Industrial control instruction verification method, electronic device, medium and product

Abstract

The application discloses an industrial control instruction verification method, an electronic device, a medium and a product. The method comprises the following steps: performing semantic restoration on a to-be-detected instruction according to a semantic mapping dictionary to obtain business semantic data; obtaining a target active work order matched with the business semantic data; taking a behavior baseline model of the target active work order as a benchmark to verify the business semantic data to obtain a first verification result; calling an AI arbitration model to verify the to-be-detected instruction to obtain a second verification result; and generating a semantic arbitration result of the to-be-detected instruction according to the first verification result and the second verification result. The method can restore a bottom-layer network control instruction to business semantic data, and realizes real-time business logic compliance verification before instruction issuing in combination with work order context and double-engine arbitration.

Description

Technical Field

[0001] This application relates to the field of industrial network security technology, specifically to an industrial control instruction verification method, electronic device, readable storage medium, and computer program product. Background Technology

[0002] With the trend of deep integration of industrial intelligence and IT / OT, the interconnection between upper-level production management systems such as Enterprise Resource Planning (ERP) and Manufacturing Execution Systems (MES) and lower-level industrial control equipment such as Programmable Logic Controllers (PLCs) and Distributed Control Systems (DCS) has become standard. While improving the efficiency of production scheduling and automated management, this also further opens up the boundaries of industrial networks, exposing them to more complex network attacks and risks of operational errors. Existing command verification methods for unauthorized control commands that may occur during industrial control network communication typically employ access control mechanisms based on industrial firewalls or intrusion detection systems. These mechanisms rely on fixed ports, protocol types, IP addresses, and known attack signature databases for rule matching and traffic filtering to identify and block known network layer attacks. However, such technical solutions only perform compliance checks at the network communication level and cannot identify malicious commands with complete protocol formats but that violate process specifications or operational logic. The lack of correlation verification capabilities with upper-level production work orders and the current process context allows such business logic attacks to penetrate traditional protection systems and directly affect the physical production process, posing a significant security risk. Summary of the Invention

[0003] In view of the above problems, this application provides an industrial control instruction verification method, electronic device, readable storage medium, and computer program product, which can solve the problem that existing industrial security protection cannot recognize business logic attack instructions that comply with protocol formats but violate process procedures.

[0004] Firstly, this application provides an industrial control instruction verification method, including: The semantics of the instruction to be detected are restored based on the semantic mapping dictionary to obtain business semantic data; Obtain the target active work orders that match the business semantic data; Based on the behavioral baseline model of the target active work order, the business semantic data is verified to obtain the first verification result; The AI ​​adjudication model is invoked to verify the instruction to be detected, and a second verification result is obtained. The semantic decision result of the instruction to be detected is generated based on the first verification result and the second verification result.

[0005] In the above technical solution, the method first performs semantic restoration of instructions based on a semantic mapping dictionary, translating the underlying register addresses and protocol points into unified business objects, thereby eliminating the semantic heterogeneity gap between IT and OT systems and laying the foundation for data alignment for subsequent verification. Second, by acquiring target active work orders that match the business semantics, it achieves precise binding of control instructions with current production tasks and processes, thereby ensuring that instruction judgment does not deviate from the actual production scenario. Third, it performs verification based on the behavioral baseline model of the target active work order, examining the legality of instructions from multiple dimensions such as parameter value range, device association logic, and operation timing constraints, thereby achieving accurate and interpretable interception of known violations. Then, it calls an AI adjudication model for auxiliary verification, using behavioral pattern learning to identify unknown covert attacks such as compliant parameters but abnormal operation frequency, change gradient, or sequence relationship, thereby compensating for the rule engine's omission of new threats. Finally, it integrates the results of the first and second verifications to generate a semantic adjudication conclusion, forming a joint judgment mechanism that complements deterministic rules and adaptive intelligent detection, comprehensively improving threat detection coverage and response reliability while maintaining a low false alarm rate.

[0006] In some implementations, before performing semantic reconstruction of the instruction to be detected based on the semantic mapping dictionary to obtain business semantic data, the method further includes: The system collects production work order data that has been issued and is in the execution state, as well as network industrial control messages in the industrial network, in a non-intrusive manner. The production work order data is structured and parsed to obtain triplet data; wherein, the triplet data includes process information, equipment information and process parameters; The network industrial control messages are parsed to obtain instruction semantic information; Based on the triplet data, obtain the system active work order and the currently executing procedure corresponding to the instruction semantic information; Using time, equipment, and process dimensions as the basis for association, the semantic information of the instruction and the triplet data are associated to obtain associated data; Construct a behavioral baseline model corresponding to the active work orders in the system based on the associated data; The behavioral baseline model defines the range of equipment that can be legally operated in the current production stage, the allowable value range of each process parameter, the logical order of operation timing, the mutual exclusion constraint relationship between processes, and the multivariate process coupling relationship.

[0007] In the above technical solution, the method can complete the entire process of pre-process preparation from data collection, work order parsing, protocol restoration to dynamic baseline construction before verification, thereby providing a scenario-based compliance judgment benchmark for subsequent real-time semantic adjudication, and fundamentally solving the problem that traditional solutions cannot carry out business logic verification due to the lack of production context.

[0008] In some implementations, the step of parsing the network industrial control message to obtain instruction semantic information includes: The network industrial control message is subjected to deep protocol parsing to obtain deep parsing data; wherein, the deep parsing data includes the original register address, original protocol point, operation type, operation value and timestamp; The process object name corresponding to the original register address and the business operation meaning corresponding to the original protocol point are obtained from the semantic mapping dictionary. The instruction semantic information includes the name of the process object, the meaning of the business operation, the operation value, and the timestamp.

[0009] In the above technical solution, the method can connect the translation link from the raw data of the network layer to the business semantics of the production layer, thereby providing a structured and understandable data foundation for the accurate association of subsequent instructions and work orders and compliance judgment, and thus effectively solving the semantic unreadable problem caused by data silos between IT and OT systems.

[0010] In some implementations, the step of semantically restoring the instruction to be detected based on the semantic mapping dictionary to obtain business semantic data includes: The target parsing data is obtained by parsing the protocol of the command to be detected. Instruction information is extracted from the target parsed data; wherein, the instruction information includes operation type, operation value, and timestamp; The instruction information is semantically restored based on the semantic mapping dictionary to obtain business semantic data; The semantic mapping dictionary is used to eliminate semantic heterogeneity between IT systems and OT systems. The semantic mapping dictionary includes multi-source identifiers that correspond one-to-one with process objects, engineering measurement units, process ranges, and data read / write permission attribute fields.

[0011] In the above technical solution, the method can eliminate the semantic heterogeneity between IT systems and OT systems, and translate the underlying raw instructions into understandable data with process object affiliation and business meaning, thereby providing a unified data foundation for the accurate association of subsequent instructions and work orders and compliance determination.

[0012] In some implementations, obtaining the target active work order that matches the business semantic data includes: The process object name and operating equipment identifier are obtained based on the business semantic data; Obtain the issued production work order data, and retrieve the work order containing the process object name and the operating equipment identifier from the production work order data to obtain the target active work order.

[0013] In the above technical solution, the method can accurately retrieve and lock the corresponding target active work order in the issued work orders based on the process object and operating equipment involved in the instruction to be detected, realize the real-time binding of the underlying control instructions and the upper-level production tasks, and ensure that the subsequent compliance judgment is always in a clear production scenario context.

[0014] In some implementations, the step of verifying the business semantic data based on the behavioral baseline model of the target active work order to obtain a first verification result includes: Based on the target timestamp of the instruction to be detected, the target current process context is obtained from the behavioral baseline model of the target active work order; wherein, the target current process context is the set of constraint rules corresponding to the target timestamp in the behavioral baseline model of the target active work order; Based on the set of constraint rules in the current process context of the target, the business semantic data is verified by the rule engine to obtain the first verification result; The first verification result includes parameter value range compliance verification result, operation timing compliance verification result, process mutual exclusion logic verification result, and multivariate coupling verification result.

[0015] In the above technical solution, the method can accurately locate the current process context based on the instruction timestamp, and perform multi-dimensional compliance verification of the instruction to be detected through the rule engine, including parameter value range, operation sequence, process mutual exclusion and multi-variable coupling, thereby achieving accurate and explainable interception of known violations.

[0016] In some implementations, the step of calling the AI ​​adjudication model to verify the instruction to be detected and obtaining a second verification result includes: Based on a preset time window and the target timestamp of the instruction to be detected, extract a continuous instruction sequence containing the instruction to be detected from the historical instruction log; Feature extraction is performed on the continuous instruction sequence to obtain feature data; wherein, the feature data includes instruction sending frequency, parameter change gradient, and operation sequence pattern; Using the aforementioned feature data as input, the AI ​​adjudication model is invoked for verification, resulting in a second verification result. The AI ​​adjudication model is used to verify whether the feature data exhibits abnormal behavioral patterns.

[0017] In the above technical solution, the method can effectively identify various behaviors that are compliant on the surface but have abnormal behavior patterns (such as covert attacks, abnormal device disturbances or unknown threats), thereby making up for the blind spots of pure rule engines in detecting new and complex attacks.

[0018] In some implementations, generating the semantic decision result of the instruction to be detected based on the first verification result and the second verification result includes: If any rule in the first verification result fails the verification, a semantic ruling result indicating a violation is generated; When all the first verification results pass, but the second verification result is an abnormal result, a semantic decision result indicating that a review is required is generated; When all the first verification results pass and the second verification result is determined to be normal, a semantic ruling result indicating compliance is generated; The semantic adjudication result includes at least a judgment of compliance or violation, a level of severity of violation, and the specific type of rule violated.

[0019] In the above technical solution, the method can realize hierarchical joint adjudication of rules and AI dual engines, thereby accurately intercepting certain violations and triggering a review mechanism for suspected anomalies, and thus achieving risk-layered management and control while taking into account both high interception accuracy and flexibility in responding to unknown threats.

[0020] In some embodiments, the method further includes: When the severity level of the violation in the semantic adjudication result is low risk, log data is generated based on the instruction to be detected, the business semantic data, the target active work order, and the semantic adjudication result, and low risk warning information is output based on the semantic adjudication result.

[0021] In the above technical solution, the method can handle low-risk violations in a differentiated and flexible manner, and achieve a lightweight response to security incidents through log retention and early warning prompts, avoiding the waste of resources caused by a single handling method.

[0022] In some embodiments, the method further includes: When the severity level of the violation in the semantic adjudication result is high-risk, pre-interception processing is performed in the link from the instruction to be detected to the underlying control device, and high-risk alarm information is output according to the semantic adjudication result.

[0023] In the above technical solution, the method can intercept high-risk and illegal commands before they reach the underlying control device, thus preventing malicious commands from being executed and shifting the security protection checkpoint from post-event tracing to real-time blocking during the event.

[0024] In some embodiments, the method further includes: When the severity level of the violation in the semantic adjudication result is an extreme violation level, a matching violation scenario is obtained based on the instruction to be detected, the business semantic data, the target active work order, and the semantic adjudication result. Obtain the security priority control instruction corresponding to the violation scenario, and execute the corresponding device security fallback protection operation according to the security priority control instruction.

[0025] In the above technical solution, the method can trigger equipment safety fallback protection in extreme violation scenarios. By matching violation scenarios and executing corresponding safety priority control instructions, it ensures that physical production safety is guaranteed with the highest priority in extreme situations.

[0026] In some embodiments, the method further includes: In the authorized learning mode, compliance data is collected; wherein, the compliance data includes compliant process change operation data and data on routine new production operation behaviors; The behavioral baseline model corresponding to the active work orders in the system is iteratively optimized based on the compliance data.

[0027] In the above technical solution, the method enables the behavioral baseline model to automatically iterate and optimize with changes in compliant processes and new production operations, thereby reducing the workload of manual strategy maintenance and improving the system's long-term adaptive capability to dynamic changes in production.

[0028] In a second aspect, this application provides an electronic device, the electronic device including a memory and a processor, the memory being used to store a computer program, the processor running the computer program to cause the electronic device to perform the industrial control instruction verification method described in any one of the first aspects.

[0029] Thirdly, this application provides a readable storage medium storing a computer program, which, when executed by a processor, performs the industrial control instruction verification method described in any one of the first aspects.

[0030] Fourthly, this application provides a computer program product, which includes a computer program that, when executed by a processor, performs the industrial control instruction verification method described in any one of the first aspects.

[0031] The beneficial effects of this application are as follows: By using work order-driven dynamic semantic verification, dual-engine intelligent adjudication, and baseline adaptive evolution, it achieves a protection upgrade from network protocol compliance to business logic compliance, thereby extending the depth of security protection to the production business application layer, and effectively identifying and blocking business logic attacks initiated based on legitimate protocols; at the same time, the security baseline is bound to the upper-layer production work order in real time, and can automatically iterate with production tasks and processes, thus completing the reconstruction of legitimate operation boundaries without manual intervention, thereby solving the problem of the disconnect between static policies and flexible manufacturing; in addition, the integration of rule engine and AI model dual-engine adjudication can take into account both the accurate interception of known violations and the intelligent identification of unknown covert attacks, thereby significantly improving the coverage and accuracy of threat detection; finally, by intercepting illegal instructions in real time, reducing manual operation and maintenance through baseline self-learning, and stabilizing process parameters to ensure product quality, it comprehensively improves production safety and operational efficiency, thereby forming a digital security protection capability that can be inherited and executed. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating the industrial control instruction verification method in some embodiments of this application; Figure 2 This is a schematic diagram of the structure of an industrial control command verification device in some embodiments of this application; Figure 3 This is a schematic diagram of the structure of an electronic device in some embodiments of this application. Detailed Implementation

[0034] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0036] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more (including two), similarly, "multiple sets" refers to two or more sets (including two sets), and "multiple pieces" refers to two or more pieces (including two pieces) unless otherwise explicitly defined.

[0037] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0038] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0039] Existing industrial security protection is based solely on network layer features and static rules, which cannot identify control commands that are compliant with protocols but have abnormal business semantics. Furthermore, static policies cannot adapt to the dynamic production scenarios of flexible manufacturing. At the same time, work orders, communication, and security systems are independent of each other and lack the ability to perform cross-system context correlation analysis. Security handling can only provide post-event alarms and cannot achieve pre-judgment verification before the command is issued.

[0040] To address the aforementioned technical issues, this application provides an industrial control instruction verification method. This method aims to: construct a dynamic behavior baseline driven by work orders; map underlying control instructions into business semantic data through semantic restoration and accurately match target active work orders; and integrate a rule engine and an AI adjudication model to perform dual-engine joint verification of instructions, thereby achieving real-time semantic compliance review and pre-interception before the issuance of control instructions, thus extending security protection from the network layer to the production business application layer.

[0041] like Figure 1 As shown, some embodiments of this application provide an industrial control command verification method, which includes: S100. Based on the semantic mapping dictionary, perform semantic restoration on the instruction to be detected to obtain business semantic data.

[0042] In this embodiment, the method is a business logic security verification step set before the execution link of device operation instructions. Its purpose is to realize intelligent verification and proactive defense of the entire link from network transmission to business compliance of industrial control instructions.

[0043] In this embodiment, the method can perform millisecond-level business semantic compliance review on each captured instruction to be detected.

[0044] In this embodiment, the method can perform a previously initialized, constructed, and continuously maintained cross-system semantic mapping dictionary with process objects as the core, thereby achieving unified semantic modeling and eliminating the data silos and semantic heterogeneity problems between industrial field information technology (IT) systems and operational technology (OT) systems.

[0045] The semantic mapping dictionary is used to establish a one-to-one mapping relationship between Manufacturing Execution System (MES) parameter identifiers (IDs), Distributed Control System (DCS) location tags, Programmable Logic Controller (PLC) register addresses, and industrial protocol access paths.

[0046] In this embodiment, the semantic mapping dictionary also extends to store attribute fields such as engineering measurement units, process range, and data read / write permissions.

[0047] In this embodiment, the method uses the semantic mapping dictionary as a standardized translation carrier, which can automatically associate and parse the upper-layer production work order parameters with the lower-layer network control command points, thereby providing a unified semantic basis for subsequent business context association and command compliance adjudication.

[0048] It should be noted that the reason for constructing a semantic mapping dictionary is that, although the business parameter identifiers of Manufacturing Execution System (MES) / Enterprise Resource Planning System (ERP), the process tags of Distributed Control System (DCS), the register addresses of Programmable Logic Controller (PLC), and the industrial protocol point paths all point to the same physical process object, their expression paradigms, data formats, and identification codes are independent of each other.

[0049] Without standardized semantic mapping, it is impossible to achieve the association and matching between upper-level work order requirements and lower-level control instructions.

[0050] S200: Obtain target active work orders that match business semantic data.

[0051] In this embodiment, the target active work order refers to the work order that contains the process object name and the operating equipment identifier in the issued production work order data.

[0052] In this embodiment, the method can match the active work order and current process context to the business semantic data.

[0053] S300: Based on the behavioral baseline model of the target active work order, the business semantic data is verified to obtain the first verification result.

[0054] In this embodiment, the behavior baseline model is a set of legal operation boundaries constructed for the target active work order.

[0055] In this embodiment, verification refers to the process of comparing business semantic data with the constraint rules defined in the behavioral baseline model.

[0056] In this embodiment, the first verification result is the compliance judgment result obtained after verifying the business semantic data through the rule engine.

[0057] In this embodiment, the method can employ a dual-engine collaborative adjudication architecture of a rules engine and a lightweight AI model to conduct compliance determination.

[0058] S400 calls the AI ​​adjudication model to verify the instruction to be detected and obtains the second verification result.

[0059] In this embodiment, the AI ​​adjudication model is a lightweight artificial intelligence model trained based on historical normal production behavior samples, used to verify whether there are abnormal behavior patterns in the feature data.

[0060] In this embodiment, verification refers to the process of comparing the feature data of the instruction to be detected with the baseline of behavioral features in the AI ​​adjudication model.

[0061] In this embodiment, the second verification result is the abnormal behavior pattern judgment result obtained by the AI ​​adjudication model after verifying the feature data.

[0062] S500: Generate the semantic decision result of the instruction to be detected based on the first verification result and the second verification result.

[0063] In this embodiment, "generation" refers to the process of outputting the corresponding semantic adjudication conclusion according to the combination relationship between the first verification result and the second verification result, and in accordance with the preset adjudication logic.

[0064] In the above embodiments, the method first performs semantic restoration of instructions based on a semantic mapping dictionary, translating the underlying register addresses and protocol points into unified business objects, thereby eliminating the semantic heterogeneity gap between IT and OT systems and laying the foundation for data alignment for subsequent verification. Second, by acquiring target active work orders that match the business semantics, it achieves precise binding of control instructions with current production tasks and processes, thereby ensuring that instruction judgment does not deviate from the actual production scenario. Third, it performs verification based on the behavioral baseline model of the target active work order, examining the legality of instructions from multiple dimensions such as parameter value range, device association logic, and operation timing constraints, thereby achieving accurate and interpretable interception of known violations. Then, it calls an AI adjudication model for auxiliary verification, using behavioral pattern learning to identify unknown covert attacks such as compliant parameters but abnormal operation frequency, change gradient, or sequence relationship, thereby compensating for the rule engine's omission of new threats. Finally, it integrates the first and second verification results to generate a semantic adjudication conclusion, forming a joint judgment mechanism that complements deterministic rules and adaptive intelligent detection, comprehensively improving threat detection coverage and response reliability while maintaining a low false alarm rate.

[0065] In some embodiments, prior to step S100, the method may further include: S10. Collect production work order data that has been issued and is in the execution state in the system and network industrial control messages in the industrial network through a non-intrusive acquisition method.

[0066] In this embodiment, the method can employ a mirrorless bypass acquisition approach to simultaneously acquire the management layer work order information stream (i.e., production work order data) and the control layer device command stream (i.e., network industrial control messages). This dual-stream data acquisition method provides a data perception foundation for stable system operation.

[0067] In this embodiment, the non-intrusive acquisition method refers to the non-mirror bypass acquisition method. Specifically, it can be a method of copying the optical signal in the link through a splitter to achieve physical layer data copying; or it can be a method of deploying a lightweight acquisition agent on the terminal device or industrial gateway side to directly read the device's local logs or communication cache.

[0068] In this embodiment, "in execution state" refers to a work order that has been issued to the workshop, is in production, and has not yet been completed; production work order data refers to the structured process information (including work order number, product model, process logic, equipment number corresponding to each process, process formula parameters, and allowable fluctuation range, etc.) bound to the work order.

[0069] In this embodiment, the work order information flow can collect production work order data issued and in execution status in the ERP and MES systems in real time through standard API interfaces, industrial middleware, or database integration. The collected content can include structured process information such as work order number, product model, process sequence logic, equipment number corresponding to each process, process formula parameters, and allowable fluctuation range, serving as the benchmark for instruction compliance determination.

[0070] In this embodiment, network control messages in the industrial network refer to communication data packets that carry equipment control commands and field data acquisition information in the industrial control network.

[0071] For example, network industrial control messages may include: Industrial control protocol messages: such as communication data of mainstream industrial control protocols like S7 (Siemens S7 protocol), Modbus TCP (Modbus Transmission Control Protocol), and OPC UA (Open Platform Unified Communication Architecture); Key instruction messages: Control instructions that directly affect the operating status of the device, such as register write operations, parameter settings, and device status switching; Real-time data messages: Process data uploaded by field equipment, such as operating status, sensor readings, and actuator feedback.

[0072] In this embodiment, the device command stream can be captured losslessly via industrial switch port mirroring, network splitters, or edge proxy deployment methods, capturing mainstream industrial control protocol messages such as S7 (Siemens S7 protocol), Modbus TCP (Modbus transmission control protocol), and OPC UA (Open Platform Unified Communication Architecture) within the industrial network. This method can focus on parsing and retaining key command messages such as register write operations, parameter settings, and device state switching, thereby achieving real-time acquisition of actual control behavior data of field equipment.

[0073] S20. Perform structured parsing on the production work order data to obtain triplet data; the triplet data includes process information, equipment information, and process parameters.

[0074] In this embodiment, structured parsing refers to decomposing the unstructured process requirements described in the production work order (such as "the temperature of the reactor is controlled at 80±2℃" and "the feed valve is opened when the agitator is running") into machine-readable structured data according to three dimensions: process information, equipment information, and process parameters.

[0075] In this embodiment, the process information in the ternary set includes the logical relationship between the order of the processes, the equipment information includes the equipment number corresponding to each process, and the process parameters include the formula value and the allowable fluctuation range.

[0076] In this embodiment, the method can first perform structured parsing on the production work order data, thereby parsing (i.e. decomposing) the "process-equipment-process parameter" triplet.

[0077] S30. Perform protocol parsing on the network industrial control messages to obtain instruction semantic information.

[0078] In this embodiment, protocol parsing refers to the process of unpacking and decoding captured network industrial control messages according to their corresponding industrial control protocol specifications (such as S7 protocol, Modbus TCP protocol, OPC UA protocol, etc.), and extracting field information such as original register address, original protocol point, operation type, operation value, and timestamp from the messages. This process converts the underlying binary or hexadecimal message data into recognizable structured data, providing input for subsequent semantic reconstruction based on a semantic mapping dictionary.

[0079] In this embodiment, the instruction semantic information includes the process object name, the meaning of the business operation, the operation value, and the timestamp.

[0080] For example, this method can perform deep protocol parsing on network industrial control messages. Specifically, this method can rely on a semantic mapping dictionary to translate the original register addresses and protocol bits into corresponding process objects and business operation meanings.

[0081] To establish a clear translation link from raw data at the network layer to business semantics at the production layer, step S30 may further include: S31. Perform deep protocol parsing on the network industrial control message to obtain deep parsing data; the deep parsing data includes the original register address, original protocol point, operation type, operation value and timestamp.

[0082] In this embodiment, the original register address in the deep parsing data is the physical number of the internal storage unit of the programmable logic controller (PLC), which is used to identify the storage location of the data in the controller.

[0083] In this embodiment, the original protocol point is the data access path or variable identifier defined in the industrial control protocol message, which is used to locate the specific communication data object; the operation type is the action category of the instruction execution.

[0084] In this embodiment, the operand is the specific numerical parameter carried when the instruction is executed.

[0085] In this embodiment, the timestamp is a time identifier of when the instruction occurred.

[0086] S32. Obtain the process object name corresponding to the original register address and the business operation meaning corresponding to the original protocol point based on the semantic mapping dictionary.

[0087] In this embodiment, the instruction semantic information includes the process object name, the meaning of the business operation, the operation value, and the timestamp. That is, the process object name, the meaning of the business operation, the operation value, and the timestamp together constitute the instruction semantic information.

[0088] In this embodiment, the process object name is the standardized identifier of the physical process equipment or process parameters in the semantic mapping dictionary.

[0089] In this embodiment, the meaning of business operation is the description of the specific operation type of the instruction obtained after translation through the semantic mapping dictionary.

[0090] S40. Based on the triplet data, obtain the system active work order and the currently executing procedure corresponding to the instruction semantic information.

[0091] In this embodiment, an active work order refers to a work order that has been issued and is in the execution state in the system.

[0092] In this embodiment, the currently executing process refers to the process step in the active work order of the system that corresponds to the timestamp in the instruction semantic information.

[0093] S50. Using time, equipment, and process dimensions as the basis for association, the semantic information of instructions and triplet data are associated to obtain associated data.

[0094] In this embodiment, the time dimension refers to aligning the instruction timestamp with the work order process time sequence; the equipment dimension refers to matching the instruction operation equipment with the corresponding equipment number of the work order process; and the process dimension refers to corresponding the instruction operation stage with the work order process steps.

[0095] In this embodiment, association refers to establishing a correspondence between the process object name, business operation meaning, operation value and timestamp in the instruction semantic information and the process information, equipment information and process parameters in the triple data, so that each control instruction is bound to the current production scenario to identify the process and operation stage to which the instruction belongs.

[0096] In this embodiment, the associated data is the basic data generated by associating instruction semantic information with triple data, which is used to construct the behavioral baseline model.

[0097] In this embodiment, the method can bind the parsed control instructions to the corresponding active work orders and the currently executing process based on the time dimension, equipment dimension, and process dimension.

[0098] S60. Construct a behavioral baseline model corresponding to the active work orders in the system based on the associated data; wherein, the behavioral baseline model defines the range of equipment that can be legally operated under the current production stage, the allowable value range of each process parameter, the logical order of operation timing, the mutual exclusion constraint relationship between processes, and the multivariate process coupling relationship.

[0099] In this embodiment, the behavior baseline model refers to the set of legal operation boundaries dynamically constructed based on the associated data for each active system work order.

[0100] In this embodiment, the method can dynamically construct a unique behavioral baseline model for each work order.

[0101] In this embodiment, the baseline model can be dynamically iterated as the work order process progresses, thereby defining in real time the range of equipment, parameter value range, operation timing logic, and process mutual exclusion constraints for legal operations under different production stages, forming a dynamic and scenario-based legal operation boundary.

[0102] As an optional implementation, the method further includes: Under the authorized learning model, compliance data is collected; this compliance data includes compliant process change operation data and data on routine new production operation behaviors. The behavioral baseline model corresponding to active work orders in the system is iteratively optimized based on compliance data.

[0103] In this embodiment, baseline model adaptive evolution can endow the system with adaptive evolution capabilities, thereby adapting to scenarios of process changes, product iterations, and production mode adjustments.

[0104] In this embodiment, the method can upload the desensitized abnormal behavior patterns and newly added process operation features to the cloud analysis platform through edge nodes.

[0105] In this embodiment, the method can optimize the AI ​​adjudication model based on full-domain sample data.

[0106] In this embodiment, the cloud can distribute the iterative model version to each edge node, thereby realizing the synchronous evolution and unified upgrade of the entire industrial network security protection capability.

[0107] In the above embodiments, the method can complete the entire pre-process preparation from data collection, work order parsing, protocol restoration to dynamic baseline construction before verification, thereby providing a scenario-based compliance judgment benchmark for subsequent real-time semantic adjudication, and fundamentally solving the problem that traditional solutions cannot carry out business logic verification due to the lack of production context.

[0108] In some embodiments, step S100 may include: S110. Perform protocol parsing on the command to be detected to obtain target parsing data.

[0109] In this embodiment, protocol parsing refers to the process of unpacking and decoding the instruction to be detected according to the corresponding industrial control protocol specification, and extracting information such as the original register address, original protocol point, operation type, operation value, and timestamp.

[0110] S120. Extract instruction information from the target parsing data; wherein, the instruction information includes operation type, operation value and timestamp.

[0111] In this embodiment, the instruction information consists of the operation type, operation value, and timestamp extracted from the target parsed data.

[0112] S130. Semantically restore the instruction information according to the semantic mapping dictionary to obtain business semantic data. The semantic mapping dictionary is used to eliminate semantic heterogeneity between the IT system and the OT system. The semantic mapping dictionary includes multi-source identifiers that correspond one-to-one with process objects, engineering measurement units, process ranges, and data read / write permission attribute fields.

[0113] In this embodiment, the information technology (IT) system refers to the upper-level information system responsible for production management, planning and scheduling, resource management, etc.; the operation technology (OT) system refers to the lower-level industrial control system responsible for field equipment control, process monitoring, data acquisition, etc.

[0114] In the above embodiments, the method can eliminate the semantic heterogeneity between the IT system and the OT system, and translate the underlying raw instructions into understandable data with process object affiliation and business meaning, thereby providing a unified data foundation for the accurate association of subsequent instructions and work orders and compliance determination.

[0115] In some embodiments, step S200 may include: S210. Obtain the process object name and operating equipment identifier based on business semantic data.

[0116] S220. Obtain the issued production work order data, and search for work orders containing process object names and operating equipment identifiers in the production work order data to obtain the target active work order.

[0117] In this embodiment, the production work order data includes structured process information, which includes one or more of the following: work order number, product model, process sequence logic, equipment number corresponding to each process, process formula parameters, and allowable fluctuation range.

[0118] In this embodiment, the target active work order is a work order that is in the execution state and matches the business semantic data.

[0119] In the above embodiments, the method can accurately retrieve and lock the current target active work order in the issued work orders based on the process object and operating equipment involved in the instruction to be detected, realize the real-time binding of the underlying control instructions and the upper-level production tasks, and ensure that the subsequent compliance judgment is always in a clear production scenario context.

[0120] In some embodiments, step S300 may include: S310. Based on the target timestamp of the instruction to be detected, obtain the target current process context from the behavior baseline model of the target active work order; wherein, the target current process context is the set of constraint rules corresponding to the target timestamp in the behavior baseline model of the target active work order.

[0121] S320. Based on the set of constraint rules in the current process context of the target, the business semantic data is verified by the rule engine to obtain the first verification result; wherein, the first verification result includes the parameter value range compliance verification result, the operation sequence compliance verification result, the process mutual exclusion logic verification result, and the multivariate coupling verification result.

[0122] In this embodiment, the rule engine can perform instruction parameter value range verification, operation sequence compliance verification, and process mutual exclusion logic verification based on deterministic prior knowledge such as pre-set process specifications, safety interlock logic, parameter threshold range, and process sequence constraints, thereby achieving accurate judgment and explainable interception of known violations.

[0123] For example, in the scenario of a chemical polymerization reactor, if the current process context constraint rule set limits the allowable range of "reactor temperature" to 75℃ to 85℃ (corresponding to parameter value range verification), and "stirrer running status is on" is a prerequisite for "initiator feed valve is on" (corresponding to operation sequence verification / process mutual exclusion logic verification), when the instruction to be detected is "set reactor temperature to 90℃" or "turn off stirrer", the rule engine compares the constraint rule set and determines that the instruction violates the parameter threshold or safety interlock logic, and the first verification result is a violation.

[0124] In the above embodiments, the method can accurately locate the current process context based on the instruction timestamp, and perform multi-dimensional compliance verification of the instruction to be detected through the rule engine, including parameter value range, operation sequence, process mutual exclusion and multi-variable coupling, thereby achieving accurate and explainable interception of known violations.

[0125] In some embodiments, step S400 may include: S410. Based on the preset time window and the target timestamp of the instruction to be detected, extract the continuous instruction sequence including the instruction to be detected from the historical instruction log.

[0126] S420. Extract features from the continuous instruction sequence to obtain feature data; wherein, the feature data includes instruction sending frequency, parameter change gradient and operation sequence pattern.

[0127] S430. Using the feature data as input, call the AI ​​adjudication model for verification to obtain the second verification result; wherein, the AI ​​adjudication model is used to verify whether there are abnormal behavioral patterns in the feature data.

[0128] In this embodiment, the behavior corresponding to the feature data can be covert attacks, probing operations, abnormal device disturbances, etc. The second verification result refers to whether the verified behavior exhibits an abnormal behavior pattern (i.e., parameters are compliant but the behavior pattern is abnormal).

[0129] In this embodiment, the AI ​​adjudication model (i.e., the lightweight AI model) can learn offline and online based on historical normal production behavior samples to build behavioral feature baselines such as instruction sending frequency, parameter change gradient, and operation sequence patterns. It can intelligently identify covert attacks, probing operations, and abnormal equipment disturbances that are compliant with parameters but have abnormal behavior patterns, thus making up for the shortcomings of a single rule engine in missing judgments of unknown abnormal behaviors.

[0130] For example, in the continuous casting process scenario, if the casting speed setting is within the process allowable range, but is repeatedly modified more than the normal frequency within one minute (abnormal command sending frequency), or the magnitude of the continuous modification increases in a stepwise manner (abnormal parameter change gradient), or the operation sequence that should be "increase speed first and then adjust water" is executed as "adjust water first and then increase speed" (abnormal operation sequence mode), then the AI ​​adjudication model determines that the above command sequence has an abnormal behavior mode, and the second verification result is abnormal.

[0131] In the above embodiments, the method can effectively identify covert attacks and unknown threats that appear compliant with parameters but exhibit abnormal behavior patterns, thus compensating for the blind spots of pure rule engines in detecting new and complex attacks.

[0132] In some embodiments, step S500 may specifically perform any of the following qualifying steps: S510. When any rule in the first verification result fails the verification, a semantic ruling result indicating a violation is generated.

[0133] In the embodiment, "any rule verification in the first verification result fails" means that at least one of the following checks fails the set of constraint rules: parameter value range compliance verification, operation timing compliance verification, process mutual exclusion logic verification, and multivariate coupling verification.

[0134] As an optional implementation, the method further includes: When the severity level of the violation in the semantic adjudication result is low risk, log data is generated based on the instruction to be detected, business semantic data, target active work order and semantic adjudication result, and low risk warning information is output based on the semantic adjudication result.

[0135] In this embodiment, the method can retain logs and provide compliance warnings for minor parameter deviations and low-risk non-routine operations.

[0136] As another optional implementation, the method further includes: When the severity level of the violation in the semantic adjudication result is high-risk, pre-interception processing is performed in the link from the instruction to be detected to the underlying control device, and high-risk alarm information is output according to the semantic adjudication result.

[0137] In this embodiment, the method can work with industrial firewalls and security agents to perform pre-interception before instructions reach the PLC controller.

[0138] As another optional implementation, the method may further include: When the severity level of the violation in the semantic adjudication result is an extreme violation level, the matching violation scenario is obtained based on the instruction to be detected, business semantic data, target active work order, and semantic adjudication result. Obtain the security priority control instructions corresponding to the violation scenario, and execute the corresponding device security fallback protection operations according to the security priority control instructions.

[0139] In this embodiment, for extreme violations that pose significant safety hazards, a preset safety priority control command can be triggered to achieve equipment safety fallback protection and avoid physical production accidents.

[0140] S520. When all the first verification results pass, but the second verification result is an abnormal result, generate a semantic decision result indicating that a review is required.

[0141] In this embodiment, "the first verification result is all passed, but the second verification result is an abnormal result" means that the rule engine determines that the instruction to be detected is compliant in terms of parameter value range, operation sequence, process mutual exclusion and multivariate coupling, but the AI ​​adjudication model determines that the continuous instruction sequence in which the instruction is located has an abnormal behavior pattern. At this time, a single engine cannot make a final judgment independently and a review result needs to be generated.

[0142] S530. When all the first verification results pass and the second verification result is determined to be normal, a semantic ruling result indicating compliance is generated.

[0143] In this embodiment, "all first verification results pass and the second verification result is judged to be normal" means that all items verified by the rule engine are compliant, and the AI ​​adjudication model determines that there is no abnormal behavior pattern in the continuous instruction sequence in which the instruction to be detected is located. At this time, the business semantics of the instruction to be detected are judged to be compliant.

[0144] In this embodiment, the semantic adjudication result includes at least the judgment of compliance or violation, the severity level of the violation, and the specific type of rule violated.

[0145] In the above embodiments, the method can achieve hierarchical joint adjudication of rules and AI dual engines, thereby accurately intercepting certain violations and triggering a review mechanism for suspected anomalies, and thus achieving risk-layered management and control while taking into account both high interception accuracy and flexibility in responding to unknown threats.

[0146] In some examples, this method can be applied to the following scenarios.

[0147] (1) Scenario and threat description: In the production of polyethylene in the chemical industry, the polymerization reactor is a high-risk key process equipment. The reaction temperature must be strictly limited within the process allowable range and must follow a fixed safety interlock logic: the normal operation of the agitator is a prerequisite for the opening of the initiator feed valve.

[0148] If the stirrer stops operating during the reaction, the initiator feed must be cut off in time and the cooling control must be activated; otherwise, it may easily lead to explosive polymerization and safety accidents.

[0149] Based on this, cyber attackers can disrupt process constraints and safety interlock logic by tampering with process temperature setting parameters and issuing unauthorized equipment control commands, thereby inducing significant safety production risks.

[0150] (2) Implementation process of this plan First, the distributed control system (DCS) and emergency shutdown system (ESD) are connected in a non-intrusive acquisition method to collect production work order data in the execution state in real time, and obtain the process formula data corresponding to the current work order, including structured process information such as the target temperature of the reactor and the safe fluctuation range. At the same time, the industrial control protocol messages in the industrial network are captured by bypass, and key command messages such as temperature setting, agitator control, and valve opening adjustment are analyzed and retained.

[0151] Secondly, the work order data is structured and parsed into a triplet of process-equipment-process parameter; the network industrial control messages are subjected to deep protocol parsing, and the original register addresses and protocol points are translated into corresponding process objects and business operation meanings based on the semantic mapping dictionary.

[0152] Furthermore, based on the three dimensions of time, equipment, and process, the parsed control instructions are bound to the current polymerization reaction work order and the execution process, and a dynamic behavior baseline is constructed that includes process parameter thresholds, equipment status association logic, and process pre-constraints. This solidifies the safety interlock constraint relationship between the reactor target temperature and safety fluctuation range, the agitator operating status, and the initiator valve.

[0153] Then, the protocol parsing and semantic restoration of the command to be detected are performed in real time according to the semantic mapping dictionary to obtain business semantic data and match the target active work order.

[0154] An example scenario: In a scenario where dangerous temperature tampering behavior is intercepted.

[0155] When the operator station is maliciously controlled and a temperature setting command exceeding the process safety range is issued, the method automatically captures the command, obtains the current process context from the behavior baseline model based on the target timestamp, verifies the business semantic data through the rule engine, and determines that the command exceeds the parameter threshold, which is a serious violation of process parameters (corresponding to S510).

[0156] At this point, the method can perform pre-interception processing in the link from instruction transmission to programmable logic controller (PLC) based on the high-risk level handling mechanism, output high-risk alarm information, and complete the source tracing and risk warning of violations.

[0157] Another exemplary scenario: in a situation where a violation of a safety interlock prevents operation from proceeding.

[0158] During the steady-state operation phase of production, if an external attack attempts to issue a stop command for the agitator, this method can automatically capture the command and obtain the current process context from the behavior baseline model based on the target timestamp. If the initiator valve is detected to be in the open state, the rule engine will verify and determine that the operation violates the safety interlock logic (corresponding to S510).

[0159] At this point, the method can perform pre-interception processing before the instruction arrives at the PLC, based on the high-risk level handling mechanism, and simultaneously trigger risk alarm records and solidify abnormal behavior logs to provide a basis for subsequent safety audits and incident tracing.

[0160] Based on this, the method can transform process parameter constraints and safety interlock logic into automatically executable dynamic verification rules, thereby achieving accurate identification and pre-interception of semantically abnormal instructions under compliance protocol messages, making up for the shortcomings of traditional safety equipment that cannot be deeply adapted to the protection of hazardous chemical processes.

[0161] It is evident that this method can serve as a supplementary protection measure to existing safety instrumented systems, enabling risk identification at the front end of the industrial control link before attack traffic enters, thereby strengthening the network security and process safety management capabilities of major hazard source processes.

[0162] In some examples, this method can also be applied to the following scenarios.

[0163] (1) Scenario and threat description: In the continuous casting process of steel, the billet speed and the cooling water flow rate of the secondary cooling zone have strong coupling correlation characteristics. The parameter matching relationship directly determines the billet forming quality, which can avoid major equipment and production accidents such as billet leakage.

[0164] The process control system outputs matching setpoints for casting speed and cooling water flow based on the superheat of molten steel and the specifications of the cast billet. Attackers can maliciously tamper with the casting speed parameters inside the programmable logic controller (PLC), disrupting the coupling and matching relationship of multiple process variables, causing a mismatch between cooling capacity and casting speed conditions, and inducing production failures and equipment damage.

[0165] (2) Implementation process of this plan First, the process control computer is connected in a non-intrusive acquisition method to obtain the standard parameter matching combination output by the casting production plan and process model in real time, and to collect the actual operating set values ​​of the basic automation system; at the same time, the industrial control protocol messages in the industrial network are captured by bypass, and key command messages such as casting speed setting and cooling water flow regulation are analyzed and retained.

[0166] Secondly, the work order data is structured and parsed into a triplet of "process-equipment-process parameter"; the network industrial control messages are subjected to deep protocol parsing, and the original register addresses and protocol points are translated into the corresponding process objects and business operation meanings based on the semantic mapping dictionary.

[0167] Furthermore, based on the three dimensions of time, equipment, and process, the parsed control instructions are bound to the current continuous casting work order and the execution process. Relying on historical steady-state production data, a dynamic coupling relationship model between casting speed and cooling water flow rate under different billet specifications is constructed through machine learning, forming a multi-variable collaborative compliance baseline and defining the confidence interval of cooling water flow rate corresponding to different casting speed conditions.

[0168] Then, the protocol parsing and semantic restoration of the command to be detected are performed in real time according to the semantic mapping dictionary to obtain business semantic data and match the target active work order.

[0169] An example scenario: In a scenario where speed parameter tampering is intercepted.

[0170] When the network side maliciously tampers with the casting speed setting value of the continuous casting programmable logic controller (PLC), the method automatically captures the instruction, compares it with the standard setting value issued by the process according to the rules, and determines that there is parameter tampering behavior; further, it calls the multivariate collaborative baseline model to verify the matching rationality between the current cooling water flow rate and the tampered casting speed condition, and identifies the abnormal state of severe mismatch of process variables (corresponding to S510).

[0171] At this point, the method can perform pre-interception processing in the link from instruction transmission to programmable logic controller (PLC) based on the high-risk level handling mechanism, push process risk warnings in real time, lock abnormal parameter change behavior, restrict the interference of unauthorized parameter tampering on the core continuous casting process, and avoid production accidents caused by process mismatch.

[0172] Based on this, the method can effectively identify two types of covert attack behaviors, namely single parameter tampering and multi-parameter collaborative mismatch, by constructing a multivariate process coupling baseline model. It adapts to the safety protection requirements of the strongly coupled continuous casting process and moves the process accident protection checkpoint from post-event handling to real-time verification and anomaly blocking during the event.

[0173] It is evident that this method can rely on model learning to solidify industry process matching experience, form a safety protection constraint logic that can be digitally implemented, and reduce the dependence of production operations on human expert experience.

[0174] like Figure 2 As shown, some embodiments of this application provide a structural schematic diagram of an industrial control command verification device. It should be understood that this device is related to... Figure 1 The method executed in the middle corresponds to the steps involved in the aforementioned method. The specific functions and effects of the device can be found in the description above. To avoid repetition, detailed descriptions are omitted here.

[0175] The industrial control command verification device includes: The semantic restoration unit 610 is used to perform semantic restoration on the instruction to be detected based on the semantic mapping dictionary to obtain business semantic data; Acquisition unit 620 is used to acquire target active work orders that match business semantic data; The first verification unit 630 is used to verify the business semantic data based on the behavioral baseline model of the target active work order to obtain the first verification result. The second verification unit 640 is used to call the AI ​​adjudication model to verify the instruction to be detected and obtain the second verification result. The generation unit 650 is used to generate a semantic decision result of the instruction to be detected based on the first verification result and the second verification result.

[0176] In this embodiment, the specific implementation steps of each unit can be found in the relevant descriptions in the method embodiments above, and will not be repeated here.

[0177] like Figure 3 As shown, this application provides an electronic device 700, which includes a processor 701 and a memory 702. The processor 701 and the memory 702 are interconnected and communicate with each other through a communication bus 703 and / or other forms of connection mechanism (not shown). The memory 702 stores a computer program that can be executed by the processor 701. When the computer program is run, the processor 701 executes the computer program to perform the method in any of the aforementioned optional implementations.

[0178] This application provides a readable storage medium storing a computer program, which, when executed by a processor, performs the method in any of the aforementioned optional implementations.

[0179] The readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0180] This application provides a computer program product, which includes a computer program that, when run by a processor, executes the method in any of the aforementioned optional implementations.

[0181] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and they should all be covered within the scope of the claims and specification of this application. In particular, as long as there is no conflict, the various technical features mentioned in the embodiments can be combined in any way. This application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A method for verifying industrial control commands, characterized in that, include: The semantics of the instruction to be detected are restored based on the semantic mapping dictionary to obtain business semantic data; Obtain the target active work orders that match the business semantic data; Based on the behavioral baseline model of the target active work order, the business semantic data is verified to obtain the first verification result; The AI ​​adjudication model is invoked to verify the instruction to be detected, and a second verification result is obtained. The semantic decision result of the instruction to be detected is generated based on the first verification result and the second verification result.

2. The industrial control command verification method according to claim 1, characterized in that, Before performing semantic reconstruction of the instruction to be detected based on the semantic mapping dictionary to obtain business semantic data, the method further includes: The system collects production work order data that has been issued and is in the execution state, as well as network industrial control messages in the industrial network, in a non-intrusive manner. The production work order data is structured and parsed to obtain triplet data; wherein, the triplet data includes process information, equipment information and process parameters; The network industrial control messages are parsed to obtain instruction semantic information; Based on the triplet data, obtain the system active work order and the currently executing procedure corresponding to the instruction semantic information; Using time, equipment, and process dimensions as the basis for association, the semantic information of the instruction and the triplet data are associated to obtain associated data; Construct a behavioral baseline model corresponding to the active work orders in the system based on the associated data; The behavioral baseline model defines the range of equipment that can be legally operated in the current production stage, the allowable value range of each process parameter, the logical order of operation timing, the mutual exclusion constraint relationship between processes, and the multivariate process coupling relationship.

3. The industrial control command verification method according to claim 2, characterized in that, The protocol parsing of the network industrial control messages to obtain instruction semantic information includes: The network industrial control message is subjected to deep protocol parsing to obtain deep parsing data; wherein, the deep parsing data includes the original register address, original protocol point, operation type, operation value and timestamp; The process object name corresponding to the original register address and the business operation meaning corresponding to the original protocol point are obtained from the semantic mapping dictionary. The instruction semantic information includes the name of the process object, the meaning of the business operation, the operation value, and the timestamp.

4. The industrial control command verification method according to claim 1, characterized in that, The step of semantically restoring the instruction to be detected based on the semantic mapping dictionary to obtain business semantic data includes: The target parsing data is obtained by parsing the protocol of the command to be detected. Instruction information is extracted from the target parsed data; wherein, the instruction information includes operation type, operation value, and timestamp; The instruction information is semantically restored based on the semantic mapping dictionary to obtain business semantic data; The semantic mapping dictionary is used to eliminate semantic heterogeneity between IT systems and OT systems. The semantic mapping dictionary includes multi-source identifiers that correspond one-to-one with process objects, engineering measurement units, process ranges, and data read / write permission attribute fields.

5. The industrial control command verification method according to claim 1, characterized in that, The step of obtaining the target active work order that matches the business semantic data includes: The process object name and operating equipment identifier are obtained based on the business semantic data; Obtain the issued production work order data, and retrieve the work order containing the process object name and the operating equipment identifier from the production work order data to obtain the target active work order.

6. The industrial control command verification method according to claim 1, characterized in that, The first verification result is obtained by verifying the business semantic data based on the behavioral baseline model of the target active work order, including: Based on the target timestamp of the instruction to be detected, the target current process context is obtained from the behavioral baseline model of the target active work order; wherein, the target current process context is the set of constraint rules corresponding to the target timestamp in the behavioral baseline model of the target active work order; Based on the set of constraint rules in the current process context of the target, the business semantic data is verified by the rule engine to obtain the first verification result; The first verification result includes parameter value range compliance verification result, operation timing compliance verification result, process mutual exclusion logic verification result, and multivariate coupling verification result.

7. The industrial control command verification method according to claim 1, characterized in that, The step of calling the AI ​​adjudication model to verify the instruction to be detected, and obtaining a second verification result, includes: Based on a preset time window and the target timestamp of the instruction to be detected, extract a continuous instruction sequence containing the instruction to be detected from the historical instruction log; Feature extraction is performed on the continuous instruction sequence to obtain feature data; wherein, the feature data includes instruction sending frequency, parameter change gradient, and operation sequence pattern; Using the aforementioned feature data as input, the AI ​​adjudication model is invoked for verification, resulting in a second verification result. The AI ​​adjudication model is used to verify whether the feature data exhibits abnormal behavioral patterns.

8. The industrial control command verification method according to claim 1, characterized in that, The step of generating the semantic decision result of the instruction to be detected based on the first verification result and the second verification result includes: If any rule in the first verification result fails the verification, a semantic ruling result indicating a violation is generated; When all the first verification results pass, but the second verification result is an abnormal result, a semantic decision result indicating that a review is required is generated; When all the first verification results pass and the second verification result is determined to be normal, a semantic ruling result indicating compliance is generated; The semantic adjudication result includes at least a judgment of compliance or violation, a level of severity of violation, and the specific type of rule violated.

9. The industrial control command verification method according to claim 8, characterized in that, The method further includes: When the severity level of the violation in the semantic adjudication result is low risk, log data is generated based on the instruction to be detected, the business semantic data, the target active work order, and the semantic adjudication result, and low risk warning information is output based on the semantic adjudication result.

10. The industrial control command verification method according to claim 8, characterized in that, The method further includes: When the severity level of the violation in the semantic adjudication result is high-risk, pre-interception processing is performed in the link from the instruction to be detected to the underlying control device, and high-risk alarm information is output according to the semantic adjudication result.

11. The industrial control command verification method according to claim 8, characterized in that, The method further includes: When the severity level of the violation in the semantic adjudication result is an extreme violation level, a matching violation scenario is obtained based on the instruction to be detected, the business semantic data, the target active work order, and the semantic adjudication result. Obtain the security priority control instruction corresponding to the violation scenario, and perform the corresponding device security fallback protection operation according to the security priority control instruction.

12. The industrial control command verification method according to claim 2, characterized in that, The method further includes: In the authorized learning mode, compliance data is collected; wherein, the compliance data includes compliant process change operation data and data on routine new production operation behaviors; The behavioral baseline model corresponding to the active work orders in the system is iteratively optimized based on the compliance data.

13. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory being used to store a computer program, and the processor running the computer program to cause the electronic device to perform the industrial control instruction verification method according to any one of claims 1 to 12.

14. A readable storage medium, characterized in that, The readable storage medium stores a computer program, which, when executed by a processor, performs the industrial control instruction verification method according to any one of claims 1 to 12.

15. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, performs the industrial control instruction verification method according to any one of claims 1 to 12.

Images