Method for detecting information integrity based on one-way control of intelligent sensor

Abstract

The application discloses a kind of information integrity detection methods based on intelligent sensor unidirectional control, comprising: deploying intelligent sensor node dedicated to industrial protocol analysis, network traffic is obtained by fiber optic splitter in physical bypass mode and cannot send data packet outward;Real-time acquisition and analysis industrial protocol data packet, extract the characteristic information of control instruction and calculate hash value;Characteristic information is sent to the integrity detection engine of security area by independent unidirectional fiber link;Characteristic information is detected using information integrity detection model based on intelligent sensor unidirectional control, judge whether abnormal;Statistical detection results and generate decision, send abnormal event to management platform through unidirectional interface and alarm.The application cuts off the reverse influence of detection process on measured system by the way of combination of physical isolation and logical unidirectional, realizes high-trust, low-interference real-time integrity monitoring, and is suitable for high-security level industrial control system sensing network.

Description

Technical Field

[0001] This invention belongs to the field of information transmission and intelligent sensing technology, and particularly relates to an information integrity detection method based on one-way control of intelligent sensors. Background Technology

[0002] Current mainstream sensor-end information integrity detection solutions primarily rely on bidirectional interactive verification logic: the detection system sends a verification request frame to the sensor node, and the node, while returning the collected data, attaches a Message Authentication Code (MAC), Cyclic Redundancy Check (CRC) field, or hash check value. The system side determines whether the data has been tampered with, lost, or inserted abnormally by comparing the verification fields with pre-stored rules. This type of solution has matured in traditional closed industrial scenarios, but its inherent technical flaws continue to surface in the ubiquitous open sensing network environment: First, the bidirectional interaction mechanism inherently has an attack surface. Attackers can bypass verification rules and simultaneously tamper with data and verification fields by forging verification requests and implanting man-in-the-middle proxies. In a 2024 incident involving the tampering of sensing terminal data in a provincial power grid, the attacker hijacked the bidirectional verification channel, simultaneously uploading the tampered line temperature data and the matching check code, causing the dispatch system to misjudge the line load capacity and triggering regional power supply fluctuations; Second, the bidirectional... Verification requires sensor nodes to continuously respond to system requests, which additionally consumes node computing and communication resources. In low-power wide-area sensing nodes powered by batteries (such as vibration sensors along oil and gas pipelines and geological disaster monitoring nodes), frequent verification interactions will shorten the node's battery life by more than 40%, making it difficult to adapt to field deployment scenarios without continuous power supply. Thirdly, most existing detection mechanisms are deployed in the cloud or at the edge gateway, lacking the active verification capability of the sensor. Once data packet loss or silent tampering occurs in the transmission link, the system can only detect anomalies in the data comparison stage and cannot block the source of tampering.

[0003] In recent years, academia and industry have conducted multiple rounds of technological iterations to address the aforementioned issues: some studies have proposed end-side verification schemes based on lightweight national cryptographic algorithms, which reduce node resource consumption by lowering algorithm complexity, but do not change the core logic of bidirectional interaction and still cannot resist collusive tampering attacks targeting the verification channel; some manufacturers have launched enhanced sensors with embedded security chips, which improve the difficulty of forging verification fields through hardware encryption, but the hardware modification cost is 2-3 times higher than that of ordinary sensors, making it difficult to promote in large-scale scenarios with tens of millions of nodes; some solutions use traffic baseline learning to detect abnormal data, but this type of method has an accuracy rate of less than 70% in identifying gradual data tampering and has a high false alarm rate, which cannot meet the high reliability requirements of critical scenarios. Especially in critical sensing scenarios involving safe production and public interests, sensing networks generally require control commands and detection signals to meet the unidirectional isolation requirements of Level 3 or above of the Information Security Protection Standard 2.0. Traditional detection schemes that rely on bidirectional signaling interaction are fundamentally in conflict with the security specifications of unidirectional transmission, resulting in a lack of effective end-to-end data integrity verification capabilities in many deployed unidirectional isolation sensing systems, becoming a core technical bottleneck restricting the deployment of high-security-level sensing networks. Against this backdrop, exploring information integrity detection models that do not rely on two-way signaling interaction and can achieve active control at the sensor end has become a common technical problem that urgently needs to be solved in the field of intelligent sensing security. Summary of the Invention

[0004] The purpose of this invention is to provide an information integrity detection method based on unidirectional control using intelligent sensors, addressing the technical problems of existing information integrity detection schemes where the high coupling between the detection subject and the system under test, and the presence of bidirectional communication, lead to easily interfered detection results and insufficient reliability. This model introduces intelligent sensors as independent, unidirectional detection nodes, constructing a detection architecture that combines physical isolation with logical unidirectionality. This enables highly reliable, low-interference real-time monitoring of the integrity of data flow, status information, and control commands in the information system. The core of this invention lies in utilizing the physical characteristics and unidirectional control mechanism of intelligent sensors to cut off the reverse influence of the detection process on the system under test, thereby ensuring the independence of the detection behavior and the objectivity of the results.

[0005] The overall inventive idea of ​​this unidirectional control mathematical model can be summarized as follows: without relying on any active excitation, information integrity detection is reconstructed from a "statistical anomaly detection" problem into a "structured sparse signal recovery" problem. Through the deep coupling of algebraic criteria, information-theoretic metrics, and convex optimization, it provides a complete mathematical solution for passive safety monitoring with clear theoretical boundaries, a well-defined solution path, and outstanding localization capabilities—this is the key to its fundamental patent value in the field of industrial control system security.

[0006] One of the innovations of this invention is that it uniformly models information integrity attacks as a composite structure of "sparseness plus arbitrary perturbation," achieving a compact mathematical characterization of the attack space. Traditional methods often treat attacks as unconstrained perturbations or simple sparse attacks, making it difficult to accurately describe the composite threat in real-world scenarios where attackers possess both sample manipulation capabilities and minor modification privileges.

[0007] This invention decomposes adversarial perturbations into two orthogonal components: a sparse attack component characterizes the attacker's ability to tamper with a limited number of key samples, whose support set is constrained by cardinality to reflect the scarcity of attack resources; and an arbitrary perturbation component characterizes the continuous micro-perturbations applied by the attacker in the feature space, employing norm sphere constraints to capture imperceptible modifications. These two types of constraints form a compact convex envelope of the attack feasibility set through a Cartesian product, avoiding the conservative estimations caused by traditional union modeling.

[0008] The compactness of this invention is reflected in two aspects: firstly, the projection onto each component space precisely restores the original constraints without information loss; secondly, dual gap analysis shows that this relaxation introduces only a controllable approximation error in the worst case. Based on this visualization, defensive optimization can derive a computable safety boundary, providing a quantifiable theoretical guarantee for robust learning. Specifically, this involves explicitly separating the attack term in the sensor measurement equation. And impose strict sparsity constraints on the attack vector. (Only a few sensors were compromised), while preserving the complete arbitrariness of the attack amplitude (no distribution assumptions, no bounded constraints). The innovation of this modeling lies in:

[0009] This elevates the attack from a "noise pollution" problem to a "structural sparsity anomaly" problem.

[0010] This allows subsequent detection to leverage compressed sensing theory, transforming attack identification into a deterministic sparse reconstruction problem, rather than relying on statistical threshold guessing, thus greatly improving the accuracy of attack localization.

[0011] The second innovation of this invention lies in the pioneering introduction of the concept of "structural left invertibility," which is established as a key algebraic criterion for passive detection, thereby filling the gap in existing theories regarding attack detectability determination.

[0012] For a long time, the field of information security has faced a lack of theoretical tools in the passive detection of cyberattacks. Traditional methods often rely on numerical simulations or engineering experience to set detection thresholds. While this approach is practical in specific scenarios, it is essentially "post-event verification" rather than "pre-event assessment." The setting of detection thresholds is often limited by specific operating conditions, lacking a universal theoretical framework based on system topology and physical models. More importantly, traditional methods cannot answer a fundamental question at the algebraic level: does the system possess the potential to be "detectable" against specific types of attacks? This leads to defenders potentially performing ineffective monitoring of some completely imperceptible "stealth attacks," resulting in a huge waste of security resources.

[0013] The "structural left invertibility" criterion proposed in this invention fundamentally changes this passive situation. This criterion utilizes the algebraic properties of the structural matrix, enabling it to determine whether a certain type of attack signal is structurally observable simply by analyzing the system's topological connections, without relying on specific numerical parameters. If the system satisfies structural left invertibility for a specific attack mode, it means that a theoretical algebraic path exists, allowing the attack signal to be parsed or reconstructed from the output measurement value; conversely, if this condition is not met, it mathematically proves that the attack is undetectable under the current system structure, and no amount of threshold adjustment will be effective.

[0014] This breakthrough not only provides a clear algebraic boundary for attack detection, but also elevates the detection logic from traditional threshold comparison to structural analysis. It allows designers to identify undetectable attack blind spots during the system modeling phase, guiding the optimization of sensor configuration or adjustment of control strategies. This leap from empiricism to rigorous algebraic theory greatly enhances the theoretical completeness and engineering reliability of passive detection systems, laying a solid mathematical foundation for building inherently safe control systems.

[0015] The third innovation of this invention is the construction of a quantitative metric for detectability based on information flow. Traditional technologies in the field of covert attack detection generally suffer from a core limitation: the determination of detectability remains at a binary qualitative level of "detectable / undetectable," failing to characterize the continuous differences in detection difficulty under different system parameters and attack modes, and even less able to support pre-assessment of system security performance during the design phase. Traditional methods require first constructing a specific detector and then repeatedly adjusting the detection threshold through trial and error to adapt to the system. This not only results in a long development cycle but also fails to fundamentally answer the underlying question of "how much resistance to covert attacks does the system itself possess."

[0016] To address the aforementioned bottlenecks, this invention proposes using information flow metric as a dynamic quantitative indicator of detectability, constructing a detectability quantification system based on information theory. The core idea is to model the relationship between the system state evolution under covert attacks and the observation at the detection end as a transmission process of information from the attack injection point to the observation point. By quantifying information flow indicators such as mutual information and transfer entropy along this transmission path, a continuous measurement of the attack's detectability can be achieved. Simultaneously, this invention derives a strict inequality for detectability determination, clarifying the correspondence between the information flow metric threshold and the lower bound of detection performance—when the system's information flow metric is higher than the determination threshold, theoretically, a detector that meets the performance requirements must exist; conversely, the detection difficulty will exceed the theoretical upper limit, making effective detection impossible.

[0017] The core value of this invention lies in elevating the research paradigm of detection problems from the engineering level of "designing specific detectors" to the information theory level of "evaluating the system's own information transmission capabilities." Engineers can directly predict the inherent potential of a system to resist covert attacks by calculating information flow metrics during the system design phase, without relying on detector prototype construction and repeated threshold adjustments. This provides a quantitative basis for the optimized design of system security parameters and a theoretical reference for the performance limits of subsequent detectors.

[0018] The fourth innovation of this invention is that it transforms attack identification into a convex optimization problem with sparse constraints, achieving joint estimation of passive states and attacks. In the field of intelligent sensing, attack detection of information typically separates attack detection from state estimation. This separation easily leads to a fundamental dilemma: the state estimation process itself is highly susceptible to contamination by carefully designed attack data. The resulting estimation bias further propagates to the residual verification stage, forming a vicious cycle of "residual contamination—estimation bias—detection failure." This coupling effect causes traditional methods to often lose their required detection sensitivity and estimation accuracy when facing highly concealed spoofed data injection attacks.

[0019] To address this bottleneck, this invention proposes a joint optimization estimation framework based on sparse constraints. The core idea is to transform attack identification and state estimation from a sequential, separate process into an integrated, collaborative solution. Specifically, this method models the attack vector as a set of sparse signals—an assumption rooted in the reality that attackers typically can only manipulate a limited number of measurement channels—and incorporates them, along with the system state variables, into a unified objective function. Thus, the original dual-task problem is reconstructed into a joint estimation problem with a sparse regularization term.

[0020] Building upon this foundation, to further ensure the computational feasibility and solution efficiency of the algorithm in practical deployment, this invention introduces convex relaxation techniques to equivalently transform the optimization problem. By using the ℓ1 norm instead of the ℓ0 norm as a convex surrogate for sparsity, the originally non-convex and NP-hard combinatorial optimization problem is relaxed into a typical convex optimization problem. This transformation guarantees a globally optimal solution and allows for rapid solution using mature and efficient numerical algorithms such as the interior-point method and the alternating direction multiplier method. Ultimately, the system can simultaneously output accurate state estimates and precise attack location results in a single optimization process, fundamentally severing the feedback chain of mutual error amplification in the separate method, and significantly improving the robustness and resilience of cyber-physical systems in the face of malicious data tampering.

[0021] To achieve the above objectives, the specific technical solution of the information integrity detection method based on one-way control of intelligent sensors of the present invention is as follows:

[0022] A method for information integrity detection based on one-way control using intelligent sensors includes the following steps:

[0023] Step S1: Deploy intelligent sensor nodes dedicated to industrial control protocol parsing on the programmable logic controller. The intelligent sensors acquire network traffic in a physical bypass manner through an optical fiber splitter and cannot send any data packets to the network.

[0024] Step S2: The intelligent sensor collects information from the switch in real time and parses the industrial control protocol data packets in the network;

[0025] Step S3: The intelligent sensor extracts the feature information of the control instructions in the industrial control protocol data packet. The feature information includes the instruction type, target address, data value, and timestamp, and calculates its hash value.

[0026] Step S4: The smart sensor sends the feature information to the integrity detection engine deployed in the secure zone through an independent, unidirectional fiber optic link. The feature information does not contain the original data packet.

[0027] Step S5: The integrity detection engine of the secure zone receives the feature information sent by the smart sensor;

[0028] Step S6: The integrity detection engine of the security zone determines whether the feature information has been completely received. If it has not been completely received, it returns to step S4.

[0029] Step S7: The integrity detection engine of the security zone determines whether to send attack information to the switch. If not, it stops sending attack information and proceeds to step S8. If yes, it sends attack information to the switch, sends a collection command to the smart sensor, and then returns to step S2.

[0030] Step S8: The integrity detection engine of the security zone uses an information integrity detection model based on intelligent sensor unidirectional control to detect the feature information. If it does not meet the detection criteria, it is determined to be an integrity abnormality; if it meets the detection criteria, it is determined to be an integrity normality.

[0031] Step S9: The integrity detection engine of the security zone counts the detection results and generates a decision, and at the same time sends the abnormal events to the management platform through a one-way interface, and the management platform issues an alarm.

[0032] Step S10: Detection ends.

[0033] Furthermore, the information integrity detection model based on intelligent sensor unidirectional control includes:

[0034] A dynamic model for intelligent sensor network monitoring is used to establish a mathematical framework describing the relationship between system state evolution and sensor measurements.

[0035] A feature model for sensor information integrity attacks is used to model the attack vector as a composite structure that satisfies sparsity constraints and arbitrary amplitude.

[0036] A detection model based on sensor information is used to determine whether an attack exists based on the measurement sequence.

[0037] Furthermore, the dynamic model for monitoring by the intelligent sensor network is constructed as follows:

[0038] At discrete time System status The evolution follows a linear dynamic equation:

[0039] in Here is the state transition matrix. For the input matrix, To control the input, This is process noise;

[0040] Equipped When the first smart sensor is used, the first The measurement model for each sensor is as follows:

[0041] in For the first The observation matrix of each sensor; For measuring noise; For the attacker in the The deviation term introduced by each sensor;

[0042] The compact form of all sensor measurements is as follows:

[0043] in For the received measurement vector, For the global observation matrix, To measure the noise vector, This is the attack vector.

[0044] Furthermore, in the feature model of the sensor information integrity attack, the attack vector It has the following characteristics:

[0045] Arbitrariness: Without statistical constraints, attackers can design arbitrarily based on the system model and the target.

[0046] Sparsity: The set of metrics of the attacked sensor is ,and , ,but:

[0047] The collection of attacked sensors It does not change over time.

[0048] Furthermore, the detection model for the sensor information includes residual generation;

[0049] State estimation is obtained using a Kalman filter under the no-attack assumption:

[0050]

[0051] The innovation or residual is defined as:

[0052] When there is no attack, Zero-mean Gaussian white noise; when an attack is present:

[0053]

[0054] The attacker's goal is to design Make residual To achieve covert attacks, the statistical characteristics should be as close as possible to those of a non-attack scenario.

[0055] Furthermore, the detection model of the sensing information includes detection criteria, which include a hypothesis testing-based detection criterion, an information flow-based detectability condition criterion, and an optimization-based robust state estimation criterion.

[0056] The detection criteria based on hypothesis testing define a binary hypothesis testing problem: No attack;

[0057] Attack exists;

[0058] Detector design decision rules ,in Deadline All available information;

[0059] The detectability criterion based on information flow is as follows: Let... Deadline Information flow measurement, if Then there exists a detector such that the detection probability ( And the probability of false alarms At a rate of at least Converging to 0; if If so, the attack is a covert attack;

[0060] The optimization-based robust state estimation criterion achieves robust state estimation by solving a convex optimization problem:

[0061] Alternatively, the attack vector can be directly estimated through sparse optimization:

[0062]

[0063] in This represents the number of non-zero elements in the attack vector, and the problem is solved by... Norm substitution Solving for the convex relaxation of the norm.

[0064] Furthermore, the intelligent sensor is an independent unidirectional detection node, which cuts off the reverse influence of the detection process on the system under test by combining physical isolation and logical unidirectionality. The physical isolation realizes the unidirectional acquisition of network traffic through an optical fiber splitter, and the logical unidirectionality realizes the unidirectional transmission of feature data through an independent unidirectional optical fiber link.

[0065] Furthermore, attack vectors Modeled as a composite structure of sparsity and arbitrary perturbation, the adversarial perturbation is decomposed into two orthogonal components: the sparse attack component characterizes the attacker's ability to tamper with a limited number of key samples, and its support set is constrained by cardinality to reflect the scarcity of attack resources; the arbitrary perturbation component characterizes the continuous perturbation applied by the attacker in the feature space, and adopts norm sphere constraints to capture imperceptible modifications; the two types of constraints form a compact convex envelope of the attack feasible set through Cartesian product.

[0066] Furthermore, the alarms issued by the management platform in step S9 include alarm information that alerts the administrator that there may be malicious control or operational errors. The abnormal events are transmitted through a one-way interface to ensure that the abnormal reporting process does not affect the normal operation of the system under test.

[0067] Furthermore, the hash value mentioned in step S3 is used to compare and verify with the subsequently received feature information to detect whether the data has been tampered with or lost during transmission.

[0068] The information integrity detection method based on one-way control of intelligent sensors of the present invention has the following advantages:

[0069] 1. Intrinsically secure: Cut off reverse attack paths

[0070] The intelligent sensor obtains traffic through physical bypass via an optical fiber splitter and cannot send any data packets to the network. At the same time, the feature data is transmitted to the security zone via an independent unidirectional optical fiber link, which fundamentally eliminates the possibility of the detection system being attacked or controlled, and meets the unidirectional isolation requirements of Level 3 or above of the Information Security Protection Standard 2.0.

[0071] 2. Strong resistance to covert attacks

[0072] By modeling attacks as a composite structure of "sparseness + arbitrary perturbation" and introducing the algebraic criterion of structural left invertibility, it is possible to determine whether an attack is theoretically detectable during the system design phase, avoiding ineffective monitoring of "undetectable attacks" and significantly improving the targeting and resource utilization efficiency of detection.

[0073] 3. Does not rely on active stimulation, adaptable to unidirectional transmission scenarios.

[0074] The detection process does not inject any detection signals or verification requests into the system under test. It completes the integrity judgment entirely based on passive observation data, which solves the core bottleneck of the conflict between the traditional two-way verification scheme and the one-way transmission security specifications. It is suitable for high-security one-way isolation scenarios such as oil and gas pipelines and power grids.

[0075] 4. Theoretically complete: Upgraded from "empirical threshold" to "algebraic criterion"

[0076] We propose quantitative measures for structural left reversibility and information flow detectability, elevating the detection problem from "designing detectors" to the information theory level of "evaluating the system's own detection potential," providing a quantitative theoretical basis for optimizing the design of system security parameters and reducing the cost of repeated trial and error.

[0077] 5. High-precision attack localization and joint state estimation

[0078] By employing a sparse-constrained convex optimization framework, attack identification and state estimation are solved in an integrated manner, and accurate state estimates and attack location results are output simultaneously. This breaks the vicious cycle of positive feedback in traditional separation methods, which is characterized by "residual contamination - estimation offset - detection failure", and improves the robustness of the system.

[0079] 6. Low resource consumption, suitable for large-scale deployment

[0080] The intelligent sensor extracts only feature information (instruction type, target address, data value, timestamp, hash value), does not transmit the original data packet, and does not need to respond to system-side verification requests, which greatly reduces communication bandwidth and node computing / storage overhead, making it suitable for battery-powered wide-area sensing nodes (such as geological disaster monitoring and pipeline vibration detection).

[0081] 7. Data integrity transmission guarantee

[0082] The extracted feature information includes hash values, which are used to compare and verify with subsequently received data. This can detect whether the data has been tampered with or lost during transmission, further enhancing the reliability of end-to-end data.

[0083] 8. Abnormal reporting is isolated in one direction, without affecting production operations.

[0084] Abnormal events are sent to the management platform through a one-way interface to ensure that the alarm reporting process does not affect the normal operation of the controlled system under test, thus achieving full-link security isolation of "detection-reporting".

[0085] 9. Possesses scalability and versatility.

[0086] The model is based on linear dynamic systems and sparse attack assumptions, and can be adapted to various industrial control protocols and sensor configurations. Furthermore, the convex optimization solution path is mature (internal point method, ADMM, etc.), which facilitates engineering implementation and secondary development. Attached Figure Description

[0087] Figure 1 Flowchart of an information integrity detection method based on one-way control of intelligent sensors;

[0088] Figure 2 Flowchart of information integrity detection based on one-way control of intelligent sensors. Detailed Implementation

[0089] To better understand the purpose, structure, and function of this invention, the following detailed description of an information integrity detection method based on one-way control of an intelligent sensor, in conjunction with the accompanying drawings, is provided.

[0090] like Figure 1 As shown, the information integrity detection model based on one-way control of intelligent sensors of the present invention includes a dynamic model of intelligent sensor network monitoring, a feature model of sensor information integrity attack, and a sensor information detection model.

[0091] The dynamic model of the intelligent sensor network monitoring is used to establish a mathematical framework describing the relationship between system state evolution and sensor measurements.

[0092] The feature model of the sensor information integrity attack is used to model the attack vector as a composite structure that satisfies sparsity constraints and has arbitrary amplitude.

[0093] The detection model for the sensor information is used to determine whether an attack exists based on the measurement sequence. It includes a residual generation submodule, a structural left invertibility algebraic criterion submodule, an information flow detectability quantization measurement submodule, and a joint optimization estimation submodule based on sparse constraints.

[0094] The method for constructing an information integrity detection model based on one-way control of intelligent sensors according to the present invention includes the following steps:

[0095] Step 1: Construct a dynamic model for intelligent sensor network monitoring

[0096] First, assume that the intelligent sensor network is a dynamically changing system, which changes at discrete times. The state can be Then its state evolution follows a linear dynamic equation:

[0097]

[0098] in Here is the state transition matrix. For the input matrix, To control the input, This is process noise (usually assumed to be Gaussian white noise).

[0099] If the system is equipped The first smart sensor, then the second The measurement model of a single sensor can be represented as:

[0100]

[0101] in: For the first The observation matrix of each sensor; To measure noise (usually assumed to be zero-mean Gaussian noise); For the attacker in the The bias term introduced by each sensor.

[0102] If all sensor measurements are written in compact form, it would be:

[0103]

[0104] in For the received measurement vector, For the global observation matrix, To measure the noise vector, This is the attack vector.

[0105] Step 2: Construct a feature model for sensor information integrity attacks

[0106] Information integrity attacks (such as spoofed data injection attacks) refer to attackers tampering with sensor measurements, causing the received data to be compromised. Deviation from true value Attack Vector It will have the following key characteristics:

[0107] Step 2.1: Arbitrariness: Without any statistical constraints, attackers can design arbitrarily based on the system model and the target.

[0108] Step 2.2: Sparsity: It is usually assumed that only a few sensors are compromised, i.e., the attack vector It is sparse. Let the set of metrics of the attacked sensor be... ,and ( ),but:

[0109]

[0110] The collection of attacked sensors It does not change over time.

[0111] Step 3: Construct a detection model for sensor information

[0112] The goal of information integrity detection is: based on the received measurement sequence Determine if an attack exists (i.e., whether an attack exists). Make Its model covers residual generation, detection criteria, and detection in unidirectional control scenarios. The detection criteria include: hypothesis testing-based detection, optimization-based robust state estimation, and optimization-based robust state estimation. These are described below:

[0113] Step 3.1: Residual Generation

[0114] Under the no-attack assumption ( The state estimate of the system can be obtained through a Kalman filter:

[0115]

[0116]

[0117] The innovation or residual is defined as:

[0118]

[0119] When there is no attack, It is zero-mean Gaussian white noise. When an attack is present:

[0120]

[0121] The attacker's goal is to design Make residual To achieve covert attacks, the statistical characteristics should be as close as possible to those of a non-attack scenario.

[0122] Step 3.2: Testing Criteria

[0123] a) Detection based on hypothesis testing

[0124] Define the binary hypothesis testing problem:

[0125] (No attack)

[0126] (Attack exists)

[0127] Detector design decision rules ,in Deadline All available information.

[0128] Detection performance is characterized by the following two probabilities:

[0129] (Probability of false alarms)

[0130] (Detection probability)

[0131] b) Detectability conditions based on information flow

[0132] Information flow theory provides a theoretical foundation for detection. Let... Deadline Information flow measurement. If:

[0133]

[0134] Then there exists a detector such that the detection probability ( And the probability of false alarms At a rate of at least It converges to 0.

[0135] Conversely, if:

[0136]

[0137] Therefore, no detector can simultaneously satisfy both a high detection probability and a low false alarm probability—the attack is stealthy.

[0138] c) Robust state estimation based on optimization

[0139] In the presence of sparse attacks, robust state estimation can be achieved by solving the following convex optimization problem:

[0140]

[0141] Alternatively, the attack vector can be directly estimated through sparse optimization:

[0142]

[0143] in This represents the number of non-zero elements in the attack vector. This problem can be solved by convex relaxation (e.g., ...). Norm substitution Solve for the norm.

[0144] Step 3.2: Detection in a one-way control scenario

[0145] In unidirectional control scenarios, control signals flow only from the controller to the actuator, and sensor data is transmitted only unidirectionally to the controller. In this case, detection relies entirely on a passive detection strategy—the detector is based solely on observation data. The ability to detect the virus cannot be enhanced by actively injecting incentive signals (such as watermarks).

[0146] Therefore, the structural left-reversibility of a system becomes a key condition for the detectability of attacks. If a system does not possess structural left-reversibility, then undetectable zero-dynamics attacks will inevitably exist.

[0147] like Figure 2 The implementation steps of the information integrity detection method based on one-way control of intelligent sensors are shown below:

[0148] Step 1: Deploy a dedicated smart sensor node for industrial control protocol parsing on the programmable logic controller (PLC). Requirement: This smart sensor acquires network traffic via a fiber optic splitter (physical bypass) and cannot send any data packets to the network.

[0149] Step 2: The intelligent sensors collect information from the switch in real time and parse the industrial control protocol data packets in the network.

[0150] Step 3: The intelligent sensor extracts the characteristics of the control instructions in the industrial control protocol data packet, including the instruction type, target address, data value, timestamp, and calculates its hash value.

[0151] Step 4: The smart sensor sends the aforementioned feature data (excluding the original data packet) to the integrity detection engine deployed in the secure zone via an independent, unidirectional fiber optic link.

[0152] Step 5: The integrity detection engine of the secure zone receives its characteristic data based on the information from the smart sensors.

[0153] Step 6: The integrity detection engine of the secure area determines whether the feature data has been completely received. If so, proceed to step 7; otherwise, proceed to step 4.

[0154] Step 7: The integrity detection engine of the secure zone determines whether to send attack information to the interactive device. If not, it stops sending attack information and proceeds to step 8; if so, the integrity detection engine of the secure zone sends attack information to the interactive device and sends a collection command to the smart sensor, then proceeds to step 2.

[0155] Step 8: The integrity detection engine of the secure zone uses the information integrity detection method based on intelligent sensor unidirectional control proposed in this invention for detection. If the detection criteria are not met, the engine immediately determines that the integrity is abnormal; if the detection criteria are met, the engine immediately determines that the integrity is normal.

[0156] Step 9: The engine compiles statistics and intelligently generates decisions. At the same time, it sends abnormal events to the management platform through a one-way interface. The platform issues an alarm, prompting the administrator that there may be malicious control or operational errors.

[0157] Step 10: Test complete.

[0158] It is understood that the present invention has been described through some embodiments, and those skilled in the art will recognize that various changes or equivalent substitutions can be made to these features and embodiments without departing from the spirit and scope of the invention. Furthermore, under the teachings of the present invention, these features and embodiments can be modified to adapt to specific situations and materials without departing from the spirit and scope of the invention. Therefore, the present invention is not limited to the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the protection scope of the present invention.

Claims

1. A method for detecting information integrity based on one-way control using intelligent sensors, characterized in that, Includes the following steps: Step S1: Deploy intelligent sensor nodes dedicated to industrial control protocol parsing on the programmable logic controller. The intelligent sensors acquire network traffic in a physical bypass manner through an optical fiber splitter and cannot send any data packets to the network. Step S2: The intelligent sensor collects information from the switch in real time and parses the industrial control protocol data packets in the network; Step S3: The intelligent sensor extracts the feature information of the control instructions in the industrial control protocol data packet. The feature information includes the instruction type, target address, data value, and timestamp, and calculates its hash value. Step S4: The smart sensor sends the feature information to the integrity detection engine deployed in the secure zone through an independent, unidirectional fiber optic link. The feature information does not contain the original data packet. Step S5: The integrity detection engine of the secure zone receives the feature information sent by the smart sensor; Step S6: The integrity detection engine of the security zone determines whether the feature information has been completely received. If it has not been completely received, it returns to step S4. Step S7: The integrity detection engine of the security zone determines whether to send attack information to the switch. If not, it stops sending attack information and proceeds to step S8. If yes, it sends attack information to the switch, sends a collection command to the smart sensor, and then returns to step S2. Step S8: The integrity detection engine of the security zone uses an information integrity detection model based on intelligent sensor unidirectional control to detect the feature information. If it does not meet the detection criteria, it is determined to be an integrity abnormality; if it meets the detection criteria, it is determined to be an integrity normality. Step S9: The integrity detection engine of the security zone counts the detection results and generates a decision, and at the same time sends the abnormal events to the management platform through a one-way interface, and the management platform issues an alarm. Step S10: Detection ends.

2. The method according to claim 1, characterized in that, The information integrity detection model based on intelligent sensor unidirectional control includes: A dynamic model for intelligent sensor network monitoring is used to establish a mathematical framework describing the relationship between system state evolution and sensor measurements. A feature model for sensor information integrity attacks is used to model the attack vector as a composite structure that satisfies sparsity constraints and arbitrary amplitude. A detection model based on sensor information is used to determine whether an attack exists based on the measurement sequence.

3. The method according to claim 2, characterized in that, The dynamic model for monitoring via the intelligent sensor network is constructed as follows: At discrete time System status The evolution follows a linear dynamic equation: in Here is the state transition matrix. For the input matrix, To control the input, This is process noise; Equipped When the first smart sensor is used, the first The measurement model for each sensor is as follows: in For the first The observation matrix of each sensor; For measuring noise; For the attacker in the The deviation term introduced by each sensor; The compact form of all sensor measurements is as follows: in For the received measurement vector, For the global observation matrix, To measure the noise vector, This is the attack vector.

4. The method according to claim 2, characterized in that, In the feature model of the sensor information integrity attack, the attack vector It has the following characteristics: Arbitrariness: Without statistical constraints, attackers can design arbitrarily based on the system model and the target. Sparsity: The set of metrics of the attacked sensor is ,and , ,but: The collection of attacked sensors It does not change over time.

5. The method according to claim 2, characterized in that, The detection model for the sensor information includes residual generation; State estimation is obtained using a Kalman filter under the no-attack assumption: The innovation or residual is defined as: When there is no attack, Zero-mean Gaussian white noise; when an attack is present: The attacker's goal is to design Make residual To achieve covert attacks, the statistical characteristics should be as close as possible to those of a non-attack scenario.

6. The method according to claim 5, characterized in that, The detection model for the sensor information includes detection criteria, which include a hypothesis testing-based detection criterion, an information flow-based detectability condition criterion, and an optimization-based robust state estimation criterion. The detection criteria based on hypothesis testing define a binary hypothesis testing problem: No attack; ； An attack exists; Detector design decision rules ,in Deadline All available information; The detectability criterion based on information flow is as follows: Let... Deadline Information flow measurement, if Then there exists a detector such that the detection probability ( And the probability of false alarms At a rate of at least Converging to 0; if If so, the attack is a covert attack; The optimization-based robust state estimation criterion achieves robust state estimation by solving a convex optimization problem: Alternatively, the attack vector can be directly estimated through sparse optimization: in This represents the number of non-zero elements in the attack vector, and the problem is solved by... Norm substitution Solving for the convex relaxation of the norm.

7. The method according to claim 1, characterized in that, The intelligent sensor is an independent unidirectional detection node. It cuts off the reverse influence of the detection process on the system under test by combining physical isolation and logical unidirectionality. The physical isolation realizes the unidirectional acquisition of network traffic through an optical fiber splitter, and the logical unidirectionality realizes the unidirectional transmission of feature data through an independent unidirectional optical fiber link.

8. The method according to claim 2, characterized in that, Attack Vector Modeled as a composite structure of sparsity and arbitrary perturbation, the adversarial perturbation is decomposed into two orthogonal components: the sparse attack component represents the attacker's ability to tamper with a limited number of key samples, and its support set is constrained by cardinality to reflect the scarcity of attack resources. Arbitrary perturbation components characterize the continuous perturbations imposed by the attacker in the feature space, and norm sphere constraints are used to capture imperceptible modifications; the two types of constraints form a compact convex envelope of the attack feasible set through Cartesian product.

9. The method according to claim 1, characterized in that, The alarms issued by the management platform in step S9 include alarm information that prompts the administrator that there may be malicious control or operational errors. The abnormal events are transmitted through a one-way interface to ensure that the abnormal reporting process does not affect the normal operation of the system under test.

10. The method according to claim 1, characterized in that, The hash value mentioned in step S3 is used to compare and verify with the subsequently received feature information to detect whether the data has been tampered with or lost during transmission.

Images