An abnormal behavior monitoring method and system for industrial control protocol deep analysis

Abstract

The application discloses an abnormal behavior monitoring method and system for industrial control protocol deep analysis. The method collects industrial control network traffic and performs session-based preprocessing, performs protocol deep analysis on industrial control messages, encodes device roles, function codes, object addresses, data values, response states, session states, and process data point meanings into protocol semantic tensors; generates a protocol constraint matrix according to protocol specifications, device operation permissions, process data point value ranges, and session state constraints, and performs constraint attention reconstruction on the protocol semantic tensors, and calculates the constraint attention reconstruction error; according to the reconstruction error, filter high-sensitive fields, construct a counterfactual field disturbance set, and calculate the counterfactual abnormal contribution degree; fusion reconstruction error and contribution degree to generate abnormal behavior monitoring results, output abnormal fields, abnormal constraint relationships, abnormal session locations, and hierarchical alarm information. It can identify industrial control communication behaviors with legal fields but abnormal semantic combinations, and improve the abnormal positioning and alarm explanation capabilities.

Description

Technical Field

[0001] This invention relates to the field of industrial control system network security technology, and in particular to a method and system for monitoring abnormal behavior through deep parsing of industrial control protocols. Background Technology

[0002] Industrial control systems are widely used in power, petrochemical, metallurgical, rail transportation, and intelligent manufacturing scenarios. PLCs, RTUs, HMIs, engineering workstations, and various sensors in these systems typically use industrial control protocols such as Modbus, DNP3, and OPC UA for data acquisition, parameter reading, control command issuance, and status feedback. Because some industrial control protocols are designed with real-time performance and compatibility in mind, they often neglect authentication, access control, semantic verification, and abnormal behavior identification. Attackers may exploit legitimate protocol formats to construct abnormal control behaviors, impacting the safe and stable operation of industrial sites.

[0003] Existing methods for monitoring anomalies in industrial control protocols largely rely on port identification, field parsing, rule matching, blacklists / whitelists, traffic statistics, or machine learning models. While these methods can detect obvious anomalies such as illegal function codes, out-of-bounds addresses, and high-frequency access, they lack the ability to identify behaviors where "the field itself is legal, but the combined semantics are abnormal." For example, the function code, address, and data value may all meet the format requirements, but the corresponding device role may not be authorized to perform the operation, or the operation may not match the current session state or the meaning of the process data point. Traditional methods are prone to missing these detections.

[0004] Furthermore, existing model-based detection methods typically rely directly on statistical or sequence features for anomaly identification, lacking explicit embedding of protocol specifications, device permissions, process value ranges, and session state constraints. This results in insufficient interpretability of detection results. Anomaly alarms often only provide risk scores or rule hit results, failing to pinpoint anomalous fields, anomalous constraint relationships, and anomalous session locations, thus not fully meeting the needs of industrial control system (ICS) site security audits, rapid tracing, and coordinated response. Therefore, there is an urgent need for an ICS protocol anomaly behavior monitoring method that, based on deep ICS protocol analysis, can uniformly express protocol fields, device roles, process data points, and session states, and combine protocol constraint relationships to achieve anomaly identification and anomaly source location. Summary of the Invention

[0005] This invention provides a method for monitoring abnormal behavior through deep parsing of industrial control protocols, comprising: S10. Collect industrial control network traffic and perform session-based preprocessing. Perform deep protocol parsing on the preprocessed industrial control messages and encode the parsed device roles, function codes, object addresses, data values, response status, session status, and process data point meanings into protocol semantic tensors. S20. Receive the protocol semantic tensor, generate a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range and session state constraints, and use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, and calculate the constraint attention reconstruction error. S30. Based on the constraint attention reconstruction error, select high-sensitivity field dimensions from the protocol semantic tensor and construct a set of counterfactual field perturbations around the high-sensitivity field dimensions; S40. Re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after perturbation, and obtain the counterfactual anomaly contribution degree corresponding to each field dimension based on the change. S50 integrates the constraint attention reconstruction error and the contribution of counterfactual anomalies to generate abnormal behavior monitoring results, and outputs abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical abnormal alarm information and security response instructions.

[0006] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols includes: collecting industrial control network traffic and performing session-based preprocessing; performing deep protocol parsing on the preprocessed industrial control messages; and encoding the parsed device roles, function codes, object addresses, data values, response statuses, session statuses, and process data point meanings into protocol semantic tensors, including: S101. Collect the mirror traffic of the industrial control network, and perform session division, message reassembly, duplicate message filtering and time sequence sorting based on the source address, destination address, port, transmission protocol, communication direction, transaction identifier and time stamp to obtain the sequence of industrial control messages to be parsed; S102. Call the plug-in protocol parsing engine to identify the industrial control protocol type corresponding to the industrial control message sequence to be parsed, and parse and extract the device address, function code, object address, data length, data value, response code, transaction identifier, session status and time stamp to obtain the basic protocol field set; S103. Combining the equipment fingerprint database, asset role information, and process data point mapping relationship, the basic protocol field set is tensor-encoded according to equipment role, function code, object address, data value, response status, session status, time sequence, and process data point to obtain the protocol semantic tensor.

[0007] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols includes receiving a protocol semantic tensor, generating a protocol constraint matrix based on protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, and using the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, calculating the constraint attention reconstruction error, including: S201. Based on the device role, function code, object address, data value, response status, and session status in the protocol semantic tensor, establish candidate semantic dependencies between field dimensions; S202. Based on the protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, candidate semantic dependencies are constrained and filtered to generate a protocol constraint matrix. S203. Use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor to obtain the reconstructed protocol semantic tensor, and calculate the constraint attention reconstruction error based on the difference between the protocol semantic tensor and the reconstructed protocol semantic tensor.

[0008] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols includes the following sub-steps: selecting high-sensitivity field dimensions from the protocol semantic tensor based on constraint attention reconstruction error, and constructing a counterfactual field perturbation set around these high-sensitivity field dimensions. S301. Based on the error distribution of constrained attention reconstruction error in device role, function code, object address, data value, response status and session status, determine the high-sensitivity field dimension; S302. For high-sensitivity fields, select counterfactual reference values ​​from the normal protocol field distribution, equipment permission rules, process data point value range, and session state order. S303. Based on the counterfactual reference value, perform replacement perturbation, masking perturbation, range regression perturbation or order substitution perturbation on the high-sensitivity field dimension to generate a counterfactual field perturbation set.

[0009] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols includes re-inputting the counterfactual field perturbation set into the constraint attention reconstruction process, calculating the change in constraint attention reconstruction error before and after the perturbation, and obtaining the counterfactual anomaly contribution rate corresponding to each field dimension based on the change, including: S401. Input the semantic tensors of each perturbation protocol in the counterfactual field perturbation set into the constraint attention reconstruction process to obtain the perturbation reconstruction error corresponding to each perturbation protocol semantic tensor. S402. Calculate the difference between each perturbation reconstruction error and the original constraint attention reconstruction error to obtain the error change corresponding to each high-sensitivity field dimension. S403. Calculate the counterfactual anomaly contribution based on the error change, and determine the field dimension with the highest counterfactual anomaly contribution as the dominant anomaly field dimension.

[0010] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols, wherein constraint attention reconstruction error and counterfactual anomaly contribution are fused to generate abnormal behavior monitoring results, and output abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical anomaly alarm information, and security response instructions, including: S501. Determine the anomaly level based on the constrained attention reconstruction error, and determine the dimensions of the anomaly field and the dominant anomaly field based on the counterfactual anomaly contribution. S502. Locate the abnormal constraint relationship based on the abnormal field, the dimension of the abnormal dominant field, and the protocol constraint matrix; S503 generates abnormal behavior monitoring results and hierarchical abnormal alarm information based on the abnormality level, abnormal fields, abnormal constraint relationships and abnormal session locations, and sends security response instructions to the security management platform, blocking devices or SIEM system.

[0011] The above-described method for monitoring abnormal behavior through deep parsing of industrial control protocols further includes a protocol constraint self-update step. S601. Obtain the field parsing rules, field meaning mapping rules, request-response matching rules, and session state transition rules for newly added industrial control protocols or private industrial control protocols, and load them into the plug-in protocol parsing engine; S602. Generate a new protocol constraint matrix based on the device role, function code, object address, data value, response status, and session status corresponding to the new industrial control protocol or private industrial control protocol. S603. Introduce the newly added protocol constraint matrix into the constraint attention reconstruction process and the counterfactual field perturbation set construction process to update the calculation range of constraint attention reconstruction error and counterfactual anomaly contribution.

[0012] This invention also provides an abnormal behavior monitoring system for deep parsing of industrial control protocols, comprising: The protocol semantic tensor generation module is used to collect industrial control network traffic and perform session-based preprocessing. It performs deep protocol parsing on the preprocessed industrial control messages, encodes the device roles, function codes, object addresses, data values, response status, session status, and process data point meanings obtained from the parsing into protocol semantic tensors, and outputs the protocol semantic tensors to the constraint attention reconstruction module. The constraint attention reconstruction module is connected to the protocol semantic tensor generation module. It receives the protocol semantic tensor, generates a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range and session state constraints, and uses the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, and calculates the constraint attention reconstruction error. The counterfactual perturbation construction module, connected to the constraint attention reconstruction module, is used to filter high-sensitivity field dimensions from the protocol semantic tensor based on the constraint attention reconstruction error, and construct a counterfactual field perturbation set around the high-sensitivity field dimensions; The anomaly contribution calculation module is connected to the constraint attention reconstruction module and the counterfactual perturbation construction module, respectively. It is used to re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after perturbation, and obtain the counterfactual anomaly contribution corresponding to each field dimension based on the change. The abnormal result output module is connected to the constraint attention reconstruction module and the abnormal contribution calculation module, respectively. It is used to integrate the constraint attention reconstruction error and the counterfactual abnormal contribution to generate abnormal behavior monitoring results and output abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical abnormal alarm information and security response instructions.

[0013] The beneficial effects achieved by this invention are as follows: By uniformly encoding the meanings of device roles, function codes, object addresses, data values, response states, session states, and process data points in industrial control messages into protocol semantic tensors, and combining them with constraint attention reconstruction analysis based on protocol specifications, device operation permissions, process value domains, and session state constraints, this invention can identify hidden industrial control communication behaviors with legal field formats but abnormal semantic combinations. Simultaneously, by calculating the anomaly contribution degree through counterfactual field perturbation, it can further locate abnormal fields, abnormal constraint relationships, and abnormal session locations. This ensures that the anomaly detection results not only have high accuracy but also good interpretability and traceability, thereby improving the industrial control system's ability to monitor security risks such as unauthorized control, abnormal parameter writing, response forgery, and abnormal session states, and providing a reliable basis for graded alarms, audit evidence collection, and coordinated handling. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0015] Figure 1 This is a flowchart of an abnormal behavior monitoring method for deep parsing of industrial control protocols provided in Embodiment 1 of this application.

[0016] Figure 2 This is a schematic diagram of the abnormal behavior monitoring system for deep parsing of industrial control protocols provided in Embodiment 2 of this application. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1

[0019] like Figure 1 As shown, Embodiment 1 of this application provides a method for monitoring abnormal behavior through deep parsing of industrial control protocols, including the following steps: S10. Collect industrial control network traffic and perform session-based preprocessing. Perform deep protocol parsing on the preprocessed industrial control messages and encode the parsed device roles, function codes, object addresses, data values, response status, session status, and process data point meanings into protocol semantic tensors. The system performs session-based preprocessing on industrial control network traffic, performs deep protocol parsing on the preprocessed industrial control messages, and encodes the meanings of the parsed protocol fields, device roles, session states, and process data points into protocol semantic tensors. Specifically, this includes the following sub-steps: S101. Collect the mirror traffic of the industrial control network, and perform session division, message reassembly, duplicate message filtering and time sequence sorting based on the source address, destination address, port, transmission protocol, communication direction, transaction identifier and time stamp to obtain the sequence of industrial control messages to be parsed; The system continuously collects mirrored traffic from industrial control networks using traffic acquisition units deployed at mirror ports of industrial control network switching equipment, bypass interfaces of industrial firewalls, or dedicated network probes. During collection, the system records the source address, destination address, port, transmission protocol, communication direction, transaction identifier, and timestamp for each packet, and uses this information to segment the mirrored traffic into sessions. The transaction identifier includes request numbers, sequence numbers, call identifiers, transaction numbers, or protocol identifiers that characterize the request-response relationship within the protocol message. When segmenting sessions, the system not only identifies the communicating parties based on the source address, destination address, port, and transmission protocol, but also determines the correspondence between request and response messages by combining the communication direction, transaction identifier, and timestamp.

[0020] For messages belonging to the same session, the system reassembles them according to the transport layer sequence, transaction identifier, and timestamp. If the industrial control protocol is based on TCP transmission, the system reassembles fragmented messages by combining the TCP connection state, sequence number, and transaction identifier; if the industrial control protocol is based on UDP or other connectionless transmission methods, the system associates request and response messages by combining the time window, communication direction, and transaction identifier. For repeatedly collected messages, the system filters them based on message payload, transaction identifier, and timestamp; for out-of-order messages within the same session, the system reorders them according to timestamp and request / response direction to obtain the sequence of industrial control messages to be parsed.

[0021] S102. Call the plug-in protocol parsing engine to identify the industrial control protocol type corresponding to the industrial control message sequence to be parsed, and parse and extract the device address, function code, object address, data length, data value, response code, transaction identifier, session status and time stamp to obtain the basic protocol field set; After obtaining the sequence of industrial control (IC) messages to be parsed, the system invokes the plug-in protocol parsing engine to identify the protocol type of the IC control message sequence. The plug-in protocol parsing engine is configured with multiple protocol parsing plugins, each corresponding to an IC control protocol or a type of message format, and records the message header structure, field offset rules, encoding method, function code meaning, object address resolution method, and request-response matching method for the corresponding protocol. The system identifies the IC control protocol type based on port characteristics, message header format, function code position, data length variations, transaction identifier structure, and communication direction, and then invokes the matching protocol parsing plugin to perform field parsing.

[0022] During field parsing, the system extracts device address, function code, object address, data length, data value, response code, transaction identifier, session state, and timestamp from the message to obtain a set of basic protocol fields. For fields with different names but the same function in different protocols, the system merges them according to unified field semantics; for example, slave address, node address, and device identifier are unified into device address, register address, object identifier, variable path, or data point number are unified into object address, and exception code, status code, or execution feedback are unified into response code. While extracting field values, the system retains the association identifiers between fields, including the role correspondence between device address and communication direction, the access relationship between function code and object address, the parameter relationship between object address and data value, the feedback relationship between response code and transaction identifier, and the order relationship between session state and timestamp.

[0023] S103. Combining the equipment fingerprint database, asset role information, and process data point mapping relationship, the basic protocol field set is tensor-encoded according to equipment role, function code, object address, data value, response status, session status, time sequence, and process data point to obtain the protocol semantic tensor.

[0024] After obtaining the basic protocol field set, the system combines the equipment fingerprint database, asset role information, and process data point mapping relationships to perform semantic completion and tensor encoding on the basic protocol field set. The equipment fingerprint database stores equipment communication characteristics, protocol types, address ranges, commonly used function codes, and historical communication objects. The system determines the equipment type based on the equipment address, protocol type, communication direction, and historical communication characteristics. Asset role information records the role attributes of each industrial control device in the industrial field. The system maps the devices participating in communication to host computers, engineering workstations, human-machine interfaces, programmable logic controllers, remote terminal units, sensor gateways, or actuator control units. The process data point mapping relationship records the correspondence between object addresses and on-site process variables. The system maps object addresses to specific process data points and determines the corresponding process object, parameter type, and value meaning of each process data point.

[0025] During tensor encoding, the system uses the message order within a session as the time axis and device role, function code, object address, data value, response status, session status, and process data point as the semantic feature axis, writing the semantic fields corresponding to each message into the corresponding positions in the tensor. For discrete fields such as device role, function code, object address, response status, and session status, the system uses numbered encoding, one-hot encoding, or embedded encoding for conversion; for continuous fields such as data values, the system performs normalization processing based on the value range, unit, and engineering meaning of the process data points; for time sequence information, the system performs serialization encoding based on the message's position in the session, the time interval between adjacent messages, and the correspondence between transaction identifiers.

[0026] For cases where different industrial control protocols have inconsistencies in the number, meaning, and length of fields, the system aligns them according to a unified semantic field template. For messages with corresponding fields, the field code is written to the corresponding tensor location; for messages without corresponding fields, the corresponding tensor location is written with a null value code, and a field mask identifier is written simultaneously; for messages with variable-length data areas, they are split into one or more data point encoding units according to the process data point mapping relationship. After the above processing, the tensor units corresponding to multiple messages within the same session are combined in chronological order to form a protocol semantic tensor.

[0027] S20. Receive the protocol semantic tensor, generate a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range and session state constraints, and use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, and calculate the constraint attention reconstruction error. The system receives the protocol semantic tensor generated in step S10 and establishes constraint relationships between protocol fields based on protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints. Subsequently, the system encodes these constraint relationships into a protocol constraint matrix and uses the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, calculating the constraint attention reconstruction error. Specifically, this includes the following sub-steps: S201. Based on the device role, function code, object address, data value, response status, and session status in the protocol semantic tensor, establish candidate semantic dependencies between field dimensions; The system reads fields such as device role, function code, object address, data value, response status, and session status from the protocol semantic tensor. Based on the co-occurrence relationships of fields within the same message, request-response fragment, and session window, it establishes candidate semantic dependencies between these fields. These candidate semantic dependencies include operational associations between device roles and function codes, access associations between function codes and object addresses, parameter associations between object addresses and data values, feedback associations between function codes and response statuses, and stage associations between session statuses and function codes / response statuses.

[0028] S202. Based on the protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, candidate semantic dependencies are constrained and filtered to generate a protocol constraint matrix. After obtaining candidate semantic dependencies, the system filters them based on protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints. For field relationships that satisfy the protocol access rules, equipment permission rules, process value range rules, and session state rules, the system retains their semantic connections; for field relationships that do not satisfy the above constraints, the system reduces their connection weights or marks them as suppressed connections. The system generates a protocol constraint matrix based on the filtered field relationships. The elements in the protocol constraint matrix correspond to the field dimensions in the protocol semantic tensor and are used to participate in subsequent constraint attention reconstruction calculations.

[0029] S203. Use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor to obtain the reconstructed protocol semantic tensor, and calculate the constraint attention reconstruction error based on the difference between the protocol semantic tensor and the reconstructed protocol semantic tensor.

[0030] After generating the protocol constraint matrix, the system inputs the protocol semantic tensor into the constraint attention reconstruction process. The system first converts each field dimension in the protocol semantic tensor into a field embedding representation, and then generates query vectors, key vectors, and value vectors from these representations. Next, the protocol constraint matrix is ​​introduced into the attention weight calculation, ensuring that the attention allocation between fields is simultaneously influenced by field similarity and protocol constraint relationships. Finally, the protocol semantic tensor is reconstructed based on the constrained attention weights, resulting in the reconstructed protocol semantic tensor.

[0031] To simultaneously measure field value reconstruction deviation, session temporal change deviation, and attention connection out-of-bounds behavior, the system calculates the constraint attention reconstruction error using the following formula: in, This represents the constraint attention reconstruction error; This indicates the number of messages in the current session window; Indicates the sequence number of the current message within the session window; Indicates the first The protocol semantic tensor unit corresponding to each message; Indicates the first The reconstructed protocol semantic tensor unit obtained after constrained attention reconstruction of a message; Indicates the first Valid field mask for each message; Indicates the importance weight of the field; Indicates the weight of time-series changes; Indicates the first The attention weight matrix formed by each message during the constrained attention reconstruction process; Indicates the first The protocol constraint matrix corresponding to each message; This represents element-wise multiplication; This represents the adjustment coefficient for time-series variation errors; This represents the external attention penalty coefficient; This represents a stability constant to prevent the denominator from being zero. When the combination of fields in the industrial control message conforms to the protocol specification, device permissions, process value range, and session state constraints, the deviation between the reconstructed protocol semantic tensor and the original protocol semantic tensor is small, and the constraint attention reconstruction error is low. When there are issues such as role overreach, functional object mismatch, abnormal object value range, abnormal response state, or inconsistent session state among the fields, the constraint attention reconstruction error increases.

[0032] S30. Based on the constraint attention reconstruction error, select high-sensitivity field dimensions from the protocol semantic tensor and construct a set of counterfactual field perturbations around the high-sensitivity field dimensions; Based on the constrained attention reconstruction error obtained in step S20, the system performs sensitivity screening on the field dimensions in the protocol semantic tensor to identify high-sensitivity field dimensions that have a significant impact on abnormal reconstruction errors. Subsequently, the system selects counterfactual reference values ​​around these high-sensitivity field dimensions and generates a set of counterfactual field perturbations through methods such as replacement, masking, range regression, or order permutation. Specifically, this includes the following sub-steps: S301. Based on the error distribution of constrained attention reconstruction error in device role, function code, object address, data value, response status and session status, determine the high-sensitivity field dimension; The system receives the constraint attention reconstruction error output in step S20 and further reads the reconstruction differences corresponding to each field dimension during the constraint attention reconstruction process. Since the protocol semantic tensor contains field dimensions such as device role, function code, object address, data value, response status, and session status, the system decomposes the overall constraint attention reconstruction error according to the field dimensions to obtain the error distribution results corresponding to each field dimension.

[0033] In specific processing, the system statistically analyzes the field-level reconstruction deviation, temporal change deviation, and external attention deviation of device roles, function codes, object addresses, data values, response states, and session states within the current session window. For a given field dimension, if its reconstruction deviation is significantly higher than other field dimensions within the same session window, or if the attention connection corresponding to that field dimension frequently falls outside the protocol constraint matrix, the system marks that field dimension as a candidate high-sensitivity field dimension. Subsequently, the system sorts the candidate high-sensitivity field dimensions based on field importance weights and session position, and selects field dimensions that meet preset sensitivity conditions as high-sensitivity field dimensions.

[0034] S302. For high-sensitivity fields, select counterfactual reference values ​​from the normal protocol field distribution, equipment permission rules, process data point value range, and session state order. After determining the high-sensitivity field dimensions, the system selects a corresponding counterfactual reference value for each high-sensitivity field dimension. The counterfactual reference value is not arbitrary, but is extracted from the normal protocol field distribution, equipment permission rules, process data point value range, and session state order to form an alternative input that is comparable to the current field value.

[0035] When the high-sensitivity field dimension is a device role, the system selects a counterfactual reference value from device roles with legitimate operating permissions within the same protocol type, session scenario, or process area. When the high-sensitivity field dimension is a function code, the system selects the function code allowed to be executed by the current device role as the counterfactual reference value based on device permission rules and the current session state. When the high-sensitivity field dimension is an object address, the system selects the object address that belongs to the same process object as the current controlled object and has a legitimate access relationship based on the process data point mapping relationship. When the high-sensitivity field dimension is a data value, the system selects the normal value range center, historical stable interval value, or parameter value at an adjacent normal time based on the process data point value range, unit, and normal operation distribution. When the high-sensitivity field dimension is a response state, the system selects a matching normal response state based on the request function code and transaction identifier. When the high-sensitivity field dimension is a session state, the system selects a session state that matches the current session stage based on the normal request-response sequence. Through the above methods, the counterfactual reference value can reflect the reasonable value that this field should present when both protocol constraints and process constraints are satisfied.

[0036] S303. Based on the counterfactual reference value, perform replacement perturbation, masking perturbation, range regression perturbation or order substitution perturbation on the high-sensitivity field dimension to generate a counterfactual field perturbation set.

[0037] After obtaining the counterfactual reference value, the system generates a counterfactual field perturbation set based on the high-sensitivity field dimension and the counterfactual reference value. For discrete field dimensions, the system uses a replacement perturbation method, replacing the values ​​of the corresponding fields in the original protocol semantic tensor with the counterfactual reference value. For example, it replaces abnormal device roles with device roles with legitimate permissions, or replaces abnormal function codes with function codes that are allowed to be executed in the current session state. For field dimensions that require verification of field necessity, the system uses a masking perturbation method, setting the corresponding field position to null value encoding or mask encoding to observe the change in constraint attention reconstruction error after the field is removed.

[0038] For continuous fields such as data values, the system employs a range regression perturbation method to revert the original data values ​​to the normal value range, historical stable range, or normal value range center of the process data points, thereby constructing counterfactual inputs that satisfy the process value range constraints. For session state or time-sequence related fields, the system uses a sequence substitution perturbation method to adjust abnormal session states to state codes that conform to the normal request-response order, or to adjust the state order in a local session fragment to the normal state transition order. The system saves the perturbed protocol semantic tensors as perturbed protocol semantic tensors, and a counterfactual field perturbation set is composed of multiple perturbed protocol semantic tensors.

[0039] S40. Re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after perturbation, and obtain the counterfactual anomaly contribution degree corresponding to each field dimension based on the change. The system re-inputs the counterfactual field perturbation set generated in step S30 into the constraint attention reconstruction process in step S20, and calculates the perturbation reconstruction error under different perturbation conditions. Subsequently, the system compares the perturbation reconstruction error with the original constraint attention reconstruction error, and calculates the counterfactual anomaly contribution corresponding to each high-sensitivity field dimension based on the error reduction magnitude, perturbation magnitude, field constraint correlation strength, and field importance. Specifically, this includes the following sub-steps: S401. Input the semantic tensors of each perturbation protocol in the counterfactual field perturbation set into the constraint attention reconstruction process to obtain the perturbation reconstruction error corresponding to each perturbation protocol semantic tensor. The counterfactual field perturbation set includes multiple perturbation protocol semantic tensors. Each perturbation protocol semantic tensor is obtained by performing replacement perturbation, masking perturbation, range regression perturbation, or order substitution perturbation on a certain high-sensitivity field dimension based on the original protocol semantic tensor. The system inputs each perturbation protocol semantic tensor into the constraint attention reconstruction process in step S20, and uses the protocol constraint matrix, field validity mask, field importance weight, and temporal change weight to obtain the perturbation reconstruction error corresponding to each perturbation protocol semantic tensor.

[0040] S402. Calculate the difference between each perturbation reconstruction error and the original constraint attention reconstruction error to obtain the error change corresponding to each high-sensitivity field dimension. After obtaining the reconstruction errors of each disturbance, the system calculates the difference between each disturbance reconstruction error and the original constraint attention reconstruction error obtained in step S20. For the first... For each highly sensitive field dimension, when it is replaced with a counterfactual reference value that satisfies protocol or process constraints, if the perturbation reconstruction error is lower than the original constraint attention reconstruction error, it indicates that the field dimension has an explanatory role in the original anomaly; if the reconstruction error changes little after the perturbation, it indicates that the field dimension contributes little to the current anomaly. The system calculates the error change under different perturbation methods for each highly sensitive field dimension and retains the perturbation field position, the field value before the perturbation, the field value after the perturbation, and the corresponding perturbation reconstruction error.

[0041] S403. Calculate the counterfactual anomaly contribution based on the error change, and determine the field dimension with the highest counterfactual anomaly contribution as the dominant anomaly field dimension.

[0042] After obtaining the error change corresponding to each highly sensitive field dimension, the system further calculates the counterfactual anomaly contribution. The counterfactual anomaly contribution comprehensively considers the magnitude of error reduction after perturbation, the closeness between the perturbation protocol semantic tensor and the original protocol semantic tensor, the correlation strength of the field in the protocol constraint matrix, and the importance of the field itself, thereby avoiding determining the source of the anomaly solely based on the magnitude of a single error decrease.

[0043] The system first calculates the first The high-sensitivity field dimension in the first Explanation value of a single perturbation under counterfactual perturbations The calculation formula is as follows: In the formula, Indicates the first The high-sensitivity field dimension in the first Explanatory value of a single perturbation under a counterfactual perturbation; This represents the original constrained attention reconstruction error calculated in step S20; Indicates the first The high-sensitivity field dimension in the first The perturbation reconstruction error obtained under a counterfactual perturbation; Represents the semantic tensor of the original protocol; Indicates the first The high-sensitivity field dimension in the first Perturbation protocol semantic tensor generated under counterfactual perturbations; Indicates the number of valid fields in the field validity mask; Indicates the disturbance cost suppression coefficient; This represents the stability constant to prevent the denominator from being zero. This represents the norm difference between the original protocol semantic tensor and the perturbation protocol semantic tensor. In the above formula, This term is used to characterize the degree to which the reconstruction error after perturbation decreases relative to the original reconstruction error. The more significant the decrease in the reconstruction error after perturbation, the stronger the explanatory power of the corresponding field dimension for anomalies. The exponential term is used to suppress counterfactual samples with excessively large perturbation amplitudes. When the difference between the perturbation protocol semantic tensor and the original protocol semantic tensor is too large, the value of this exponential term is reduced, thereby reducing the impact of the perturbation result on the contribution calculation.

[0044] Subsequently, the system aggregates multiple single-perturbation interpretation values ​​under the same high-sensitivity field dimension and calculates the first... Unnormalized contribution values ​​of each high-sensitivity field dimension The calculation formula is as follows: ,in, Indicates the first Unnormalized contribution values ​​of each high-sensitivity field dimension; Indicates the first The number of counterfactual disturbances corresponding to each highly sensitive field dimension; Indicates the first The constraint correlation strength of each highly sensitive field dimension in the protocol constraint matrix; Indicates the first The importance weight of each highly sensitive field dimension; This represents the constraint correlation strength adjustment coefficient; This represents the field importance adjustment coefficient. Among them, According to the The number of effective constraint connections and connection weights between each highly sensitive field dimension and other field dimensions in the protocol constraint matrix are determined. The importance of device role, function code, object address, data value, response status, and session status in anomaly monitoring is determined based on their preset importance. This is achieved by introducing... and The unnormalized contribution value simultaneously reflects the effect of error change after field perturbation, the degree of correlation of the field in protocol semantic constraints, and the importance of the field itself.

[0045] Finally, the system normalizes the unnormalized contribution values ​​of each high-sensitivity field dimension, obtaining the first... Contribution of counterfactual anomalies corresponding to each high-sensitivity field dimension The calculation formula is as follows: ,in, Indicates the first The counterfactual anomaly contribution of each highly sensitive field dimension; This represents the set of highly sensitive field dimensions determined in step S301; Represents any field dimension in the set of highly sensitive field dimensions; Indicates the first Unnormalized contribution values ​​of each high-sensitivity field dimension.

[0046] Through the above calculations, the system obtains the counterfactual anomaly contribution degree corresponding to each high-sensitivity field dimension. The system sorts the high-sensitivity field dimensions according to the counterfactual anomaly contribution degree from high to low, and determines the field dimension with the highest counterfactual anomaly contribution degree as the anomaly-dominant field dimension. When the counterfactual anomaly contribution degrees of multiple field dimensions all exceed the preset contribution threshold, the system determines the multiple field dimensions together as the anomaly-dominant field dimension combination.

[0047] S50 integrates the constraint attention reconstruction error and the contribution of counterfactual anomalies to generate abnormal behavior monitoring results, and outputs abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical abnormal alarm information and security response instructions.

[0048] The system integrates the constraint attention reconstruction error obtained in step S20 and the counterfactual anomaly contribution rate obtained in step S40 to determine anomalies in the current industrial control message or session window. The system determines the degree of anomaly based on the constraint attention reconstruction error, identifies the source of the anomaly based on the counterfactual anomaly contribution rate, and locates the anomaly constraint relationships using the protocol constraint matrix. Finally, it generates anomaly behavior monitoring results, tiered anomaly alarm information, and security response instructions. Specifically, it includes the following sub-steps: S501. Determine the anomaly level based on the constrained attention reconstruction error, and determine the dimensions of the anomaly field and the dominant anomaly field based on the counterfactual anomaly contribution. The system first reads the constraint attention reconstruction error calculated in step S20 and compares it with a preset anomaly threshold to determine the anomaly level of the current industrial control communication behavior. The preset anomaly threshold can be set based on historical normal operation data, industrial control protocol type, equipment role, process area, and security policy. Specifically, when the constraint attention reconstruction error does not exceed the first anomaly threshold, the system classifies the current communication behavior as normal or low-risk behavior; when the constraint attention reconstruction error exceeds the first anomaly threshold but does not exceed the second anomaly threshold, the system classifies the current communication behavior as suspicious anomaly; when the constraint attention reconstruction error exceeds the second anomaly threshold, the system classifies the current communication behavior as high-risk anomaly; when the constraint attention reconstruction error exceeds the third anomaly threshold, and the counterfactual anomaly contribution of the corresponding field dimension is concentrated in control-related fields or key process data point fields, the system classifies the current communication behavior as serious anomaly.

[0049] After determining the anomaly level, the system further reads the counterfactual anomaly contribution rate corresponding to each field dimension calculated in step S40, and sorts the high-sensitivity field dimensions according to the counterfactual anomaly contribution rate from high to low. The system determines the field dimension with the highest counterfactual anomaly contribution rate as the anomaly-dominant field dimension, and determines the original field value corresponding to the anomaly-dominant field dimension as the anomaly field. For example, when the counterfactual anomaly contribution rate of the function code dimension is the highest, the system determines the current function code as the anomaly field; when the counterfactual anomaly contribution rate of the object address dimension is the highest, the system determines the current object address as the anomaly field; when the counterfactual anomaly contribution rate of the data value dimension is the highest, the system determines the current data value or the corresponding process parameter as the anomaly field; when the counterfactual anomaly contribution rate of the equipment role dimension or the session status dimension is the highest, the system determines the corresponding equipment role or session status as the anomaly field, respectively.

[0050] When the counterfactual anomaly contribution of multiple field dimensions exceeds a preset contribution threshold, the system identifies the multiple field dimensions together as the dominant anomaly field dimension combination and determines the corresponding field combination as the anomaly field combination. Through this process, the anomaly behavior monitoring results can not only provide the anomaly level of the current communication behavior, but also identify which type of field among device role, function code, object address, data value, response status, or session status the anomaly mainly originates from.

[0051] S502. Locate the abnormal constraint relationship based on the abnormal field, the dimension of the abnormal dominant field, and the protocol constraint matrix; After identifying the anomalous field and the dominant anomalous field dimension, the system locates the anomalous constraint relationships involved in the anomalous field based on the protocol constraint matrix. The system first searches the protocol constraint matrix for the matrix row or column corresponding to the dominant anomalous field dimension to determine the constraint connections between this field dimension and other field dimensions. Subsequently, the system combines the original field values ​​in the protocol semantic tensor, the reconstructed field values ​​in the reconstructed protocol semantic tensor, and the field values ​​after counterfactual perturbation to determine which type of protocol semantic constraint the anomalous field violates.

[0052] Specifically, when the dominant field of the exception is device role, the system checks the permission constraints between that device role and the current function code and object address to determine if there are unauthorized devices performing control operations, non-engineering workstations modifying parameters, or non-host computers accessing key process data points. When the dominant field of the exception is function code, the system checks the constraint relationships between that function code and object address, response status, and session status to determine if there are mismatches between the function code and the accessed object, if the function code is not allowed to be executed under the current session status, or if the response status does not correspond to the requested function code. When the dominant field of the exception is object address, the system checks the constraint relationships between the object address and function code, data value, and process data point to determine if there are instances of accessing unexpected data areas, unauthorized access to key registers, or access to data points that do not match the current control action.

[0053] When the dominant field dimension of the anomaly is a data value, the system checks the value range constraints, variation range constraints, and unit constraints of the data value and the corresponding process data point of the object address to determine if there are any abnormal parameter writes, exceeding the process safety range, parameter jumps, or discrepancies with historical normal operating ranges. When the dominant field dimension of the anomaly is a response status, the system checks the feedback constraints between the response status and the transaction identifier, function code, and session status to determine if there are any responses forged, response codes that do not match the request, or abnormal responses that are disguised as normal responses. When the dominant field dimension of the anomaly is a session status, the system checks the constraint relationships between the current session status and the order of preceding and following messages, the request-response process, and allowed operations to determine if there are any abnormal session status transitions, responses that occur without necessary requests, or control commands lacking corresponding feedback.

[0054] Through the above processing, the system maps the abnormal fields to the constraint connection relationships in the protocol constraint matrix, thus obtaining the abnormal constraint relationships.

[0055] S503 generates abnormal behavior monitoring results and hierarchical abnormal alarm information based on the abnormality level, abnormal fields, abnormal constraint relationships and abnormal session locations, and sends security response instructions to the security management platform, blocking devices or SIEM system.

[0056] After locating the abnormal constraints, the system combines the abnormality level, abnormal fields, the dimension of the dominant abnormal field, the abnormal constraint relationship, and the abnormal session location to generate abnormal behavior monitoring results. The abnormal session location is determined based on the timestamp, transaction identifier, session identifier, and message sequence number of the message containing the abnormal field, and is used to indicate the specific location where the abnormality occurred within the current session window. The abnormal behavior monitoring results may include the abnormality occurrence time, source device, destination device, protocol type, abnormal fields, abnormal field values, dimension of the dominant abnormal field, abnormal constraint relationship, constraint attention reconstruction error, counterfactual anomaly contribution, abnormality level, and abnormal session location.

[0057] Subsequently, the system generates tiered anomaly alarm information based on the anomaly level and anomaly constraint relationships. For suspicious anomalies, the system generates a prompt-level alarm and records the anomaly fields, anomaly session location, and corresponding reconstruction error; for medium-risk anomalies, the system generates an alarm-level event and associates the anomaly fields, anomaly constraint relationships, and counterfactual anomaly contribution; for high-risk anomalies, the system generates a high-risk alarm and marks the abnormal communication source, abnormal session, and abnormal access object; for severe anomalies, the system generates an emergency alarm and triggers a security response command. The security response command can be sent to the security management platform, blocking devices, or the SIEM system to perform alarm display, log retention, session blocking, access restriction, source address blocking, abnormal access path blocking, or emergency response work order generation.

[0058] When generating hierarchical anomaly alarm information, the system combines the anomaly fields, anomaly constraint relationships, and anomaly session locations, so that the alarm information can simultaneously reflect "what anomaly occurred", "which field caused the anomaly", "which type of protocol constraint was violated", and "where in the session the anomaly occurred".

[0059] S60, Protocol Constraint Self-Update Steps.

[0060] To adapt to newly added protocols, proprietary protocols, or changes in protocol fields in industrial control environments, the system also performs a protocol constraint self-update step. This step updates the plug-in protocol parsing engine and protocol constraint matrix, enabling newly added protocol messages to be incorporated into the protocol semantic tensor encoding, constraint attention reconstruction, and counterfactual field perturbation analysis processes. Specifically, it includes the following sub-steps: S601. Obtain the field parsing rules, field meaning mapping rules, request-response matching rules, and session state transition rules for newly added industrial control protocols or private industrial control protocols, and load them into the plug-in protocol parsing engine; When a new device is added to the industrial control field, a private industrial control protocol is enabled, or the field structure of an existing protocol is extended, the system obtains the corresponding protocol's field parsing rules, field meaning mapping rules, request-response matching rules, and session state transition rules. Field parsing rules determine the location and encoding method of device addresses, function codes, object addresses, data values, response statuses, and session identifiers in the new protocol messages. Field meaning mapping rules convert new protocol fields into device roles, operational meanings, process data points, and parameter meanings. Request-response matching rules determine the correspondence between request and response messages in the new protocol. Session state transition rules describe the state changes of the new protocol during request, response, confirmation, exception feedback, and continuous interaction processes. The system loads these rules into the plug-in protocol parsing engine, enabling it to parse new or private industrial control protocols.

[0061] S602. Generate a new protocol constraint matrix based on the device role, function code, object address, data value, response status, and session status corresponding to the new industrial control protocol or private industrial control protocol. After the new protocol parsing rules are loaded, the system establishes semantic constraint relationships between field dimensions based on the device role, function code, object address, data value, response status, and session status corresponding to the new industrial control protocol or private industrial control protocol. Specifically, the system generates a new protocol constraint matrix based on the authorization relationship between device role and function code, the access relationship between function code and object address, the value relationship between object address and data value, the feedback relationship between function code and response status, and the status relationship between session status and allowed operations. The new protocol constraint matrix uses the same data structure as the protocol constraint matrix in step S20, enabling the new protocol fields to participate in subsequent constraint attention reconstruction calculations.

[0062] S603. Introduce the newly added protocol constraint matrix into the constraint attention reconstruction process and the counterfactual field perturbation set construction process to update the calculation range of constraint attention reconstruction error and counterfactual anomaly contribution.

[0063] After generating the new protocol constraint matrix, the system incorporates it into the constraint attention reconstruction process in step S20, enabling the protocol semantic tensor corresponding to the new protocol to calculate the constraint attention reconstruction error according to the new constraint relationships. Simultaneously, the system incorporates the new protocol constraint matrix into the counterfactual field perturbation set construction process in step S30, allowing the new protocol fields to generate counterfactual reference values ​​and perturbation protocol semantic tensors according to their corresponding device permissions, functional object relationships, process value domains, and session state transition rules. Through this process, the system updates the calculation range for constraint attention reconstruction error and counterfactual anomaly contribution.

[0064] Example 2 like Figure 2 As shown, Embodiment 2 of this application provides an abnormal behavior monitoring system for deep parsing of industrial control protocols, including: The protocol semantic tensor generation module is used to collect industrial control network traffic and perform session-based preprocessing. It then performs deep protocol parsing on the preprocessed industrial control messages, encoding the parsed device roles, function codes, object addresses, data values, response statuses, session statuses, and process data point meanings into protocol semantic tensors. These tensors are then output to the constraint attention reconstruction module. This includes: The traffic processing submodule is used to collect mirrored traffic from the industrial control network and perform session segmentation, packet reassembly, duplicate packet filtering, and timing organization based on the source address, destination address, port, transmission protocol, communication direction, transaction identifier, and timestamp to obtain the sequence of industrial control packets to be parsed.

[0065] The protocol parsing submodule is used to call the plug-in protocol parsing engine to identify the industrial control protocol type corresponding to the industrial control message sequence to be parsed, and to parse and extract the device address, function code, object address, data length, data value, response code, transaction identifier, session status and timestamp to obtain the basic protocol field set.

[0066] The tensor encoding submodule is used to combine the equipment fingerprint database, asset role information and process data point mapping relationship to perform tensor encoding on the basic protocol field set according to equipment role, function code, object address, data value, response status, session status, time order and process data point to obtain the protocol semantic tensor.

[0067] The constraint attention reconstruction module connects to the protocol semantic tensor generation module. It receives the protocol semantic tensor, generates a protocol constraint matrix based on protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, and uses this constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, calculating the constraint attention reconstruction error. This includes: The dependency establishment submodule is used to establish candidate semantic dependencies between field dimensions based on device roles, function codes, object addresses, data values, response states, and session states in the protocol semantic tensor.

[0068] The matrix generation submodule is used to constrain and filter candidate semantic dependencies based on protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, and generate a protocol constraint matrix.

[0069] The error calculation submodule is used to perform constraint attention reconstruction on the protocol semantic tensor using the protocol constraint matrix to obtain the reconstructed protocol semantic tensor, and calculate the constraint attention reconstruction error based on the difference between the protocol semantic tensor and the reconstructed protocol semantic tensor.

[0070] The counterfactual perturbation construction module connects to the constraint attention reconstruction module. It is used to filter high-sensitivity field dimensions from the protocol semantic tensor based on the constraint attention reconstruction error, and construct a set of counterfactual field perturbations around these high-sensitivity field dimensions. This includes: The field filtering submodule is used to determine the high-sensitivity field dimensions by reconstructing the error distribution of device roles, function codes, object addresses, data values, response statuses, and session statuses based on constrained attention.

[0071] The reference selection submodule is used to select counterfactual reference values ​​for high-sensitivity fields from the normal protocol field distribution, equipment permission rules, process data point value range, and session state order.

[0072] The perturbation generation submodule is used to perform replacement perturbation, masking perturbation, range regression perturbation, or order permutation perturbation on the high-sensitivity field dimension based on the counterfactual reference value, and generate a set of counterfactual field perturbations.

[0073] The anomaly contribution calculation module is connected to both the constraint attention reconstruction module and the counterfactual perturbation construction module. It is used to re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after the perturbation, and obtain the counterfactual anomaly contribution value corresponding to each field dimension based on the change. This includes: The perturbation reconstruction submodule is used to input the semantic tensors of each perturbation protocol in the counterfactual field perturbation set into the constraint attention reconstruction process to obtain the perturbation reconstruction error corresponding to each perturbation protocol semantic tensor.

[0074] The change calculation submodule is used to calculate the difference between each perturbation reconstruction error and the original constraint attention reconstruction error, and obtain the error change corresponding to each high-sensitivity field dimension.

[0075] The contribution calculation submodule is used to calculate the counterfactual anomaly contribution based on the error change, and to determine the field dimension with the highest counterfactual anomaly contribution as the dominant anomaly field dimension.

[0076] The anomaly output module is connected to both the constraint attention reconstruction module and the anomaly contribution calculation module. It integrates the constraint attention reconstruction error and the counterfactual anomaly contribution to generate anomaly behavior monitoring results, and outputs anomaly fields, anomaly constraint relationships, anomaly session locations, tiered anomaly alarm information, and security response instructions. This includes: The level determination submodule is used to determine the anomaly level based on the constraint attention reconstruction error, and to determine the dimensions of the anomaly field and the anomaly dominant field based on the counterfactual anomaly contribution.

[0077] The relationship location submodule is used to locate abnormal constraint relationships based on the abnormal field, the dimension of the abnormal dominant field, and the protocol constraint matrix.

[0078] The alarm output submodule is used to generate abnormal behavior monitoring results and hierarchical abnormal alarm information based on the abnormality level, abnormal fields, abnormal constraint relationships and abnormal session location, and send security response instructions to the security management platform, blocking devices or SIEM system.

[0079] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for monitoring abnormal behavior through deep parsing of industrial control protocols, characterized in that, include: S10. Collect industrial control network traffic and perform session-based preprocessing. Perform deep protocol parsing on the preprocessed industrial control messages and encode the parsed device roles, function codes, object addresses, data values, response status, session status, and process data point meanings into protocol semantic tensors. S20. Receive the protocol semantic tensor, generate a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range and session state constraints, and use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, and calculate the constraint attention reconstruction error. S30. Based on the constraint attention reconstruction error, select high-sensitivity field dimensions from the protocol semantic tensor and construct a set of counterfactual field perturbations around the high-sensitivity field dimensions; S40. Re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after perturbation, and obtain the counterfactual anomaly contribution degree corresponding to each field dimension based on the change. S50 integrates the constraint attention reconstruction error and the contribution of counterfactual anomalies to generate abnormal behavior monitoring results, and outputs abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical abnormal alarm information and security response instructions.

2. The abnormal behavior monitoring method for deep parsing of industrial control protocols according to claim 1, characterized in that, Collect industrial control network traffic and perform session-based preprocessing. Perform deep protocol parsing on the preprocessed industrial control messages, and encode the parsed device roles, function codes, object addresses, data values, response statuses, session statuses, and process data point meanings into protocol semantic tensors. This includes the following sub-steps: S101. Collect the mirror traffic of the industrial control network, and perform session division, message reassembly, duplicate message filtering and time sequence sorting based on the source address, destination address, port, transmission protocol, communication direction, transaction identifier and time stamp to obtain the sequence of industrial control messages to be parsed; S102. Call the plug-in protocol parsing engine to identify the industrial control protocol type corresponding to the industrial control message sequence to be parsed, and parse and extract the device address, function code, object address, data length, data value, response code, transaction identifier, session status and time stamp to obtain the basic protocol field set; S103. Combining the equipment fingerprint database, asset role information, and process data point mapping relationship, the basic protocol field set is tensor-encoded according to equipment role, function code, object address, data value, response status, session status, time sequence, and process data point to obtain the protocol semantic tensor.

3. The abnormal behavior monitoring method for deep parsing of industrial control protocols according to claim 1, characterized in that, The process involves receiving the protocol semantic tensor, generating a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range, and session state constraints, and then using the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, calculating the constraint attention reconstruction error. This includes the following sub-steps: S201. Based on the device role, function code, object address, data value, response status, and session status in the protocol semantic tensor, establish candidate semantic dependencies between field dimensions; S202. Based on the protocol specifications, equipment operation permissions, process data point value ranges, and session state constraints, candidate semantic dependencies are constrained and filtered to generate a protocol constraint matrix. S203. Use the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor to obtain the reconstructed protocol semantic tensor, and calculate the constraint attention reconstruction error based on the difference between the protocol semantic tensor and the reconstructed protocol semantic tensor.

4. The abnormal behavior monitoring method for deep parsing of industrial control protocols according to claim 1, characterized in that, Based on the constrained attention reconstruction error, high-sensitivity field dimensions are selected from the protocol semantic tensor, and a set of counterfactual field perturbations is constructed around the high-sensitivity field dimensions, including the following sub-steps: S301. Based on the error distribution of constrained attention reconstruction error in device role, function code, object address, data value, response status and session status, determine the high-sensitivity field dimension; S302. For high-sensitivity fields, select counterfactual reference values ​​from the normal protocol field distribution, equipment permission rules, process data point value range, and session state order. S303. Based on the counterfactual reference value, perform replacement perturbation, masking perturbation, range regression perturbation or order substitution perturbation on the high-sensitivity field dimension to generate a counterfactual field perturbation set.

5. The method for monitoring abnormal behavior through deep parsing of industrial control protocols according to claim 1, characterized in that, The counterfactual field perturbation set is re-input into the constraint attention reconstruction process. The change in constraint attention reconstruction error before and after perturbation is calculated, and the counterfactual anomaly contribution of each field dimension is obtained based on the change. This includes the following sub-steps: S401. Input the semantic tensors of each perturbation protocol in the counterfactual field perturbation set into the constraint attention reconstruction process to obtain the perturbation reconstruction error corresponding to each perturbation protocol semantic tensor. S402. Calculate the difference between each perturbation reconstruction error and the original constraint attention reconstruction error to obtain the error change corresponding to each high-sensitivity field dimension. S403. Calculate the counterfactual anomaly contribution based on the error change, and determine the field dimension with the highest counterfactual anomaly contribution as the dominant anomaly field dimension.

6. The method for monitoring abnormal behavior through deep parsing of industrial control protocols according to claim 1, characterized in that, The system integrates constraint attention reconstruction error and counterfactual anomaly contribution to generate abnormal behavior monitoring results, and outputs anomaly fields, anomaly constraint relationships, anomaly session locations, hierarchical anomaly alarm information, and security response instructions. This includes the following sub-steps: S501. Determine the anomaly level based on the constrained attention reconstruction error, and determine the dimensions of the anomaly field and the dominant anomaly field based on the counterfactual anomaly contribution. S502. Locate the abnormal constraint relationship based on the abnormal field, the dimension of the abnormal dominant field, and the protocol constraint matrix; S503 generates abnormal behavior monitoring results and hierarchical abnormal alarm information based on the abnormality level, abnormal fields, abnormal constraint relationships and abnormal session locations, and sends security response instructions to the security management platform, blocking devices or SIEM system.

7. The method for monitoring abnormal behavior through deep parsing of industrial control protocols according to claim 1, characterized in that, It also includes the protocol constraint self-update step: S601. Obtain the field parsing rules, field meaning mapping rules, request-response matching rules, and session state transition rules for newly added industrial control protocols or private industrial control protocols, and load them into the plug-in protocol parsing engine; S602. Generate a new protocol constraint matrix based on the device role, function code, object address, data value, response status, and session status corresponding to the new industrial control protocol or private industrial control protocol. S603. Introduce the newly added protocol constraint matrix into the constraint attention reconstruction process and the counterfactual field perturbation set construction process to update the calculation range of constraint attention reconstruction error and counterfactual anomaly contribution.

8. An abnormal behavior monitoring system based on deep parsing of industrial control protocols, characterized in that, include: The protocol semantic tensor generation module is used to collect industrial control network traffic and perform session-based preprocessing. It performs deep protocol parsing on the preprocessed industrial control messages, encodes the device roles, function codes, object addresses, data values, response status, session status, and process data point meanings obtained from the parsing into protocol semantic tensors, and outputs the protocol semantic tensors to the constraint attention reconstruction module. The constraint attention reconstruction module is connected to the protocol semantic tensor generation module. It receives the protocol semantic tensor, generates a protocol constraint matrix based on the protocol specification, equipment operation permissions, process data point value range and session state constraints, and uses the protocol constraint matrix to perform constraint attention reconstruction on the protocol semantic tensor, and calculates the constraint attention reconstruction error. The counterfactual perturbation construction module, connected to the constraint attention reconstruction module, is used to filter high-sensitivity field dimensions from the protocol semantic tensor based on the constraint attention reconstruction error, and construct a counterfactual field perturbation set around the high-sensitivity field dimensions; The anomaly contribution calculation module is connected to the constraint attention reconstruction module and the counterfactual perturbation construction module, respectively. It is used to re-input the counterfactual field perturbation set into the constraint attention reconstruction process, calculate the change in constraint attention reconstruction error before and after perturbation, and obtain the counterfactual anomaly contribution corresponding to each field dimension based on the change. The abnormal result output module is connected to the constraint attention reconstruction module and the abnormal contribution calculation module, respectively. It is used to integrate the constraint attention reconstruction error and the counterfactual abnormal contribution to generate abnormal behavior monitoring results and output abnormal fields, abnormal constraint relationships, abnormal session locations, hierarchical abnormal alarm information and security response instructions.

Images