attack samples in different protocol spaces, the proportion of protocol space detection can be calculated: ; in, This represents the total number of attack samples. This metric describes the distribution of attack traffic across different protocol spaces. A significant increase in the proportion of a particular protocol space usually indicates that attackers are conducting concentrated testing on a specific business system or protocol.

[0078] To further characterize the concentration of attack traffic in the protocol space, the protocol distribution entropy metric is introduced: ; When attack traffic is evenly distributed across multiple protocol spaces, this indicator value is high, indicating that the attack is still in the broad scanning phase; when attack traffic gradually concentrates in certain protocol spaces, this indicator value will gradually decrease, indicating that the attacker has begun targeted testing of specific systems or protocols.

[0079] In an optional embodiment, the risk of the attack source is determined based on the following steps: Within the statistical time window, the number of communication protocol types involved in the source address, the number of ports accessed, and the number of structural patterns triggered are counted. Calculate the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns; Calculate the proportion of vulnerability verification behavior occurring in the attack sequence to obtain the vulnerability verification ratio; The attack source risk score is obtained by weighting and aggregating the attack behavior coverage index and the vulnerability verification ratio. The risk level of the attack source is determined based on the attack source risk score.

[0080] In this embodiment, within a set statistical time window, historical interaction data from the same source address is statistically analyzed from multiple dimensions to obtain the number of communication protocol types involved, the number of ports accessed, and the number of triggered structural patterns. These three quantitative indicators are then fused to calculate an attack behavior coverage index reflecting the breadth of the attack. The attack sequence corresponding to the source address is analyzed, and the proportion of semantic tags belonging to vulnerability verification behavior is calculated to obtain the vulnerability verification ratio, which measures the depth and severity of the attack. The attack behavior coverage index and the vulnerability verification ratio are weighted and aggregated to calculate a comprehensive attack source risk score. Finally, based on a preset scoring range or threshold, the system maps this risk score to a specific attack source risk level, such as low risk, medium risk, high risk, or extremely high risk, providing a decision-making basis for subsequent automated defense or manual assessment.

[0081] Understandably, there are no strict time constraints in calculating the attack coverage index and the vulnerability verification ratio.

[0082] In the specific implementation process, let the attack source address be... The set of attack requests generated within the time window is as follows: ; in, This represents the source address corresponding to the attack sample. Using the above definition, the attack source can be obtained. The set of all attack requests generated within the time window.

[0083] Based on this, the system further counts the number of protocol types involved in the attack sources. Number of ports accessed and the number of triggered structural patterns This allows the system to characterize the attacker's probe range across protocol space, port space, and protocol structure layers. To comprehensively characterize the attack source's behavior in the early stages of an attack, the system calculates an attack behavior coverage index based on port coverage, the number of protocol types, and the number of structural patterns. This index measures the attacker's probe breadth across different dimensions. Port coverage reflects the attacker's scanning behavior at the network service layer, the number of protocol types reflects the attacker's probe capabilities across different protocol systems, and the number of structural patterns reflects the complexity of the attacker's in-depth testing within the protocols.

[0084] Based on the above, the system further analyzes the proportion of vulnerability verification requests appearing in attack requests. Let the set of vulnerability verification requests be: ; in, This indicates the result of the vulnerability signature matching; The vulnerability verification ratio is: ; When this ratio gradually increases, it usually indicates that the attacker has moved from the information gathering stage to the vulnerability verification stage, and their attack behavior has a higher potential threat.

[0085] After obtaining the above behavioral characteristics, the system further constructs an attack source risk scoring function: ; in and These are weighting coefficients used to comprehensively assess the risk level of the attack source's behavior in the early stages of an attack. This is the attack behavior coverage index. When the risk score exceeds a preset threshold, the system can mark the attack source as a high-risk attack source and generate corresponding threat intelligence records, including the attack source address, main attack behavior types, involved protocol spaces, and risk score, thereby enabling semantic interpretation and risk output of attack behavior.

[0086] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application accurately quantifies the breadth of attackers through coverage index and accurately quantifies the depth through vulnerability verification ratio. The weighted aggregation mechanism scientifically integrates these two orthogonal dimensions to construct a three-dimensional, multi-dimensional profile of the attack source.

[0087] In an optional embodiment, calculating the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns includes: The attack behavior coverage index is obtained by weighting and aggregating the ratios of the number of communication protocol types to the maximum number of communication protocol types, the ratio of the number of ports to the total number of ports, and the ratio of the number of structural patterns to the maximum number of structural patterns.

[0088] In this embodiment, the system obtains the number of communication protocol types actually triggered, the number of ports accessed, and the number of structural patterns triggered by the attack source within the statistical time window. The system divides these three absolute numbers by their respective upper limit values ​​to obtain three relative ratios between 0 and 1, thereby eliminating the difference in absolute numerical dimensions between different dimensions. Based on the actual security requirements of the industrial internet, the system assigns corresponding weight coefficients to these three ratios, aggregates and calculates these three weighted ratios, and finally obtains a standardized attack behavior coverage index.

[0089] The specific formula for calculating the attack behavior coverage index is as follows: ; in, These are weighting coefficients used to adjust the degree of influence of different feature dimensions in the comprehensive index; Indicates the maximum number of ports within the system's monitoring range; Indicates the amount of protocol space; Indicates the upper limit of the number of structural patterns.

[0090] The method for measuring and characterizing early behaviors of industrial internet network attacks provided in this application maps the data of the three dimensions to a dimensionless space of 0 to 1 by dividing the three parameters by their respective maximum upper limits.

[0091] The following describes the device for measuring and characterizing early behaviors of industrial internet network attacks provided in the embodiments of this application. The device for measuring and characterizing early behaviors of industrial internet network attacks described below and the method for measuring and characterizing early behaviors of industrial internet network attacks described above can be referred to in correspondence with each other.

[0092] Figure 4 This is a schematic diagram of the structure of the industrial internet network attack early behavior measurement and characterization device provided in this application, such as... Figure 4 As shown, the device for measuring and characterizing early behaviors of industrial internet network attacks may include, but is not limited to: Data processing module 410 is used to: collect access behavior data from external networks as raw sample data, and perform data preprocessing on the raw sample data to obtain standardized sample data. The semantic classification module 420 is used to: divide the sample data according to the communication protocol, extract features from the sample data, and perform unsupervised clustering within the protocol space to obtain the attack behavior semantic labels corresponding to each sample data. The sequence generation module 430 is used to: sort the semantic tags of each sample data in chronological order using the source address as an index to obtain an attack sequence; The risk determination module 440 is used to: determine the attack status and attack source risk of the source address based on the attack sequence.

[0093] It should be noted that the industrial internet network attack early behavior measurement and characterization device provided in this application embodiment can execute the industrial internet network attack early behavior measurement and characterization method described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0094] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a method for measuring and characterizing early behaviors of industrial internet network attacks. This method includes: Access behavior data from external networks is collected as raw sample data. After data preprocessing, standardized sample data is obtained. After dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. Using the source address as an index, the semantic tags of each sample data are sorted in chronological order to obtain the attack sequence; Based on the attack sequence, the attack posture and attack source risk of the source address are determined.

[0095] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the industrial internet network attack early behavior measurement and characterization method provided by the above methods, the method including: Access behavior data from external networks is collected as raw sample data. After data preprocessing, standardized sample data is obtained. After dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. Using the source address as an index, the semantic tags of each sample data are sorted in chronological order to obtain the attack sequence; Based on the attack sequence, the attack posture and attack source risk of the source address are determined.

[0097] Furthermore, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, is implemented to perform the methods for measuring and characterizing early behaviors of industrial internet network attacks provided by the methods described above, the method comprising: Access behavior data from external networks is collected as raw sample data. After data preprocessing, standardized sample data is obtained. After dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. Using the source address as an index, the semantic tags of each sample data are sorted in chronological order to obtain the attack sequence; Based on the attack sequence, the attack posture and attack source risk of the source address are determined.

[0098] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0099] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for measuring and characterizing early-stage behaviors of industrial internet network attacks, characterized in that, include: Access behavior data from external networks is collected as raw sample data. After data preprocessing, standardized sample data is obtained. After dividing the sample data according to the communication protocol, feature extraction is performed on the sample data, and unsupervised clustering is performed within the protocol space to obtain the attack behavior semantic label corresponding to each sample data. Using the source address as an index, the semantic tags of each sample data are sorted in chronological order to obtain the attack sequence; Based on the attack sequence, the attack posture and attack source risk of the source address are determined.

2. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 1, characterized in that, The feature extraction of the sample data includes: Feature extraction is performed on the key structural fields of the sample data to obtain structural feature vectors. The key structural fields include at least one of the following: protocol identification field, version field, interface parameter field, and vulnerability-related field.

3. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 2, characterized in that, The step of performing unsupervised clustering within the protocol space to obtain the attack behavior semantic labels corresponding to each sample data includes: Unsupervised clustering is used to partition the structural pattern of each set of structural feature vectors within the protocol space, resulting in multiple sets of structural patterns within the protocol space. For any of the sample data, determine the structural pattern label based on the set of structural patterns to which it belongs; The structural pattern labels are mapped to attack behavior semantic labels.

4. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 3, characterized in that, The data preprocessing of the original sample data includes deduplication of duplicate samples: For raw sample data whose capture time falls within the statistical time window, extract the load data and calculate the load summary fingerprint; Construct a Bloom filter, the Bloom filter comprising l One hash function; The payload digest fingerprint is sequentially input into each of the hash functions to calculate the corresponding bit array index position, and the bit value status of the corresponding index position in the Bloom filter is queried. If at least one bit value is 0 in the index position, the load data is determined to be the first occurrence of the structure type. The bit value of the corresponding index position is updated to 1, and the original sample data is retained for subsequent processing. If all the bit values ​​at the index position are 1, it is determined that the load data has appeared in the historical samples, the original sample data is marked as a repeated detection behavior, and its subsequent processing flow is terminated.

5. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 4, characterized in that, After deduplication of duplicate samples, filtering for abnormal and invalid samples is also included: For any of the original sample data, count the number of times each byte appears in the payload data and calculate the byte frequency distribution; If the frequency of any byte exceeds the frequency threshold, the original sample data is marked as an abnormal sample, and its subsequent processing is terminated. If the frequency of all bytes does not exceed the frequency threshold, then the information entropy of the original sample data is calculated. If the information entropy is less than the information entropy threshold, the original sample data is marked as an invalid sample, and its subsequent processing is terminated.

6. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 5, characterized in that, Following the filtering of abnormal and invalid samples, the process also includes constructing a load-structured representation: For any of the original sample data, the payload data is matched according to the fingerprint rules of each communication protocol to obtain a matching result, the matching result including one or more communication protocols corresponding to the original sample data.

7. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 6, characterized in that, The fingerprint rules include at least one of the following: message start identifier features, key field string features, fixed offset field structure features, and constraints on the relationship between field length and function code.

8. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 4, characterized in that, The risk of the attack source is determined based on the following steps: Within the statistical time window, the number of communication protocol types involved in the source address, the number of ports accessed, and the number of structural patterns triggered are counted. Calculate the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns; Calculate the proportion of vulnerability verification behavior occurring in the attack sequence to obtain the vulnerability verification ratio; The attack source risk score is obtained by weighting and aggregating the attack behavior coverage index and the vulnerability verification ratio. The risk level of the attack source is determined based on the attack source risk score.

9. The method for measuring and characterizing early behaviors of industrial internet network attacks according to claim 8, characterized in that, The calculation of the attack behavior coverage index based on the number of communication protocol types, the number of ports, and the number of structural patterns includes: The attack behavior coverage index is obtained by weighting and aggregating the ratios of the number of communication protocol types to the maximum number of communication protocol types, the ratio of the number of ports to the total number of ports, and the ratio of the number of structural patterns to the maximum number of structural patterns.

10. A device for measuring and characterizing early-stage behaviors of industrial internet network attacks, characterized in that, include: The data processing module is used to: collect access behavior data from external networks as raw sample data, and perform data preprocessing on the raw sample data to obtain standardized sample data. The semantic classification module is used to: divide the sample data according to the communication protocol, extract features from the sample data, and perform unsupervised clustering within the protocol space to obtain the attack behavior semantic labels corresponding to each sample data. The sequence generation module is used to: sort the semantic tags of each sample data in chronological order using the source address as an index to obtain the attack sequence; The risk determination module is used to: determine the attack status and attack source risk of the source address based on the attack sequence.

Images