Network security intrusion prevention control method for industrial internet control system

Abstract

The application provides a network security intrusion prevention control method for an industrial internet control system, relates to the technical field of network security, is executed by a security defense controller in communication with an industrial firewall, a field controller and a security alternative control agent, and comprises the following steps: step one, collecting industrial network messages, controller input and output data, execution mechanism feedback data and process measurement data with the scanning period of the field controller as the alignment boundary, and aligning network requests, control instructions, execution feedback, process responses and communication confirmations belonging to the same control action chain as control transactions, wherein the application jointly restricts the control transactions by the scanning period of the controller and a protocol session, associates network requests, control instructions, execution feedback, process responses and confirmation information in the same action chain, and enables abnormal physical consequences caused by legal format messages to be located to specific nodes and edges.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security intrusion prevention and control method for industrial internet control systems. Background Technology

[0002] Industrial Internet control systems typically consist of field sensors, actuators, PLCs or DCS controllers, industrial switches, industrial firewalls, edge gateways, monitoring servers, and enterprise-level industrial Internet platforms. With the increasing number of remote operations and maintenance, edge-cloud collaboration, and industrial IoT connections, traditionally relatively closed control networks are gradually exposed to cyberattack risks arising from cross-domain access, supply chain components, mobile media, and remote communication. Attackers can not only disrupt communication using abnormal messages, malicious code, or denial-of-service attacks, but may also send syntactically and address-valid control commands with malicious timing or numerical combinations, causing spurious data injection, control command replay, control loop bias, or lateral movement across security zones.

[0003] Existing industrial network intrusion detection solutions mostly rely on traffic statistics, known attack characteristics, logs, or single process variables to build classification models. Detection results are typically converted into alarms, packet loss, rate limiting, connection reset, or device isolation commands. These solutions have shortcomings.

[0004] The lack of deterministic correlation at the scan cycle level between network packets and on-site execution results and physical process responses makes it difficult to identify low-speed attacks formed by combinations of multiple legitimate packets.

[0005] A single detection model is sensitive to changes in operating conditions, equipment aging, communication jitter, and maintenance operations. It is prone to misjudging normal changes in operating conditions as intrusions, or generating contradictory evidence due to attacks simultaneously contaminating multiple data sources.

[0006] The detection system and the process control system are isolated from each other. Directly blocking control messages or isolating control equipment may cause the closed-loop control to be interrupted. For industrial processes with inertia, lag, or interlocking relationships, the defensive action itself may cause liquid level exceeding the limit, pressure change, temperature runaway, material accumulation on the conveyor line, or sudden equipment stoppage.

[0007] Therefore, a defense and control method is needed that uses the industrial control scanning cycle as a common time reference and can integrate intrusion causal evidence, attack paths, network handling, and process security control. Summary of the Invention

[0008] In view of this, the present invention provides a network security intrusion prevention and control method for industrial internet control systems, in order to solve the problem of how to obtain traceable evidence that reflects network behavior and physical consequences when industrial internet control systems are subjected to intrusions that are grammatically legal but malicious in effect, cross-device collaborative intrusions, or data source contamination, and to keep the industrial process state within a security envelope while blocking the attack path, so as to avoid the competitive state between network handling and alternative control.

[0009] The technical solution proposed in this invention is: a network security intrusion prevention and control method for industrial internet control systems, executed by a security defense controller that communicates with industrial firewalls, field controllers, and security alternative control agents, including the following steps: Step 1: Using the scan cycle of the field controller as the alignment boundary, collect industrial network messages, controller input and output data, actuator feedback data, and process measurement data. Align network requests, control commands, execution feedback, process responses, and communication confirmations belonging to the same control action chain into control transactions. Step 2: Using industrial equipment, control operations, and process variables as nodes, and network reachability relationships, instructions, confirmation relationships, and execution and response relationships as edges, construct and update the network physical cause-effect graph based on control transactions; Step 3: Perform industrial protocol state consistency detection, topology reconstruction detection based on network physical causal graph, and process response prediction detection on the control transaction respectively to obtain protocol deviation evidence, topology deviation evidence, and process residual evidence. Perform conflict adaptive fusion and sequential accumulation across scanning cycles on each piece of evidence to output intrusion confidence and causal evidence subgraph containing abnormal nodes and abnormal edges. Step 4: In the causal evidence subgraph, determine the attack path from the intrusion source node to the protected process variable, and generate multiple candidate defense action pairs for the attack path. Each candidate defense action pair includes a network handling rule for cutting off the attack path and a security alternative control sequence for maintaining the protected process variable during the network handling rule's effective period. Step 5: Under the constraints of process security envelope, control command amplitude, control command change rate, communication latency and attack path coverage, optimize the security physical coordination of candidate defense action pairs, and filter out candidate defense action pairs that cannot maintain the positive invariance of process state according to control barrier conditions, to obtain defense transactions that include effective scan cycle and rollback conditions. Step 6: Perform the preparation and submission phases for the defense transaction. In the preparation phase, pre-configure the inactive network handling rules to the industrial firewall and pre-install the security alternative control sequence to the security alternative control agent. After receiving the readiness confirmation from both, activate the network handling rules and the security alternative control sequence synchronously at the same cycle boundary of the effective scanning cycle, and maintain or roll back the defense transaction according to the activated process security margin and communication confirmation status.

[0010] Furthermore, the control transaction includes at least the scan cycle identifier, protocol session identifier, source device identifier, target device identifier, function code, variable address, request value, response value, execution feedback value, process measurement value, data acquisition timestamp and integrity flag; Alignment includes: prioritizing deterministic matching based on scan cycle identifier and protocol session identifier; For data lacking a scan cycle identifier, a matching cost is constructed based on the time difference, protocol sequence difference, and variable address difference, and data with the lowest matching cost that does not exceed a preset threshold is incorporated into the same control transaction. For unmatched data, a missing bit is set in the control transaction, and the original value used for security decisions is not replaced with interpolated data.

[0011] Furthermore, the edges in the network physical cause-effect graph include network reachability edges between devices, instruction edges from network requests to control operations, confirmation edges from control operations to communication confirmations, execution edges from control operations to actuator feedback, and response edges from actuator feedback to process variables. The prior weights of edges are generated based on the engineering configuration file, industrial protocol semantics, and safety interlocking logic. The conditional transition entropy between process variables is calculated based on the normal operation control transaction. The prior weights, normalized conditional transition entropy, and online observation consistency weights are then integrated into edge weights. Online updates that generate edges that conflict with the engineering configuration file or safety interlocking logic are prohibited.

[0012] Furthermore, the industrial protocol state consistency detection is based on a protocol whitelist state machine constructed according to device roles, function codes, variable address ranges, allowed state transitions, and response timeouts. It calculates protocol deviations caused by illegal state transitions, discontinuous sequences, response timeouts, and inconsistencies between written and acknowledged values. The topology reconstruction detection uses a graph attention autoencoder, which takes the protocol features, control features, and process features of nodes, as well as edge weights, as inputs to reconstruct node features and adjacency relationships. The weighted sum of node reconstruction errors and edge reconstruction errors is used as evidence of topology deviations.

[0013] Furthermore, process response prediction detection includes: A higher-dimensional dictionary function is constructed using process measurement data and controller output data under normal operation, and a finite-dimensional Koopman state transition matrix is ​​obtained by extended dynamic mode decomposition. Predict the process response for the next scan cycle based on the current process status and control commands; The Mahalanobis distance is calculated based on the difference between the measured process response and the predicted process response, as well as the normal residual covariance matrix, and process residual evidence is generated based on the Mahalanobis distance.

[0014] Furthermore, conflict-adaptive fusion includes: The evidence of protocol deviation, topology deviation, and process residual are mapped to the basic probability assignments of the three propositions: intrusion, normal, and uncertainty, respectively. The reliability discount of each piece of evidence is determined based on the conflict coefficient between any two pieces of evidence and the integrity flag of the corresponding data source; The discounted basic probability allocation is combined using Dempster's algorithm to obtain the fused intrusion probability for the current scan cycle; The fusion intrusion probability is converted into a log-likelihood increment and accumulated between adjacent scan cycles according to the sequential probability ratio test. When the accumulated value reaches the intrusion threshold, the intrusion confidence and causal evidence subgraph are output. When the accumulated value reaches the normal threshold, the current sequential accumulation is cleared.

[0015] Furthermore, the attack path was determined to include: Starting with the anomalous source device or anomalous external session in the causal evidence subgraph, and ending with the security interlock variable, critical quality variable, or critical device status, set edge risks for each anomalous edge, determined by the fused intrusion probability, network exposure, process sensitivity, and allowable response time. At least one attack path is obtained by using A-star search, which is subject to risk upper bound constraints; Common cut edges, common cut points, and corresponding protected process variables located on different attack paths are identified as candidate disposal locations.

[0016] Furthermore, the safety physical coordination optimization adopts mixed-integer model predictive control: The decision is based on whether the network handling rules are activated, with the security alternative control sequence as the continuous decision-making quantity. The objective function is the weighted minimum of the remaining attack risk, legitimate communication loss, process state deviation, control energy, and number of action switching. Each attack path is constrained to be covered by at least one active network handling rule, and the process state in the prediction time domain is constrained to be within the process security envelope; The control barrier condition is that the safety barrier function value of the adjacent scan cycle is not lower than the current safety barrier function value multiplied by the preset retention coefficient.

[0017] Furthermore, the defensive transaction also includes a transaction identifier, a network disposition rule summary, a security alternative control sequence summary, a preparation deadline, a commit token, a duration, and a rollback operation; The preparation phase also includes verifying the pre-configured content summaries returned by the industrial firewall and the security alternative control agent, respectively. A commit token is generated only when both pre-set content digests are consistent with the corresponding digests in the defense transaction, the readiness confirmations arrive before the preparation deadline, and the field controller is not in manual maintenance mode. Synchronous activation is triggered by both token submission and the effective scanning cycle.

[0018] Furthermore, after the network handling rules and safety alternative control sequences are activated, the process safety margin, the confirmation loss rate between the field controller and the actuator, and the prediction residuals of the protected process variables are monitored according to the preset observation window. When the process safety margin is lower than the rollback margin threshold, the acknowledgment loss rate is higher than the loss rate threshold, or the predicted residuals continuously exceed the residual threshold, the rollback is executed in the order of first restoring the most recent trusted control sequence and then revoking the network handling rules. Only control transactions that have been manually confirmed or confirmed by the protocol whitelist state machine and that meet the control barrier conditions within the entire observation window are written into the normal baseline sample set for updating edge weights, graph attention autoencoders, or Koopman state transition matrices.

[0019] The present invention has the following beneficial effects: This invention uses the controller scan cycle and protocol session to jointly constrain control transactions, and associates network requests, control commands, execution feedback, process responses and confirmation information in the same action chain, so that the abnormal physical consequences caused by legal format messages can be located to specific nodes and edges; This invention adaptively discounts three types of evidence under the constraints of conflict coefficient and data integrity, and suppresses single-cycle jitter through sequential accumulation, enabling it to distinguish between network intrusion, equipment failure, and normal operating condition switching. In this invention, candidate defense actions are not individual firewall rules, but rather paired combinations of network handling rules and security alternative control sequences. Mixed-integer model predictive control and control barrier functions ensure that the process security envelope is still satisfied when blocking attack paths. This invention employs a two-stage execution mechanism with the same scan cycle as the submission boundary. It only takes effect synchronously when network rules and alternative controls are ready and the digests are consistent. It also sets up an ordered rollback triggered by process security margin to reduce secondary risks caused by race conditions in defense actions. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments will be briefly described below.

[0021] The accompanying drawings described below are only related to some embodiments of the invention and are not intended to limit the invention.

[0022] In the attached diagram: Figure 1 A schematic diagram of the process of this invention is shown. Detailed Implementation

[0023] The security defense controller acquires network packets through the mirror port of an industrial switch, a network splitter, or the bypass interface of an industrial firewall, and acquires controller input / output, actuator feedback, and process measurement through read-only industrial protocols, the controller mirror variable area, or the data acquisition gateway.

[0024] The security defense controller does not directly replace the basic control functions of the PLC or DCS. Instead, it issues network handling rules to the industrial firewall and issues alternative control sequences to the security-certified alternative control agent.

[0025] Safety alternative control agents can be set up in PLC redundant controllers, edge controllers, safety instrumented systems with permitted external interfaces, or industrial gateways with hardware write protection and whitelist verification.

[0026] The scanning cycle referred to in this invention is the discrete control cycle corresponding to the field controller performing input sampling, logic operation, and output refresh. For event-triggered controllers, the triggering period of the control task or the gating period of the time-sensitive network is used as the equivalent scan period.

[0027] The process safety envelope, as referred to in this invention, is a set of process states jointly defined by the upper limit of the process, the lower limit of the process, the interlocking threshold, the allowable rate of change, and equipment constraints.

[0028] The safe alternative control sequence referred to in this invention is a finite time-domain control sequence generated from trusted historical control values, redundant measurement values, and prediction models, and which satisfies the process safety envelope, when some network connections are blocked or some control commands are determined to be untrustworthy.

[0029] Control transactions are not abstract records of database transactions, but rather technical data structures corresponding to a chain of control actions.

[0030] A control transaction must include at least: scan cycle identifier k, protocol session identifier sid, source device identifier src, target device identifier dst, function code fc, variable address addr, request value vreq, response value vrsp, execution feedback value vact, process measurement vector xk, request time tq, response time tr, feedback time ta, measurement time tm, and integrity flag q. The integrity flag is used to represent original values, trusted redundant values, missing values, and contaminated values. Security decisions do not use sourceless interpolation to replace original values. Network requests, control commands, execution feedback, process responses, and communication acknowledgments are aligned to the same control transaction.

[0031] Data with scan cycle identifiers and protocol transaction identifiers are matched deterministically.

[0032] For Modbus TCP, EtherNet / IP, or proprietary protocol data that does not carry a scan cycle identifier, the security defense controller calculates the matching cost based on the time difference, sequence number difference, and address difference between the candidate data and the current cycle: C(k,j)=λt·|tj−tk| / Ts+λq·dseq(j,k)+λa·daddr(j,k)+λr·drole(j,k)(1); In the formula, Ts is the scan period, dseq is the normalized value of the protocol sequence difference, daddr is the difference in whether the variable address corresponds, drole is the difference in whether the source and target device roles conform to the request-response direction, and λt, λq, λa, and λr are non-negative weights. The formula selects j* = arg min C(k,j). Candidate data j is incorporated into the control transaction of period k only if C(k,j*) is not greater than the matching threshold ηc; otherwise, it remains unmatched data and a missing bit is set.

[0033] This prevents incorrect splicing caused by attackers forging timestamps or communication jitter.

[0034] To reduce the impact of dimensional differences on subsequent detection, robust standardization of continuous variables was performed using the median and median absolute deviation. xəi,k=(xi,k−medi) / (1.4826·MADi+ε) (2); In the formula, medi and MADi are calculated from a normal baseline period confirmed by a whitelist, and ε is a positive number to prevent the denominator from being zero. Discrete function codes, status words, and device roles use one-hot encoding or verifiable enumeration encoding, and the IP address itself is not used as a decisive attack label.

[0035] The physical causal graph of the network is denoted as Gk=(V,Ek,Wk).

[0036] The node set V includes device nodes, control operation nodes, and process variable nodes.

[0037] Equipment nodes correspond to engineering workstations, edge gateways, PLCs, remote input / output modules, sensors, and actuators; control operation nodes correspond to reading, writing, starting, stopping, setting value modification, mode switching, and interlock reset; process variable nodes correspond to liquid level, pressure, flow rate, temperature, speed, position, current, or equipment status.

[0038] The edge set Ek includes at least network reachable edges, instruction edges, confirmation edges, execution edges, and response edges.

[0039] First, the prior weights weng of the edges are extracted from the engineering configuration file, PLC variable table, control loop diagram, OPC UA information model, industrial firewall whitelist, and security interlock logic.

[0040] Subsequently, in normal control transactions, the conditional transition entropy for a given historical state is calculated for the two process sequences Xi and Xj: TEi→j=Σp(xj,k+1,xj,k(m),xi,k(n))·ln[p(xj,k+1|xj,k(m),xi,k(n)) / p(xj,k+1|xj,k(m))] (3); In the formula, m and n are the order of the history window.

[0041] Transition entropy reflects the amount of information that the history of Xi adds to the next periodic state of Xj, given that the history of Xj itself is known.

[0042] Normalize TEi→j according to the normal sample quantiles to obtain wte.

[0043] Edge weights are updated using the following formula: wij,k=clip(λe·weng+λt·wte+λo·wobs,k,0,1), λe+λt+λo=1 (4); In the formula, wobs,k indicates whether the instructions, confirmations, executions, and responses of the current control transaction are complete and consistent.

[0044] λe takes a larger value in the early stage of system operation, and can be gradually reduced as the number of reliable normal samples increases, but it must not be lower than the engineering prior lower limit.

[0045] If the candidate edge generated by online statistics conflicts with the engineering configuration direction or safety interlocking logic, the creation of that edge is prohibited, and it is only recorded as an unknown association awaiting manual review.

[0046] This avoids the problem of attacks and pollution causing the causal graph to learn incorrect topologies on its own.

[0047] Evidence of protocol deviation is generated by the protocol whitelist state machine.

[0048] The state machine is established according to the device role, allowed peers, function codes, variable address ranges, controller operating modes, allowed state transitions, response timeouts, and write acknowledgment rules.

[0049] Protocol deviation ep,k can be represented as a weighted sum of illegal state transitions, discontinuous sequences, response timeouts, unauthorized address writes, and inconsistencies between written and acknowledged values. Each component retains the trigger message, control transaction identifier, and corresponding rule identifier, ensuring traceability of the results.

[0050] Evidence of topological bias is generated by a graph attention autoencoder.

[0051] For node i, the attention of the l-th layer graph is calculated as follows: hi(l+1)=σ(Σj∈N(i) αij(l)W(l)hj(l)) (5); αij=softmaxj(LeakyReLU(aT[Whi∥Whj∥wij])) (6); In the formula, hi represents the node feature, N(i) is the set of allowed neighbors of node i, wij is the edge weight of the causal graph, and ∥ represents vector concatenation.

[0052] The encoder outputs a low-dimensional node representation, and the decoder reconstructs the node features X̂ and the adjacency matrix Â.

[0053] The training loss is: Lgae=μx·‖X−X̂‖F²+μa·‖M⊙(A−Â)‖F²+μs·Lsparse (7); In the formula, M is the engineering allowable edge mask, and Lsparse is the sparse constraint.

[0054] At runtime, the topological deviation eg,k is obtained by weighting the node reconstruction error and the edge reconstruction error.

[0055] The engineering-permitted edge mask constraint model cannot reduce losses by reconstructing unauthorized communication relationships.

[0056] The process residual evidence is generated by a finite-dimensional Koopman prediction model.

[0057] A dictionary function φ is selected, which includes the original state, second-order terms, cross terms, and nonlinear terms specified by the process mechanism, to increase the dimension of the process state x to z=φ(x).

[0058] Using the state matrix Z in the normal control transaction, the state matrix Z+ in the next cycle, and the control matrix U, the following can be obtained through extended dynamic mode decomposition: [KB]=Z+·[Z;U]† (8; In the formula, † represents the Moore-Penrose generalized inverse.

[0059] The next cycle prediction is ẑk+1=Kzk+Buk, which maps back to the original state to get x̂k+1.

[0060] The Mahalanobis distance is calculated using the residual rk = xk+1 − x̂k+1 and the normal residual covariance Σr: epc,k=rkT(Σr+εI)−1rk (9); epc,k is mapped to process residual evidence using the quantiles of the normal residual distribution.

[0061] If redundant sensors are inconsistent, the integrity flag of the affected measurement channel is lowered instead of immediately attributing all residuals to a network intrusion.

[0062] Set the identification framework as Θ={I,N}, where I denotes intrusion and N denotes normality. Basic probability assignments ms(I), ms(N) and ms(Θ) are established for protocol deviation, topology deviation and process residual respectively. The reliability ρs of data source s is determined jointly by the integrity flag qs, the recent window stability and the evidence conflict coefficient, and is discounted according to the following formula: m′s(A)=ρs·ms(A), A∈{I,N}; m′s(Θ)=1−ρs+ρs·ms(Θ) (10); The conflict coefficient Kc of any two pieces of evidence is Kc=ΣB∩C=∅m1(B)m2(C).

[0063] When Kc rises, the reliability of data sources with poor integrity flags or conflicting with engineering priors is preferentially reduced; when all three pieces of evidence are missing or all have low reliability, the system outputs "insufficient evidence" and shall not automatically perform high-impact isolation. Dempster's combination is applied to the discounted evidence: m(A)=[ΣB∩C=A m1(B)m2(C)] / (1−Kc) (11); The current cycle fused intrusion probability pk=m(I)+0.5m(Θ) is obtained.

[0064] To prevent single-cycle spikes from triggering high-impact response, the sequential probability ratio test is used: Sk=Sk−1+ln[f1(pk) / f0(pk)] (12); In the formula, f1 and f0 are the likelihood models of the fused probability under the intrusion state and the normal state respectively.

[0065] The upper threshold A=ln[(1−β) / α], the lower threshold B=ln[β / (1−α)], where α and β are the allowable false alarm probability and missed detection probability respectively.

[0066] When Sk≥A, an intrusion is confirmed and a causal evidence subgraph is output; when Sk≤B, normality is determined and Sk is reset to zero; when B<Sk<A, observation is continued.

[0067] For the scenario where a safety interlock variable has a hard over-limit, an independent hard rule can directly initiate safety response without waiting for sequential accumulation.

[0068] In the causal evidence subgraph, abnormal external sessions, abnormal engineer stations or abnormal edge gateways are taken as source nodes, and safety interlock variables, critical quality variables or critical equipment states are taken as target nodes.

[0069] The edge risk is defined for the abnormal edge (i,j): rij=pij·eij·sij / (τij+ε) (13); In the formula, pij is the intrusion probability assigned to the edge by the fused evidence, eij is the network exposure, sij is the process sensitivity of the target process variable to the edge, and τij is the remaining allowable response time from the edge to cross the security envelope.

[0070] Using an A-star search constrained by an upper risk bound, the path cost is: J(P)=Σ(i,j)∈P[−ln(rij+ε)+λd·dij+λb·bij] (14); In the formula, dij represents the legal communication delay introduced by handling the edge, and bij represents the impact on process continuity. The heuristic function uses the minimum remaining safe time lower bound from the current node to the target node, without overestimating the remaining cost.

[0071] Output the highest-risk paths and find common cut edges, common cut vertices, and corresponding protected variables.

[0072] For each candidate disposal location, the security defense controller generates network disposal rule 421 and security alternative control sequence 422.

[0073] Network handling rules can include five-tuple blocking, industrial function code blocking, variable address write protection, device-level rate limiting, session reset, virtual LAN isolation, or allowing only trusted redundant channels.

[0074] The safety alternative control sequence can be: holding the most recent reliable output, gradually changing to a safety setpoint at an allowable rate of change, switching to a redundant sensor closed loop, switching to a local manual preset value, or a finite time-domain sequence calculated by a predictive controller.

[0075] Both are bound with the same candidate number, and it is not allowed to select only network rules and omit the corresponding process compensation.

[0076] Let yn∈{0,1} represent whether the nth network disposal rule is activated, and U={uk,…,uk+H−1} be a safe alternative control sequence of length H.

[0077] Solution using mixed-integer model predictive control: min J=ωrRres(y)+ωcCleg(y)+Σh=0H−1[‖xk+h−xref‖Q²+‖uk+h‖R²+ωΔ‖Δuk+h‖1]+ωsNsw (15); Rres represents the remaining attack risk after handling, Cleg represents the loss of legitimate communication due to blocked access, and Nsw represents the number of times network rules and control modes have been switched.

[0078] The prediction model can be a validated linear local model xk+1=Axk+Buk+Edk, or a security-certified piecewise affine model.

[0079] The optimization constraints should include at least the following: each confirmed attack path is covered by at least one activation rule; xmin≤xk+h≤xmax; umin≤uk+h≤umax; |Δuk+h|≤Δumax; the total communication and computation latency does not exceed the allowable response time; and devices in maintenance or manual takeover mode must not automatically switch control sources.

[0080] The candidate solutions obtained from mixed integer optimization still need to be verified by controlling the barrier function.

[0081] Construct hl(x) for the l-th security boundary, with the security set being C = {x | hl(x) ≥ 0, ∀l}. The discrete control barrier condition is: hl(xk+1)−(1−γl)hl(xk)≥0, 0<γl≤1 (16); If the candidate solution does not satisfy equation (16), then the minimum modified quadratic programming problem is solved within the allowable control set to minimize the deviation between the modified alternative control sequence and the original optimized sequence and satisfy all barrier conditions; if there is still no feasible solution, then the candidate solution is not executed automatically, and the process is switched to the safety instrumented system or manual emergency response.

[0082] The purpose of control barrier screening is not to re-evaluate network intrusion, but to prove that the process state during the effective period of network defense actions will not leave the safe set due to the interruption of the control chain.

[0083] Defense transactions include transaction identifier tid, candidate action number, network handling rule, network rule summary hn, security alternative control sequence, security sequence summary hu, preparation deadline period kp, effective period kc, duration period Hd, rollback condition Cr, and rollback action Ar.

[0084] The digest can be calculated using a hash algorithm that meets the requirements of the system's cryptographic module. The digest is only used to confirm that the two execution ends have received the same version of the content and does not replace device authentication and secure communication.

[0085] During the preparation phase, the security defense controller sends inactive network rules to the industrial firewall and inactive alternative sequences to the security alternative control agent; the industrial firewall returns an acknowledgment containing a summary of the pre-configured rules, and the security alternative control agent returns an acknowledgment containing a summary of the pre-configured sequences.

[0086] Summary of security defense controllers, inspection preparation deadline, equipment health status, and manual maintenance indicators.

[0087] A commit token is generated when all conditions are met.

[0088] If any confirmation times out, the summary is inconsistent, or the execution end is unhealthy, the pre-set content will be revoked and the submission stage will not be entered.

[0089] During the submission phase, the security defense controller issues an effective period kc and a submission token to both execution ends.

[0090] The industrial firewall activates network disposition rules at the cycle boundary (kc). The security alternative control agent provides the first alternative control variable to the field controller at the same cycle boundary. The field controller continues to enforce existing interlocks and output limiting, without disabling any hardwired security protections.

[0091] Both the industrial firewall and the security alternative control agent record the actual effective period. The security defense controller verifies whether the difference between the two effective periods is zero. If there is an allowable error in the device clock, the judgment is made using a common scan cycle counter instead of an absolute timestamp.

[0092] After activation, calculate the process safety margin M=minl hl(x), communication acknowledgment loss rate, and Koopman prediction residual within the observation window.

[0093] If M falls below the rollback margin, the confirmation loss rate exceeds the threshold, or the prediction residuals continuously exceed the limit, rollback will proceed in the following order: first, restore the most recent trusted control sequence or redundant control channel; second, confirm that the process state has moved into the security set; and third, revoke the network handling rules. This order avoids revoking network rules first, allowing the attack to re-enter before process control has been restored.

[0094] If the attack path still exists but the current action is not feasible, maintain the minimum necessary isolation and request manual confirmation.

[0095] The graph attention autoencoder and Koopman prediction model establish baselines using normal production cycles, start-up and shutdown cycles, formula changeover cycles, and planned maintenance cycles verified by engineers, to avoid mixing different operating conditions into a single distribution.

[0096] The training samples retain device roles, control modes, and recipe identifiers, but remove incidental identifiers that are irrelevant to the attack category and are prone to overfitting.

[0097] The training set and validation set are divided into consecutive time periods. It is prohibited to include adjacent slices of the same control transaction into the training set and validation set at the same time.

[0098] The protocol state machine thresholds are derived from the protocol specifications, equipment manuals, and permissible latency in the field; the process safety envelope is derived from the process design, equipment rated range, and safety interlock settings, and is not automatically relaxed by the machine learning model; the evidence threshold can be determined by the normal baseline quantiles and acceptable α and β; the model prediction time domain H is selected based on process inertia and the shortest permissible response time. After commissioning, writing to the normal baseline sample set is only allowed when the control transaction is manually confirmed or confirmed by the protocol whitelist, meets the control barrier conditions within the complete observation window, and does not belong to a confirmed attack path. Online updates use a small learning rate or forgetting factor and save the model summary before the update, which can be recovered in case of performance degradation.

[0099] The security defense controller can be configured with a resource degradation mode.

[0100] When edge computing resources are insufficient, the protocol state machine, hard safety rules, and two-phase commit functionality are maintained first, while reducing the frequency of graph model updates. When the causal graph or process model is unavailable, only pre-approved low-impact network rules are allowed to be executed, and large-scale isolation is not automatically implemented. This ensures that algorithm module failures do not cancel the original interlocking, limiting, and manual takeover mechanisms of the industrial control system.

[0101] Please refer to Figure 1 Example 1: Defense against spoofing and replaying in water supply pumping stations based on Modbus TCP.

[0102] This embodiment applies to a water supply pumping station consisting of a supervisory control system (SCADA), an industrial firewall, two redundant PLCs, a variable frequency pump, inlet and outlet valves, a level gauge, a pressure transmitter, and a flow meter. The PLC scan cycle is set to 100 ms. The SCADA reads the holding register via Modbus TCP and writes the pump frequency setpoint according to the scheduling plan. The level, outlet pressure, pump frequency feedback, and valve opening are treated as protected process variables.

[0103] The following parameters are for illustrative purposes only and do not constitute a claim on measured performance for items not provided.

[0104] The security controller obtains the transaction identifier, function code, register address, write value, and response value from the firewall mirror port; it read-only obtains the output refresh value from the PLC mirror variable area; and it obtains execution feedback and process response from the frequency converter and pressure transmitter. Aligned with a 100 ms scan cycle, a control transaction for writing pump frequency sequentially includes function code 06 write request, PLC confirmation, PLC output refresh, frequency converter frequency feedback, and subsequent pressure and flow responses for several cycles. Engineering configuration specifies that the SCADA dispatch station can only write to the target register in automatic mode when the liquid level is within the allowable range, and the pump frequency change rate must not exceed the process set value.

[0105] When an attacker replays a legitimate frequency-incrementing message from the past, the source address, function code, and register of a single message may all satisfy the whitelist, but its protocol sequence is not continuous with the current scheduling session; the graph attention autoencoder detects that the 'scheduling instruction - PLC confirmation - pump feedback' subgraph deviates from the normal adjacency pattern under the current liquid level state; the pressure response predicted by the Koopman predictor based on liquid level, pressure, current frequency, and valve opening is inconsistent with the measured trend.

[0106] After reliability discounting and sequential accumulation of the three types of evidence, the abnormal edge is located in the pump frequency writing operation from the dispatch station.

[0107] The candidate network handling rules include: only blocking write function codes to the pump frequency register from abnormal sessions, while preserving read communication of level, pressure, and equipment health status.

[0108] The corresponding safety alternative control sequence starts from the most recent reliable frequency setpoint and transitions periodically to the safe frequency calculated by the level control loop according to the allowable rate of change.

[0109] The mixed integer model predictive control selects action pairs under constraints of upper and lower limits of liquid level, upper limit of outlet pressure, pump frequency, and rate of change; the control barrier function is constructed using the minimum margin between the liquid level and the upper and lower limits and the pressure and the upper limit.

[0110] During the preparation phase, register-level write blocking rules are pre-configured for the industrial firewall, and alternative frequency sequences are pre-installed for the security agent on the redundant PLC side; once the summaries of both are consistent, they are activated in the same scan cycle.

[0111] During activation, monitoring read messages are retained, and the safety defense controller continuously obtains liquid level and pressure data.

[0112] If the safety margin decreases or the redundant PLC fails to confirm the output refresh, first restore the most recent reliable frequency sequence and switch to local level control, then cancel or adjust the blocking rules. This avoids directly cutting off the SCADA-PLC link, which would cause the pump station to lose monitoring and control.

[0113] Example 2: Covert bias injection defense for temperature control loop in chemical reactor.

[0114] This embodiment applies to a control system for a jacketed cooling batch reactor. The system includes a DCS controller, an OPC UA server, PROFINET remote inputs and outputs, reactor temperature and pressure sensors, cooling water regulating valves, a stirring motor, and an independent safety instrumented system. The DCS temperature control task cycle is 50 ms, and the batch management server issues recipe stages and temperature setpoints via OPC UA. Protected variables include reactor temperature, reactor pressure, cooling valve opening, and heating rate.

[0115] For each setpoint change issued by the batch management server, the control transaction log records the OPC UA session, node identifier, written setpoint, DCS confirmation, temperature controller output, valve positioner feedback, and subsequent temperature and pressure responses. The causal graph engineering prior includes a directed chain of 'recipe stage—temperature setpoint—controller output—valve opening—reactor temperature—reactor pressure', and estimates the transfer entropy and Koopman matrix for different reaction stages. The safety envelope consists of the recipe's permissible temperature range, pressure limit, maximum heating rate, and cooling valve rate of change; the interlocking threshold of the independent safety instrumented system remains unchanged by this method.

[0116] If an attacker continuously applies a small positive bias to the temperature setpoint within a legitimate OPC UA session, the single-cycle deviation may not exceed the conventional threshold. The protocol state machine records inconsistencies between setpoint changes and authorization during the recipe phase; the graph model reveals a gradual increase in edge reconstruction errors between batch phase nodes and setpoint write operations; and the Koopman residuals show that the joint response of reactor temperature and pressure deviates from the normal model under the current exothermic reaction state. Sequential probability ratio tests accumulate evidence over multiple scan cycles, while the causal evidence subgraph maintains its focus on specific OPC UA nodes and control operations.

[0117] For this path, network handling rules restrict batch servers to write permissions to the target node while retaining historical DCS data uploads; the safe alternative control sequence freezes the most recently trusted setpoint, and the predictive controller calculates the cooling valve sequence based on the current vessel temperature, pressure, and exothermic disturbances. Cooperative optimization requires that the vessel temperature, pressure, and heating rate all fall within the safe envelope in the prediction time domain, while limiting excessively rapid valve action. If the control barrier quadratic programming has no feasible solution, the network defense controller will not continue to adjust; instead, the independent safety instrumented system will be requested to handle the situation according to predetermined safety logic.

[0118] Firewall OPC UA node-level rules and security alternative control sequences are submitted within the same DCS task cycle. If the pressure safety margin decreases within the observation window, the cooling capacity allowed by the safety instrumented logic is maintained or increased first, and then the network rules are rolled back. If evidence confirms that the issue originates from a batch server account rather than a network link, the action can be downgraded from system-wide isolation to freezing node write permissions. This implementation ensures that network security measures comply with process safety constraints, rather than replacing process control with immediate network disconnection.

[0119] Example 3: Robot-Conveyor Line Timing Replay Defense in Discrete Manufacturing Production Lines.

[0120] This embodiment applies to an assembly line consisting of a production line PLC, robot controller, vision station, variable frequency conveyor, RFID reader / writer, manufacturing execution system gateway, and industrial firewall. The control network uses EtherNet / IP and message queue telemetry transmission protocol to carry periodic I / O and edge status reporting. The main task cycle of the production line PLC is 20 ms. Protected states include robot safety zone occupancy, conveyor belt speed, pallet position, fixture arrival signal, and station cycle time.

[0121] The safety defense controller aligns robot entry permission signals, pallet arrival signals, conveyor start / stop commands, inverter speed feedback, visual results, and PLC confirmations into control transactions. Engineering configuration specifies that the PLC can only issue robot start permission when the pallet is in place, the gripper is closed, and the robot's safety zone is empty; the conveyor can only accelerate after the robot leaves the shared area. Cause-effect graphs represent these discrete state transitions together with network communication relationships. Graph attention autoencoders establish workstation topology baselines for each product model, while the Koopman model is used for continuous state prediction of conveyor belt speed and pallet position.

[0122] When an attacker replays previous batches of robot start-up authorization and vision pass messages, the message format and device identity may still be legitimate, but the scan cycle identifier, pallet identifier, and fixture status cannot form a complete control transaction. The protocol state machine generates session sequence and object identifier deviations; the graph model generates anomaly edges for 'old pallet message - current robot authorization'; the process model detects that the conveyor belt speed and pallet position responses do not match the current workstation status. The causal evidence subgraph locates the anomaly path to the message channel from the manufacturing execution system gateway to the production line PLC and the robot authorization node.

[0123] Candidate network actions include freezing the corresponding message topic or only blocking the robot's authorized objects without interrupting vision and device health reporting. The corresponding safe alternative control sequence is: maintain the robot in its current safe posture, reduce the conveyor belt speed by the permissible deceleration, keep the gripper closed, and resume local PLC sequential control after the shared area is cleared. Cooperative optimization comes at the cost of remaining attack path risks, workstation downtime losses, pallet position deviations, and action switching counts. The safety barrier function is constructed from robot safety zone mutual exclusion conditions, minimum braking distance, and gripper holding conditions.

[0124] During the preparation phase, the industrial firewall is pre-configured with object-level blocking rules, the robot safety agent is pre-installed with safety posture instructions, and the conveyor control agent is pre-installed with deceleration sequences. After all execution ends return a summary and ready status, they are committed at the same 20 ms interval.

[0125] If any execution end is not ready, partial isolation will not be implemented; instead, the PLC will continue the existing safety sequence and request manual intervention. After the transaction is completed, the relevant control transaction can only enter the normal baseline if the current pallet has been safely cleared, all barrier conditions are continuously met, and the message source has been confirmed manually or by a whitelist.

[0126] Security defense controllers can be deployed in industrial edge servers, trusted execution environments, or redundant security control stations. For systems that do not allow external write control values, the security alternative control agent can select only the pre-approved security program blocks within the PLC. The security alternative control sequence in the defense transaction is represented by the security program block identifier and parameters, instead of being written to the control values ​​by external devices cycle by cycle.

[0127] The present invention allows for the hierarchical storage of network physical causal graphs according to factories, production units, and control loops. Attack paths across production units are searched in the upper-level graph and expanded in the lower-level graph after entering a specific control loop. The graph attention autoencoder can also be replaced with a graph convolutional autoencoder constrained by engineering masks, but its output must still include node reconstruction errors and edge reconstruction errors; the Koopman predictor can be replaced with a validated state-space observer, but its residuals must maintain a traceable correlation with control transactions and causal edges.

[0128] Evidence fusion can switch to conservative conjunctive rules when Dempster combination conflicts are too high, preserving a higher probability in uncertain propositions Θ; high-impact defensive transactions are only generated when the automatic execution threshold is met and the evidence completeness reaches a specified value. All automatic actions do not remove existing hardware interlocks, emergency stop circuits, safety instrumented systems, or manual takeover priorities from the field controller.

[0129] Each step of this invention can be implemented by a processor executing program instructions stored in memory. Control transactions, cause-effect graphs, model parameters, and defense transactions can be stored in an industrial security database. When the program instructions are executed, the security defense controller completes the data acquisition, graph construction, intrusion detection, collaborative optimization, synchronous submission, and rollback as described in the claims.

Claims

1. A network security intrusion prevention and control method for industrial internet control systems, characterized in that, The security defense controller, which communicates with industrial firewalls, field controllers, and security alternative control agents, performs the following steps: Step 1: Using the scan cycle of the field controller as the alignment boundary, collect industrial network messages, controller input and output data, actuator feedback data, and process measurement data. Align network requests, control commands, execution feedback, process responses, and communication confirmations belonging to the same control action chain into control transactions. Step 2: Using industrial equipment, control operations, and process variables as nodes, and network reachability relationships, instructions, confirmation relationships, and execution and response relationships as edges, construct and update the network physical cause-effect graph based on control transactions; Step 3: Perform industrial protocol state consistency detection, topology reconstruction detection based on network physical causal graph, and process response prediction detection on the control transaction respectively to obtain protocol deviation evidence, topology deviation evidence, and process residual evidence. Perform conflict adaptive fusion and sequential accumulation across scanning cycles on each piece of evidence to output intrusion confidence and causal evidence subgraph containing abnormal nodes and abnormal edges. Step 4: In the causal evidence subgraph, determine the attack path from the intrusion source node to the protected process variable, and generate multiple candidate defense action pairs for the attack path. Each candidate defense action pair includes a network disposition rule for cutting off the attack path and a security alternative control sequence for maintaining the protected process variable during the network disposition rule's effective period. Step 5: Under the constraints of process security envelope, control command amplitude, control command change rate, communication latency and attack path coverage, optimize the security physical coordination of candidate defense action pairs, and filter out candidate defense action pairs that cannot maintain the positive invariance of process state according to control barrier conditions, so as to obtain defense transactions including effective scanning cycle and rollback conditions. Step 6: Perform the preparation and submission phases for the defense transaction. In the preparation phase, pre-configure the inactive network handling rules to the industrial firewall and pre-install the security alternative control sequence to the security alternative control agent. After receiving the readiness confirmation from both, activate the network handling rules and the security alternative control sequence synchronously at the same cycle boundary of the effective scanning cycle, and maintain or roll back the defense transaction according to the activated process security margin and communication confirmation status.

2. The network security intrusion prevention and control method for industrial internet control systems according to claim 1, characterized in that, Control transactions include at least the scan cycle identifier, protocol session identifier, source device identifier, target device identifier, function code, variable address, request value, response value, execution feedback value, process measurement value, data acquisition timestamp, and integrity flag. Alignment includes: prioritizing deterministic matching based on scan cycle identifier and protocol session identifier; For data lacking a scan cycle identifier, a matching cost is constructed based on the time difference, protocol sequence difference, and variable address difference, and data with the lowest matching cost that does not exceed a preset threshold is incorporated into the same control transaction. For unmatched data, a missing bit is set in the control transaction, and the original value used for security decisions is not replaced with interpolated data.

3. The network security intrusion prevention and control method for industrial internet control systems according to claim 2, characterized in that, The edges in a network physical cause-effect graph include network reachability edges between devices, instruction edges from network requests to control operations, confirmation edges from control operations to communication acknowledgments, execution edges from control operations to actuator feedback, and response edges from actuator feedback to process variables. The prior weights of edges are generated based on the engineering configuration file, industrial protocol semantics, and safety interlocking logic. The conditional transition entropy between process variables is calculated based on the normal operation control transaction. The prior weights, normalized conditional transition entropy, and online observation consistency are weighted and merged into edge weights. Online updates that generate edges that conflict with the engineering configuration file or safety interlocking logic are prohibited.

4. The network security intrusion prevention and control method for industrial internet control systems according to claim 3, characterized in that, Industrial protocol state consistency detection is based on a protocol whitelist state machine constructed according to device roles, function codes, variable address ranges, allowed state transitions, and response timeouts. It calculates protocol deviations caused by illegal state transitions, discontinuous sequences, response timeouts, and inconsistencies between written and acknowledged values. Topology reconstruction detection uses a graph attention autoencoder, which takes the protocol features, control features, and process features of nodes, as well as edge weights, as inputs to reconstruct node features and adjacency relationships. The weighted sum of node reconstruction errors and edge reconstruction errors is used as evidence of topology deviations.

5. The network security intrusion prevention and control method for industrial internet control systems according to claim 3, characterized in that, Process response prediction detection includes: A higher-dimensional dictionary function is constructed using process measurement data and controller output data under normal operation, and a finite-dimensional Koopman state transition matrix is ​​obtained by extended dynamic mode decomposition. Predict the process response for the next scan cycle based on the current process status and control commands; The Mahalanobis distance is calculated based on the difference between the measured process response and the predicted process response, as well as the normal residual covariance matrix, and process residual evidence is generated based on the Mahalanobis distance.

6. The network security intrusion prevention and control method for industrial internet control systems according to claim 1, characterized in that, Conflict adaptive fusion includes: The evidence of protocol deviation, topology deviation, and process residual are mapped to the basic probability assignments of the three propositions: intrusion, normal, and uncertainty, respectively. The reliability discount of each piece of evidence is determined based on the conflict coefficient between any two pieces of evidence and the integrity flag of the corresponding data source; The discounted basic probability allocation is combined using Dempster's algorithm to obtain the fused intrusion probability for the current scan cycle; The fusion intrusion probability is converted into a log-likelihood increment and accumulated between adjacent scan cycles according to the sequential probability ratio test. When the accumulated value reaches the intrusion threshold, the intrusion confidence and causal evidence subgraph are output. When the accumulated value reaches the normal threshold, the current sequential accumulation is cleared.

7. The network security intrusion prevention and control method for industrial internet control systems according to claim 6, characterized in that, The attack path was determined to include: Starting with the anomalous source device or anomalous external session in the causal evidence subgraph, and ending with the security interlock variable, critical quality variable, or critical device status, set edge risks for each anomalous edge, determined by the fused intrusion probability, network exposure, process sensitivity, and allowable response time. At least one attack path is obtained by using A-star search, which is subject to risk upper bound constraints; Common cut edges, common cut points, and corresponding protected process variables located on different attack paths are identified as candidate disposal locations.

8. The network security intrusion prevention and control method for industrial internet control systems according to claim 7, characterized in that, Safety physical coordination optimization employs mixed-integer model predictive control: The decision is based on whether the network handling rules are activated, with the security alternative control sequence as the continuous decision-making quantity. The objective function is the weighted minimum of the remaining attack risk, legitimate communication loss, process state deviation, control energy, and number of action switching. Each attack path is constrained to be covered by at least one active network handling rule, and the process state in the prediction time domain is constrained to be within the process security envelope; The control barrier condition is that the safety barrier function value of the adjacent scan cycle is not lower than the current safety barrier function value multiplied by the preset retention coefficient.

9. The network security intrusion prevention and control method for industrial internet control systems according to claim 8, characterized in that, Defense transactions also include transaction identifiers, network disposition rule summaries, security alternative control sequence summaries, preparation deadlines, commit tokens, durations, and rollback operations; The preparation phase also includes verifying the pre-configured content summaries returned by the industrial firewall and the security alternative control agent, respectively. A commit token is generated only when both pre-set content digests are consistent with the corresponding digests in the defense transaction, the readiness confirmations arrive before the preparation deadline, and the field controller is not in manual maintenance mode. Synchronous activation is triggered by both token submission and the effective scanning cycle.

10. The network security intrusion prevention and control method for industrial internet control systems according to claim 9, characterized in that, After the network handling rules and safety alternative control sequences are activated, the process safety margin, the confirmation loss rate between the field controller and the actuator, and the prediction residuals of the protected process variables are monitored according to the preset observation window. When the process safety margin is lower than the rollback margin threshold, the acknowledgment loss rate is higher than the loss rate threshold, or the predicted residuals continuously exceed the residual threshold, the rollback is executed in the order of first restoring the most recent trusted control sequence and then revoking the network handling rules. Only control transactions that have been manually confirmed or confirmed by the protocol whitelist state machine and that meet the control barrier conditions within the entire observation window are written into the normal baseline sample set for updating edge weights, graph attention autoencoders, or Koopman state transition matrices.

Images