A risk grading-based industrial control software security crowd testing personnel behavior anomaly controllable disposal method, device, medium and product

Abstract

The application discloses a risk grading-based abnormal behavior controllable disposal method, device, medium and product for crowd testing personnel of industrial control software security, relates to the field of industrial control software security management and control, and comprises the following steps: abnormal behavior identification is performed on behavior data of the crowd testing personnel to generate suspected abnormal behavior events, multi-dimensional time sequence behavior features are extracted, scene characteristic parameters are combined, behavior abnormality risk scores are calculated, the behavior abnormality risk scores are mapped to a risk level threshold interval matched, a target risk level is determined, a differentiated disposal strategy is matched from a disposal strategy library and executed, a structured log is generated and stored in a block chain, disposal effect is verified in multiple dimensions in parallel, a disposal effect verification report is generated, and the above results are stored in an abnormal case library in association and optimized through double self-calibration. The application can realize controllable, efficient and accurate disposal of abnormal behavior of crowd testing personnel of industrial control software security, and balance industrial control security management and control and crowd testing efficiency.

Description

Technical Field

[0001] This application relates to the field of industrial control software security management, and in particular to a method, equipment, medium and product for controllable handling of abnormal behavior of industrial control software security crowdsourced testers based on risk classification. Background Technology

[0002] With the deep integration of the Industrial Internet and manufacturing, industrial control software, as the "nerve center" of critical infrastructure industrial control systems, directly determines the continuity of industrial production and operation and public safety through its security and stability. However, during the crowdsourcing testing of industrial control software security, the behavior of testers is complex and uncertain, posing a severe challenge to the security management of industrial control software. Testers may accidentally modify the software due to operational errors (such as misadjusting core PLC control parameters), or maliciously leak data (such as downloading industrial control system configuration files), or even cause the security isolation between the test environment and the real industrial control network to fail due to abuse of privileges.

[0003] Currently, the handling of abnormal behavior by testers in the field of industrial control software security crowdsourcing generally adopts a "one-size-fits-all" approach: whether it's a low-risk anomaly like "accidentally clicking a sensitive function button" or a high-risk anomaly like "injecting malicious code to tamper with control logic," the common response is to "freeze the account and interrupt the test." This traditional approach has significant technical flaws: (1) Risk classification is divorced from the characteristics of industrial control and only uses general indicators such as the impact and scope of behavior. It does not take into account the core characteristics of the industry, such as the sensitivity of industrial control software control logic, the special nature of industrial protocols, and the criticality of process parameters. This results in high-risk industrial control anomalies (such as minor process parameter tampering and illegal invocation of industrial protocols) being under-judged and low-risk behaviors being over-judged.

[0004] (2) The grading threshold is fixed and rigid. The risk level is divided by a fixed score threshold, which cannot adapt to the different risk tolerance of different industrial control scenarios such as power, petrochemical, and rail transit. It also cannot be dynamically adjusted according to the progress of the crowdsourcing task (such as the early / late stage of the test) and the test object (core PLC / ordinary monitoring module).

[0005] (3) The timing characteristics of the behavior are not considered. Single behaviors are judged independently, ignoring the temporal correlation of abnormal industrial control behaviors (such as the continuous behavior sequence of "first query process parameters → then modify → then try to upload". Single behaviors are risk-free, but the combination is high-risk), resulting in the distortion of the classification of hidden industrial control anomalies.

[0006] (4) The calibration mechanism is simple, and only the threshold is adjusted based on the harm rate / false judgment rate of historical abnormal data. It lacks the self-learning and scene adaptation capabilities of AI models, and the improvement of classification accuracy is limited.

[0007] (5) The handling intensity is not matched with the risk level. Over-handling of low-risk anomalies will significantly reduce testing efficiency, resulting in idle high-quality testing resources and extended project cycles. If precise control measures are not taken in a timely manner for high-risk anomalies, the best opportunity to contain the risk may be missed, leading to leakage of core data or loss of control of the testing environment.

[0008] In summary, existing technologies for handling abnormal behavior of crowdsourced testers of industrial control software security fail to establish a matching mechanism between "risk level and handling intensity," which neither meets the stringent "security" requirements of crowdsourced testing of industrial control software nor takes into account the testing process. Summary of the Invention

[0009] The purpose of this application is to provide a method, equipment, medium, and product for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification. This method can achieve controllable, efficient, and accurate handling of abnormal behavior of crowdsourced testers of industrial control software security, and balance industrial control security management with crowdsourced testing efficiency.

[0010] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for controllable handling of abnormal behavior of crowdsourced security testers for industrial control software based on risk classification, including: The system collects behavioral data from multiple sources during the crowd testing process of industrial control software security, and uses a rule engine and deep learning model to identify abnormal behaviors in the behavioral data and generate suspected abnormal behavior events. Based on the suspected abnormal behavior events, multi-dimensional time-series behavioral features are extracted, and combined with the scene feature parameters in the pre-built industrial control scene feature library, a behavioral abnormality risk score is calculated. Based on the scenario feature parameters, the corresponding risk level threshold range is dynamically matched from the multi-dimensional threshold base table, and the abnormal behavior risk score is mapped to the risk level threshold range to determine the target risk level. Based on the target risk level, a differentiated disposal strategy is matched from the disposal strategy library and executed, while a structured log is generated and stored on the blockchain. The effectiveness of the differentiated treatment strategy is verified in multiple dimensions and in parallel, and a treatment effectiveness verification report is generated. The suspected abnormal behavior events, target risk levels, differentiated handling strategies, handling effect verification reports, and actual harm determination data are associated and stored in the abnormal case library, and dual self-calibration optimization is performed based on the full-link data in the abnormal case library.

[0011] Secondly, this application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification.

[0012] Thirdly, this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method for controlling abnormal behavior of crowdsourced testers of industrial control software based on risk classification.

[0013] Fourthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification.

[0014] According to the specific embodiments provided in this application, this application has the following technical effects: (1) By using a rule engine and a deep learning model to identify abnormal behavior in the behavioral data, it can accurately match clear violation rules and capture hidden time-series dependency anomalies. By combining multi-dimensional time-series behavioral features and scene feature parameters, it solves the problem of high false alarm rate and high false alarm rate caused by the traditional method due to the separation from the industrial control business logic, and realizes accurate perception of abnormal behavior of industrial control software crowd testers. (2) Based on the scenario feature parameters, the corresponding risk level threshold range is dynamically matched from the multi-dimensional threshold base table, and the abnormal behavior risk score is mapped to the risk level threshold range to determine the target risk level. This breaks through the limitation that traditional fixed thresholds cannot adapt to the risk tolerance differences of different industrial control scenarios (such as power core modules and ordinary monitoring modules); it ensures that the risk level judgment is highly matched with the actual industrial control hazard level, and realizes the scenario-based adaptive classification standard. (3) By implementing differentiated handling strategies, generating structured logs and storing them on the blockchain, and conducting multi-dimensional parallel verification of the handling effects, the problems of delayed response, easily tampered operation records, and lack of effect confirmation in traditional automated handling are solved; high-risk behaviors can be prioritized and quickly blocked, the handling process is tamper-proof, and the handling results are genuine and effective, thus realizing the inherent security of the industrial control security crowdsourcing environment. (4) Based on the full-link data in the abnormal case library, dual self-calibration optimization is carried out, which solves the problems of limited calibration effect and lack of self-learning ability of traditional systems, and forms a virtuous closed loop of "identification-grading-disposal-verification-optimization", which enhances the long-term adaptability to cope with new industrial control threats. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating a method for controlling abnormal behavior of crowdsourced testers of industrial control software security based on risk classification, as provided in an embodiment of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0019] In one exemplary embodiment, such as Figure 1 As shown, a method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification is provided. The method is executed by computer equipment, specifically by a computer device such as a terminal or a server alone, or by a terminal and a server together. In this embodiment, the method is described using a server as an example, including the following steps S1 to S6.

[0020] S1: Collect behavioral data of participants in the crowdsourcing testing process of industrial control software security from multiple sources, and use a rule engine and deep learning model to identify abnormal behaviors in the behavioral data and generate suspected abnormal behavior events.

[0021] Specifically, the data collection targets include test terminal operation behaviors (keyboard input, mouse clicks, file operations). The collection method involves deploying a lightweight agent (using ≤5% CPU and ≤100MB memory) on the test terminal to collect data in real-time at a frequency of 1 time per second. The data is then encrypted using the SM4 encryption algorithm before being transmitted to the system server. The server-side uses a high-performance gateway service written in Netty or Go, supporting long-term connections from a large number of agents. The gateway is responsible for decrypting the data, performing preliminary format validation, and then delivering the structured data to message queues such as Kafka for subsequent abnormal behavior identification.

[0022] Abnormal behavior identification specifically includes: (1) Use a rule engine to perform real-time matching of the behavioral data to identify violations and output the first identification result.

[0023] Specifically, a high-performance rule engine, either Drools or a self-developed one, is used. Rules such as "modifying ≥5 core parameters within 10 minutes" are written as DSL (Domain-Specific Language) scripts. The rule engine consumes data streams from Kafka in real time and matches behavioral events. Clearly matching violations are directly output as "suspected anomalies".

[0024] (2) Use a deep learning model to identify the hidden abnormal behavior of the behavioral data and output the second identification result.

[0025] In this embodiment, a Transformer encoder (such as a variant of BERT) is used for unsupervised pre-training on a massive amount of normal industrial control operation logs, allowing the model to learn normal operating patterns. Supervised fine-tuning of the pre-trained model is then performed using labeled (normal / abnormal) historical data. After training, the behavioral data is converted into a token sequence that the model can understand (similar to converting words into vectors in NLP) and input into the Transformer encoder, outputting an "abnormal probability value" (between 0 and 1). A threshold is set (e.g., 0.992); when the abnormal probability value is greater than this threshold, it is considered abnormal.

[0026] (3) When the first identification result and the second identification result are logically ORed and merged, and when either identification result is determined to be abnormal, the suspected abnormal behavior event is generated.

[0027] The results from the rules engine and the deep learning model are merged using a logical "OR" component. If either channel is deemed abnormal, the behavioral event is listed as a suspected abnormal behavior event, ensuring no event is missed.

[0028] S2: Extract multi-dimensional temporal behavioral features based on the suspected abnormal behavior events, and calculate the behavioral abnormality risk score by combining them with scene feature parameters in a pre-built industrial control scenario feature library. Specifically, this includes: S21: The suspected abnormal behavior events are serialized into a behavior time sequence according to the timestamp, and the multi-dimensional time sequence behavior features of the behavior time sequence are extracted from three dimensions: behavior characteristics, time sequence correlation characteristics, and industrial control impact characteristics.

[0029] This embodiment introduces time-series behavior sequence mining technology, which transforms the behavior of testers from "single events" into "time-series behavior sequences" and extracts a three-dimensional feature set specific to industrial control, thereby achieving a comprehensive and multi-dimensional feature characterization of abnormal behavior.

[0030] Behavior timing processing: Serialize suspected abnormal behavior events into behavior timing sequences by timestamp (millisecond level), and segment them based on the smallest execution unit of industrial control operation (such as a parameter modification or a protocol call) to ensure the industrial control business logic of the sequence.

[0031] Industrial Control System (ICS) Specific 3D Feature Set Extraction: From three dimensions—behavior-specific features, temporal correlation features, and ICS impact features—a total of 28 sub-features were extracted, 16 of which are ICS-specific features, comprehensively covering the core features of abnormal ICS behavior. The multi-dimensional temporal behavior features include behavior-specific features, temporal correlation features, and ICS impact features, as detailed in Table 1. Table 1

[0032] S22: Extract the corresponding scene feature parameters from the pre-built industrial control scene feature library.

[0033] Industrial Control System (ICS) Scenario Feature Library Construction: Based on five core ICS industries—power, petrochemical, rail transit, steel manufacturing, and equipment manufacturing—a structured and scalable ICS scenario feature library is constructed. Each scenario includes three levels of feature dimensions (first-level scenario features, second-level test object features, and third-level task status features). The feature library supports dynamic addition / modification via a web interface without requiring an engine restart and can adapt to new ICS sub-scenarios. The three-level feature dimensions are detailed in Table 2. Table 2

[0034] Before the testers begin testing, the system automatically retrieves the current test scenario information, object information, and task status from the platform, and extracts the corresponding scenario feature parameters from the industrial control scenario feature library.

[0035] S23: Input the multi-dimensional temporal behavioral features and the scene feature parameters into the Transformer encoder for feature extraction, and perform nonlinear mapping on the extracted feature vectors through a multilayer perceptron to output a behavioral anomaly risk score.

[0036] In this embodiment, a Transformer encoder is used as the basic backbone network. Its self-attention mechanism can effectively capture long-distance and hidden temporal dependencies in the operation sequence, solving the problem of identifying "multi-step operation and hidden association" of abnormal industrial control behavior.

[0037] This embodiment introduces an innovative industrial control attention layer based on the standard Transformer attention mechanism to enhance the model's sensitivity to high-risk features in industrial control systems. Specifically, the extracted scene feature parameters (including industrial control scene features, test object features, and task state features) are converted into low-dimensional dense vectors. When calculating the attention score, not only are the semantic correlations between multi-dimensional temporal behavioral features considered, but scene feature parameters are also incorporated as conditional bias terms or gating signals into the calculation of the attention matrix. This allows the model to automatically focus on operation nodes with higher hazard weights in specific industrial control scenarios (such as power relay protection setting modifications or DCS process parameter adjustments), thereby achieving accurate perception of industrial control-specific abnormal behaviors.

[0038] Multilayer perceptron (MLP) is used to non-linearly map the output feature vector of the Transformer encoder, outputting a behavior anomaly probability value between 0 and 1, and mapping the anomaly probability value to a behavior anomaly risk score of 0-100.

[0039] In the pre-training phase, we collected massive amounts of normal crowdsourcing behavior logs and historical abnormal behavior logs (more than 1 million records) from five major industrial control industries, including power and petrochemicals, to perform unsupervised pre-training on the model. This allowed the model to learn normal and abnormal behavior patterns under different industrial control scenarios, forming "prior knowledge" of industrial control behavior. In the fine-tuning phase, we used scenario-specific labeled datasets (normal / abnormal behavior, with actual hazard levels) to perform supervised fine-tuning on the pre-trained model for different industrial control scenarios, allowing the model to adapt to the risk judgment standards of different scenarios.

[0040] S3: Based on the scene feature parameters, dynamically match the corresponding risk level threshold range from the multi-dimensional threshold base table, map the abnormal behavior risk score to the risk level threshold range, and determine the target risk level.

[0041] Abandoning the original "fixed score threshold for risk level classification" model, a dynamic threshold mapping mechanism adaptive to industrial control scenarios is constructed. The abnormal behavior risk score is mapped to four risk levels (Level 1: low risk; Level 2: medium risk; Level 3: high risk; Level 4: extremely high risk) according to different industrial control scenarios, different test objects, and different task states, so as to achieve dynamic classification of "different thresholds for different scenarios and different thresholds for different objects".

[0042] Multi-dimensional Threshold Base Table Construction: Based on the industrial control system scenario feature library, a multi-dimensional threshold base table with four risk levels is constructed. The base table sets differentiated risk level threshold ranges for different scenarios, objects, and task states. The threshold ranges are formulated by industrial control security experts in combination with industry standards and actual hazard levels. An example is shown in Table 3. Table 3

[0043] Based on the scene feature parameters, the corresponding risk level threshold range is automatically matched from the multi-dimensional threshold base table, and the abnormal risk score is mapped to the corresponding risk level to achieve dynamic determination of risk level.

[0044] Real-time dynamic threshold adjustment: Supports two dynamic adjustment methods to ensure that the threshold matches the risk tolerance of the actual test scenario in real time.

[0045] (1) Based on the threshold modification instructions input by industrial control security experts through the Web interface, update the corresponding risk level threshold range in the multi-dimensional threshold base table.

[0046] (2) When the preset automatic adjustment triggering conditions are met, the risk level threshold range is automatically tightened.

[0047] For example, when the crowdsourcing platform triggers scenarios such as emergency tasks, core module testing, or periods of high incidence of abnormal behavior, the engine can automatically tighten and adjust the risk level threshold range (such as reducing the level 4 risk threshold from 60 points to 50 points) to improve the sensitivity of high-risk scenario classification.

[0048] S4: Based on the target risk level, match differentiated disposal strategies from the disposal strategy library, execute the differentiated disposal strategies, and generate structured logs for blockchain storage.

[0049] The policy library uses JSON format to store policies and supports dynamic updates (administrators can add new scenario policies through the web interface without restarting the system), with a policy call response time of ≤500ms.

[0050] When the target risk level is Level 1 (low risk), an alarm recording policy is matched; when the target risk level is Level 2 (medium risk), a policy to restrict the operation permissions of the test account is matched; when the target risk level is Level 3 (high risk), a policy to interrupt the test session and isolate the test terminal is matched; when the target risk level is Level 4 (extremely high risk), a policy to interrupt the test session, isolate the test terminal, freeze the test account, and roll back the industrial control parameters to a safe value is matched in parallel.

[0051] Based on the target risk level, precise and differentiated handling strategies are matched, with high-risk cases being prioritized. During the execution process, the log recorder generates structured logs in real time and calls the blockchain evidence storage service to write the log hash value to the blockchain, ensuring that the operation records are tamper-proof and traceable.

[0052] S5: Perform multi-dimensional parallel verification of the treatment effect after implementing the differentiated treatment strategy, and generate a treatment effect verification report.

[0053] The effectiveness of the measures is verified in multiple dimensions and in parallel to ensure that the risks are completely eliminated and to provide verification data for closed-loop risk management.

[0054] Specifically, virus scanning verification, network connectivity verification, and data integrity verification are initiated in parallel to verify the effectiveness of the differentiated handling strategy.

[0055] The virus scanning verification involves calling the virus scanning engine's API to scan the processed test terminal for malicious code.

[0056] The network connectivity verification involves initiating a TCP Ping or port connection test from the internal network to the isolated or blocked test node, confirming connection failure, and verifying the effectiveness of the isolation and blocking measures.

[0057] The data integrity verification involves calculating the MD5 or SHA256 hash value of the key configuration file, comparing it with the pre-stored baseline hash value, and verifying the compliance of the rolled-back process parameters with industrial control process compliance.

[0058] The verification results are summarized and a handling effect verification report is generated (including verification items, verification results, and anomaly descriptions), clearly indicating whether the handling was "successful", "failed", or "partially successful". The report hash value is stored on the blockchain and synchronized to the anomaly case database to provide data support for the calibration of the hierarchical engine.

[0059] S6: The suspected abnormal behavior events, target risk levels, differentiated handling strategies, handling effect verification reports, and actual harm level determination data are associated and stored in the abnormal case library, and dual self-calibration optimization is performed based on the full-link data in the abnormal case library.

[0060] Using Elasticsearch as both storage and search engine, an "anomaly case index" is created. This index automatically links the entire data chain for each anomaly event—from identification, classification, handling to verification (including event ID, scenario characteristics, AI score, risk level, handling strategy, verification results, actual harm level, and debriefing opinions)—to form a complete "case file," which is then synchronized to Elasticsearch via Logstash.

[0061] Dual self-calibration mechanism: Threshold self-calibration: Each month, based on the calibration dataset, threshold self-calibration is performed using the PR curve (precision-recall curve) combined with the industrial control hazard loss function. With the goal of "level precision ≥ 99.5% and high-risk recall 100%", higher loss weights are assigned to "low judgment of level 4 risk" and "high judgment of level 1 risk", and the threshold range in the multi-dimensional threshold base table is automatically adjusted.

[0062] Model self-learning optimization: Every quarter, based on the calibration dataset, graded error samples, new abnormal behavior samples, and new scene samples are extracted, re-labeled, and merged with the original training set to incrementally fine-tune the Transformer encoder, optimize the weights of the industrial control attention layer in the model, and achieve model self-evolution.

[0063] Application scenario example: In the power sector scenario, during crowdsourcing testing of a power grid dispatch automation system, when it is detected that a tester has continuously modified multiple critical relay protection settings within a very short period of time, based on the extremely high risk of potentially causing power grid oscillations, this is classified as a Level 4 risk. A Level 4 risk handling strategy is immediately applied, and the following actions are executed in parallel: the test session is interrupted, the test terminal is switched to an isolation sandbox, the tester's account permissions are frozen, and the relay protection settings are automatically rolled back to the safe baseline value. Simultaneously, a structured log is generated and uploaded to the blockchain for real-time evidence storage.

[0064] In the oil and petrochemical industry: During crowdsourcing testing of distributed control systems and safety instrumented systems in refining, oil and gas pipelines, modifications to process parameters (such as reactor temperature and pipeline pressure) by testers were identified and classified as a Level 3 risk. A Level 3 risk mitigation strategy was immediately implemented, including: interrupting the test session and isolating the test terminal to prevent the spread of the abnormal operation; and simultaneously triggering an alarm to notify safety experts to intervene and analyze the situation.

[0065] In the rail transit scenario: An abnormal testing operation was discovered by a tester on the train operation control system and signaling system software crowdsourcing platform, targeting train section block logic and signal interlocking conditions. Risk assessment determined this to be a Level 4 risk, potentially penetrating the real signaling network. A Level 4 risk mitigation strategy was immediately activated, executing the following actions in parallel: interrupting the test session, isolating the relevant test nodes, freezing the tester's account, and rolling back the signal interlocking configuration to a secure version. All actions and verification results were stored on the blockchain, creating an immutable audit trail.

[0066] In the steel manufacturing scenario, for crowdsourced testing of programmable logic controllers (PLCs) in complex processes such as blast furnaces, continuous casting, and rolling mills, the system effectively identifies abnormal modifications made by testers to the equipment control logic (such as abnormal equipment start-up and shutdown sequences or tampering with robot arm trajectories). If such behavior is assessed as a Level 4 risk (potentially leading to equipment collisions or production interruptions), a Level 4 risk mitigation strategy will be immediately applied, and the following actions will be executed in parallel: interrupting the test session, switching the test terminal to an isolation sandbox, freezing the tester's account permissions, and automatically rolling back the PLC control logic to a safe baseline value. Simultaneously, effect verification is initiated, comparing the control logic backup hash value to ensure its integrity, and all operation records are uploaded to the blockchain in real time for evidence storage. This ensures that while leveraging crowdsourced testing to discover deep vulnerabilities in industrial control software, significant property damage and production stoppages caused by the testing behavior itself are resolutely prevented.

[0067] In equipment manufacturing scenarios, during crowdsourcing testing of industrial control software involving industrial robots and CNC machine tools, malicious testing behaviors that could potentially cause physical damage to equipment (such as motion commands exceeding safety limits) are identified by monitoring operations such as G-code uploads and motion trajectory planning. If such behavior is assessed as a Level 4 risk, a Level 4 risk handling strategy will be immediately applied, and the following measures will be implemented in parallel: interrupting the test session, stripping the tester of control over the physical equipment and restricting their operation to a pure simulation environment (isolated terminal), freezing the test account, and rolling back the machining program to a secure version. Simultaneously, data integrity verification is triggered to ensure that the machining program has not been tampered with, enabling manufacturers to discover security vulnerabilities in core production equipment control software using crowdsourcing capabilities with zero risk.

[0068] In an exemplary embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments. The computer device can be a server or a terminal. The computer device includes a processor, a memory, an input / output interface (I / O), and a communication interface. The processor, memory, and I / O interface are connected via a system bus, and the communication interface is connected to the system bus via the I / O interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device stores data to be processed. The I / O interface of the computer device is used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with an external terminal via a network connection. When the computer program is executed by the processor, it implements the steps in the above-described method embodiments.

[0069] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0070] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0071] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0072] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0073] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0074] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0075] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification, characterized in that, include: The system collects behavioral data from multiple sources during the crowd testing process of industrial control software security, and uses a rule engine and deep learning model to identify abnormal behaviors in the behavioral data and generate suspected abnormal behavior events. Based on the suspected abnormal behavior events, multi-dimensional time-series behavioral features are extracted, and combined with the scene feature parameters in the pre-built industrial control scene feature library, a behavioral abnormality risk score is calculated. Based on the scenario feature parameters, the corresponding risk level threshold range is dynamically matched from the multi-dimensional threshold base table, and the abnormal behavior risk score is mapped to the risk level threshold range to determine the target risk level. Based on the target risk level, a differentiated disposal strategy is matched from the disposal strategy library and executed, while a structured log is generated and stored on the blockchain. The effectiveness of the differentiated treatment strategy is verified in multiple dimensions and in parallel, and a treatment effectiveness verification report is generated. The suspected abnormal behavior events, target risk levels, differentiated handling strategies, handling effect verification reports, and actual harm determination data are associated and stored in the abnormal case library, and dual self-calibration optimization is performed based on the full-link data in the abnormal case library.

2. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 1, characterized in that, The process of identifying abnormal behavior from the behavioral data using a rule engine and a deep learning model specifically includes: A rule engine is used to perform real-time matching of the behavioral data for specific violations, and a first identification result is output. A deep learning model is used to identify concealed abnormal behaviors in the behavioral data, and a second identification result is output. When the first identification result and the second identification result are logically ORed and merged, and either identification result is determined to be abnormal, the suspected abnormal behavior event is generated.

3. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 1, characterized in that, The multi-dimensional temporal behavioral characteristics include behavioral characteristics, temporal correlation characteristics, and industrial control impact characteristics; The scenario feature parameters include industrial control scenario features, test object features, and task status features.

4. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 3, characterized in that, Based on the suspected abnormal behavior events, multi-dimensional temporal behavior features are extracted, and combined with scene feature parameters in a pre-built industrial control scenario feature library, a behavior anomaly risk score is calculated, specifically including: The suspected abnormal behavior events are serialized into a behavior time sequence according to the timestamp, and multi-dimensional time sequence behavior features of the behavior time sequence are extracted from three dimensions: behavior characteristics, time sequence correlation characteristics, and industrial control impact characteristics. Extract the corresponding scene feature parameters from the pre-built industrial control scene feature library; The multi-dimensional temporal behavioral features and the scene feature parameters are input into the Transformer encoder for feature extraction, and the extracted feature vectors are nonlinearly mapped by a multilayer perceptron to output a behavioral anomaly risk score.

5. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 1, characterized in that, Based on the target risk level, differentiated handling strategies are matched from the handling strategy library, specifically including: When the target risk level is Level 1 Low Risk, the alarm recording strategy is matched; When the target risk level is Level 2 (medium risk), a policy to restrict the operation permissions of the test account will be applied. When the target risk level is Level 3 (high risk), the strategy of interrupting the test session and isolating the test terminal is applied. When the target risk level is Level 4 (extremely high risk), the strategy of interrupting the test session, isolating the test terminal, freezing the test account, and rolling back the industrial control parameters to a safe value is executed in parallel.

6. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 1, characterized in that, The effectiveness of the differentiated treatment strategy after its implementation is verified in a multi-dimensional and parallel manner, specifically including: To verify the effectiveness of the differentiated handling strategy, virus scanning, network connectivity verification, and data integrity verification are performed in parallel. The virus scanning verification involves calling the virus scanning engine's API to scan the processed test terminal for malicious code. The network connectivity verification involves initiating a TCP Ping or port connection test from the internal network to the isolated or blocked test node, confirming the connection failure, and verifying the effectiveness of the isolation and blocking measures. The data integrity verification involves calculating the MD5 or SHA256 hash value of the key configuration file, comparing it with the pre-stored baseline hash value, and verifying the compliance of the rolled-back process parameters with industrial control process compliance.

7. The method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software security based on risk classification as described in claim 1, characterized in that, Also includes: Based on the threshold modification command input by the industrial control security expert through the web interface, update the corresponding risk level threshold range in the multi-dimensional threshold base table; When the preset automatic adjustment trigger conditions are met, the risk level threshold range will be automatically tightened.

8. A computer device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the method for controllable handling of abnormal behavior of crowdsourced testers of industrial control software based on risk classification, as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method for controlling abnormal behavior of industrial control software security crowdsourcing testers based on risk classification, as described in any one of claims 1-7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for controlling abnormal behavior of industrial control software security crowdsourcing testers based on risk classification, as described in any one of claims 1-7.

Images