Industrial control network node dynamic deception method, device, equipment, medium and product

Abstract

The application provides an industrial control network node dynamic deception method, device, equipment, medium and product, and relates to the technical field of network security, and the method comprises the following steps: modeling an industrial process of an industrial control system based on domain prior knowledge and historical data of the industrial control system, generating a process model of the industrial control system; simulating the industrial process of the industrial control system based on the process model, generating a virtual deception network; and interacting with an abnormal client based on the virtual deception network. Through the above method, effective modeling of the real industrial process of the industrial control system is realized, the modeling effect of the virtual deception network is optimized, the virtual deception network has high fidelity, and effective defense can be provided for the industrial control system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, medium and product for dynamic deception of industrial control network nodes. Background Technology

[0002] Industrial Control Systems (ICS) are the core of industrial infrastructure, and their secure and stable operation is crucial. With the deep integration of the Industrial Internet and Cyber-Physical Systems (CPS) technologies, the traditional physical barriers protecting industrial control systems are gradually being broken down, exposing them to complex and ever-changing external network environments. Existing cyberattacks can now penetrate the virtual network boundaries of industrial control systems and precisely target real industrial processes, easily causing severe production stoppages, equipment damage, and environmental disasters. Meanwhile, traditional defense methods, such as firewalls, intrusion detection systems, and virus protection, are essentially static and passive, proving inadequate in dealing with advanced persistent threats. These methods suffer from problems such as attackers having a one-way transparent advantage, difficulty in effectively addressing unknown threats, and an asymmetry between offense and defense.

[0003] To reverse the asymmetry between offense and defense, academia and industry have begun exploring new paradigms of proactive defense. The core idea of ​​proactive defense is to shift from passively detecting and intercepting abnormal requests to actively interfering with and manipulating them. By introducing dynamism, uncertainty, and deception, it increases the cognitive complexity and attack costs for attackers, thereby disrupting their attack chain. Network deception technology is a typical proactive defense method. It induces attackers to launch attacks against false targets by setting up fake targets, providing false information, and creating false feedback, thus protecting the real network and systems. Network deception technology not only disrupts the attacker's judgment but can also delay attack behavior to some extent, giving defenders more time to formulate response strategies.

[0004] In some related technologies, network deception technology is used to protect industrial control systems. Industrial control systems include various devices and components, such as sensors, PLCs (Programmable Logic Controllers), HMIs (Human-Machine Interfaces), and industrial equipment components. Each device or component can be regarded as an industrial control network node. Defenders can set up virtual deception networks based on these industrial control network nodes and set up multiple industrial control honeypots in the virtual deception networks to simulate industrial control network nodes. Then, they can induce attackers to launch attacks on these fake industrial control honeypots, thereby protecting the real industrial control system.

[0005] However, in real industrial control systems, different industrial control network nodes may be interconnected. For example, an inlet valve, an outlet pump, and a level sensor can each be considered as three industrial control network nodes. Damage to the inlet valve and outlet pump will affect the data changes of the level sensor. Therefore, there is a correlation between these three industrial control network nodes. In the corresponding virtual deception network, if the industrial control honeypot representing the inlet valve or outlet pump is attacked by an attacker, then the industrial control honeypot representing the level sensor will theoretically also be affected by the attack and produce a correlated response. However, existing single industrial control honeypots can usually only simulate the state and data of a single industrial control network node. Different industrial control honeypots in the virtual deception network are independent of each other, and the states and data of different industrial control honeypots do not affect each other, which is inconsistent with the operation of real industrial control systems. When an attacker interacts with multiple industrial control honeypots simultaneously, if these industrial control honeypots exhibit independent and physically contradictory behaviors (e.g., the heating component is on but the temperature sensor data remains unchanged), their deceptive nature will be exposed.

[0006] Therefore, existing methods for deceiving industrial control network nodes are insufficient for effectively modeling real industrial processes in industrial control systems, resulting in poor modeling performance of virtual deception networks and making it difficult to provide effective defense for industrial control systems. Summary of the Invention

[0007] This invention provides a method, apparatus, equipment, medium, and product for dynamic deception of industrial control network nodes, which addresses the shortcomings of existing industrial control network node deception methods that are unable to effectively model the real industrial processes of industrial control systems, resulting in poor modeling effects of virtual deception networks and difficulty in providing effective defense for industrial control systems.

[0008] This invention provides a method for dynamic deception of industrial control network nodes, comprising: modeling the industrial process of the industrial control system based on prior domain knowledge and historical data of the industrial control system to generate a process model of the industrial control system; the industrial control system includes multiple industrial control network nodes, and the process model is a mathematical model used to describe the topological relationships, causal relationships, and dynamic parameter changes among the multiple industrial control network nodes in the industrial process; simulating the industrial process of the industrial control system based on the process model to generate a virtual deception network; the virtual deception network includes multiple virtual deception nodes, each virtual deception node representing an industrial control network node, and the node state of each virtual deception node evolves over time; and interacting with abnormal clients based on the virtual deception network.

[0009] According to the present invention, a method for dynamic deception of industrial control network nodes is provided. Based on domain prior knowledge and historical data of the industrial control system, the method models the industrial process of the industrial control system and generates a process model of the industrial control system. The method includes: modeling the industrial control system based on domain prior knowledge and historical data to generate a causal structure graph of the industrial control system; the causal structure graph includes multiple nodes and multiple directed edges, where each node represents a variable, a variable represents the state of an industrial control network node, and a directed edge represents the causal relationship between two nodes; modeling the dynamic relationship of each directed edge to generate a switching affine model corresponding to each directed edge; the switching affine model is a mathematical model used to describe the dynamic parameter changes of the directed edge under different operating conditions; wherein, the process model includes all switching affine models.

[0010] According to the present invention, a dynamic deception method for industrial control network nodes is provided. Based on domain prior knowledge and historical data, an industrial control system is modeled to generate a causal structure graph of the industrial control system. The method includes: determining a set of random variables describing the industrial control system based on historical data, and constructing an initial undirected graph based on the set of random variables; the set of random variables includes multiple variables, and the initial undirected graph includes multiple nodes and multiple undirected edges, with one undirected edge representing the connection relationship between two nodes; determining a set of prior knowledge constraints based on domain prior knowledge; performing conditional independence checks on all nodes in the initial undirected graph to generate a separation set; the separation set includes at least two nodes that are independent under specific conditions, and there is no causal relationship between the independent nodes; removing undirected edges between independent nodes in the initial undirected graph based on the separation set to generate a target undirected graph; and orienting the edges of the target undirected graph based on the set of prior knowledge constraints to determine the direction of each undirected edge in the target undirected graph, thereby generating a causal structure graph; wherein the causal structure graph satisfies the constraints in the set of prior knowledge constraints.

[0011] According to the present invention, a dynamic deception method for industrial control network nodes is provided, wherein the prior knowledge constraint set includes timing constraints, physical constraints, and control constraints; wherein, timing constraints are used to characterize the temporal irreversibility of the causal relationship between two nodes, physical constraints are used to characterize the physical laws used by the industrial control system, and control constraints are used to characterize the control loop logic of the industrial control system.

[0012] According to the present invention, a dynamic deception method for industrial control network nodes is provided. The switching affine model is an ARX model, which is determined based on a target switching variable, a target partitioning variable, and a target model parameter vector. The target switching variable is used to characterize the switching of different operating conditions of the industrial control system, the target partitioning variable is used to characterize different operating condition regions of the industrial control system, and the target model parameter vector is the optimal set of model parameters of the ARX model. The switching affine model corresponding to any directed edge is constructed based on the following steps: extracting historical variable data of the two variables corresponding to the directed edge from historical data; iteratively optimizing the partitioning variable and the model parameter set of the ARX model based on the historical variable data to determine the target partitioning variable and the target model parameter vector; and iteratively optimizing the switching variable to determine the target switching variable, given the determined target partitioning variable and the target model parameter vector. The target switching variable, the target partitioning variable, and the target model parameter vector are the parameters that minimize the global prediction error of the ARX model.

[0013] According to the present invention, a dynamic deception method for industrial control network nodes is provided, which interacts with an abnormal client based on a virtual deception network, including: receiving a network request from the abnormal client; parsing the network request for business logic and extracting the operation instructions in the network request; operating on a target virtual deception node in the virtual deception network based on the operation instructions to obtain response data from the virtual deception network; and sending the response data to the abnormal client.

[0014] This invention also provides a dynamic deception device for industrial control network nodes, comprising: a modeling module for modeling the industrial process of the industrial control system based on prior domain knowledge and historical data of the industrial control system, generating a process model of the industrial control system; the industrial control system includes multiple industrial control network nodes, and the process model is a mathematical model used to describe the topological relationships, causal relationships, and dynamic parameter changes among the multiple industrial control network nodes in the industrial process; a simulation module for simulating the industrial process of the industrial control system based on the process model, generating a virtual deception network; the virtual deception network includes multiple virtual deception nodes, each virtual deception node representing an industrial control network node, and the node state of each virtual deception node evolves over time; and an interaction module for interacting with abnormal clients based on the virtual deception network.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the above-described methods for dynamic deception of industrial control network nodes.

[0016] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described methods for dynamic deception of industrial control network nodes.

[0017] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-described methods for dynamic deception of industrial control network nodes.

[0018] The present invention provides a method, apparatus, device, medium, and product for dynamic deception of industrial control network nodes. It overcomes the limitations of existing technologies that neglect the physical logic of real industrial processes. First, based on prior domain knowledge and historical data of the industrial control system, it models the real industrial process of the industrial control system, generating a process model to describe the topological relationships, physical causal relationships, and dynamic parameter changes among multiple industrial control network nodes in the real industrial process. Then, based on the process model, it simulates the industrial process of the industrial control system, generating a virtual deception network. This virtual deception network includes multiple virtual deception nodes, each representing an industrial control network node. The node state of each virtual deception node can evolve over time, thus simulating the changes in node states and data of different industrial control network nodes over time in the real industrial process. These time-evolving virtual deception nodes can collaboratively simulate the complete business process of the industrial control system in the real industrial process, achieving effective modeling of the real industrial process of the industrial control system. This optimizes the modeling effect of the virtual deception network, giving it high fidelity. Finally, the virtual deception network interacts with the attacker's abnormal client, thus providing effective defense for the industrial control system. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the dynamic deception method for industrial control network nodes provided by the present invention.

[0021] Figure 2 This is a schematic diagram of the DecepTwin framework provided by the present invention.

[0022] Figure 3 This is a schematic diagram illustrating the working principle of the protocol simulation engine provided by this invention.

[0023] Figure 4 This is a schematic diagram of the interaction process between an attacker and a virtual deception network provided by the present invention.

[0024] Figure 5This is a schematic diagram of the structure of the dynamic deception device for industrial control network nodes provided by the present invention.

[0025] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] Please see Figures 1 to 4 , Figure 1 This is a flowchart illustrating the dynamic deception method for industrial control network nodes provided by the present invention. Figure 2 This is a schematic diagram of the DecepTwin framework provided by the present invention. Figure 3 This is a schematic diagram illustrating the working principle of the protocol simulation engine provided by this invention. Figure 4 This is a schematic diagram of the interaction process between an attacker and a virtual deception network provided by the present invention.

[0028] In this embodiment, the dynamic spoofing method for industrial control network nodes is applied to systems or terminal devices that employ the DecepTwin framework.

[0029] Considering that the core bottleneck of existing network deception technology lies in the insufficient fidelity of virtual deception networks, especially when simulating industrial processes of complex industrial control systems composed of multiple device components, it is often difficult to guarantee the self-consistency of the node status and data of each industrial control network node in physical logic. Based on this, this embodiment designs a brand-new high-fidelity deception framework, namely the DecepTwin framework.

[0030] The DecepTwin framework is designed to achieve high-fidelity system-level simulation of industrial processes. Therefore, its core modeling philosophy centers on the real industrial processes within the industrial control system, rather than on individual industrial devices or components. Traditional industrial control honeypots often attempt to simulate a single industrial control network node, while the DecepTwin framework focuses on building a complete virtual deception network composed of multiple Virtual Deception Nodes (VDNs). The framework's operation includes offline and online phases: In the offline phase, DecepTwin uses a systematic modeling approach to deeply analyze the real industrial processes of the industrial control system, generating a process model that describes the system's causal structure and dynamic behavior under multiple operating conditions. In the online phase, an independent simulation runtime engine loads the process model and simulates the industrial processes of the industrial control system based on the model, generating the virtual deception network. This network then controls multiple virtual deception nodes (VDNs) to simulate the industrial processes described by the process model in real time and collaboratively, responding to dynamic interventions from external attackers.

[0031] Specifically, such as Figure 2 As shown, the DecepTwin framework adopts a modular architecture, which includes four core components: the associated node state evolution process modeling engine, the simulation runtime engine, the protocol emulation engine, and the deception logic adapter, which acts as the glue between the three.

[0032] The modeling engine for the state evolution of associated nodes is responsible for executing the modeling process, which includes two steps: causal discovery and multi-condition dynamic identification. The input data for this process is historical data from real industrial control systems and domain prior knowledge. The output data is a standardized process model file that describes the complete industrial process of the real industrial control system. All calculations in this component are completed offline before the virtual deception node is deployed.

[0033] The simulation runtime engine is a lightweight, high-performance online execution engine that can load a specified process model file at startup, then build a data structure corresponding to the process model file in memory, and continuously iterate and update the shared state of each virtual deception node according to the defined process model file at fixed time steps, thereby driving the evolution of the virtual deception network.

[0034] The protocol simulation engine is responsible for simulating the communication protocols used by one or more industrial control network nodes on the virtual spoofing network, such as Modbus protocol, TCP protocol (Transmission Control Protocol), etc., and listening to and parsing network requests from abnormal clients of attackers.

[0035] The deception logic adapter is responsible for converting the operation instructions in the network request parsed by the protocol emulation engine (such as "write the value 1 to address 40001") into standardized API (Application Programming Interface) calls to the emulation runtime engine, and vice versa.

[0036] Network requests from external attackers are first received by the protocol simulation engine. The protocol simulation engine interacts with the simulation runtime engine through the deception logic adapter: when it receives a read request, it queries the running virtual deception network for the latest data; when it receives a write request, it modifies the data and node state of the corresponding virtual deception node in the running virtual deception network, thereby dynamically affecting the subsequent evolution of the industrial process.

[0037] Specifically, such as Figure 1 As shown, the dynamic spoofing method for industrial control network nodes includes steps S110 to S130, and the specific steps are as follows: S110: Based on prior knowledge of the domain and historical data of the industrial control system, model the industrial process of the industrial control system and generate the process model of the industrial control system.

[0038] An industrial control system consists of multiple industrial control network nodes. A process model is a mathematical model used to describe the topological relationships, causal relationships, and dynamic parameter changes among multiple industrial control network nodes in an industrial process.

[0039] In the context of cyber spoofing in industrial control systems, a core challenge lies in accurately simulating the dynamic response of an industrial control system after an attack. Attackers sending network requests via network communication protocols essentially constitute external intervention in the industrial processes of the control system. A high-fidelity virtual spoofing network must be able to accurately reflect the causal chain of this intervention, conforming to physical logic. Traditional industrial control honeypots, lacking modeling of the inherent interrelationships within industrial processes, often exhibit static or isolated responses, making them easily detectable.

[0040] Based on this, this embodiment proposes an innovative modeling method for the state evolution process of associated nodes. The core of this modeling method is to combine data-driven causal discovery with system identification of multi-condition dynamic processes, aiming to construct a mathematical model that can accurately capture and simulate the state evolution law of multiple associated industrial control network nodes in an industrial control system under external intervention.

[0041] Specifically, in the offline phase, the modeling engine for the state evolution of associated nodes can model the industrial process of the industrial control system based on prior domain knowledge and historical data of the industrial control system, generating a process model of the industrial control system. The modeling process consists of two steps: First, through a causal discovery algorithm that integrates prior domain knowledge, the causal relationships between all industrial control network nodes are inferred from the historical data of the industrial control system, forming a causal structure graph as the "transmission skeleton" of state evolution; then, based on the generated causal structure graph, a multi-condition dynamic process collaborative identification algorithm is used to establish a switching affine model for each causal relationship in the causal structure graph, which can describe its dynamic behavior under different conditions. These switching affine models together constitute the process model of the industrial control system.

[0042] Among them, the switching affine model is a mathematical model that can be represented by mathematical formulas. Therefore, the process model is essentially a high-fidelity mathematical model used to describe the topological relationships, causal relationships and dynamic parameter changes between multiple industrial control network nodes in an industrial process.

[0043] S120: Based on the process model, simulate the industrial process of the industrial control system and generate a virtual deception network.

[0044] A virtual deception network consists of multiple virtual deception nodes. Each virtual deception node represents an industrial control network node, and the node state of each virtual deception node evolves over time.

[0045] Specifically, the process model generated in the offline stage does not have the ability to deceive. In order to transform the process model into a dynamic virtual deception network that can interact with attackers in real time, this embodiment uses a simulation runtime engine to simulate the industrial process of the industrial control system based on the process model, and generates a dynamic virtual deception network that can evolve over time.

[0046] S130: Based on a virtual deception network, it interacts with abnormal clients.

[0047] The dynamic deception method for industrial control network nodes provided in this embodiment overcomes the limitation of existing technologies that ignore the physical logic of real industrial processes. First, based on prior domain knowledge and historical data of the industrial control system, it models the real industrial process of the industrial control system, generating a process model to describe the topological relationships, physical causal relationships, and dynamic parameter changes among multiple industrial control network nodes in the real industrial process. Then, based on the process model, it simulates the industrial process of the industrial control system, generating a virtual deception network. The virtual deception network includes multiple virtual deception nodes, each representing an industrial control network node. The node state of each virtual deception node can evolve over time, thereby simulating the phenomenon of node states and data changes of different industrial control network nodes over time in the real industrial process. These time-evolving virtual deception nodes can collaboratively simulate the complete business process of the industrial control system in the real industrial process, achieving effective modeling of the real industrial process of the industrial control system, optimizing the modeling effect of the virtual deception network, and giving the virtual deception network high fidelity. Finally, the virtual deception network is used to interact with the attacker's abnormal client, thus providing effective defense for the industrial control system.

[0048] In some embodiments, based on domain prior knowledge and historical data of the industrial control system, the industrial process of the industrial control system is modeled to generate a process model of the industrial control system, including: modeling the industrial control system based on domain prior knowledge and historical data to generate a causal structure graph of the industrial control system; the causal structure graph includes multiple nodes and multiple directed edges, a node represents a variable, a variable is used to represent the state of an industrial control network node, and a directed edge is used to represent the causal relationship between two nodes; the dynamic relationship of each directed edge is modeled to generate a switching affine model corresponding to each directed edge; the switching affine model is a mathematical model used to describe the dynamic parameter changes of the directed edge under different operating conditions; wherein, the process model includes all switching affine models.

[0049] Before modeling an unknown industrial process, the primary task is to understand the interdependencies among the variables involved (such as sensors and actuators). Compared to existing modeling methods that rely solely on prior domain knowledge, this embodiment chooses to mine the relationships between variables from historical data, which can more objectively reflect the actual operating mode of the industrial control system. This embodiment proposes a causal discovery algorithm based on physical constraints. Its core lies in automatically constructing a causal structure graph that conforms to physical reality from historical data (the historical data of an industrial control system is essentially a multivariate time series data) based on causal inference theory.

[0050] Specifically, based on prior knowledge of the domain, the physical constraints of the industrial control system in the real industrial process are first determined to form a prior knowledge constraint set. Then, through a causal discovery algorithm, the industrial control system is modeled by combining the prior knowledge constraint set and historical data to generate a causal structure diagram of the industrial control system.

[0051] The causal structure graph is a directed acyclic graph (DAG) consisting of multiple nodes and multiple directed edges. Each node represents a variable, which represents the state of an industrial control network (ICN) node. A directed edge represents a causal relationship between two nodes (i.e., a causal relationship between two variables representing the state of an ICN node). The causal structure graph can be denoted as... , For a set of nodes, It is a directed edge set.

[0052] In this context, the two nodes connected by a directed edge are the cause node and the result node, respectively. If there is a causal relationship between the two nodes, the directed edge points from the cause node to the result node (i.e., the cause node is the parent node and the result node is the child node), indicating that the cause node is the reason for the change in the result node.

[0053] To facilitate understanding of cause-and-effect diagrams, a concrete example is given below: Assume an industrial control system includes a controller and actuators. The controller can be considered as node 1 of the industrial control network, and the actuator as node 2. Different output data from the controller can serve as different control commands to drive the actuator to perform different tasks. In this industrial control system, the controller's output data can be used to represent the working state of node 1 (different specific values ​​of the controller's output data indicate different operating conditions of node 1). In this case, the controller's output data can be considered as a variable representing the state of node 1, denoted as variable 1. Similarly, the controller's output data is actually the actuator's... The input data is different, and the output data of the actuator (which can be used as an execution instruction) is also different. The output data of the actuator can be used to represent the working state of industrial control network node 2 (different specific values ​​of the actuator output data indicate that industrial control network node 2 is currently in different working conditions). At this time, the output data of the actuator can be regarded as a variable representing the state of industrial control network node 2, denoted as variable 2. Since the change of variable 1 is the cause of the change of variable 2, there is a causal relationship between variable 1 and variable 2. Assuming that variable 1 is represented by node 1 and variable 2 is represented by node 2, then in the causal structure graph, there exists a directed edge from node 1 to node 2, denoted as "". ".

[0054] Furthermore, after generating the causal structure graph of the industrial control system, for each directed edge (i.e. each causal relationship) in the causal structure graph, the dynamic relationship of the directed edge is modeled to generate the switching affine model corresponding to each directed edge.

[0055] Among them, the switching affine model is a mathematical model used to describe the dynamic parameter changes of a directed edge under different working conditions. The switching affine models corresponding to all directed edges can be used together to form the process model.

[0056] In some embodiments, modeling an industrial control system based on domain prior knowledge and historical data to generate a causal structure graph of the industrial control system includes: determining a set of random variables describing the industrial control system based on historical data, and constructing an initial undirected graph based on the set of random variables; the set of random variables includes multiple variables, and the initial undirected graph includes multiple nodes and multiple undirected edges, with one undirected edge representing the connection relationship between two nodes; determining a set of prior knowledge constraints based on domain prior knowledge; performing conditional independence checks on all nodes in the initial undirected graph to generate a separation set; the separation set includes at least two nodes that are independent under specific conditions, and there is no causal relationship between the independent nodes; removing undirected edges between independent nodes in the initial undirected graph based on the separation set to generate a target undirected graph; and orienting the target undirected graph based on the set of prior knowledge constraints to determine the direction of each undirected edge in the target undirected graph, thereby generating a causal structure graph; wherein the causal structure graph satisfies the constraints in the set of prior knowledge constraints.

[0057] First, based on historical data, a set of random variables describing the industrial control system is determined, and an initial undirected graph is constructed based on this set of random variables.

[0058] Specifically, for an industrial control system, the state of each industrial control network node can be represented by a variable. Therefore, a set of random variables can be used to represent the state of all industrial control network nodes. These random variables together form the set of random variables describing the industrial control system, denoted as […]. , Indicates the first The nth variable is used to represent the nth... The state of an industrial control network node, a set of random variables It is actually the set of nodes in a causal structure graph; for a set of random variables. For each variable in the dataset, the historical data of the industrial control system contains historical observations of that variable at T discrete time points (i.e., historical variable data). All historical observations of all variables can collectively constitute a multivariate time series dataset. ,in Representing variables At any moment Historical observations; based on the set of random variables and multivariate time series datasets By performing preliminary modeling of industrial processes in an industrial control system, an initial undirected graph of the industrial control system can be generated.

[0059] The initial undirected graph consists of multiple nodes and multiple undirected edges, with one undirected edge representing the connection between two nodes.

[0060] It's important to note that in the initial undirected graph, the undirected edges between nodes can be determined based on the topological relationships between nodes in the industrial control network. Therefore, the initial undirected graph only reflects the topological structure of the industrial control system. However, undirected edges cannot represent the causal relationships between different nodes (i.e., variables). Therefore, the goal of subsequent modeling is to orient the edges and generate a directed acyclic graph that can describe the causal relationships between these variables. .

[0061] Furthermore, based on domain prior knowledge, a set of prior knowledge constraints is determined.

[0062] Specifically, the prior knowledge of the domain is formally transformed to generate a set of prior knowledge constraints. Prior knowledge constraint set Including timing constraints Physical constraints and control constraints , recorded as These three types of constraints will be applied at different stages of the subsequent causal discovery algorithm.

[0063] Among them, timing constraints Used to characterize the temporal irreversibility of a causal relationship between two nodes.

[0064] For example, if the change of variable u consistently leads that of variable v in time, then the final causal structure graph should not contain directed edges. "This is because the change in variable u is not caused by variable v."

[0065] physical constraints Physical laws used to characterize industrial control systems.

[0066] For example, fluid mechanics determines that the opening of an upstream valve necessarily affects the downstream flow rate. Therefore, the variable representing the opening of the upstream valve must be the cause of the change in the downstream flow rate. This type of relationship must be forcibly defined as a directed edge.

[0067] Control constraints Used to characterize the control loop logic of industrial control systems.

[0068] For example, the controller's output data This variable must be the state data of the actuator. The reason for this change in variable is that the final causal structure graph must contain directed edges. ".

[0069] The final generated causal structure graph must satisfy the prior knowledge constraint set. .

[0070] Furthermore, execution is based on a set of prior knowledge constraints. The causal discovery algorithm consists of two steps: skeleton discovery and edge orientation.

[0071] During the skeleton discovery phase, the causal discovery algorithm performs conditional independence checks on all nodes in the initial undirected graph, generating a separation set. The separation set includes at least two nodes that are independent of each other under specific conditions, and there is no causal relationship between the independent nodes. Since nodes without causal relationships do not affect each other, there is no need for directed edges. Therefore, the undirected edges between independent nodes in the initial undirected graph can be removed based on the separation set to generate the target undirected graph (i.e., the undirected graph skeleton).

[0072] Specifically, the goal of skeleton discovery is to find the undirected connections between variables in the initial undirected graph, that is, to determine which variables should have edges (regardless of direction). The core of this stage is the conditional independence test.

[0073] For any two discrete variables in the initial undirected graph , Given the condition S, if the variable and variables They are independent under given condition S, denoted as... Then the variable is considered to be and variables There are no direct causal edges (i.e., directed edges) between them. The skeleton discovery process involves identifying each variable pair in the initial undirected graph. , Iteratively test their conditional independence under different given conditions, and if a given condition S is found that makes the variables... and variables Given conditions S, if the edges are independent, then remove undirected edges from the initial undirected graph. During this process, variables and variables Record in the split set In, the separation set The variables (i.e. nodes) in the equation are independent of each other under given condition S, and there is no causal relationship between them.

[0074] For any two continuous variables in the initial undirected graph , Given condition S, under the assumption that the variables follow a multivariate Gaussian distribution, conditional independence is equivalent to the partial correlation coefficient between two variables being zero, while the variables... and variables Partial correlation coefficient under given condition S It can be defined by the residuals of linear regression.

[0075] First, define continuous variables. The residuals of linear regression under given conditions S The residuals of linear regression The expression is as follows: ; in, It is the regression coefficient vector obtained by the least squares method; Representing continuous variables At any moment Historical observation values; Indicates at time Given the condition S.

[0076] Similarly, define continuous variables The residuals of linear regression under given conditions S .

[0077] Then, define variables. and variables Partial correlation coefficient under given condition S Partial correlation coefficient The expression is as follows: ; in, Represents covariance operation; This indicates variance calculation.

[0078] Statistical tests require a null hypothesis. Variables in real historical data and variables Using historical observations as a sample, and substituting them into the formula defined above for calculation, we can obtain the variable. and variables Sample partial correlation coefficient under given condition S The partial correlation coefficient of the sample Performing Fisher's z-transformation, we have: ; Under the original hypothesis Under the condition that it holds true, the statistic It approximately follows a mean of 0 and a standard deviation of . The normal distribution, where This represents the sample size.

[0079] Then based on the statistics Calculate the p-value. If the p-value is greater than the preset significance level... If the null hypothesis is true, then the variable can be considered as... and variables Given conditions S, the edges are independent and there is no causal relationship between them. Therefore, undirected edges can be removed from the initial undirected graph. ".

[0080] As described above, the main task of the skeleton discovery stage is to remove some invalid edges from the initial undirected graph, thus obtaining a simplified target undirected graph. The two vectors connected by the remaining undirected edges in the target undirected graph are not independent, therefore a causal relationship must exist. At this point, the causal discovery algorithm will enter the edge orientation step, based on the prior knowledge constraint set. Perform edge orientation on all remaining undirected edges in the target undirected graph to determine the direction of each undirected edge in the target undirected graph, and generate a causal structure graph.

[0081] The goal of edge orientation is to transform the undirected target graph obtained in the skeleton discovery phase into a directed acyclic graph that is as accurate as possible in terms of causal relationships. This process must first satisfy the set of prior knowledge constraints. All directional requirements.

[0082] In mathematics, D-separation is the bridge connecting graph structure and probabilistic independence: in a causal graph, if a set of variables (let's say variable Z) D-separates variables X and Y, then probabilistically, This must be true.

[0083] The process of edge orientation is essentially a reverse application of the aforementioned D-separation principle: during the skeleton discovery phase, a series of conditional independence relations (separation sets) have already been identified. Nodes in and nodes Under certain conditions, they are independent of each other. The process of edge orientation is to find a unique combination of arrow directions so that the D separation relationship contained in the final causal structure diagram completely matches a series of conditional independence relationships learned from the data in the skeleton discovery stage.

[0084] Specifically, the edge orientation process includes the following three steps: (1) V-structure identification: Suppose that there exists an unmasked triple in the target undirected graph, i.e., three nodes. w, v, nodes The relationship between , w, and v is " ", and nodes and nodes There are no direct undirected edges between them. During the skeleton discovery phase, nodes... and nodes There are no direct undirected edges between them, which means that the causal discovery algorithm must have found a separating set. , making " "Established."

[0085] So, regarding the above relationship " There are three possible causal relationships: chain structure, branching structure, and collision structure. The collision structure is also known as the V-structure.

[0086] Chain structure refers to nodes The causal relationship between , w, and v is " In a chain structure, nodes and nodes It is connected by D; however, when the intermediate node w is controlled, the node... and nodes The path between them is blocked, at which point the node and nodes It is separated by D, therefore, probabilistically, "Established, which means the separation set" It must contain node w.

[0087] A bifurcation structure refers to nodes The causal relationship between , w, and v is " In a bifurcated structure, nodes and nodes All are result nodes of the common cause node w, nodes and nodes It is connected by D; however, when the common cause node w is controlled, the node... and nodes The path between them is blocked, at which point the node and nodes It is separated by D, therefore, probabilistically, "Established, which means the separation set" It must also contain node w.

[0088] Collision structures refer to nodes The causal relationship between , w, and v is " In a collision structure, nodes and nodes These are two independent cause nodes of node w, node and nodes There is no D-connection path between them, therefore the node and nodes It is unconditionally independent, that is, it satisfies " However, if the colliding node w (or any of its descendants) is controlled, a new dependency path is opened, and the node... and nodes It becomes conditionally dependent, therefore, probabilistically, "Established, which means the separation set" It must not contain node w.

[0089] For unmasked triples (nodes) Regarding (w, v), if the separation set found during the skeleton discovery phase... If node w is not included, then the node The causal relationship between , w, and v can only be a collision structure, i.e., nodes. The causal relationship between , w, and v can only be " ".

[0090] Based on the above principles, the causal discovery algorithm can use the separation set obtained in the skeleton discovery phase. For unmasked triples in the target undirected graph, perform edge orientation to determine the direction of the undirected edges in the unmasked triples.

[0091] (2) Applying Meek rules for directional propagation: By identifying the V structure, some directed edges can be generated in the target undirected graph. However, many edges in the target undirected graph are still undirected. At this point, the Meek rule can be used to continue directional propagation based on the already generated directed edges to generate more directed edges.

[0092] Meek rules are a set of logical axioms that can infer the direction of more undirected edges using the existing arrow directions. The core of Meek rules is to avoid generating new V-structures (because all V-structures have been found in the first step) and to avoid generating directed cycles.

[0093] The Meek rules consist of four sub-rules, denoted as Sub-rule 1, Sub-rule 2, Sub-rule 3, and Sub-rule 4.

[0094] Sub-rule 1 is "avoid generating new V-structures": It is assumed that after the V-structure identification step, the target undirected graph contains nodes. w, v, nodes The known relationship between , w, and v is " ", and nodes and nodes Not adjacent; in this case, if " "Directed to" "Then a causal relationship will be formed." This creates a new V-structure, which, according to the principles of V-structures, requires that node w is not in the separating set. In the middle; however, during the skeleton discovery phase, nodes and nodes The node was not directly deleted, but rather because of the existence of node w (as a node). The neighboring data (and thus the data) might be separated, meaning this situation does not satisfy the conditions for a new V-structure. Therefore, to avoid creating a new V-structure that the data does not support, the causal discovery algorithm can only include "neighboring data" in the V-structure. "Directed to" This enables propagation along the edge direction.

[0095] Sub-rule 2 is "avoid generating directed cycles": It is assumed that after the V-structure identification step, the target undirected graph contains nodes. w, v, nodes The known relationship between , w, and v is " "and there is an undirected edge in the target undirected graph " ”; if “ "Directed to" This will form a directed cycle. This violates the fundamental assumption of constructing a causal structure graph (a directed acyclic graph). Therefore, causal discovery algorithms can only find... "Directed to" ".

[0096] Sub-rule 3: Assume that after the V-structure identification step, there are nodes in the target undirected graph. w, v, z, nodes The known relationship between , w, and v is " ",node The known relationship between z and v is " ", and node w and node There exists an undirected edge " ",node and nodes Not adjacent; if " "Directed to" "So, for the existing " "and" , combined with " This might force the formation of loops or unsupported new V-structures when applying other sub-rules subsequently. Therefore, according to standard Meek rules, the causal discovery algorithm can only include " "Directed to" ".

[0097] Sub-rule 4: Assume that after the V-structure identification step, there are nodes in the target undirected graph. w, z, nodes The known relationship between , w, and z is " "and there is an undirected edge in the target undirected graph " ”; if “ "Directed to" This will form a directed cycle. This violates the fundamental assumption of constructing a causal structure graph (a directed acyclic graph). Therefore, causal discovery algorithms can only find... "Directed to" ".

[0098] (3) Applying prior knowledge constraint sets Conduct final orientation: After applying the Meek rule for directional propagation, the target undirected graph may still contain some undirected edges. This typically occurs when causal relationships cannot be uniquely determined by conditional independence (i.e., a Markov equivalence class problem exists). In this case, the causal discovery algorithm will utilize a set of prior knowledge constraints beyond the data. Let's orient the remaining undirected edges.

[0099] Prior knowledge constraint set Including timing constraints Physical constraints and control constraints .

[0100] Timing constraints The principle is that the cause must precede the effect. Mathematically, for any undirected edge in an undirected graph, " "It can be based on the variables corresponding to both in historical data." and Cross-correlation function between Perform edge orientation.

[0101] Among them, variables and Cross-correlation function between The expression is as follows: ; in, Expressing expectations; Representing variables The average value; variable Representing variables At any moment Historical observation values; Representing variables At any moment Historical observation values; Representing variables The average value; Indicates time delay.

[0102] Based on the above formula, we need to find the cross-correlation function. Delay to reach the maximum value ,Right now ;like A value greater than zero indicates The changes significantly lead the way At this point, the causal discovery algorithm will " "Directed to" ";like Less than zero indicates The changes significantly lead the way At this point, the causal discovery algorithm will " "Directed to" ".

[0103] physical constraints and control constraints The principle is: if, after all data-driven inferences, the undirected edge " The direction remains uncertain, but prior knowledge of the domain has clearly indicated it. yes The reason for this is that prior knowledge in the domain is adopted.

[0104] In summary, the core process of the causal discovery algorithm follows a causal discovery paradigm based on physical constraints, which consists of two main stages: skeleton discovery and edge orientation. In the skeleton discovery stage, the algorithm starts from a fully connected initial undirected graph and systematically removes undirected edges that do not have a direct causal relationship by iteratively performing conditional independence checks. The key innovation of this process is that before performing the edge removal operation, it first checks against the prior knowledge constraint set. Upon verification, any causal path defined as "necessary to exist" by physical laws or control logic will have its corresponding edges protected from erroneous deletion, based on the set of prior knowledge constraints. The introduction of this approach significantly improves the robustness and accuracy of skeleton discovery in high-noise, highly correlated industrial data environments. In the edge orientation stage, the algorithm aims to assign causal logical directions to the remaining undirected edges in the target undirected graph. This stage follows a hybrid logic from data-driven to knowledge-driven: First, by identifying the V-structure, the most reliable causal direction is found from the data. Second, the Meek rule is applied iteratively, and the logical propagation of causal directions is performed under the premise of satisfying the two axioms of "avoiding new V-structures" and "avoiding directed cycles". Finally, using prior knowledge constraints, the remaining undirected edges that cannot be uniquely determined by data alone are finally oriented, generating the final causal structure graph.

[0105] In some embodiments, the prior knowledge constraint set includes temporal constraints, physical constraints, and control constraints; wherein, temporal constraints are used to characterize the temporal irreversibility of the causal relationship between two nodes, physical constraints are used to characterize the physical laws used by the industrial control system, and control constraints are used to characterize the control loop logic of the industrial control system.

[0106] In some embodiments, the switching affine model is an ARX model, which is determined based on a target switching variable, a target partitioning variable, and a target model parameter vector. The target switching variable characterizes the switching of different operating conditions of the industrial control system, the target partitioning variable characterizes different operating condition regions of the industrial control system, and the target model parameter vector is the optimal set of model parameters for the ARX model. The switching affine model corresponding to any directed edge is constructed based on the following steps: extracting historical variable data of the two variables corresponding to the directed edge from historical data; iteratively optimizing the partitioning variable and the model parameter set of the ARX model based on the historical variable data to determine the target partitioning variable and the target model parameter vector; and iteratively optimizing the switching variable to determine the target switching variable, given the determined target partitioning variable and the target model parameter vector. The target switching variable, target partitioning variable, and target model parameter vector are the parameters that minimize the global prediction error of the ARX model.

[0107] After obtaining the causal structure graph, for each directed edge (i.e. each causal relationship) in the causal structure graph, the multi-condition dynamic process collaborative identification algorithm is used to model the dynamic relationship of the directed edge and generate the switching affine model corresponding to the directed edge.

[0108] Specifically, causal structure diagrams can only solve the "who affects whom" problem in industrial control systems, but they do not reveal the dynamic characteristics of this influence, nor do they consider the multi-condition characteristics that are common in real industrial processes. In actual industrial control scenarios, the dynamic response (e.g., response speed, gain) of the same industrial process will change significantly at different operating stages (e.g., "start-up," "stable operation," "shutdown," etc.), under different production formulas, or under different environmental conditions. A high-fidelity virtual deception network must be able to accurately capture and reproduce this "switching of dynamic behavior," otherwise its response will deviate greatly from the real industrial control system under specific operating conditions, making it easily detectable by attackers.

[0109] Based on this, this embodiment proposes a multi-condition dynamic process collaborative identification algorithm, which establishes a mathematical model that can describe the dynamic behavior of each causal relationship in the causal structure graph.

[0110] For a directed edge in a causal structure graph, " The most direct modeling approach is to assume that the dynamic relationship is constant and use a single linear time-invariant (LTI) model, such as the ARX model, to describe the average behavior of the causal relationship on the dataset. ; The core assumption of this method is the parameter vector. At all points in time The above is constant.

[0111] However, this modeling method has shortcomings in multi-condition industrial control systems: chemical reactors are typical multi-condition industrial control systems. Taking a chemical reactor as an example, during the heating and temperature rise stage, the steam valve opening (assuming this variable is denoted as...) The temperature inside the vessel (assuming this variable is denoted as) The effect of the initial steam valve opening change is manifested as a large gain and a small time constant; however, after entering the "heat preservation reaction" stage, due to the exothermic reaction itself, the effect of the same change in steam valve opening on the reactor temperature is significantly weakened, exhibiting a smaller gain and different dynamic characteristics. If a single linear time-invariant model is used to fit all the data containing these two stages (i.e., two operating conditions), the resulting parameter vector... It is necessarily an average of two real dynamic working conditions. This model may be too slow to respond during the heating stage and too sensitive during the heat preservation stage. It cannot meet the high-fidelity requirements under any specific working condition.

[0112] Based on this, in order to accurately simulate the state evolution of real industrial processes in multi-condition industrial control systems, this embodiment abandons the assumption of a single model and instead models the multi-condition industrial control system as a switched linear system. The core idea of ​​this method is that the multi-condition industrial control system is nonlinear and time-varying on a macroscopic level, but on a microscopic level, it is composed of a finite number of linear models and a switching rule. This is highly consistent with the physical reality of multi-condition industrial control systems in real industrial processes, which consist of a finite number of definite operating conditions.

[0113] In this embodiment, for a directed edge " " in the causal structure graph The dynamic relationship can be modeled as a switching affine model, which is an improved ARX model, consisting of triples. Determine (in this triple, (i represents the time domain), aiming to minimize the global prediction error.

[0114] Among them, in the triplet middle, The variable is a switching variable, and its numerical change represents the switching of different operating conditions in the industrial control system; To divide variables, its essence is... The spatial division formed by the value range represents different operating condition regions of the industrial control system; This is the model parameter vector, which is the set of model parameters for the ARX model.

[0115] One of the model parameter vectors A corresponding improved ARX model is expressed as follows: ; in, This represents the unexplained portion of the model's output, such as noise and error, whose effects are not interpretably reflected in other model parameters. These can be uniformly represented by parameters. measure.

[0116] The expression for the improved ARX model described above can be further written in the following form: ; Among them, the regression vector and model parameter vector They are defined as follows: ; .

[0117] The collaborative identification task is to solve a joint optimization problem, where directed edges are defined as follows: "Find the optimal target triplet, in which the target switching variable, target splitting variable, and target model parameter vector minimize the global mean squared prediction error of the ARX model." : ; in, It is a point in time. The operating condition assignment function is determined by the switching variable. and partitioning variables A joint decision.

[0118] The aforementioned collaborative identification task is essentially a complex non-convex mixed-integer programming problem, because the job assignment function... It is discrete and depends on unknown switching variables. and partitioning variables Therefore, it is very difficult to solve directly.

[0119] Based on this, this embodiment designs a clustering-regression iterative heuristic algorithm (i.e., a multi-condition dynamic process collaborative identification algorithm) to decouple this joint optimization problem into three easier-to-handle sub-problems, and solves them iteratively in a collaborative manner. The three sub-problems are as follows: (1) Switching logic identification: Assuming the model parameter vector is fixed, how to find the optimal switching variable? .

[0120] (2) Working condition division: Assume that the switching variable has been selected. How to cluster the data for each time point? Assign an optimal working condition assignment function. .

[0121] (3) Model parameter identification: Assuming that the working conditions have been divided, how to estimate the optimal model parameter vector for each working condition? .

[0122] The multi-condition dynamic process collaborative identification algorithm in this embodiment approximates the global optimal solution by iteratively solving these three sub-problems.

[0123] For a fixed working condition division (i.e., a subset of historical data) Subproblem (3) can be solved exactly, and at this point, the model parameter vector... Solving this problem is a classic linear least squares problem, the objective of which is to minimize the sum of squared residuals under this operating condition. : ; By solving the normal equation , can be obtained The unique least squares solution : .

[0124] After successfully solving subproblem (3), iteratively solving the other two subproblems will yield the global optimal solution, thereby determining the optimal target triplet.

[0125] Based on the above principles, the overall framework of the multi-condition dynamic process collaborative identification algorithm in this embodiment adopts a double-loop structure.

[0126] The outer loop is responsible for optimal variable switching. The search considers only directed edges " "Middle node" Using the parent node as a candidate switching variable might overlook environmental variables, external states, and other variables affecting the switching process. Therefore, the algorithm can set the search scope of candidate switching variables to the parent node, grandparent node, and even external variables of the cause node, exhaustively traversing all possibilities. For each candidate switching variable, the algorithm performs a complete inner-level iterative optimization and finally evaluates the merits of the candidate switching variable as a switching driver based on the Bayesian Information Criterion (BIC). The Bayesian Information Criterion penalizes model complexity while evaluating model fit, ensuring that the selected optimal switching variable is chosen. It is not only highly explanatory, but also has a concise model.

[0127] The inner loop implements an iterative optimization process based on the expectation maximization (EM) principle, used to collaboratively identify the working condition partition and dynamic model parameter vector. This process consists of the following two steps: (1) M-Step: "Soft" assignment given the current working condition (by probability matrix) In this step, a weighted least squares problem is solved for each load case to find the model parameter vector of the ARX model that maximizes the likelihood of the data for that load case. .

[0128] (2) E-Step: Fixed model parameter vectors for all working conditions This step recalculates each time point. Posterior probabilities generated for each working condition i The calculation of this probability combines the clustering degree of the data points in z-space (provided by GMM) and the model fit in v-space.

[0129] By iterating between the two steps mentioned above until convergence, the algorithm can find a local optimum, which is a set of switching affine models that best interprets multi-condition data.

[0130] Specifically, for a directed edge in a causal structure graph, " The multi-condition dynamic process collaborative identification algorithm in this embodiment can first extract the historical variable data of the two variables corresponding to the directed edge from the historical data (i.e., the historical observation values ​​of these two variables at multiple times). Then, the inner loop will iteratively optimize the partitioning variable and the model parameter set of the ARX model based on the historical variable data of these two variables to determine the optimal target partitioning variable and the optimal target model parameter vector. After determining the target partitioning variable and the target model parameter vector, the outer loop will iteratively optimize the switching variable to determine the optimal target switching variable. Then, based on the target switching variable, the target partitioning variable and the target model parameter vector, the optimal switching affine model corresponding to the directed edge is constructed. This switching affine model is a high-fidelity mathematical model that can describe the state evolution process of the associated nodes.

[0131] In some embodiments, interacting with an abnormal client based on a virtual deception network includes: receiving a network request from the abnormal client; parsing the network request for business logic and extracting operation instructions from the network request; operating on a target virtual deception node in the virtual deception network based on the operation instructions to obtain response data from the virtual deception network; and sending the response data to the abnormal client.

[0132] Each directed edge in the causal structure graph has a corresponding switching affine model. These switching affine models together constitute the process model. However, the process model generated in the offline stage does not have the ability to deceive. In order to transform the process model into a dynamic virtual deception network that can interact with the attacker in real time, this embodiment uses a simulation runtime engine to simulate the industrial process of the industrial control system according to the process model, and generates a dynamic virtual deception network that can evolve over time.

[0133] Specifically, during initialization, the simulation runtime engine loads and parses the process model, instantiates all the switching affine models and variables defined within it into memory, and generates a virtual deception network. Its core data structure includes a globally shared state vector. A list of model instances, with a globally shared state vector. Used to store the current values ​​of n (n is a positive integer) system variables (i.e., virtual deception nodes), the model instance list contains all loaded dynamic models that have been converted to state space form.

[0134] After the simulation runtime engine initializes, it enters its core discrete-time simulation loop phase. This loop iterates continuously with a fixed, configurable time step dt. Specifically, the simulation runtime engine continuously calculates and updates the node state and data of each virtual deception node in the virtual deception network according to the time step dt. At the beginning of each loop, the simulation runtime engine first performs a topological sort based on the causal structure graph to obtain a computational order of virtual deception nodes that conforms to causal constraints. This step ensures that the computation of the node state and data of any virtual deception node occurs after the computation of all its causal nodes (i.e., parent nodes) is completed. Subsequently, the simulation runtime engine traverses each virtual deception node in the topological sort list. For each virtual deception node, the simulation runtime engine reads the current values ​​of all its parent nodes from the globally shared state vector, using these as inputs to its corresponding dynamic model. Then, the simulation runtime engine judges the operating mode of the industrial control system based on the current switching variables of the virtual deception node. The value is used to select the active state space matrix under the current operating condition from the corresponding switching affine model. The state space equation is then calculated based on the state space matrix to determine the current output value of the virtual deception node. On the other hand, it updates its internal state vector. This prepares for the next iteration; after traversing all virtual deception nodes, all newly calculated output values ​​will be atomically updated back to the globally shared state vector. This completes a full state evolution of the virtual deception network. This cycle repeats continuously, driving the entire virtual physical world to evolve precisely and logically in the time dimension.

[0135] Optionally, to enable interaction with other core components in the DecepTwin framework, the simulation runtime engine provides two standardized API interfaces: the get_state(variable_name) interface is used to query the globally shared state vector. The `set_state(variable_name, value)` interface is used to receive external intervention to modify the globally shared state vector. The latter is key to simulating attack behavior.

[0136] Furthermore, after the engine generates a dynamic virtual spoofing network during the simulation runtime, the protocol simulation engine and the spoofing logic adapter are responsible for enabling real-time interaction with the attacker.

[0137] The protocol simulation engine serves as the interface between the DecepTwin framework and external networks. Its core task is to accurately and statefully simulate the complete communication process of communication protocol servers (such as Modbus and TCP protocols). To achieve high fidelity, the protocol simulation engine design must not only ensure the absolute correctness of the communication protocol syntax but also handle details such as session management, error responses, and transaction associations.

[0138] like Figure 3 As shown, assuming that the communication protocol used by each industrial control network node is TCP, the protocol simulation engine can act as an asynchronous I / O (input / output) based TCP server, creating an independent session processor for each client connection outside the industrial control system. During the request processing phase, if the protocol simulation engine receives a network request from an external client (using the TCP protocol), it can read the byte stream from the TCP socket of the network request and parse it according to the structure of the TCP Application Data Unit (ADU). Specifically, it separates the first 7 bytes of data from the network request as the MBAP (Modbus Application Protocol) header and extracts information such as the transaction identifier, protocol identifier, length, and unit identifier. The protocol simulation engine strictly verifies whether the protocol identifier is 0 and accurately receives subsequent Protocol Data Units (PDUs) based on the length field. The function code and data fields in the PDU together constitute the business logic of the network request. This business logic information is encapsulated by the protocol simulation engine into a structured internal object and passed to the deception logic adapter for further processing.

[0139] The deception logic adapter is responsible for converting the business logic parsed by the protocol simulation engine into standardized API calls to the simulation runtime engine. Therefore, the deception logic adapter's main role is to manage virtual deception nodes (VDNs) and implement bidirectional address translation. The core data structure of the deception logic adapter is a multi-level mapping table, which is dynamically constructed based on the process model during the initialization of the DecepTwin framework. In the virtual deception network, each virtual deception node represents an independent device (such as a PLC or a sensor) from the attacker's perspective. It encapsulates its network identity (such as IP address, Modbus unit ID, etc.), readable and writable register addresses, and the correspondence between these register addresses and the globally shared state vectors in the simulation runtime engine. The multi-level mapping table is mainly used to map the encapsulated information mentioned above.

[0140] The workflow of the deception logic adapter is bidirectional: When the protocol emulation engine parses a valid read request (a type of network request) for business logic, such as reading register 40001 of the device with IP address 192.168.1.10 and unit ID 1, the protocol emulation engine will pass this structured read request to the deception logic adapter. The deception logic adapter can find the corresponding virtual deception node through its network address routing table, and then query the internal mapping of the virtual deception node to find that register 40001 corresponds to the tank_level variable in the global shared state vector. At this time, the deception logic adapter can call the get_state(variable_name) interface of the emulation runtime engine to obtain the current state of the device. The deception logic adapter retrieves the precise value of the `tank_level` variable after the evolution of the processing. Then, it returns this value to the protocol simulation engine, which performs the final protocol encapsulation, sending the data required for the read request to the external client. When the protocol simulation engine parses a valid write request (a type of network request), the process reverses. The deception logic adapter converts the parsed write value into a call to the simulation runtime engine's `set_state(variable_name, value)` interface through a mapping relationship. This call directly modifies the corresponding virtual deception node and the globally shared state vector, thus acting as external intervention and dynamically influencing the physical evolution of all subsequent simulation steps. Through this mechanism, the deception logic adapter successfully transforms an attacker's isolated network-level operations into effective intervention in a connected, dynamically evolving virtual physical system.

[0141] During the response generation phase, the protocol emulation engine receives a structured response object from the deception logic adapter. This object contains the operation to be performed (e.g., a successful response or an exception return). The engine then constructs a TCP protocol data unit based on this object, followed by a MBAP header (where the transaction identifier and unit identifier must be strictly copied from the original network request to maintain transaction consistency; the length field is recalculated based on the size of the newly generated protocol data unit). Finally, the MBAP header and protocol data unit are concatenated into a complete TCP application data unit, which is then encapsulated in a TCP socket and sent as response data to the attacker's client. Through this precise parsing and reconstruction process, the protocol emulation engine ensures that all network interactions are completely consistent with those of a real device at the protocol syntax level.

[0142] Specifically, when the simulation runtime engine simulates the industrial process of the industrial control system based on the process model and generates a dynamic virtual deception network that evolves over time, the virtual deception network can be used by the DecepTwin framework to interact in real time with the attacker's abnormal client. When the DecepTwin framework's protocol simulation engine receives a network request from the abnormal client (the network request can be a read request or a write request), the protocol simulation engine can perform business logic parsing on the network request according to the communication protocol used by the network request, extract the operation instructions (such as read instructions or write instructions) in the network request, and send the extracted operation instructions to the deception logic adapter. The deception logic adapter can make an interface call to the simulation runtime engine according to the operation instructions, and operate on the target virtual deception node in the virtual deception network according to the operation instructions, thereby obtaining the response data of the virtual deception network. Subsequently, the deception logic adapter can send the response data of the virtual deception network to the protocol simulation engine, which will encapsulate the response data into the format of the corresponding communication protocol and send the encapsulated response data back to the abnormal client to achieve the purpose of deceiving the attacker.

[0143] For ease of understanding, an example is provided here of an attacker interacting with a virtual deception network generated by the DecepTwin framework.

[0144] Specifically, assuming the industrial control system is a storage tank system, it includes three industrial control network nodes: an inlet valve, an outlet pump, and a level sensor. The DecepTwin framework's associated node state evolution modeling engine collects historical data of the storage tank system and, based on domain prior knowledge and this historical data, models the industrial process of the system. This generates a process model describing the topological relationships, causal relationships, and dynamic parameter changes among the multiple industrial control network nodes during the system's industrial process. This process model defines the relationships between the inlet valve, outlet pump, and level sensor. The mathematical relationship is established; then, the simulation runtime engine of the DecepTwin framework can load the process model and simulate the industrial process of the tank system based on the process model, generating a dynamic virtual deception network that can evolve over time and a globally shared state vector. The virtual deception network includes three virtual deception nodes, namely "virtual inlet valve PLC-1" (corresponding to the inlet valve), "virtual outlet pump PLC-2" (corresponding to the outlet pump), and "virtual level sensor-3" (corresponding to the level sensor). The node states of these three virtual deception nodes evolve over time.

[0145] When the three virtual spoofing nodes are created, they encapsulate their network identity in the virtual spoofing network (such as IP address, Modbus unit ID, etc.) and the mapping relationship between them and the globally shared state vector. The protocol simulation engine maintains a routing table from the network identity to the specific virtual spoofing node. For example, the IP address "IP_PLC1" is mapped to "virtual water inlet valve PLC-1", and the IP address "IP_Sensor3" is mapped to "virtual liquid level sensor-3".

[0146] The DecepTwin framework employs a real-time co-simulation workflow mechanism. The simulation runtime engine, as an independent background task, can continuously call the data update method at fixed time steps (e.g., time step dt=100ms) to continuously update the status and data of each virtual deception node within the virtual deception network. This ensures the dynamism of the industrial process; even without external interaction, the virtual deception network itself evolves dynamically over time.

[0147] like Figure 4 As shown, suppose an attacker's aberrant client sends a network request, specifically a write request, that requests a "write register" operation instruction to IP address "IP_PLC1" in an attempt to open the inlet valve. The protocol emulation engine extracts this "write register" operation instruction and sends it to "Virtual Inlet Valve PLC-1" (the target virtual deception node). "Virtual Inlet Valve PLC-1" then maps this instruction to a call to a globally shared state vector through a deception logic adapter, thus completing the operation on "Virtual Inlet Valve PLC-1". A write operation is performed to open the virtual inlet valve. After the write operation is completed, the deception logic adapter sends a response data indicating successful write operation to the "virtual inlet valve PLC-1". The "virtual inlet valve PLC-1" then sends the response data to the attacker's abnormal client through the protocol simulation engine. However, since the virtual inlet valve is already open, in the next simulation step, the internal calculation of the virtual deception network will cause the liquid level increase rate of the "virtual liquid level sensor-3" to change due to the change in the state of the "virtual inlet valve PLC-1" (the virtual inlet valve changes from "closed" to "open").

[0148] Understandably, after completing the write operation, the attacker, in order to verify the success of the write operation, will send another network request after a period of time. This network request is a read request, which requests a "read register" operation instruction to be sent to the IP address "IP_Sensor3" in an attempt to read the change in liquid level detected by the liquid level sensor. After the protocol simulation engine extracts the "read register" operation instruction, it can send the extracted operation instruction to "virtual liquid level sensor-3" (i.e., the target virtual spoofing node). "Virtual liquid level sensor-3" maps the operation instruction to a read of the globally shared state vector through the spoofing logic adapter, thereby obtaining the continuously rising liquid level value due to the opening of "virtual inlet valve PLC-1" as response data. The spoofing logic adapter will send the liquid level value to "virtual liquid level sensor-3", and "virtual liquid level sensor-3" will send the response data to the attacker's abnormal client through the protocol simulation engine. After obtaining the rising liquid level value, the attacker will believe that the change in liquid level value conforms to the real industrial process and physical logic of a normal tank system, and thus believe that the virtual spoofing network is a real tank system.

[0149] Through this real-time collaborative workflow, the DecepTwin framework successfully enables multiple independent virtual deception nodes to work together. From the attacker's perspective, it appears as if they are interacting with a real tank system containing multiple industrial control network nodes, and where the industrial process conforms to the laws of physical causality, thus achieving system-level high fidelity in the virtual deception network. This architectural design is the core difference between the DecepTwin framework and traditional monolithic honeypots.

[0150] The dynamic deception method for industrial control network nodes provided in this embodiment breaks through the limitations of traditional network deception technology, which "emphasizes protocol simulation and neglects physical logic". By combining the causal discovery algorithm with the multi-condition dynamic process collaborative identification algorithm, a mathematical model that can accurately simulate the evolution of industrial process states in industrial control systems is constructed. Through a shared state-driven multi-node collaborative mechanism, high-fidelity deception at the system level is achieved.

[0151] This invention also provides a dynamic deception device for industrial control network nodes. Please refer to [link / reference]. Figure 5 , Figure 5 This is a schematic diagram of the structure of the dynamic deception device for industrial control network nodes provided by the present invention. In this embodiment, the dynamic deception device for industrial control network nodes includes a modeling module 510, a simulation module 520, and an interaction module 530.

[0152] Modeling module 510 is used to model the industrial processes of industrial control systems based on prior knowledge of the domain and historical data of industrial control systems, and generate process models of industrial control systems.

[0153] An industrial control system consists of multiple industrial control network nodes. A process model is a mathematical model used to describe the topological relationships, causal relationships, and dynamic parameter changes among multiple industrial control network nodes in an industrial process.

[0154] Simulation module 520 is used to simulate industrial processes in industrial control systems based on process models, generating virtual deception networks.

[0155] A virtual deception network consists of multiple virtual deception nodes. Each virtual deception node represents an industrial control network node, and the node state of each virtual deception node evolves over time.

[0156] Interaction module 530 is used to interact with abnormal clients based on a virtual deception network.

[0157] In some embodiments, based on domain prior knowledge and historical data of the industrial control system, the industrial process of the industrial control system is modeled to generate a process model of the industrial control system, including: modeling the industrial control system based on domain prior knowledge and historical data to generate a causal structure graph of the industrial control system; the causal structure graph includes multiple nodes and multiple directed edges, a node represents a variable, a variable is used to represent the state of an industrial control network node, and a directed edge is used to represent the causal relationship between two nodes; the dynamic relationship of each directed edge is modeled to generate a switching affine model corresponding to each directed edge; the switching affine model is a mathematical model used to describe the dynamic parameter changes of the directed edge under different operating conditions; wherein, the process model includes all switching affine models.

[0158] In some embodiments, modeling an industrial control system based on domain prior knowledge and historical data to generate a causal structure graph of the industrial control system includes: determining a set of random variables describing the industrial control system based on historical data, and constructing an initial undirected graph based on the set of random variables; the set of random variables includes multiple variables, and the initial undirected graph includes multiple nodes and multiple undirected edges, with one undirected edge representing the connection relationship between two nodes; determining a set of prior knowledge constraints based on domain prior knowledge; performing conditional independence checks on all nodes in the initial undirected graph to generate a separation set; the separation set includes at least two nodes that are independent under specific conditions, and there is no causal relationship between the independent nodes; removing undirected edges between independent nodes in the initial undirected graph based on the separation set to generate a target undirected graph; and orienting the target undirected graph based on the set of prior knowledge constraints to determine the direction of each undirected edge in the target undirected graph, thereby generating a causal structure graph; wherein the causal structure graph satisfies the constraints in the set of prior knowledge constraints.

[0159] In some embodiments, the prior knowledge constraint set includes temporal constraints, physical constraints, and control constraints; wherein, temporal constraints are used to characterize the temporal irreversibility of the causal relationship between two nodes, physical constraints are used to characterize the physical laws used by the industrial control system, and control constraints are used to characterize the control loop logic of the industrial control system.

[0160] In some embodiments, the switching affine model is an ARX model, which is determined based on a target switching variable, a target partitioning variable, and a target model parameter vector. The target switching variable characterizes the switching of different operating conditions of the industrial control system, the target partitioning variable characterizes different operating condition regions of the industrial control system, and the target model parameter vector is the optimal set of model parameters for the ARX model. The switching affine model corresponding to any directed edge is constructed based on the following steps: extracting historical variable data of the two variables corresponding to the directed edge from historical data; iteratively optimizing the partitioning variable and the model parameter set of the ARX model based on the historical variable data to determine the target partitioning variable and the target model parameter vector; and iteratively optimizing the switching variable to determine the target switching variable, given the determined target partitioning variable and the target model parameter vector. The target switching variable, target partitioning variable, and target model parameter vector are the parameters that minimize the global prediction error of the ARX model.

[0161] In some embodiments, interacting with an abnormal client based on a virtual deception network includes: receiving a network request from the abnormal client; parsing the network request for business logic and extracting operation instructions from the network request; operating on a target virtual deception node in the virtual deception network based on the operation instructions to obtain response data from the virtual deception network; and sending the response data to the abnormal client.

[0162] The present invention also provides an electronic device. Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 6 As shown, the electronic device may include a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a dynamic deception method for industrial control network nodes.

[0163] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0164] The present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the dynamic deception method for industrial control network nodes provided by the above methods.

[0165] The present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the dynamic deception method for industrial control network nodes provided by the above methods.

[0166] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0167] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0168] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for dynamically deceiving nodes in an industrial control network, characterized in that, include: Based on prior knowledge of the domain and historical data of the industrial control system, the industrial process of the industrial control system is modeled to generate a process model of the industrial control system. The industrial control system includes multiple industrial control network nodes, and the process model is a mathematical model used to describe the topological relationships, causal relationships, and dynamic parameter changes among the multiple industrial control network nodes in the industrial process. Based on the process model, the industrial process of the industrial control system is simulated to generate a virtual deception network; the virtual deception network includes multiple virtual deception nodes, one virtual deception node represents one industrial control network node, and the node state of each virtual deception node evolves over time. Based on the aforementioned virtual deception network, interaction is conducted with abnormal clients.

2. The method for dynamic deception of industrial control network nodes according to claim 1, characterized in that, The process modeling of the industrial control system, based on domain prior knowledge and historical data of the industrial control system, generates a process model of the industrial control system, including: Based on the prior knowledge of the domain and the historical data, the industrial control system is modeled to generate a causal structure graph of the industrial control system. The causal structure graph includes multiple nodes and multiple directed edges. Each node represents a variable, each variable is used to represent the state of an industrial control network node, and each directed edge is used to represent the causal relationship between two nodes. The dynamic relationship of each directed edge is modeled to generate a switching affine model for each directed edge; the switching affine model is a mathematical model used to describe the dynamic parameter changes of the directed edge under different working conditions. The process model includes all of the switching affine models.

3. The method for dynamic deception of industrial control network nodes according to claim 2, characterized in that, The process of modeling the industrial control system based on prior knowledge of the domain and historical data, and generating a causal structure graph of the industrial control system, includes: Based on the historical data, a set of random variables describing the industrial control system is determined, and an initial undirected graph is constructed based on the set of random variables; the set of random variables includes multiple variables, and the initial undirected graph includes multiple nodes and multiple undirected edges, with one undirected edge representing the connection relationship between two nodes; Based on the prior knowledge of the aforementioned domain, determine the set of prior knowledge constraints; Perform a conditional independence test on all nodes in the initial undirected graph to generate a separation set; the separation set includes at least two nodes that are independent of each other under specific conditions, and there is no causal relationship between the independent nodes; Based on the separation set, the undirected edges between the mutually independent nodes in the initial undirected graph are removed to generate the target undirected graph; Based on the prior knowledge constraint set, the edge orientation of the target undirected graph is performed to determine the direction of each undirected edge in the target undirected graph, and the causal structure graph is generated. The causal structure graph satisfies the constraints in the prior knowledge constraint set.

4. The method for dynamic deception of industrial control network nodes according to claim 3, characterized in that, The prior knowledge constraint set includes temporal constraints, physical constraints, and control constraints; The timing constraints are used to characterize the temporal irreversibility of the causal relationship between the two nodes, the physical constraints are used to characterize the physical laws used by the industrial control system, and the control constraints are used to characterize the control loop logic of the industrial control system.

5. The method for dynamic deception of industrial control network nodes according to claim 2, characterized in that, The switching affine model is an ARX model, which is determined based on the target switching variable, the target partitioning variable, and the target model parameter vector. The target switching variable is used to characterize the switching of different operating conditions of the industrial control system, the target partitioning variable is used to characterize different operating condition regions of the industrial control system, and the target model parameter vector is the optimal model parameter set of the ARX model. The switching affine model corresponding to any of the directed edges is constructed based on the following steps: Extract the historical variable data of the two variables corresponding to the directed edge from the historical data; Based on the historical variable data, the set of partitioning variables and model parameters of the ARX model are iteratively optimized to determine the target partitioning variables and the target model parameter vector; Given the target partitioning variable and the target model parameter vector, the switching variable is iteratively optimized to determine the target switching variable; The target switching variable, the target partitioning variable, and the target model parameter vector are parameters that minimize the global prediction error of the ARX model.

6. The method for dynamic deception of industrial control network nodes according to claim 1, characterized in that, The interaction with the abnormal client based on the virtual deception network includes: Receive network requests from the abnormal client; The network request is parsed using business logic to extract the operation instructions from the network request; Based on the operation instructions, the target virtual deception node in the virtual deception network is operated to obtain the response data of the virtual deception network; The response data is sent to the abnormal client.

7. A dynamic deception device for industrial control network nodes, characterized in that, include: The modeling module is used to model the industrial process of the industrial control system based on prior domain knowledge and historical data of the industrial control system, and generate a process model of the industrial control system. The industrial control system includes multiple industrial control network nodes, and the process model is a mathematical model used to describe the topological relationships, causal relationships and dynamic parameter changes among the multiple industrial control network nodes in the industrial process. The simulation module is used to simulate the industrial process of the industrial control system based on the process model and generate a virtual deception network. The virtual deception network includes multiple virtual deception nodes, each virtual deception node represents an industrial control network node, and the node state of each virtual deception node evolves over time. The interaction module is used to interact with the abnormal client based on the virtual deception network.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the dynamic deception method for industrial control network nodes as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the dynamic deception method for industrial control network nodes as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the dynamic deception method for industrial control network nodes as described in any one of claims 1 to 6.

Images