A vulnerability attack behavior clustering and classification method for a power generation side industrial control system

Abstract

The disclosure provides a vulnerability attack behavior clustering classification method for a power generation side industrial control system, log collection agents are respectively deployed at a management information node, a production control node and a forward synchronization server, three types of logs are collected, three independent log sets are obtained, data source coverage of a full path of a cross-node attack chain is realized, and a complete original data basis is provided for subsequent cross-node correlation analysis; a feature vector is extracted and standardized into a five-tuple neutral event sequence containing a subject, an operation, an object, a parameter and a timestamp, a gap between log isomerism and semantics is eliminated, and the three types of logs can be compared and correlated in the same semantic space; based on the neutral event sequence, a cross-node time sequence causal diagram kernel and clock drift compensation are combined to solve an attack chain event error segmentation problem caused by clock drift, and an accurate clustering cluster is obtained; and a clustering classification result is output for security personnel to identify an attack mode and provide early warning and defense.

Description

Technical Field

[0001] This invention relates to the field of power generation side industrial control, and in particular to a clustering and classification method for vulnerability attack behaviors in power generation side industrial control systems. Background Technology

[0002] To ensure production safety, power generation-side industrial control systems generally adopt a physically isolated architecture of "management information node - production control node," with data transmitted unidirectionally between the two nodes via a forward isolation device. Attackers, aiming to damage production equipment, often employ cross-node ferry attack techniques: first, they compromise the engineer's station or operator's station within the management information node; then, they write malicious commands into the forward synchronization server, disguising the malicious commands as legitimate ferry command files. These files are then synchronized to the production control node via the forward isolation device, ultimately causing unplanned generator shutdowns or equipment damage.

[0003] Cluster analysis of such attacks is a crucial method for identifying attack patterns and tracing attack sources. Traditional clustering methods typically treat events from each log source as independent samples, extracting features and directly performing clustering calculations based on metrics such as Euclidean distance. However, cross-node ferry attacks, whose attack chains span two physically isolated network regions, suffer from the following technical drawbacks: First, traditional methods lack a semantic causal relationship mechanism for cross-node attack chains when constructing clustered samples. The operation logs of management information nodes (such as user modifications to configuration file parameters) and the instruction execution logs of production control nodes (such as programmable logic controller register values ​​being overwritten) are physically isolated. Traditional methods can only cluster logs from individual nodes separately or treat all logs as homogeneous samples, failing to combine events from three different sources with causal temporal relationships (office-side operation events, shuttle synchronization events, and industrial control-side execution events) into a complete attack behavior sample. This causes the input objects for clustering analysis to degenerate from complete attack chains into isolated event fragments, and key distinguishing features of different attack modes cannot be effectively extracted due to sample fragmentation.

[0004] Secondly, traditional methods fail to consider the semantic gap between logs from two nodes when performing cross-node event correlation. Management information node operation logs often use operating system or application event description formats, while production control node instruction execution logs often use field parsing results from industrial control protocols. The same attack intent (e.g., setting the main steam valve opening to a specific value) is expressed completely differently in the two types of logs, including differences in the naming conventions of the operation objects, the semantic granularity of the operation actions, and the precision of parameter values. Traditional methods directly concatenate or cluster the feature vectors of the two types of logs separately, failing to establish an accurate mapping from "office-side operation semantics" to "industrial control-side execution semantics." This prevents the correct correlation of numerous semantically similar but differently expressed pre-attack events and post-attack events.

[0005] Finally, traditional methods, when performing cross-node event timing analysis, fail to consider clock drift between the system clocks of the two nodes. The system clocks of the management information node and the production control node operate independently, lacking a unified clock synchronization mechanism. The production control node clock exhibits a cumulative time deviation (i.e., clock drift) relative to the management information node clock. It should be noted that the management information node's operation logs and the ferry instruction records of the forward synchronization server are both within the management information node's security domain; their clocks originate from the same source and do not exhibit clock drift. Clock drift only manifests as the cumulative deviation of the production control node's timestamp relative to the management information node's clock. When measuring the temporal pattern similarity of different attack behaviors, traditional methods directly use the time interval obtained by subtracting the original timestamps as a feature, without compensating for clock drift in the time interval involving the production control node's timestamp. This means that two identical attack behaviors occurring at different time periods will have significantly different measured "ferry-execution" time intervals due to varying amounts of accumulated clock drift. When the accumulated clock drift is comparable to the actual time interval, these two attack behaviors, which should belong to the same attack mode, will be incorrectly classified into different categories during the clustering process, resulting in a decrease in clustering effectiveness.

[0006] In summary, traditional methods lack semantic causal associations for cross-node attack chains, standardized semantic mapping of cross-node logs, and timing compensation mechanisms involving clock drift, making it impossible to effectively cluster cross-node ferry attack behaviors. There is an urgent need for a clustering and classification method that can construct a complete three-event attack chain, unify the semantic representation of cross-node events, and compensate for clock drift of timestamps on the production control node side. Summary of the Invention

[0007] The first aspect of this disclosure provides a clustering and classification method for vulnerability attack behaviors in power generation side industrial control systems, including the following steps: The first log collection agent collects the operation logs of the management information node, the second log collection agent collects the instruction execution logs of the production control node, and the third log collection agent collects the transfer instruction records of the forward synchronization server, thus obtaining the first log set, the second log set, and the third log set. Based on the first log set, the second log set, and the third log set, a first event feature vector, a second event feature vector, and a third event feature vector are extracted respectively. The first event feature vector, the second event feature vector, and the third event feature vector are then formatted according to industrial control semantics to obtain a first neutral event representation sequence, a second neutral event representation sequence, and a third neutral event representation sequence. Based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, a clustering algorithm is used in conjunction with a cross-node temporal causal graph kernel for analysis and processing, resulting in a cluster of cross-node ferry attack behaviors. The clusters of the cross-node ferry attack behaviors are output as clustering classification results.

[0008] Preferably, based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, a clustering algorithm combined with a cross-node temporal causal graph kernel is used for analysis and processing to output a cluster of cross-node ferry attack behaviors, including the following steps: The management information node neutral event in the first neutral event representation sequence, the ferry neutral event in the third neutral event representation sequence, and the production control node neutral event in the second neutral event representation sequence are combined into a cross-node attack chain based on the cross-node attack semantic causal association rule to generate a cross-node attack chain candidate fragment set. For each cross-node attack chain candidate segment in the cross-node attack chain candidate segment set, cross-node attack behavior graph structuring is performed to obtain a cross-node attack behavior spatiotemporal graph set. Based on the set of spatiotemporal graphs of cross-node attack behavior, the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behavior in the set of spatiotemporal graphs of cross-node attack behavior is calculated by combining the cross-node temporal causal graph kernel with clock drift compensation analysis, and the graph kernel similarity matrix is ​​obtained. Using the graph kernel similarity matrix as input, the spectral clustering algorithm is used to first construct a normalized Laplacian matrix based on the graph kernel similarity matrix, then calculate the eigenvectors of the normalized Laplacian matrix, and finally cluster the eigenvectors of the normalized Laplacian matrix using the K-means clustering algorithm to obtain the clusters of cross-node ferry attack behaviors.

[0009] Preferably, each cross-node attack chain candidate segment includes a management information node attack pre-attack event, a ferry neutral event, and a production control node attack post-attack event; wherein, each cross-node attack behavior spatiotemporal graph includes a management information node attack pre-attack event node, a ferry neutral event node, a production control node attack post-attack event node, a first directed edge from the management information node attack pre-attack event node to the ferry neutral event node, and a second directed edge from the ferry neutral event node to the production control node attack post-attack event node.

[0010] Preferably, based on the set of spatiotemporal graphs of cross-node attack behaviors, the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behaviors in the set of spatiotemporal graphs of cross-node attack behaviors is calculated using a cross-node temporal causal graph kernel combined with clock drift compensation analysis, to obtain a graph kernel similarity matrix, including the following steps: Obtain the clock drift parameters between the first log collection agent and the second log collection agent; Select the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph from the set of cross-node attack behavior spatiotemporal graphs; The second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after the first compensation. The second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after the second compensation. Based on the first edge attribute and the second edge attribute after compensation that remain unchanged in the first cross-node attack behavior spatiotemporal graph, and the first edge attribute and the second edge attribute after compensation that remain unchanged in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation of the cross-node temporal causal graph kernel function. Traverse all two spatiotemporal graphs of cross-node attack behaviors in the spatiotemporal graph set, and use the calculated similarity value of each graph kernel as a matrix element to form a graph kernel similarity matrix.

[0011] Preferably, the clock drift parameters include clock drift rate and clock offset reference value.

[0012] Preferably, the clock drift parameters between the first log collection agent and the second log collection agent are obtained, including: Extract the ferry record timestamp of each ferry instruction record from the ferry instruction records collected by the third log collection agent, and extract the production control node timestamp of the production control node instruction execution log corresponding to each ferry instruction record from the production control node instruction execution log collected by the second log collection agent. Calculate the time difference between the timestamp of each pair of ferry records and the timestamp of the corresponding production control node to obtain a time difference sequence. The time difference sequence is fitted with linear regression within a preset sliding time window to obtain the clock drift rate and clock offset reference value of the current sliding time window.

[0013] Preferably, the second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after first compensation. The second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior is then corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after second compensation. This includes the following steps: Extract the ferry record timestamp of the ferry neutral event corresponding to the second directed edge in the spatiotemporal graph of the first cross-node attack behavior as the first compensation reference time point; The first clock drift compensation amount is calculated based on the first compensation reference time point, the clock drift rate r, and the clock offset reference value b. Subtract the first clock drift compensation amount from the second edge attribute of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior to obtain the second edge attribute after the first compensation. Extract the timestamp of the ferrying record of the ferrying neutral event corresponding to the second directed edge in the spatiotemporal graph of the second cross-node attack behavior as the second compensation reference time point; calculate the second clock drift compensation amount based on the second compensation reference time point, the clock drift rate and the clock offset reference value; subtract the second clock drift compensation amount from the second edge attribute of the second directed edge in the spatiotemporal graph of the second cross-node attack behavior to obtain the second compensated second edge attribute.

[0014] Preferably, based on the unchanging first edge attribute and the first compensated second edge attribute in the first cross-node attack behavior spatiotemporal graph, and the unchanging first edge attribute and the second compensated second edge attribute in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation processing of the cross-node temporal causal graph kernel function, including the following operation steps: Based on the first edge attributes that remain unchanged in the spatiotemporal graph of the first cross-node attack behavior and the first edge attributes that remain unchanged in the spatiotemporal graph of the second cross-node attack behavior, calculate the temporal causal similarity value of the first edge between the first directed edges; based on the first compensated second edge attributes and the second compensated second edge attributes, calculate the temporal causal similarity value of the second edge between the second directed edges. For the first management information node attack preceding event node, the first ferry neutral event node, and the first production control node attack following event node in the first cross-node attack behavior spatiotemporal graph, and for the second management information node attack preceding event node, the second ferry neutral event node, and the second production control node attack following event node in the second cross-node attack behavior spatiotemporal graph, calculate the node attribute semantic similarity for each, and sum the node attribute semantic similarity to obtain the node similarity sum value. Based on the first edge temporal causal similarity value, the second edge temporal causal similarity value, and the node similarity accumulation value, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is calculated using the cross-node temporal causal graph kernel function.

[0015] Preferably, based on the first edge attributes that remain unchanged in the spatiotemporal graph of the first cross-node attack behavior and the first edge attributes that remain unchanged in the spatiotemporal graph of the second cross-node attack behavior, the temporal causal similarity value of the first edge between the first directed edges is calculated; based on the first compensated second edge attributes and the second compensated second edge attributes, the temporal causal similarity value of the second edge between the second directed edges is calculated, including the following steps: Obtain the preset power generation-side cross-node ferry attack time decay coefficient λ; Extract the first edge attribute of the first directed edge in the spatiotemporal graph of the first cross-node attack behavior; extract the first edge attribute of the first directed edge in the spatiotemporal graph of the second cross-node attack behavior; Calculate the absolute difference between the first edge attribute and the first edge attribute of the first directed edge in the spatiotemporal graph of the second cross-node attack behavior; Based on the time decay coefficient λ of the cross-node ferry attack on the power generation side and the absolute difference, the temporal causal similarity value of the first edge between the first directed edges is calculated using the exponential time decay kernel function: Extract the attributes of the second edge after the first compensation of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior; extract the attributes of the second edge after the second compensation of the second directed edge in the spatiotemporal graph of the second cross-node attack behavior. Calculate the absolute difference between the second side attribute after the first compensation and the second side attribute after the second compensation; Based on the time decay coefficient λ of the cross-node ferry attack on the power generation side and the absolute difference, the temporal causal similarity value of the second edge between the second directed edges is calculated using the exponential time decay kernel function.

[0016] In another aspect, the present invention also provides a storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of the above-described clustering and classification method for vulnerability attack behavior of a power generation side industrial control system.

[0017] Compared with the prior art, the embodiments of the present invention have at least the following technical advantages: Analysis of the vulnerability attack behavior clustering and classification method for power generation side industrial control systems provided by this invention reveals that, in practical applications, log collection agents are deployed at the management information node, production control node, and forward synchronization server respectively to collect operation logs from the management information node, instruction execution logs from the production control node, and ferry instruction records, resulting in three independent log sets. This achieves full data source coverage of the cross-node attack chain, providing a complete raw data foundation for subsequent cross-node correlation analysis. Event feature vectors are extracted from the three log sets and formatted according to industrial control semantics, uniformly converting heterogeneous logs into a neutral event representation sequence containing a five-tuple of "subject-operation-object-parameter-timestamp". This eliminates the log format heterogeneity between the three data sources, resolves the semantic gap problem of cross-node logs, and enables logs from the management information node, production control node, and forward synchronization server to be compared and correlated in the same semantic space. Based on this, this embodiment uses three neutral event representation sequences and performs analysis and processing through a clustering algorithm combined with a cross-node temporal causal graph kernel. It also incorporates clock drift compensation analysis to address the cumulative time deviation (i.e., clock drift) between the production control node clock and the management information node clock. This solves the problem of traditional methods incorrectly segmenting events in the same attack chain due to ignoring clock drift, thus obtaining accurate cross-node ferry attack behavior clusters. Finally, the cross-node ferry attack behavior clusters are output as clustering classification results. Based on this, security analysts can quickly identify different types of cross-node attack patterns according to the output clustering classification results, and accordingly conduct early warning responses and formulate corresponding defense measures. Attached Figure Description

[0018] Figure 1 A schematic diagram of the main process of a clustering and classification method for vulnerability attack behavior in power generation side industrial control systems; Figure 2 A simulation diagram illustrating the cumulative problem of timestamp deviation caused by clock drift in a clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system. Figure 3This is a simulation diagram illustrating the incorrect segmentation caused by clock drift in a clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system. Figure 4 This is a schematic diagram simulating information and data interaction in a clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system. Figure 5 This is a schematic diagram of the graph structured simulation of cross-node attack behavior in a clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system. Figure 6 This is a clustering simulation diagram in a clustering classification method for vulnerability attack behavior in power generation side industrial control systems. Figure 7 This is a schematic diagram of a sliding window + linear regression fitting of clock drift parameters in a clustering and classification method for vulnerability attack behavior in a power generation side industrial control system. Figure 8 This is a simulation diagram comparing clock drift compensation before and after a clustering classification method for vulnerability attack behavior in a power generation-side industrial control system. Detailed Implementation

[0019] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those disclosed herein.

[0020] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0021] Example 1 like Figure 1 As shown, Embodiment 1 of the present invention provides a clustering and classification method for vulnerability attack behavior in power generation side industrial control systems, including the following steps: Step S10: Collect management information node operation logs through the first log collection agent (i.e., management information node log collection agent), collect production control node instruction execution logs through the second log collection agent (i.e., production control node log collection agent), and collect forward synchronization server transfer instruction records through the third log collection agent (i.e., forward isolation device synchronization log collection agent), to obtain the first log set (i.e., management information node operation log set), the second log set (i.e., production control node instruction execution log set), and the third log set (i.e., transfer instruction record set); It should be noted that the above-described embodiment of this application achieves full data source coverage across the entire cross-node attack chain by deploying log collection agents at three key nodes: the management information node, the production control node, and the forward synchronization server. Specifically, the first log collection agent captures the attacker's initial intrusion and operational behavior, such as file modifications and parameter configuration changes on the engineer's workstation; the second log collection agent captures the execution results of malicious instructions ultimately implemented in the industrial control system, such as changes in register values ​​after the programmable logic controller receives a write instruction; and the third log collection agent specifically captures the transition instruction records in the attack chain. These transition instruction records are the only data carriers crossing physical isolation boundaries, containing key time points and instruction content that indicate the instruction is synchronized from the office side to the industrial control side. Through the above processing, synchronous and independent collection of logs from the three physically isolated nodes is achieved, providing a complete raw data foundation for subsequent cross-node correlation analysis. For example, in a power plant deployment, the first log collection agent is deployed on the engineer station and operator station to collect operating system logs and application logs; the second log collection agent accesses the control layer switch in a bypass mirroring manner to collect Modbus TCP or IEC61850 command messages sent to programmable logic controllers and protection devices; the third log collection agent directly reads the synchronization task log file of the forward synchronization server; the log sets collected by the three agents are independent of each other but have an inherent causal relationship. For example, an attack may manifest as parameter modification records in the engineer station logs, file transfer records in the synchronization task logs, and register write records in the industrial control network traffic.

[0022] It should also be noted that in this embodiment, all cross-node attacks generate ferry instruction records through the synchronization task of the forward isolation device; for attack behaviors without ferry log records, since they cannot form complete three-node attack chain candidate segments, they are not within the scope of cluster analysis of this scheme. Step S20: Based on the first log set, the second log set, and the third log set, extract the first event feature vector (i.e., the management information node event feature vector), the second event feature vector (i.e., the production control node event feature vector), and the third event feature vector (i.e., the ferry instruction feature vector), respectively. Then, perform standard formatting based on industrial control semantics on the first event feature vector, the second event feature vector, and the third event feature vector to obtain the first neutral event representation sequence (i.e., the management information node neutral event representation sequence), the second neutral event representation sequence (i.e., the production control node neutral event representation sequence), and the third neutral event representation sequence (i.e., the ferry neutral event representation sequence). It should be noted that the log formats of the three data sources are completely different. For example, the management information node operation log may be in XML format (Windows event log), the production control node instruction execution log may be parsed text of a binary network protocol, and the ferry instruction record may be a structured log specific to the synchronization software. To eliminate this heterogeneity, this step extracts a feature vector of a unified dimension for each type of log and maps it to a neutral event representation space based on industrial control semantics. The standard format based on industrial control semantics refers to uniformly representing all events in a standardized format containing a five-tuple of "subject-operation-object-parameter-timestamp". Among them, the "object" is uniformly identified by the measurement point hierarchy coding of the power generation side industrial control system. For example, a temperature measurement point of the steam turbine system is coded as "UNIT1.TURBINE.TEMP.POINT01", instead of using inconsistent names such as "Tag_101" or "Device_01.Temp" that may appear in different logs. Through the above processing, the heterogeneous logs from three different physical nodes are converted into a semantically unified, directly comparable, and correlated neutral event sequence, solving the semantic gap problem of cross-node logs. For example: A management information node operation log entry "User Admin modified the parameter MainSteamValveSetpoint to 85 in the file config.ini at 10:30:00 on 2024-06-10" will be converted into a neutral event representation {Subject: Admin, Operation: Modify, Object: UNIT1.VALVE.MAINSTEAM.SETPOINT, Parameter: 85, Timestamp: 1717986600}; a production control node instruction execution log entry containing an entry written to the boiler main steam valve setpoint register... Odbus commands are also converted into this five-tuple format, so that parameter modification behavior on the office side and command execution behavior on the industrial control side can be compared in the same semantic space. To clearly distinguish the data processing stage, in this embodiment, "log" refers to the raw, unprocessed data collected, such as "management information node operation log"; "event" refers to the structured representation after feature extraction and standard formatting, i.e., "neutral event". The above-mentioned step S20 of this application extracts feature vectors from the raw log set and converts them into a standardized neutral event representation sequence. Therefore, the input is the log set and the output is the event sequence.

[0023] Step S30: Based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, the clustering algorithm is combined with the cross-node temporal causal graph kernel for analysis and processing, and the cross-node ferry attack behavior cluster is output. Existing technologies, when performing clustering, either fail to establish associations across node events or rely solely on simple temporal sequences, completely ignoring clock drift between nodes (e.g., ...). Figure 2 As shown, clock drift refers to the cumulative time deviation between the system clock of the production control node (industrial control side) and the system clock of the management information node (office side). Specifically, the management information node and the ferry instruction record belong to the same security domain, and their system clocks are synchronized, so there is no clock drift. The production control node operates its clock independently. Due to factors such as crystal oscillator frequency differences and temperature changes, its clock will gradually "run faster" or "run slower" relative to the management information node's clock, resulting in a difference in their timestamps. This deviation increases (or decreases) linearly over time; it is not a fixed value but accumulates over time, hence the term clock drift, and its rate of change is called the clock drift rate r (e.g., "100 milliseconds / hour"). The accumulation of timestamp deviations leads to the incorrect segmentation of seemingly unrelated events that are actually part of the same attack chain (e.g.,...). Figure 3 As shown, Figure 3In the previous example, G1 and G2 belonged to the same attack mode. Due to the large difference in delay on the second side caused by clock drift, they were incorrectly divided into two clusters. This application innovatively introduces a cross-node temporal causal graph kernel as the core metric of the clustering algorithm, and deeply integrates clock drift compensation analysis to solve the above problems. Step S40: Output the clusters of the cross-node ferry attack behavior as clustering classification results.

[0024] Through the technical solutions adopted in the above embodiments of this application, this application achieves accurate clustering and classification of cross-node ferry attack behavior in the power generation side industrial control system, effectively solving the problems of attack chain breakage and clustering failure caused by cross-node log heterogeneity, semantic fragmentation and clock drift; security analysts can quickly identify different types of cross-node attack patterns based on the clustering and classification results, thereby conducting early warning responses and formulating corresponding defense methods for each pattern.

[0025] like Figure 4 As shown in the above embodiments of this application, by deploying log collection agents on the management information node, production control node, and forward synchronization server respectively, and collecting operation logs from the management information node, instruction execution logs from the production control node, and ferry instruction records respectively, three independent log sets are obtained. This achieves data source coverage of the entire cross-node attack chain, providing a complete raw data foundation for subsequent cross-node correlation analysis. Event feature vectors are extracted from the three log sets and formatted according to industrial control semantics. This unifies the heterogeneous logs into a neutral event representation sequence containing a five-tuple of "subject-operation-object-parameter-timestamp," eliminating the log format heterogeneity between the three data sources, resolving the semantic gap problem of cross-node logs, and enabling the logs from the management information node, production control node, and forward synchronization server to be used for cross-node attack chain analysis. Logs from control nodes and forward synchronization servers can be compared and correlated within the same semantic space. Based on three neutral event representation sequences, clustering algorithms combined with cross-node temporal causal graph kernels are used for analysis and processing. Simultaneously, clock drift compensation analysis is integrated to address the cumulative time deviation (i.e., clock drift) between the production control node clock and the management information node clock. This solves the problem of traditional methods incorrectly segmenting events in the same attack chain due to ignoring clock drift, thus obtaining accurate cross-node ferry attack behavior clusters. Finally, the cross-node ferry attack behavior clusters are output as clustering classification results. Security analysts can quickly identify different types of cross-node attack patterns based on the output clustering classification results, and accordingly conduct early warning responses and formulate corresponding defense measures.

[0026] Specifically, in step S30, based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, a clustering algorithm combined with a cross-node temporal causal graph kernel is used for analysis and processing to output a cluster of cross-node ferry attack behaviors, including the following operation steps: Step S31: Represent the neutral events of the management information nodes in the first neutral event representation sequence (…). The third neutral event represents the ferry neutral event in the sequence. ) and the second neutral event represents the neutral event of the production control node in the sequence ( Based on the semantic causal association rules of cross-node attacks, a three-event cross-node attack chain is combined to generate a set of candidate fragments for cross-node attack chains; Each cross-node attack chain candidate segment contains a management information node attack pre-attack event, a ferry neutral event, and a production control node attack post-attack event. It should be noted that the purpose of this step is to initially pair and connect the events in the three independent sequences according to the semantic causal logic of the attack. The cross-node attack semantic causal association rule is essentially to find those event triples that "performed an operation on the office side, then the corresponding instruction appeared in the ferry record, and finally the execution of the corresponding instruction was observed on the industrial control side". If this step is not performed, the events in the three sequences will remain isolated and cannot form a complete attack chain view, and the subsequent clustering will lose the analysis object. For example: Suppose there is an instruction in the ferry log that sets "UNIT1.VALVE.MAINSTEAM.SETPOINT" to "85". The system backtracks the neutral event sequence on the office side and finds an operation event with a semantic similarity of 95% (the user also modified the value of the same measurement point to 85 in the configuration file). At the same time, in the forward neutral event sequence on the industrial control side, an execution event with a similarity of 100% is found (the measurement point register was indeed successfully written to 85). These three events are combined into a cross-node attack chain candidate fragment. Specifically, the above embodiments of this application refer to any... , and Define the semantic matching degree between each pair of events, which is calculated based on the "object" field and the "operation / parameter" field in the neutral representation of each event; Object matching degree Compare the hierarchical encoding of the "object" field of two events (in ascending or descending order of "leaf node.child node...root node", depending on the actual system); if the two object encodings are exactly the same, then =1; If one encoding is a prefix of another encoding (i.e., an inclusion relationship), let the depth difference d = |depth(a) - depth(b)|, where depth is the number of nodes in the encoding. Then =1 / (d+1); For example, when the depth difference is 1, =0.5; when the depth difference is 2, ≈0.333; In this embodiment, instead of using a fixed value of 0.8, a continuous function inversely proportional to the depth difference is used to more finely distinguish the semantic proximity of different levels; if the codes of two objects are neither equal nor prefixes of each other, then =0; Operation-parameter matching degree : When comparing and hour: First, perform exact matching on the "Operation" field (e.g., if "Modify" and "Write" are considered different, the similarity is 0; if synonym mapping is allowed, a mapping table is predefined); for the "Parameter" field, if the parameter is numerical, calculate the relative error. , The value is a very small positive number to avoid a denominator of 0; then the parameter similarity is calculated. ,in The preset tolerance is used (e.g., 0.05); if the parameter is a string, edit distance or BERT sentence similarity is used (the output is normalized to [0,1]); finally The operation matching result is 0 or 1; when comparing and At the same time, the operation fields must be strictly consistent (e.g., "write" in the ferry command corresponds to "write register" on the industrial control side); the parameter field values ​​must be consistent: if the absolute difference between the two is less than a preset threshold (e.g., 1% of the range), the similarity is 1; otherwise, it is 0. For floating-point numbers, use... They are considered equal. Comprehensive semantic matching degree: First, calculate the matching degree product between each pair of events: Secondly, in addition to pairwise matching, it is also necessary to check... and Direct semantic consistency between events is required to avoid semantic conflicts between the first and last events of the attack chain. Define direct matching degree: Operation semantic matching: if Operations (such as "modifying configuration file parameters") and An operation (such as "writing to a register") is considered an allowed causal relationship in the preset causal mapping table if its value is 1; otherwise, it is 0. The causal mapping table predefines the legal correspondence between office-side operations and industrial control-side operations. (The causal mapping table is a predefined, extensible set of key-value pairs used to map operation types in the management information area to corresponding allowed operation types in the production control area. Specifically, its construction method is based on the industrial control system security knowledge base (such as attack patterns recommended by ICS-CERT) and common PLC instruction set definitions, and includes at least the following mappings: {"Modify" → "Write", "Delete" → "Clear", "Create" → "Add", "Read" → "Read", "Start" → "Run", "Stop" → "Stop"}. This mapping table is stored in the system as a configuration file (such as JSON or XML format), allowing safety engineers to extend or modify it according to the equipment manuals and configuration logic of a specific power plant.) When comparing office-side operations... Operation with industrial control side At that time, if Belongs to mapping[ If the defined set (one office operation can be mapped to multiple industrial control operations) is specified, the operation semantic matching value is 1; otherwise, it is 0. For operation pairs not defined in the mapping table, the default matching value is 0, and the system can log to prompt engineers to review and supplement the mapping rules. Parameter field matching: requirements and If the parameter values ​​are equal, or if the relative error is within a preset tolerance range (relative error <5%), the same relative error formula as the aforementioned parameter similarity is used: Let and Calculate the relative error based on the parameter values ​​for the two events. ,in It is a very small positive number (e.g., 1e-6); parameter matching degree ,in The preset tolerance level is 0.05 (default, i.e., 5%); ultimately, ; Parameter matching degree here It only indicates the degree of matching of parameter values, unlike the aforementioned The degree of matching between the synthesized operations and parameters in the function; Operation causal matching result: If the operation pair is in the causal mapping table, the value is 1; otherwise, it is 0. Comprehensive semantic matching degree of cross-node attack chain candidate fragments. as follows: That is, the product of the pairwise matching degree and the direct matching degree. The rationale for using the product form is that: only when the office-side event and the ferry event semantically match, the ferry event and the industrial control-side event semantically match, and the office-side event and the industrial control-side event satisfy direct causal consistency, is the triple considered a valid attack chain candidate segment; any low matching degree will lead to a significant decrease in the overall matching degree, which meets the "logical AND" requirement of attack chain semantic transmission; Ultimately, the necessary and sufficient condition for the three events to combine into a candidate fragment is: ;in The preset semantic matching threshold (e.g., 0.85). The preset direct matching threshold (e.g., 0.8) ensures that the events at the beginning and end of the attack chain have a semantic causal relationship. Next, the temporal causality constraint is applied, meaning the timestamps of the three events must satisfy the causal order: < < ; Furthermore, the time interval must be less than the preset maximum effective duration of the attack chain. (For example, 24 hours. The default value of 24 hours is based on the typical data transfer cycle (once a day) of the power generation side industrial control system. For attacks related to protection devices with real-time requirements, it can be set to 1 hour; for historical data synchronization scenarios, it can be set to 72 hours; this parameter can be automatically read from the business configuration file of the industrial control system.) Finally, the candidate fragment generation process is performed, which involves traversing... , and All combinations of events in the sequence, if simultaneously satisfying >θ (where θ is a preset semantic matching threshold, such as 0.85; the default value of 0.85 comes from 100 manually labeled positive samples in the power plant's historical logs). The 5th percentile of the distribution, after the system is running, can be automatically adjusted within the range of [0.7, 0.95] based on the silhouette coefficient of the clustering results, with a step size of 0.01. If the labeled samples are insufficient, an empirical value of 0.85 can be used first. The adjustment can only be performed periodically by the system in offline mode (e.g., once a week), and real-time online adjustment is not performed to avoid circular dependencies; during adjustment, a set of candidate thresholds is given: {0.70, 0.72, 0.75, 0.78, 0.80, 0.82, 0.85, 0.88, 0.90, 0.92, 0.95}, for each threshold, run steps S31 to S34 to obtain the clustering results and calculate the silhouette coefficient; select the threshold that maximizes the silhouette coefficient as the current optimal θ; if multiple thresholds correspond to the same silhouette coefficient, select the smaller threshold (to retain more candidate segments); this optimization process relies on historical log data, and the configuration file is updated after each adjustment; if there is insufficient historical labeled data (no real labels before clustering), the silhouette coefficient calculation is still based on the density of the clustering results themselves. This method is self-supervised and does not cyclically depend on the threshold itself; if the system cannot obtain stable silhouette coefficients (e.g., too little data), the default value of 0.85 is maintained, along with temporal causal constraints; then these three events are combined to generate a "cross-node attack chain candidate segment F=( , , ", and add it to the candidate fragment set; In the above-described embodiment of this application, step S31 employs an object matching degree calculation method based on hierarchical coding depth difference, which is a coarse-grained fast matching method. Its purpose is to efficiently filter out event combinations with hierarchical relationships during the candidate fragment generation stage, reducing the computational load of subsequent processing. In contrast, in step S3342, the similarity of object fields is calculated using cosine similarity based on word embedding vectors (Word2Vec), which is a fine-grained semantic matching method. Its purpose is to accurately measure the semantic similarity of two attack graphs in terms of the objects being manipulated during the clustering stage. These two methods are applied to different stages: coarse-grained matching is used for rapid association, while fine-grained matching is used for accurate clustering.

[0027] Step S32: For each cross-node attack chain candidate segment in the cross-node attack chain candidate segment set, perform cross-node attack behavior graph structuring to obtain a cross-node attack behavior spatiotemporal graph set; Each cross-node attack behavior spatiotemporal graph includes the preceding event node of the management information node attack, the ferry neutral event node, the following event node of the production control node attack, the first directed edge from the preceding event node of the management information node attack to the ferry neutral event node, and the second directed edge from the ferry neutral event node to the following event node of the production control node attack. It should be noted that, as Figure 5 As shown, in order to use the graph kernel method for similarity calculation, each cross-node attack chain candidate segment must be transformed from an event sequence into a graph structure; the graph structure can naturally express the asymmetric causal transmission relationship of "cause → relay → consequence", that is... Figure 5The process involves managing node time, ferrying node events, and controlling node events. Each event is abstracted into a node, and the node attributes are defined by its feature vector or semantic fingerprint. Two directed edges represent the propagation direction and time consumption of the attack behavior. Through this graph structuring process, the three originally discrete events are encapsulated into a structured attack behavior unit, providing a standard input data structure for subsequent graph similarity calculations.

[0028] Step S33: Based on the set of spatiotemporal graphs of cross-node attack behavior, use the cross-node temporal causal graph kernel combined with clock drift compensation analysis to calculate the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behavior in the set of spatiotemporal graphs of cross-node attack behavior, and obtain the graph kernel similarity matrix. It should be noted that the management information node log and the ferry instruction record are both located in the management information node security domain, and their system clocks are synchronized. Therefore, there is no cross-node clock drift between the timestamp of the pre-attack event on the management information node and the timestamp of the ferry record. Clock drift only exists on the production control node side, that is, there is a cumulative deviation between the timestamp of the production control node and the clock of the management information node. If the original second directed edge attribute (the time interval between the ferry record timestamp and the production control node timestamp) is directly used to calculate the graph kernel function, the measured second time interval of two identical attack behaviors occurring in different time periods will be different due to the accumulation of clock drift. This deviation will directly lead to a decrease in edge attribute similarity, which in turn will cause two graphs that should cluster into the same attack pattern to be incorrectly segmented. Therefore, this application only introduces clock drift compensation analysis for the second directed edges involving the timestamp of the production control node.

[0029] Step S34: Using the graph kernel similarity matrix as input, the spectral clustering algorithm is used to first construct a normalized Laplacian matrix based on the graph kernel similarity matrix, then calculate the eigenvectors of the normalized Laplacian matrix, and finally cluster the eigenvectors of the normalized Laplacian matrix using the K-means clustering algorithm to obtain the cross-node ferry attack behavior clusters.

[0030] It should be noted that, as Figure 6As shown, the graph kernel similarity matrix obtained in step S33 is essentially a kernel matrix that defines the similarity between any two attack behavior samples. It can be directly used by clustering algorithms based on similarity matrices, such as spectral clustering and hierarchical clustering. According to this matrix, the clustering algorithm divides the spatiotemporal graphs of cross-node attack behaviors with high graph similarity into the same cluster. Each cluster represents a type of cross-node ferry attack behavior with the same attack mode and attack path. For example, attack behaviors launched by the same attacker at different time periods, targeting the same type of device, and having the same "low and slow" parameter modification strategy, even if the time interval between the occurrences is several days, will be clustered into the same cluster because they have similar node semantics and similar time intervals after clock drift compensation, and thus be identified as the same type of attack activity. Example of spectral clustering calculation: Assuming there are three spatiotemporal graphs G1, G2, and G3 representing cross-node attack behaviors, the calculated graph kernel similarity matrix K (3×3) is as follows: ; Using the spectral clustering algorithm (N-cut version): Construct a degree matrix D, where :

[0031] Constructing the normalized Laplace matrix ; calculate Given the eigenvalues ​​and eigenvectors, take the eigenvector (Fiedler vector) corresponding to the second smallest eigenvalue, for example, v=[0.6,0.55,-0.58]; Perform K-means clustering (k=2) on the elements in v, separating positive and negative values: G1 and G2 are in one cluster (high similarity), and G3 is in another cluster; finally, output two clusters: {G1,G2} and {G3}.

[0032] Specifically, in step S33, based on the set of spatiotemporal graphs of cross-node attack behavior, the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behavior in the set of spatiotemporal graphs of cross-node attack behavior is calculated using cross-node temporal causal graph kernels combined with clock drift compensation analysis, to obtain the graph kernel similarity matrix, including the following operation steps: Step S331: Obtain the clock drift parameters between the first log collection agent and the second log collection agent, wherein the clock drift parameters include the clock drift rate and the clock offset reference value; It should be noted that the clock drift parameter is the basis for compensation; this application uses a forward synchronization server as a "clock reference bridge"; since the ferry instruction record also contains the timestamp of the ferry occurrence. (Time stamp from the management information node side) and the log record timestamp of the instruction being executed by the industrial control side. (From the production control node side clock), by calculating the difference sequence Δ between these two timestamps over a period of time. - By fitting the data using linear regression, the relative drift rate and offset reference value of the two node domain system clocks at the current moment can be dynamically estimated; let the management information node clock be the reference clock, and denote its time as... The production control node clock is the clock to be calibrated, and its time is recorded as... Define clock skew When Δ(t) > 0, it indicates that the production control node clock is faster than the management information node clock; when Δ(t) < 0, it indicates that it is slower. In linear regression fitting, using... (The ferry record timestamp belongs to) Let x be the independent variable and Δ = - Let y be the dependent variable, and fit the straight line y = r·(x- )+b; where, The starting time of the sliding window (in) (Based on); r is the clock drift rate, in units of [time units / time units], representing the change per unit reference time Δ; r can be positive or negative; b is the time... The estimated clock offset at time Δ( ) = b; b can be positive or negative.

[0033] like Figure 7 As shown, specifically, this application involves extracting the ferry record timestamp of each ferry instruction record from the ferry instruction records collected by the third log collection agent. Furthermore, the production control node timestamp corresponding to each ferry instruction record is extracted from the production control node instruction execution log collected by the second log collection agent. Then, the time difference Δ between each pair of ferry record timestamps and the corresponding production control node timestamps is calculated to obtain a time difference sequence. Next, the time difference sequence is fitted with linear regression within a preset sliding time window to obtain the clock drift rate and clock offset reference value of the current sliding time window. The clock drift rate and clock offset reference value of the current sliding time window are used as the clock drift parameter. For example, in a power plant system, the preset sliding time window is set to 8 hours. Within this window, the system collects 100 ferry commands and their corresponding execution timestamp pairs. The calculated difference sequence shows a linear growth trend from 100ms to 900ms. A linear regression equation is then obtained. ,in The window starts at the time (based on the clock of the management information node), b=100ms is the clock offset reference value, and r=100ms / hour is the clock drift rate. This means that within this 8-hour window, the clock deviation between the two nodes increases by 100ms every hour, and the reference deviation at the start of the window is 100ms. The sliding window method is used to dynamically track changes in clock drift, because the clock drift rate may change slowly due to environmental factors such as temperature. Example of clock drift parameter fitting values: Set sliding time window (Management Information Node Clock), 3 ferry-execution timestamp pairs were collected in the window (for simplicity, the actual system will collect more, as shown in Table 1 below):

[0034] Table 1 Using univariate linear regression for fitting The independent variable (Unit: hours), dependent variable y = Δ (unit: seconds); Calculation process: x = [1, 2, 3] hours, y = [0.100, 0.250, 0.450] seconds; =2, ; molecular

[0035]

[0036] ; denominator ; Slope r = 0.35 / 2 = 0.175 seconds / hour = 175 milliseconds / hour; Intercept ; The fitted line is then... In practical use, it is recommended that there be no fewer than 50 data points in the window and that the closed-form solution of the least squares method be used (the closed-form solution of the least squares method is common knowledge to those skilled in the art, and will not be described in detail in this application). It should also be noted that the sliding time window uses a fixed duration W (e.g., 8 hours) and slides forward in fixed steps S (e.g., 1 hour). The start time of each window... The timestamp of the first ferry record within this window (based on the clock of the management information node) is the hour; for any The system first determines which sliding window it belongs to. If it falls outside the current window, use distance. Compensation is performed using the (r,b) obtained by fitting the nearest window (distance from the time center point); when When the time distance from the window exceeds W / 2, refitting is triggered to ensure compensation accuracy.

[0037] Step S332: Select the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph from the set of cross-node attack behavior spatiotemporal graphs; Step S333: For the second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior, perform clock drift compensation correction using the clock drift parameter to obtain the second edge attribute after the first compensation; and for the second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior, perform clock drift compensation correction using the clock drift parameter to obtain the second edge attribute after the second compensation. The first edge attribute (i.e., the time interval corresponding to the first directed edge) remains unchanged because there is no cross-node clock drift and can be directly used for subsequent calculations; It should be noted that, as Figure 8 As shown, the compensation correction only applies to the time interval across nodes, aiming to remove spurious delays caused by clock drift from the measured time intervals. Since different attacks occur at different times, their corresponding clock drift compensation amounts may differ. Through this personalized compensation correction, the second-side attribute of all attacks is converted to the same fair time base for subsequent comparisons. The compensated second-side attribute Δt2′ is not the absolute true delay of the attack propagation (because the absolute true delay requires knowing the absolute deviation between the clocks of the two nodes, while this scheme can only estimate the relative drift), but rather is based on the starting time of the sliding window. A normalized delay estimate based on a common time base, eliminating the effects of clock drift. Since Δt2′ for all attack behaviors is discounted to the same base. They can be directly compared in terms of temporal pattern similarity, which is exactly what clustering requires. To convert to absolute true time delay, a baseline deviation 'b' at the start of the window can be added, but this step is not necessary during clustering.

[0038] Step S334: Based on the first edge attribute and the second edge attribute after compensation that remain unchanged in the first cross-node attack behavior spatiotemporal graph, and the first edge attribute and the second edge attribute after compensation that remain unchanged in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation of the cross-node temporal causal graph kernel function. It should be noted that the calculation logic of the cross-node temporal causal graph kernel function is as follows: taking into account the similarity of the two graphs in terms of node semantics and edge temporal causality, only those attack graphs with the same attack semantics (same operation object, same operation parameter change pattern) and consistent attack rhythm (consistent pre-ferry-after-effect time interval after clock drift compensation) will be calculated with a high graph kernel similarity value.

[0039] Step S335: Traverse all two cross-node attack behavior spatiotemporal graphs in the set of cross-node attack behavior spatiotemporal graphs, and use the calculated similarity value of each graph kernel as a matrix element to form a graph kernel similarity matrix.

[0040] It should be noted that the graph kernel similarity matrix is ​​an N×N symmetric matrix, where N is the number of graphs in the spatiotemporal graph set of cross-node attack behavior; the element in the i-th row and j-th column of the matrix represents the graph kernel similarity value between the i-th graph and the j-th graph; this matrix fully describes the pairwise similarity relationship between all attack behavior samples.

[0041] Specifically, in step S333, the second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after first compensation. The second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior is then corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after second compensation. This includes the following steps: Step S3331: Extract the timestamp of the ferrying record of the neutral event corresponding to the second directed edge in the spatiotemporal graph of the first cross-node attack behavior. As the first compensation benchmark time point; Step S3332: Based on the first compensation reference time point The clock drift rate r and the clock offset reference value b are used to calculate the first clock drift compensation amount. ,in The starting time of the sliding time window (management information node clock); It should be noted that, in the calculations of the above embodiments of this application, it is necessary to ensure that... The time unit of r must be consistent with the time unit of r (the denominator). For example, if the unit of r is 'milliseconds / hour', then... It needs to be converted to hours.

[0042] First clock drift compensation amount The calculation formula is based on the fitted straight line, at t_f ( ¹ ) The expected clock deviation at time is ; due to the actual measured properties of the second side This bias is included, therefore subtract Then, the normalized time delay estimate Δt2′=Δt2-C1 based on time T0 is obtained; note that b and C1 can both be negative values, and the subtraction operation correctly compensates for the deviation direction (if the production control node clock is faster, C1 is positive, then subtracting the positive number will result in a smaller normalized time delay).

[0043] Step S3333: Assign the second edge attribute of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior. Subtracting the first clock drift compensation amount, we obtain the second side attribute after the first compensation. ; Step S3334: Extract the timestamp of the ferrying record of the ferrying neutral event corresponding to the second directed edge in the spatiotemporal graph of the second cross-node attack behavior. As the second compensation reference time point; the second clock drift compensation amount is calculated based on the second compensation reference time point, the clock drift rate, and the clock offset reference value. The second edge attribute of the second directed edge in the spatiotemporal graph of the second cross-node attack behavior. Subtracting the second clock drift compensation amount yields the second side attribute after the second compensation. .

[0044] It should be noted that since different attacks occur at different times, their corresponding clock drift compensation amounts may be different. Through the above steps, the second side attribute of the spatiotemporal graph of each cross-node attack behavior is personalized and compensated, while the first side attribute remains unchanged. Thus, the time characteristics of all attacks are converted to a unified time base that is unaffected by clock drift.

[0045] Specifically, in step S334, based on the unchanged first edge attribute and the first compensated second edge attribute in the first cross-node attack behavior spatiotemporal graph, and the unchanged first edge attribute and the second compensated second edge attribute in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation of the cross-node temporal causal graph kernel function, including the following operation steps: Step S3341: Calculate the temporal causal similarity value of the first edge between the first directed edges based on the first edge attribute that remains unchanged in the spatiotemporal graph of the first cross-node attack behavior and the first edge attribute that remains unchanged in the spatiotemporal graph of the second cross-node attack behavior; calculate the temporal causal similarity value of the second edge between the second directed edges based on the first compensated second edge attribute and the second compensated second edge attribute. Step S3342: For the first management information node attack preceding event node, the first ferry neutral event node, and the first production control node attack subsequent event node in the first cross-node attack behavior spatiotemporal graph, and for the second management information node attack preceding event node, the second ferry neutral event node, and the second production control node attack subsequent event node in the second cross-node attack behavior spatiotemporal graph, calculate the semantic similarity of node attributes for each node pair, and sum the similarity of each node pair to obtain the node similarity sum value; For example, a power plant may have the following measurement point level encoding strings: 1. UNIT1. BOILER. TEMP. POINT01; 2. UNIT1. BOILER. PRESS. POINT01; 3. UNIT1. TURBINE. SPEED. POINT01; 4. UNIT1. TURBINE. TEMP. POINT01; 5. UNIT2. BOILER. TEMP. POINT01; When constructing the corpus, each complete encoded string is treated as a "sentence," or the encoding is segmented hierarchically (e.g., ['UNIT1', 'BOILER', 'TEMP', 'POINT01']) as a "sentence." The Word2Vec Skip-gram model is used for training, with a vector dimension of 128 and a window size of 2 (if segmented hierarchically) or 5 (if processed as a whole string). After training, the vector of "BOILER.TEMP" will have a certain similarity to the vector of "TURBINE.TEMP," while the similarity between the vectors of "BOILER.TEMP" and "BOILER.PRESS" will be low. For the combination stage in step S31, to pursue efficiency, the method based on hierarchical depth can still be used. However, in the node similarity calculation stage, the semantic embedding-based method of this supplement is used.

[0046] It should be noted that the semantic similarity calculation of node attributes involves calculating the similarity of the node attribute vectors of three corresponding nodes in two graphs. Firstly, to ensure fairness in the distance calculation for different types of features, the constructed node attribute vectors... Each part undergoes internal normalization or weighting: for scalar values ​​of parameter fields Treat it as an independent dimension; for the 128-dimensional dense vector of the object field. Calculate its L2 norm and normalize it to make its magnitude 1; the final node's feature vector for[ , , , ],in No additional cross-dimensional normalization is performed because the numerical range has already been limited to the [-1,1] or [0,1] interval by dividing by the upper limit of the range, which is basically consistent with the numerical range of each dimension of the normalized object vector. As a more robust alternative, similarity can be calculated separately for different types of features before weighted summation to avoid the curse of dimensionality.

[0047] ; Where sim is the cosine similarity or the absolute difference similarity for a scalar, w1 to w4 are preset weights, and their sum is 1; in this embodiment, to highlight the importance of the operation object and parameters, w1=0.1, w2=0.1, w3=0.4, w4=0.4 can be set; this application uses cosine similarity for the attribute vectors of two nodes. , Similarity Then, the node similarity sums are obtained by accumulating the values. This ensures that only attack behaviors with the same target and similar semantics can obtain a high similarity score; Specifically, in the above embodiments of this application, the specific calculation process of node attribute semantic similarity is as follows: First, construct the node attribute vector. For any event's quintuple {body, operation, object, parameter, timestamp}, it is quantified as follows: Main field Map users / roles to fixed-length one-hot encoded vectors (e.g., Admin->[1,0,0], Operator->[0,1,0]). Operation fields Map operation types (such as "modify" and "write") to fixed-length one-hot encoded vectors; object fields The generation-side measurement point hierarchical encoding (e.g., UNIT1.TURBINE.TEMP.POINT01) is converted into a dense vector of fixed dimensions (e.g., 128 dimensions) using a pre-trained word embedding model or a predefined dictionary. Object field vectorization can be based on either a dictionary or training. Specifically, dictionary-based processing involves pre-establishing a mapping table of all generation-side measurement point hierarchical encodings to integer IDs, then using one-hot encoding or randomly initialized trainable embedding layers (dimensions set to 64-256). The mapping table is automatically generated from the industrial control system configuration file. Pre-training-based processing involves collecting all object hierarchical encoding strings appearing in the power plant's historical logs to form a corpus. This corpus is trained using the Word2Vec Skip-gram model with a window size of 5 and an output dimension of 128. The trained embedding vectors can express the semantic similarity between measurement points (e.g., the distance between the UNIT1.TURBINE.TEMP and UNIT1.TURBINE.PRESSURE vectors is relatively close). Parameter fields If the parameter is a numerical value, its value is taken and normalized (for example, divided by the upper limit of the range of the measuring point parameter, where the "upper limit of the range" is obtained from the measuring point configuration database of the power generation side industrial control system, and each measuring point has a predefined range (such as temperature measuring point 0~150℃, pressure measuring point 0~1.6MPa, etc.). If the upper limit of the range cannot be obtained, maximum-minimum normalization is used, with the maximum and minimum values ​​in historical data as boundaries), to obtain a scalar. If the parameter is an enumerated value, it is encoded using one-hot encoding. Concatenate the vectors from the above components to form the final node attribute vector. (Specific example of node attribute vectorization: Taking the neutral event {Subject: Admin, Operation: Modify, Object: UNIT1.VALVE.MAINSTEAM.SETPOINT, Parameter: 85, Timestamp: 1717986600} as an example, assuming there are 3 roles in the system: Admin, Operator, Engineer, then...) It is a 3-dimensional one-hot vector, with Admin corresponding to [1,0,0]; there are 4 operation types in the system: modify, write, read, and delete. The vector is a 4-dimensional unique heat vector, with "modify" corresponding to [1,0,0,0]; Object encoding: A pre-trained Word2Vec model (trained on the generator-side measurement point description corpus) is used to map the hierarchical encoding "UNIT1.VALVE.MAINSTEAM.SETPOINT" to a 128-dimensional dense vector, for example, [0.12,-0.34,\dots,0.56]; Parameters: The upper limit of the measurement range of this measurement point is 100 (units are the same as parameters), then after normalization... =85 / 100=0.85, which is a scalar; ultimately Dimension = 3 + 4 + 128 + 1 = 136 dimensions; the specific vector value is the concatenation of the above parts. Next, calculate the semantic similarity between the two nodes. Use the cosine similarity formula: ; Finally, calculate the accumulated value. :

[0048] ; Step S3343: Based on the first edge temporal causal similarity value, the second edge temporal causal similarity value, and the node similarity accumulation value, calculate the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph using the cross-node temporal causal graph kernel function.

[0049] It should be noted that the kernel function of a cross-node temporal cause-effect graph is defined as follows: ; in This is the cumulative value of node similarity. Let be the temporal causal similarity value of the first directed edge. This represents the temporal causal similarity value of the second directed edge. The reason for using a product form is that the similarity of an attack chain requires similarity across the preceding, transition, and attack semantic stages to be considered overall similar; excessive differences in any stage will lead to a decrease in overall similarity. The product form is equivalent to applying a continuous approximation of a "logical AND" operation (often called a "soft AND" operation in machine learning) to the three similarity dimensions (nodes, preceding edges, and following edges). Compared to weighted summation (addition), the product is more sensitive to minimum values; that is, if the similarity of any one dimension approaches 0, the overall similarity also approaches 0. This better aligns with the logic of overall attack chain matching: an attack behavior must be similar in the preceding, transition, and following stages to be considered a similar attack pattern. Since the spatiotemporal graph of cross-node attack behavior has a fixed topological structure of "three nodes and two edges," the calculation of the graph kernel function can directly enumerate the correspondence between nodes and edges, resulting in high computational efficiency. It should be further explained that the cross-node temporal causal graph kernel defined above... It is a valid positive definite kernel that satisfies the Mercer condition, for the following reasons: It is the sum of the similarities of the three nodes. The similarity of each node is calculated using cosine similarity (positive definite kernel). The sum of the positive definite kernels is still a positive definite kernel. and Both are exponential time decay kernel functions This function is a form of the Laplace kernel, which is known to be a conditionally positive definite kernel and is widely accepted in the construction of similarity matrices commonly used in spectral clustering. The product of positive definite kernels (pointwise multiplication) is still a positive definite kernel (Schur product theorem). Therefore, the global K is a positive definite kernel, and the kernel matrix constructed in this way is positive semi-definite, which can be safely used in spectral clustering algorithms and guarantees convergence to the global optimal partition. Additionally, it should be noted that before calculating the graph kernel similarity, the spatiotemporal graph of each cross-node attack behavior is validated: if its second-edge attribute compensation Δt2' is still greater than 1, then the validity of the graph is verified. (or the first side attribute Δt1> If the graph is not found to be a timeout graph, it will be marked as a "timeout exception graph" and will not participate in subsequent clustering, or its similarity will be uniformly set to zero. This mechanism avoids including non-attack behaviors caused by log collection delays or system anomalies in the clustering.

[0050] Specifically, in step S3341, based on the first edge attribute that remains unchanged in the first cross-node attack behavior spatiotemporal graph and the first edge attribute that remains unchanged in the second cross-node attack behavior spatiotemporal graph, the temporal causal similarity value of the first edge between the first directed edges is calculated; based on the first compensated second edge attribute and the second compensated second edge attribute, the temporal causal similarity value of the second edge between the second directed edges is calculated, including the following operation steps: Step S33411: Obtain the preset power generation side cross-node ferry attack time decay coefficient λ; It should be noted that the time decay coefficient λ for the cross-node ferry attack on the power generation side is a preset positive real number parameter used to control the degree of influence of time interval differences on similarity; the dimension of λ is... Its value must match the unit of the time interval; for example, if the time interval is in milliseconds, then λ can take the value of The larger the coefficient, the faster the similarity decays as time differences increase. For attacks related to protection devices with extremely high response speed requirements, a larger λ value can be set; for attacks related to ordinary control loops with slower response speeds, a smaller λ value can be set. The value of λ can be determined based on the statistical distribution of the response time of typical cross-node attacks in the power generation side industrial control system. Specifically, collect recent (e.g., within 30 days) cross-node ferry attack events confirmed by security experts, and extract the original measured values ​​of the second-side attributes in each attack event. (Uncompensated); Calculate the sample standard deviation σ of these Δt2 values; If λ=1 / σ is used, then when the Δt2 of two attacks differs by σ, their edge temporal causal similarity is approximately ≈0.368; If λ=\ln(2) / σ is used, then when the difference is σ, the similarity is 0.5 (half-life); If there are no labeled samples, empirical values ​​can be used first. (As shown in the example), after the system is running, it will be adaptively adjusted based on the silhouette coefficient of the clustering results; the value of λ is selected using the following hierarchical processing method: If the system has accumulated cross-node ferry attack event samples (≥30) confirmed by security experts, then calculate the sample standard deviation σ of the original measurement value Δt2 of the second side attribute in these samples, and set λ=ln(2) / σ so that when the difference between Δt2 of two attacks is σ, their side temporal causal similarity is exactly 0.5 (half-life); if the number of labeled samples is insufficient (<30), then adopt the empirical value based on the business characteristics of the industrial control system; for the power generation side industrial control system, considering that the ferry-execution time interval of a typical cross-regional ferry attack is usually in the range of seconds to minutes (e.g., 100ms~60s), this embodiment sets λ=0.01ms. - ¹, the feature scale corresponding to this value is 100ms (i.e., the similarity is approximately 0.368 when the difference is 100ms); this empirical value can be configured once according to the actual network latency characteristics of the power plant, and is not used as an adaptive adjustment parameter; after the system is running, λ is not automatically adjusted online to avoid instability of the clustering results; if optimization is required, the security analyst will recalculate and update the configuration using historical labeled data in offline mode.

[0051] Step S33412. Extract the first edge attribute of the first directed edge in the spatiotemporal graph of the first cross-node attack behavior, denoted as Δt1. ( ¹ ) Extract the attribute of the first edge of the first directed edge in the spatiotemporal graph of the second cross-node attack behavior, denoted as Δt1. ( ² ) ; It should be noted that the first edge attribute is the first time interval between the timestamp of the management information node in the preceding event of the first cross-node attack behavior in the spatiotemporal graph of the management information node attack and the timestamp of the ferry record of the ferry neutral event, and the first time interval between the timestamp of the management information node in the preceding event of the second cross-node attack behavior in the spatiotemporal graph of the management information node attack and the timestamp of the ferry record of the ferry neutral event. Since both the timestamp of the management information node and the timestamp of the ferry record are generated based on the clock of the management information node side, there is no cross-node clock drift. Therefore, the first edge attribute does not need to be corrected for clock drift and can be directly used for edge temporal causal similarity calculation.

[0052] Step S33413: Calculate the first edge attribute Δt1 ( ¹ ) With Δt1 ( ² ) The absolute difference between them, i.e., |Δt1 ( ¹ ) -Δt1 ( ² ) |; Step S33414: Based on the power generation side cross-node ferry attack time decay coefficient λ and the absolute difference |Δt1 ( ¹ ) -Δt1 ( ² ) | The temporal causal similarity value between the first directed edges is calculated using the exponential time decay kernel function: ; It should be noted that the characteristics of the exponential time decay kernel function are: when the attributes of the two first sides are completely equal, the temporal causal similarity value of the first side is 1; as the difference increases, the similarity value decays exponentially; small time differences (e.g., tens of milliseconds) have little impact on the attack pattern determination, while large differences (several seconds) significantly indicate different patterns. The exponential decay can express this relationship smoothly and non-linearly, and it is also simple to calculate.

[0053] Step S33415: Extract the attribute Δt2 of the second edge after the first compensation of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior. ( ¹ ) ′;Extract the attribute Δt2 of the second edge after compensation of the second directed edge in the spatiotemporal graph of the second cross-node attack behavior. ( ² ) ′; It should be noted that the second-side attribute after the first compensation is the time interval after clock drift compensation correction, and the second-side attribute after the second compensation is also the time interval after clock drift compensation correction; the purpose of the compensation correction is to remove the false delay caused by cross-node clock drift from the measured second-side attribute.

[0054] Step S33416: Calculate the second side attribute Δt2 after the first compensation. ( ¹ ) ′ and the second side attribute Δt2 after the second compensation ( ² ) The absolute difference between ′, i.e., |Δt2 ( ¹ ) ′-Δt2 ( ² ) ′|; Step S33417: Based on the power generation side cross-node ferry attack time decay coefficient λ and the absolute difference |Δt2 ( ¹ ) ′-Δt2 ( ² ) The temporal causal similarity value between the second directed edges is calculated using the exponential time decay kernel function: ; It should be noted that when the two compensated second-side attributes are completely equal, the temporal causal similarity value of the second side is 1; as the difference increases, the similarity value decays exponentially; since the compensation correction eliminates the influence of clock drift, this similarity value can truly reflect the degree of temporal pattern similarity of the attack behavior in the transition from the industrial control execution stage.

[0055] Examples of the technical solutions adopted in the embodiments of this application are provided below: Using the previous data, the attributes of the spatiotemporal graphs GA and GB for the two cross-node attack behaviors are as follows: Figure GA: First side attribute Δt1 ( ¹ ) (Management Information Node → Ferry): 500ms; Second side attribute (before compensation, ferry → production control node): 2000ms; The attribute Δt2 of the second side after compensation ( ¹ ) ′:1600ms (compensation amount 400ms); Node similarity cumulative value =2.93; Figure GB: First side attribute Δt1 ( ² ) 520ms; Second side attribute (before compensation, ferry → production control node): 2100ms; The attribute Δt2 of the second side after compensation ( ² ) ′: 1500ms (compensation amount 600ms); Node similarity cumulative value =2.84; System parameters: The time decay coefficient is based on an empirical value of λ = 0.01 ms. - ¹ Calculation steps: Calculate the temporal causal similarity value of the first side (steps S33413-S33414): Absolute difference = |500-520| = 20ms; =exp(-0.01×20)=exp(-0.2)≈0.8187; Calculate the temporal causal similarity value of the second side (steps S33416-S33417): Absolute difference = |1600-1500| = 100ms; =exp(-0.01×100)=exp(-1.0)≈0.3679; Calculate the kernel similarity value (step S3343): =2.84×0.8187×0.3679≈0.855; This similarity value reflects the comprehensive matching degree of two attack behaviors in terms of semantics and compensated temporal features, and can be fed into a spectral clustering algorithm for clustering; if another pair of attack graphs calculates a kernel value of only 0.12, they will not be clustered into the same cluster.

[0056] In summary, the proposed clustering and classification method for vulnerability attack behaviors in power generation side industrial control systems addresses this issue by deploying log collection agents on three types of nodes to uniformly convert the collected heterogeneous logs into a five-tuple neutral event representation based on industrial control semantics. Clustering is then performed using a cross-node temporal causal graph kernel combined with clock drift compensation analysis. This solves the problems of attack chain breakage and clustering failure caused by cross-regional log format heterogeneity, semantic fragmentation, and clock drift of production control nodes in traditional methods. It enables attack events belonging to three physically isolated nodes to be assembled into complete attack behavior samples and performs accurate similarity measurement and clustering after eliminating the impact of clock drift. In the further processing, based on the semantic causal association rules of cross-node attacks, the events in the three independent neutral event sequences are combined into candidate fragments of the three-event cross-node attack chain, and then graph-structured. Then, spectral clustering is performed using the graph kernel similarity matrix as input. This solves the problem that traditional methods cannot associate office-side operation events, ferry events, and industrial control-side execution events into a complete attack chain. This restores the input object of clustering analysis from isolated event fragments to structured attack behavior units, providing a complete attack chain view for subsequent graph similarity calculation and clustering. In the further processing, a forward synchronization server is used as a clock reference bridge. The difference sequence between the ferry record timestamp and the production control node timestamp is fitted by linear regression to obtain the clock drift parameter. Clock drift compensation is performed only on the second directed edge attribute involving the production control node timestamp. Then, the compensated graph kernel similarity matrix is ​​calculated to solve the problem that the same attack pattern is incorrectly segmented in different time periods due to the neglect of clock drift in the traditional method. This makes the second edge attribute of all attack behaviors converted to a unified time base, and the graph kernel similarity value can truly reflect the temporal pattern similarity of attack behaviors. In the further processing, the timestamp of the ferry record to which each cross-node attack behavior spatiotemporal graph belongs is used as the compensation reference time point. The corresponding clock drift compensation amount is calculated for each, and the corresponding compensation amount is subtracted from the second side attribute. This realizes personalized clock drift compensation correction for attack behaviors that occur at different time points, so that the time characteristics of each attack behavior are converted to a common time coordinate system based on the starting time of the sliding window, eliminating the compensation difference introduced by different occurrence times. On the other hand, the temporal causal similarity values ​​of the first and second directed edges are calculated separately, and the sum of the semantic similarity values ​​of the node attributes of the three pairs of nodes is added together. Then, the three are fused through a cross-node temporal causal graph kernel function in the form of a product to obtain the graph kernel similarity value. The similarity measurement of the attack chain depends on three dimensions: the temporal pattern of the preceding stage, the temporal pattern of the ferrying aftereffect stage, and the attack semantics. If the difference in any dimension is too large, the overall similarity will be significantly reduced, thereby effectively distinguishing attack behaviors that are semantically similar but have different temporal patterns. Furthermore, the absolute difference is directly calculated for the first-side attributes without clock drift compensation, and the absolute difference is calculated for the second-side attributes after clock drift compensation. The temporal causal similarity values ​​of the first and second sides are calculated independently using the same exponential time decay kernel function and a preset time decay coefficient λ. The similarity calculation of the first side is not affected by clock drift, and the similarity calculation of the second side eliminates the false delay differences caused by clock drift. The temporal causal similarity values ​​of both sides can accurately reflect the true similarity of the attack propagation delay at their respective stages.

[0057] The above embodiments are only used to illustrate the technical solutions of this disclosure, and are not intended to limit it. Although this disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this disclosure, and should all be included within the protection scope of this disclosure.

Claims

1. A clustering and classification method for vulnerability attack behaviors in power generation side industrial control systems, characterized in that, The following steps are included: The first log collection agent collects the operation logs of the management information node, the second log collection agent collects the instruction execution logs of the production control node, and the third log collection agent collects the transfer instruction records of the forward synchronization server, thus obtaining the first log set, the second log set, and the third log set. Based on the first log set, the second log set, and the third log set, a first event feature vector, a second event feature vector, and a third event feature vector are extracted respectively. The first event feature vector, the second event feature vector, and the third event feature vector are then formatted according to industrial control semantics to obtain a first neutral event representation sequence, a second neutral event representation sequence, and a third neutral event representation sequence. Based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, a clustering algorithm is used in conjunction with a cross-node temporal causal graph kernel for analysis and processing, resulting in a cluster of cross-node ferry attack behaviors. The clusters of the cross-node ferry attack behaviors are output as clustering classification results.

2. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 1, characterized in that, Based on the first neutral event representation sequence, the second neutral event representation sequence, and the third neutral event representation sequence, a clustering algorithm combined with a cross-node temporal causal graph kernel is used for analysis and processing to output a cluster of cross-node ferry attack behaviors, including the following operation steps: The management information node neutral event in the first neutral event representation sequence, the ferry neutral event in the third neutral event representation sequence, and the production control node neutral event in the second neutral event representation sequence are combined into a cross-node attack chain based on the cross-node attack semantic causal association rule to generate a cross-node attack chain candidate fragment set. For each cross-node attack chain candidate segment in the cross-node attack chain candidate segment set, cross-node attack behavior graph structuring is performed to obtain a cross-node attack behavior spatiotemporal graph set. Based on the set of spatiotemporal graphs of cross-node attack behavior, the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behavior in the set of spatiotemporal graphs of cross-node attack behavior is calculated by combining the cross-node temporal causal graph kernel with clock drift compensation analysis, and the graph kernel similarity matrix is ​​obtained. Using the graph kernel similarity matrix as input, the spectral clustering algorithm is used to first construct a normalized Laplacian matrix based on the graph kernel similarity matrix, then calculate the eigenvectors of the normalized Laplacian matrix, and finally cluster the eigenvectors of the normalized Laplacian matrix using the K-means clustering algorithm to obtain the clusters of cross-node ferry attack behaviors.

3. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 2, characterized in that, Each cross-node attack chain candidate segment contains a management information node attack preceding event, a ferry neutral event, and a production control node attack following event; wherein, each cross-node attack behavior spatiotemporal graph contains a management information node attack preceding event node, a ferry neutral event node, a production control node attack following event node, a first directed edge from the management information node attack preceding event node to the ferry neutral event node, and a second directed edge from the ferry neutral event node to the production control node attack following event node.

4. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 3, characterized in that, Based on the set of spatiotemporal graphs of cross-node attack behaviors, the graph kernel similarity value between any two spatiotemporal graphs of cross-node attack behaviors in the set of spatiotemporal graphs of cross-node attack behaviors is calculated using cross-node temporal causal graph kernels combined with clock drift compensation analysis, to obtain the graph kernel similarity matrix. The process includes the following steps: Obtain the clock drift parameters between the first log collection agent and the second log collection agent; Select the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph from the set of cross-node attack behavior spatiotemporal graphs; The second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after the first compensation. The second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior is corrected by clock drift compensation using the clock drift parameter to obtain the second edge attribute after the second compensation. Based on the first edge attribute and the second edge attribute after compensation that remain unchanged in the first cross-node attack behavior spatiotemporal graph, and the first edge attribute and the second edge attribute after compensation that remain unchanged in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation of the cross-node temporal causal graph kernel function. Traverse all two spatiotemporal graphs of cross-node attack behaviors in the spatiotemporal graph set, and use the calculated similarity value of each graph kernel as a matrix element to form a graph kernel similarity matrix.

5. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 4, characterized in that, The clock drift parameters include the clock drift rate and the clock offset reference value.

6. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 5, characterized in that, Obtain the clock drift parameters between the first log collection agent and the second log collection agent, including: Extract the ferry record timestamp of each ferry instruction record from the ferry instruction records collected by the third log collection agent, and extract the production control node timestamp of the production control node instruction execution log corresponding to each ferry instruction record from the production control node instruction execution log collected by the second log collection agent. Calculate the time difference between the timestamp of each pair of ferry records and the timestamp of the corresponding production control node to obtain a time difference sequence. The time difference sequence is fitted with linear regression within a preset sliding time window to obtain the clock drift rate and clock offset reference value of the current sliding time window.

7. The method for clustering and classifying vulnerability attack behaviors in a power generation-side industrial control system according to claim 6, characterized in that, The process involves the following steps: First, for the second edge attribute carried by the second directed edge in the spatiotemporal graph of the first cross-node attack behavior, clock drift compensation correction is performed using the clock drift parameters to obtain the first compensated second edge attribute. Second, for the second edge attribute carried by the second directed edge in the spatiotemporal graph of the second cross-node attack behavior, clock drift compensation correction is performed using the clock drift parameters to obtain the second compensated second edge attribute. Extract the ferry record timestamp of the ferry neutral event corresponding to the second directed edge in the spatiotemporal graph of the first cross-node attack behavior as the first compensation reference time point; The first clock drift compensation amount is calculated based on the first compensation reference time point, the clock drift rate r, and the clock offset reference value b. Subtract the first clock drift compensation amount from the second edge attribute of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior to obtain the second edge attribute after the first compensation. Extract the timestamp of the ferrying record of the ferrying neutral event corresponding to the second directed edge in the spatiotemporal graph of the second cross-node attack behavior as the second compensation reference time point; The second clock drift compensation amount is calculated based on the second compensation reference time point, the clock drift rate, and the clock offset reference value; Subtract the second clock drift compensation amount from the second side attribute of the second directed edge in the spatiotemporal graph of the second cross-node attack behavior to obtain the second compensated second side attribute.

8. The clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system according to claim 7, characterized in that, Based on the unchanged first edge attribute and the first compensated second edge attribute in the first cross-node attack behavior spatiotemporal graph, and the unchanged first edge attribute and the second compensated second edge attribute in the second cross-node attack behavior spatiotemporal graph, and combining the nodes in the first cross-node attack behavior spatiotemporal graph and the nodes in the second cross-node attack behavior spatiotemporal graph, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is obtained through the analysis and calculation of the cross-node temporal causal graph kernel function, including the following operation steps: Based on the first edge attributes that remain unchanged in the spatiotemporal graph of the first cross-node attack behavior and the first edge attributes that remain unchanged in the spatiotemporal graph of the second cross-node attack behavior, calculate the temporal causal similarity value of the first edge between the first directed edges; Based on the first compensated second edge attribute and the second compensated second edge attribute, calculate the second edge temporal causal similarity value between the second directed edges; For the first management information node attack preceding event node, the first ferry neutral event node, and the first production control node attack following event node in the first cross-node attack behavior spatiotemporal graph, and for the second management information node attack preceding event node, the second ferry neutral event node, and the second production control node attack following event node in the second cross-node attack behavior spatiotemporal graph, calculate the node attribute semantic similarity for each, and sum the node attribute semantic similarity to obtain the node similarity sum value. Based on the first edge temporal causal similarity value, the second edge temporal causal similarity value, and the node similarity accumulation value, the graph kernel similarity value between the first cross-node attack behavior spatiotemporal graph and the second cross-node attack behavior spatiotemporal graph is calculated using the cross-node temporal causal graph kernel function.

9. A clustering and classification method for vulnerability attack behavior in a power generation-side industrial control system according to claim 8, characterized in that, Based on the first edge attributes that remain unchanged in the spatiotemporal graph of the first cross-node attack behavior and the first edge attributes that remain unchanged in the spatiotemporal graph of the second cross-node attack behavior, calculate the temporal causal similarity value of the first edge between the first directed edges; based on the first compensated second edge attributes and the second compensated second edge attributes, calculate the temporal causal similarity value of the second edge between the second directed edges, including the following steps: Obtain the preset power generation-side cross-node ferry attack time decay coefficient λ; Extract the first edge attribute of the first directed edge in the spatiotemporal graph of the first cross-node attack behavior; Extract the first edge attribute of the first directed edge in the spatiotemporal graph of the second cross-node attack behavior; Calculate the absolute difference between the first edge attribute and the first edge attribute of the first directed edge in the spatiotemporal graph of the second cross-node attack behavior; Based on the time decay coefficient λ of the cross-node ferry attack on the power generation side and the absolute difference, the temporal causal similarity value of the first edge between the first directed edges is calculated using the exponential time decay kernel function: Extract the attributes of the second edge after the first compensation of the second directed edge in the spatiotemporal graph of the first cross-node attack behavior; Extract the second edge attribute of the second directed edge after second compensation in the spatiotemporal graph of the second cross-node attack behavior; Calculate the absolute difference between the second side attribute after the first compensation and the second side attribute after the second compensation; Based on the time decay coefficient λ of the cross-node ferry attack on the power generation side and the absolute difference, the temporal causal similarity value of the second edge between the second directed edges is calculated using the exponential time decay kernel function.

10. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the vulnerability attack behavior clustering and classification method for a power generation side industrial control system as described in claim 1.

Images