An industrial internet security situation awareness system
By constructing a dynamic directed weighted graph in an industrial control network and calculating the graph editing distance, the problems of insufficient detection of protocol burstiness and communication graph structure evolution in existing technologies are solved, and high sensitivity and accuracy of abnormal behavior detection are achieved.
Patent Information
- Application Number
- CN202611428530.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-15
- Publication Date
- 2026-11-06
AI Technical Summary
Existing technologies are insufficient to effectively detect sudden protocol behavior and rapid evolution of communication graph structures in industrial control networks, resulting in inadequate anomaly detection capabilities.
By calculating the variance of the arrival interval of protocol type messages within a time-series sliding window to generate burst weights, a dynamic directed weighted graph is constructed, and the graph edit distance between consecutive snapshots is calculated to mark abnormal moments for visualization.
It improves the detection sensitivity and visualization of abnormal behavior in industrial control networks, effectively distinguishing between periodic normal traffic and sudden anomalies, reducing false alarms, and enhancing the accuracy of security situation awareness.
Smart Images
Figure CN123055446A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of industrial internet security monitoring technology, specifically to an industrial internet security situation awareness system. Background Technology
[0002] Security situation awareness systems in industrial internet control networks are typically deployed at core switching nodes. They collect and statistically analyze network packets and communication relationships to identify abnormal behaviors that deviate from normal operating patterns. Existing technologies mainly include threshold detection based on traffic statistics and anomaly identification based on communication topology analysis. Methods based on traffic statistics generally count the number of packets, connections, bytes, or protocol distribution per unit time and compare these statistics with preset thresholds. Methods based on communication topology, on the other hand, construct host connection graphs or communication interaction graphs based on the communication relationships between devices, and detect anomalies through changes in graph structure indicators.
[0003] The aforementioned technical solutions have shortcomings in practical applications. Industrial control networks contain a large number of periodic polling, fixed-interval data acquisitions, and sporadic control commands. Message count statistics are easily affected by normal periodic traffic. Some abnormal interactions have low message frequency, but their arrival time is sudden, making it difficult to distinguish them from normal low-frequency communication based solely on message count or fixed risk weights. Existing graph construction methods often use message interaction counts or pre-set protocol risk values for edge weights, failing to fully integrate the arrival fluctuation characteristics of protocol messages over time. This makes it difficult for edge attributes in dynamic communication graphs to reflect the degree of sudden anomalies. Furthermore, existing detection methods for communication graph changes often rely on single-moment graph feature threshold discrimination or direct comparison of adjacent snapshots, which are prone to false alarms due to normal jitter and cannot reflect the changing trend of graph structure change speed between consecutive snapshots, making it difficult to detect anomalies in rapidly evolving stages.
[0004] Existing technologies still suffer from insufficient representation of bursty protocol behavior in dynamic graphs, and the evolution rate of continuous graph snapshot structures is not effectively used for anomaly detection. Industrial control network security situational awareness needs to simultaneously focus on the burstiness of message arrival times and the accelerated evolution of communication graph structures to enhance the detection capabilities for both burst anomalies and structural evolution anomalies. Summary of the Invention
[0005] To address the shortcomings of existing technologies in representing protocol burstiness in dynamic graphs and the ineffective use of continuous graph snapshot structure evolution rates for anomaly detection, an industrial internet security situation awareness system is provided. This system calculates the arrival interval variance of messages for each protocol type within a time-series sliding window and generates burstiness weights. These burstiness weights are then weighted with message interaction frequencies to construct a dynamic directed weighted graph. The system calculates the adjacent graph edit distances for snapshots from multiple consecutive sampling times, marks anomalies based on the graph edit distance change rate, and highlights the dynamic directed weighted graph of anomalies, enhancing the sensitivity and visual recognition of anomaly detection in industrial control networks.
[0006] To achieve the above objectives, the present invention provides the following technical solution: The present invention provides an industrial internet security situation awareness system, deployed at the core switching node of an industrial control network, including a data acquisition unit, a processing unit, a graph construction unit, a storage unit, an update unit, and a display unit. The data acquisition unit captures network packets at fixed intervals, extracting the protocol type field, source media access control address, destination media access control address, and payload length from each packet; the processing unit constructs a time-series sliding window based on the captured packets, calculates the arrival interval variance of packets of each protocol type within the time-series sliding window, and determines the burst weight of each protocol type based on the arrival interval variance; the graph construction unit constructs a dynamic directed weighted graph using the source and destination media access control addresses as vertices and the burst weight and packet interaction frequency as edge attributes; the storage unit maintains snapshots of the dynamic directed weighted graph at multiple consecutive sampling times, forming a snapshot sequence; the update unit calculates the graph edit distance between adjacent snapshots in the snapshot sequence and marks abnormal times based on the rate of change of the graph edit distance; the display unit highlights the dynamic directed weighted graph corresponding to the abnormal times and outputs a security situation visualization result. This system can detect abnormal fluctuations in industrial control networks from two levels: message timing characteristics and communication topology changes, thereby improving the accuracy of security situation identification and visualization efficiency.
[0007] As one technical solution of the present invention, the processing unit acquires the arrival times of all messages of the same protocol type within a time-series sliding window, calculates the time difference sequence between adjacent arrival times, calculates the variance value of the time difference sequence, and normalizes the variance value to a preset numerical range to obtain the burst weight of the protocol type. This process is repeated for all protocol types, and the burst weight of each protocol type is calculated separately. This allows the time fluctuation of different protocol types to be converted into comparable weights, which can be used to characterize the impact of protocol burstiness on communication behavior.
[0008] For any pair of source and destination media access control addresses, the graph construction unit counts the total number of packets sent from the source address to the destination address within a time-series sliding window as the packet interaction frequency. It then determines the protocol type to which the packets sent from the source address belong and assigns the burst weight of this protocol type to the directed edge pointing from the source address to the destination address. Finally, it performs a weighted sum of the packet interaction frequency and the burst weight to obtain the comprehensive weight of the directed edge. The dynamically directed weighted graph constructed in this way not only reflects the communication frequency between devices but also the temporal burst characteristics of the communication protocol, improving the graph structure's ability to distinguish security events.
[0009] The storage unit receives the dynamic directed weighted graph at the current time from the graph construction unit according to a preset sampling period, assigns a unique sequence number to each snapshot at each sampling time, and stores the snapshots in a circular buffer in the form of an adjacency list. When the circular buffer is full, the earliest snapshot is overwritten, and the number of vertices, the number of directed edges, and the sum of all comprehensive weights for each snapshot are recorded as the graph feature triples for that snapshot. This storage method can control storage overhead while maintaining the continuity of the time series, facilitating subsequent fast retrieval and comparison.
[0010] The update unit reads the adjacency lists of the k-th and (k+1)-th snapshots from the storage unit. It then uses the Hungarian algorithm to match the vertex correspondences between the k-th and (k+1)-th snapshots, determining the number of vertices to be inserted, deleted, or replaced, as well as the number of directed edges. The sum of the changes in the number of vertices and the changes in the number of directed edges is used as the graph edit distance between the k-th and (k+1)-th snapshots. This process is repeated for all adjacent snapshots in the snapshot sequence to obtain the graph edit distance sequence. This graph edit distance quantifies the overall change in network communication topology and edge attributes between adjacent sampling times.
[0011] The update unit calculates the difference between each graph edit distance in the graph edit distance sequence and its preceding graph edit distance, obtaining a difference sequence. It then calculates the moving average of this difference sequence and compares it to a preset threshold. When the moving average exceeds the preset threshold, the corresponding time is marked as an abnormal time. A judgment sequence is formed by the graph edit distance at this abnormal time and its three preceding graph edit distances, and this judgment sequence is stored in an anomaly record table. By comparing the rate of change of the graph edit distance, false alarms caused by instantaneous fluctuations can be reduced, improving the stability and accuracy of anomaly marking.
[0012] The display unit receives the anomaly record table transmitted by the update unit, extracts the sequence number of the anomaly moment from the record table, and retrieves the adjacency list of the corresponding dynamic directed weighted graph from the storage unit based on the sequence number. Directed edges in the dynamic directed weighted graph at the anomaly moment whose comprehensive weight exceeds a threshold are rendered in the first color level, while directed edges whose comprehensive weight is less than or equal to the threshold are rendered in the second color level, generating a situation highlight layer. This visually highlights high-weight communication links at anomaly moments, assisting security analysts in quickly locating suspicious communication behavior.
[0013] The data acquisition unit continuously receives port mirroring traffic from the core switching node at fixed intervals. For each received packet, it parses the Ethernet frame header, extracts the source and destination media access control addresses, parses the network layer header, identifies the protocol type field, and calculates the payload length. The extracted fields are then written into a buffer queue in the order of packet arrival time. This method can acquire real-time packet characteristics without affecting the normal operation of the industrial control network.
[0014] The processing unit reads packets from the buffer queue, sets the right boundary of the window to the current time, and sets the left boundary of the window to a fixed duration. It then extracts all packets located between the left and right boundaries of the window. The extracted packets are sorted by arrival time, forming the packet set for the time-series sliding window. At the next fixed period, the right boundary of the window is shifted backward by a fixed duration, and the time-series sliding window is updated. The time-series sliding window can smoothly handle short-term fluctuations, ensuring that weights and interaction frequencies change smoothly over time.
[0015] Preferably, when updating the time-series sliding window, the interaction frequency and burst weight corresponding to the historical messages that have moved out of the left boundary of the window are decremented from the current statistics, and the corresponding statistics of the newly included messages are increased, thereby avoiding duplicate statistics, ensuring that the current statistics are consistent with the messages in the time-series sliding window, and improving the real-time performance and accuracy of subsequent graph structure updates.
[0016] The technical effects and advantages provided by the present invention in the above technical solution are as follows: Burst weights are generated based on the variance of protocol message arrival intervals. These burst weights are then weighted with message interaction frequency to form a directed edge composite weight, allowing the dynamic directed weighted graph to simultaneously carry two types of information: communication frequency and protocol message arrival time fluctuation. In industrial control networks, periodic data acquisition and control commands typically have stable arrival intervals and low variance, corresponding to low burst weights; while occasional abnormal behaviors exhibit significant arrival interval fluctuations and high variance, corresponding to high burst weights. By weighting burst weights with message interaction frequency, communication edges with low interaction frequency but highly abnormal arrival times receive higher composite weights, while high-frequency but periodically stable normal communication edges are not excessively amplified simply because of a large number of messages. This approach differs from conventional schemes that use single message counts or fixed protocol risk values as edge weights, effectively highlighting low-frequency, high-burst abnormal links in the dynamic graph and reducing the overwhelming impact of periodic normal traffic on abnormal weights. The burst weights are updated as the sliding window moves, and the statistics of historical messages that move out of the window are reduced, so that the edge weights can follow the changes in the current traffic time distribution and enhance the ability of the dynamic graph to represent the real-time situation.
[0017] A snapshot sequence is formed by dynamically directed weighted graph snapshots taken at multiple consecutive sampling times. The graph edit distance between adjacent snapshots is composed of changes in the number of vertices and directed edges, reflecting the degree of addition, subtraction, and replacement of graph structures. After obtaining the graph edit distance sequence, the difference between adjacent graph edit distances is calculated, and a moving average is applied to the difference sequence. The moving average is compared with a preset threshold, and moments exceeding the threshold are marked as abnormal moments. This method does not only apply a fixed threshold to the graph features of a single snapshot, but also continuously analyzes the rate of change of graph structure differences. Under normal operating conditions, the communication topology may experience small fluctuations, but the rate of change of graph edit distance is low. When the graph structure changes rapidly over a short period of time, the difference in graph edit distance increases, the moving average exceeds the threshold, and an anomaly is marked. Moving average processing can smooth out occasional jitter, reduce false alarms caused by single abrupt changes, and highlight the process of accelerated structural evolution between consecutive snapshots. The judgment sequence associated with the abnormal moment consists of the edit distance of the graph at that moment and the edit distances of the three graphs before it. It can preserve the context of structural changes before and after the anomaly occurs. The display unit uses the first color level and the second color level to render directed edges with a comprehensive weight exceeding the threshold and those below or equal to the threshold, respectively. This makes sudden abnormal edges and ordinary edges have different identifiability in the visualization results, which is convenient for security analysts to quickly locate abnormal communication paths. Attached Figure Description
[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.
[0019] Figure 1 This is a schematic diagram of the structure of an industrial internet security situation awareness system. Figure 2 This is a flowchart of data acquisition and time-series sliding window processing; Figure 3 This is a flowchart of the message statistics update process within a time-series sliding window. Detailed Implementation
[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0021] See Figure 1 This invention provides an industrial internet security situation awareness system deployed at the core switching node of an industrial control network. The system includes a data acquisition unit, a processing unit, a graph construction unit, a storage unit, an update unit, and a display unit. The data acquisition unit captures network packets at fixed intervals, extracting the protocol type field, source media access control address, destination media access control address, and payload length from each packet. The processing unit constructs a time-series sliding window based on the packets captured by the data acquisition unit, calculates the arrival interval variance for each protocol type within the time-series sliding window, and determines the burst weight for each protocol type based on the arrival interval variance. The graph construction unit constructs a dynamic directed weighted graph using the source and destination media access control addresses as vertices and the burst weight and packet interaction frequency as edge attributes. The storage unit maintains snapshots of the dynamic directed weighted graph at multiple consecutive sampling times, forming a snapshot sequence. The update unit calculates the graph edit distance between adjacent snapshots in the snapshot sequence and marks abnormal moments based on the rate of change of the graph edit distance. The display unit highlights the dynamic directed weighted graph corresponding to the abnormal moments and outputs a security situation visualization result.
[0022] In practice, the processing unit obtains the arrival times of all packets of the same protocol type within the timing sliding window. The processing unit arranges the arrival times of the same protocol type in chronological order and calculates the time intervals between adjacent arrival times. All time intervals are then combined into a time difference sequence. The a-th time difference in the time difference sequence is the difference between the (a+1)-th arrival time and the a-th arrival time, where 'a' is the sequence number of the time differences in the time difference sequence, and the value of 'a' ranges from 1 to n-1. 'n' is the number of packets of the same protocol type within the timing sliding window.
[0023] The processing unit calculates the variance of the time difference sequence using the following formula: in, This represents the variance of the time difference series. This indicates the number of time differences in the time difference sequence. This represents the b-th time difference in the time difference sequence. This represents the average of all time differences in the time difference series. Indicates the index of the time difference in the time difference sequence. The value range is from 1 to The processing unit obtains the minimum and maximum variance values among the variance values of all protocol types within the timing sliding window. The processing unit calculates the difference between the variance value and the minimum variance value for a given protocol type, obtaining a first difference value; the processing unit calculates the difference between the maximum and minimum variance values, obtaining a second difference value; the processing unit divides the first difference value by the second difference value to obtain the burst weight value for that protocol type within the preset numerical interval [0,1]. The processing unit iterates through all protocol types appearing within the timing sliding window and calculates the burst weight value for each protocol type.
[0024] The graph construction unit traverses each message within the timing sliding window. For each message, the graph construction unit parses the source and destination media access control addresses (MAC addresses) and extracts the protocol type field. The graph construction unit maintains a set of counters with the source and destination MAC addresses as keys. When the graph construction unit detects a message sent from the first source MAC address to the first destination MAC address, it increments the counters corresponding to the first source and destination MAC addresses. After traversal, the graph construction unit obtains the message interaction frequency between any pair of source and destination MAC addresses within the timing sliding window.
[0025] For directed edges from the first source media access control address to the first destination media access control address, the graph construction unit checks the number of packets of each protocol type in all packets sent by the first source media access control address and selects the protocol type with the most packets as the protocol type corresponding to the directed edge from the first source media access control address to the first destination media access control address. When the packets sent by the first source media access control address involve multiple protocol types and the number of packets of each protocol type is the same, the graph construction unit selects the protocol type with the largest arrival interval variance as the protocol type corresponding to the directed edge from the first source media access control address to the first destination media access control address. The graph construction unit assigns the burstiness weight corresponding to the above protocol types to the directed edge from the first source media access control address to the first destination media access control address.
[0026] The graph construction unit multiplies the message interaction frequency by a first weighting coefficient of 0.5, multiplies the burst weight of the protocol type by a second weighting coefficient of 0.5, and adds the product of the message interaction frequency and the first weighting coefficient of 0.5 to the product of the burst weight of the protocol type and the second weighting coefficient of 0.5 to obtain the comprehensive weight of the directed edge from the first source media access control address to the first destination media access control address. The first weighting coefficient of 0.5 and the second weighting coefficient of 0.5 are set so that the contributions of the message interaction frequency and the burst weight of the protocol type to the comprehensive weight are equal.
[0027] In implementation, the storage unit receives the dynamic directed weighted graph at the current moment from the graph construction unit according to a preset sampling period. The preset sampling period is set to 1 second. The storage unit assigns a unique sequence number to each snapshot at each sampling moment, with the sequence number starting from 1 and incrementing sequentially. The storage unit stores the dynamic directed weighted graph in the form of an adjacency list in a circular buffer. The circular buffer contains a fixed number of storage slots, and each storage slot stores the adjacency list of one snapshot. The number of slots in the circular buffer is set to 100. When the circular buffer is full, the storage unit overwrites the snapshot with the smallest sequence number. The storage unit records the number of vertices, the number of directed edges, and the sum of all comprehensive weights for each snapshot, as the graph feature triple of the snapshot. The number of vertices is the total number of vertices after deduplicating the source and destination media access control addresses in the snapshot; the number of directed edges is the total number of all directed edges in the snapshot; and the sum of all comprehensive weights is the value obtained by accumulating the comprehensive weights of all directed edges in the snapshot. The storage unit associates the graph feature triple with the sequence number of the corresponding snapshot.
[0028] The update unit reads the adjacency lists of the k-th and (k+1)-th snapshots from the storage unit, where k is the snapshot sequence number, and its value ranges from 1 to 99. The update unit extracts all vertices from the k-th snapshot to form the k-th vertex set; it also extracts all vertices from the (k+1)-th snapshot to form the (k+1)-th vertex set. The update unit constructs the cost matrix required for the Hungarian algorithm based on the k-th and (k+1)-th vertex sets. The number of rows in the cost matrix equals the number of vertices in the k-th vertex set, and the number of columns equals the number of vertices in the (k+1)-th vertex set. For the u-th vertex in the k-th vertex set and the v-th vertex in the (k+1)-th vertex set, the update unit compares the media access control address (MAC address) of the u-th vertex in the k-th vertex set with that of the v-th vertex in the (k+1)-th vertex set. When the two MAC addresses are identical, the element in the u-th row and v-th column of the cost matrix is set to 0; when the two MAC addresses are different, the element in the u-th row and v-th column of the cost matrix is set to 1. When the number of vertices in the k-th vertex set is not equal to the number of vertices in the (k+1)-th vertex set, the update unit adds a virtual vertex to the vertex set with the smaller number of vertices. The media access control address of the virtual vertex is empty, and the matching cost between the virtual vertex and any real vertex is set to 1000. The update unit uses the Hungarian algorithm to solve for the minimum cost matching on the cost matrix. The Hungarian algorithm consists of an iterative process of subtracting the minimum value from each row and column, covering zero elements, and adjusting the matrix. The input of the Hungarian algorithm is the cost matrix, and the output is the vertex correspondence between the k-th vertex set and the (k+1)-th vertex set. In the matching results output by the Hungarian algorithm, vertices that match the virtual vertex are considered unmatched vertices.
[0029] The update unit determines the number of vertices to be inserted, deleted, or replaced, as well as the number of directed edges, based on the vertex correspondences output by the Hungarian algorithm. Vertices present in the k-th vertex set but not in the (k+1)-th vertex set are counted as deleted vertices; vertices present in the (k+1)-th vertex set but not in the k-th vertex set are counted as inserted vertices. For vertex pairs present in both vertex sets and matched by the Hungarian algorithm, the update unit compares the adjacency list content of that vertex in the k-th snapshot with the adjacency list content of the corresponding vertex in the (k+1)-th snapshot. If at least one outgoing or incoming edge differs in the adjacency list content, that vertex is counted as a replaced vertex. The change in the number of directed edges consists of the number of directed edge insertions and deletions. The update unit compares the set of directed edges in the adjacency list of the k-th snapshot with the set of directed edges in the adjacency list of the (k+1)-th snapshot. Directed edges that exist in the adjacency list of the k-th snapshot but not in the adjacency list of the (k+1)-th snapshot are counted as directed edge deletions; directed edges that exist in the adjacency list of the (k+1)-th snapshot but not in the adjacency list of the k-th snapshot are counted as directed edge insertions.
[0030] The update unit uses the sum of the changes in the number of vertices and the changes in the number of directed edges as the graph edit distance between the k-th snapshot and the (k+1)-th snapshot. The graph edit distance is calculated using the following formula: in, This represents the graph edit distance between the k-th snapshot and the (k+1)-th snapshot. Indicates the number of vertices inserted. Indicates the number of vertices deleted. Indicates the number of vertices to be replaced. This indicates the number of directed edges inserted. This indicates the number of directed edges deleted. The update unit iterates through all adjacent snapshots in the snapshot sequence to obtain the graph edit distance sequence. The snapshot sequence is a set of snapshots arranged consecutively by sequence number in a circular buffer, with adjacent snapshots corresponding to two snapshots whose sequence numbers differ by 1.
[0031] In practice, the update unit reads the graph edit distance sequence, which is obtained by the update unit traversing all adjacent snapshots in the snapshot sequence. The nth graph edit distance in the graph edit distance sequence corresponds to the graph edit distance between the nth and (n+1)th snapshots, where n ranges from 1 to the total number of snapshots minus 1. Starting from the second element in the graph edit distance sequence, the update unit subtracts the previous graph edit distance from the current graph edit distance to obtain the difference value corresponding to the current graph edit distance. The update unit traverses all elements in the graph edit distance sequence to obtain the difference value sequence. The pth difference value in the difference value sequence corresponds to the difference between the (p+1)th and pth graph edit distances in the graph edit distance sequence, where p ranges from 1 to the length of the graph edit distance sequence minus 1.
[0032] In practice, the moving average window length is set to 4. When the number of differences in the difference sequence is less than 4, the update unit does not calculate the moving average. When the number of differences in the difference sequence is greater than or equal to 4, the update unit starts from the 4th difference and calculates the arithmetic mean of the current difference and the 3 differences preceding it to obtain the moving average corresponding to the current difference. The moving average is calculated using the following formula: in, This represents the moving average value corresponding to the t-th difference in the difference sequence, where t represents the index of the difference in the difference sequence, and the value of t ranges from 4 to the length of the difference sequence. Represents the first value in the difference sequence. There are several differences, where c represents the summation index, and the value of c can be 0, 1, 2, or 3.
[0033] In practice, a preset threshold is used. The settings are configured by the update unit during the system initialization phase. The update unit collects the graph editing distance differences for 100 consecutive sampling periods during stable operation of the industrial control network, forming an initialization difference set. The update unit calculates the mean and standard deviation of all differences in the initialization difference set. The update unit adds three times the standard deviation to the mean of the initialization difference set to obtain the preset threshold. The update unit will move the average. With preset threshold Compare them. When the moving average... Exceeding the preset threshold At that time, the update unit will move the average value. The corresponding time point is marked as an abnormal time. Moving average. The corresponding time is the sampling time corresponding to the graph edit distance of the t-th difference in the difference sequence. The update unit obtains the graph edit distance corresponding to the abnormal time and the three graph edit distances preceding the abnormal time, forming a decision sequence. The decision sequence sequentially includes the graph edit distances of the third sampling time before the abnormal time, the second sampling time before the abnormal time, the first sampling time before the abnormal time, and the graph edit distance of the abnormal time. The update unit stores the decision sequence in the abnormal record table. The abnormal record table contains the sequence number of the abnormal time, the values of the four graph edit distances in the decision sequence, and the recording timestamp of the abnormal time.
[0034] In practice, the display unit receives the exception record table transmitted by the update unit. The display unit extracts the sequence number of the exception time from the exception record table. Based on the sequence number, the display unit retrieves the adjacency list of the corresponding dynamically directed weighted graph from the storage unit. The display unit calculates the comprehensive weight of all directed edges in the dynamically directed weighted graph and arranges all comprehensive weights in descending order of value. The display unit determines the comprehensive weight value at the 90th percentile position after arrangement as the comprehensive weight threshold. When the 90th percentile position is not an integer, the display unit takes the comprehensive weight value with the sequence number closest to the 90th percentile position as the comprehensive weight threshold.
[0035] In practice, the display unit traverses each directed edge in the dynamic directed weighted graph at the time of the anomaly. For the currently traversed directed edge, the display unit compares its overall weight with a threshold weight. When the overall weight of the currently traversed directed edge exceeds the threshold weight, the display unit renders it as a first-level color, highlighted in red. When the overall weight of the currently traversed directed edge is less than or equal to the threshold weight, the display unit renders it as a second-level color, gray. The display unit combines all rendered directed edges and vertices to generate a situational awareness highlight layer and outputs the security situation visualization results.
[0036] In specific implementation, please refer to Figure 2 The data acquisition unit continuously receives port mirroring traffic from the core switching node at a fixed period of 1 second. For each received packet, the data acquisition unit parses the Ethernet frame header, extracting the destination Media Access Control (MAC) address from bytes at offsets 0 to 5, and the source MAC address from bytes at offsets 6 to 11. The data acquisition unit then parses the network layer header, reading the protocol type field from the location of the protocol field. The value of the protocol type field corresponds to different network layer protocols. Finally, the data acquisition unit reads the packet length field to obtain the total packet length.
[0037] In practice, the data acquisition unit parses the Ethernet frame header length, which is fixed at 14 bytes, excluding the Virtual LAN tag. The data acquisition unit then parses the header length field in the network layer header, multiplying the value by 4 to obtain the network layer header length. The data acquisition unit uses the total message length, the Ethernet frame header length, and the network layer header length to calculate the payload length using the following formula: in, Indicates the effective payload length. Indicates the total length of the message. Indicates the length of the Ethernet frame header. Indicates the length of the network layer header. The data is read from the message length field by the data acquisition unit. Fixed at 14 bytes The data acquisition unit multiplies the value of the header length field in the network layer header by 4 to obtain the result.
[0038] The data acquisition unit writes the extracted source media access control address, destination media access control address, protocol type field, and payload length into the buffer queue in the order of packet arrival time. The buffer queue is a first-in, first-out queue, and the data acquisition unit continuously writes to it at fixed intervals, while retaining the timestamp of the packet arrival time in the buffer queue.
[0039] In practice, the processing unit reads packets from the buffer queue. The processing unit uses the current time as the right boundary of the window and sets the left boundary of the window for a fixed duration of 10 seconds. The processing unit intercepts all packets located between the left and right boundaries of the window, sorts the intercepted packets by arrival time, and forms a packet set for the time-series sliding window. The processing unit then arranges the packets in the time-series sliding window packet set from earliest to latest arrival time.
[0040] In practice, at the arrival of the next fixed period, the processing unit shifts the right boundary of the window backward by a fixed duration of 10 seconds. Simultaneously, the processing unit shifts the left boundary of the window backward by the same fixed duration, ensuring that the time span between the left and right boundaries remains 10 seconds. The processing unit then re-reads all packets located between the updated left and right boundaries of the window from the buffer queue, forming a new packet set for the time-series sliding window.
[0041] In practice, when updating the time-series sliding window, the processing unit decrements the interaction frequency and burst weight of the removed message from the current statistics for messages removed from the old window; conversely, it increments the interaction frequency and burst weight of the newly added message from the current statistics for messages newly added to the window. After each update of the time-series sliding window, the processing unit provides the message set of the time-series sliding window to the graph construction unit for constructing a dynamically directed weighted graph.
[0042] In specific implementation, please refer to Figure 3 When updating the timing sliding window, the processing unit determines the time interval between the left boundary of the window before the update and the left boundary of the window after the update. The processing unit marks packets arriving within this time interval as historical packets that have been moved out of the left boundary of the window. The processing unit also determines the time interval between the right boundary of the window before the update and the right boundary of the window after the update. The processing unit marks packets arriving within this time interval as newly included packets in the window. The processing unit processes the set of historical packets that have been moved out of the left boundary of the window and the set of newly included packets separately.
[0043] In practical implementation, for each historical packet that leaves the left boundary of the window, the processing unit extracts the source media access control address, destination media access control address, and protocol type fields. Based on the source and destination media access control addresses of the historical packet leaving the left boundary of the window, the processing unit locates the directed edge from the source media access control address of the historical packet leaving the left boundary of the window to the destination media access control address of the historical packet leaving the left boundary of the window in the adjacency list of the dynamic directed weighted graph. The processing unit then searches for the interaction frequency counter of this directed edge. The processing unit decrements the found interaction frequency counter value by one to obtain the updated interaction frequency counter value. The interaction frequency counter value is updated using the following formula: in, This represents the updated interaction frequency counter value. This represents the interaction frequency counter value before the update. The interaction frequency counter value of the directed edge before it was removed. This is the interaction frequency counter value of the directed edge after it is removed.
[0044] In practice, when the updated interaction frequency counter value is zero, the processing unit deletes the directed edge from the adjacency list of the dynamic directed weighted graph. When the updated interaction frequency counter value is greater than zero, the processing unit retains the directed edge in the adjacency list of the dynamic directed weighted graph and updates the interaction frequency counter value of the directed edge to the updated interaction frequency counter value.
[0045] In specific implementation, the processing unit determines the protocol type of the historical messages removed from the left boundary of the window based on the protocol type field of the historical messages. The processing unit searches for a timestamp in the arrival time array of that protocol type that matches the arrival time of the historical messages removed from the left boundary of the window. The processing unit deletes the found timestamp from the arrival time array of that protocol type. Based on the deleted arrival time array of that protocol type, the processing unit recalculates the time difference sequence of that protocol type. The processing unit recalculates the variance value of the time difference sequence of that protocol type. The processing unit renormalizes the recalculated variance value to a preset numerical range [0,1] to obtain the updated burst weight of that protocol type. The processing unit updates the burst weight of that protocol type with the updated burst weight of that protocol type.
[0046] In practice, for each newly included message in the window, the processing unit extracts the source media access control address, destination media access control address, and protocol type fields. Based on the source and destination media access control addresses of the newly included message, the processing unit locates the directed edge from the source media access control address to the destination media access control address in the adjacency list of the dynamic directed weighted graph. If the directed edge exists in the adjacency list of the dynamic directed weighted graph, the processing unit increments the interaction frequency counter value of the directed edge by one to obtain the updated interaction frequency counter value. If the directed edge does not exist in the adjacency list of the dynamic directed weighted graph, the processing unit creates the directed edge and sets the interaction frequency counter value of the newly created directed edge to 1.
[0047] In specific implementation, the processing unit determines the protocol type of the newly included message based on the protocol type field of the newly included message. The processing unit inserts the arrival time of the newly included message into the arrival time array of the protocol type to which the newly included message belongs, maintaining the chronological order of the arrival time array. Based on the inserted arrival time array of the protocol type to which the newly included message belongs, the processing unit recalculates the time difference sequence of the protocol type to which the newly included message belongs. The processing unit recalculates the variance value of the time difference sequence of the protocol type to which the newly included message belongs. The processing unit renormalizes the recalculated variance value to a preset numerical range [0,1], obtaining the updated burst weight of the protocol type to which the newly included message belongs. The processing unit updates the burst weight of the protocol type to which the newly included message belongs to the updated burst weight of the protocol type to which the newly included message belongs.
[0048] In practice, after updating the statistics of all historical packets removed from the left boundary of the window and all newly added packets, the processing unit writes the updated dynamic directed weighted graph adjacency list, the updated burst weights for each protocol type, and the updated arrival time arrays for each protocol type into the snapshot of the current time. The processing unit then provides the snapshot of the current time to the storage unit for storage.
[0049] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.
Claims
1. An industrial internet security situation awareness system, characterized in that, The system is deployed at the core switching node of the industrial control network and includes: The data acquisition unit is used to capture network packets at fixed intervals and extract the protocol type field, source media access control address, destination media access control address and payload length from each packet. The processing unit is used to construct a timing sliding window based on the messages captured by the data acquisition unit, calculate the arrival interval variance of messages of each protocol type within the timing sliding window, and determine the burst weight of each protocol type based on the arrival interval variance. The graph construction unit is used to construct a dynamic directed weighted graph with the source media access control address and the destination media access control address as vertices and the burst weight and message interaction frequency as edge attributes. A storage unit is used to maintain snapshots of the dynamic directed weighted graph at multiple consecutive sampling times, forming a snapshot sequence; An update unit is used to calculate the graph edit distance between adjacent snapshots in the snapshot sequence and mark abnormal moments according to the rate of change of the graph edit distance; The display unit is used to highlight the dynamic directed weighted graph corresponding to the abnormal moment and output the security situation visualization result.
2. The industrial internet security situation awareness system according to claim 1, characterized in that, The step of the processing unit determining the burst weight of each protocol type based on the arrival interval variance includes: Obtain the arrival times of all messages of the same protocol type within the time-series sliding window, and calculate the time difference sequence between adjacent arrival times; Calculate the variance of the time difference sequence and normalize the variance to a preset numerical range to obtain the burst weight of this protocol type; Iterate through all protocol types and calculate the burst weight for each protocol type.
3. The industrial internet security situation awareness system according to claim 2, characterized in that, The steps of the graph construction unit to construct a dynamic directed weighted graph using the burstiness weight and message interaction frequency as edge attributes include: For any pair of source media access control addresses and destination media access control addresses, the total number of packets sent from the source media access control address to the destination media access control address within the time-series sliding window is counted and used as the packet interaction frequency. Determine the protocol type to which the message sent from the source media access control address belongs, and assign the burst weight of the protocol type to the directed edge from the source media access control address to the destination media access control address; The weighted sum of the message interaction frequency and the burstiness weight is used to obtain the comprehensive weight of the directed edge.
4. The industrial internet security situation awareness system according to claim 3, characterized in that, The step of maintaining snapshots of the dynamically directed weighted graph at multiple consecutive sampling times in the storage unit includes: According to a preset sampling period, the dynamic directed weighted graph at the current moment is received from the graph construction unit, and a unique sequence number is assigned to each snapshot at each sampling moment; The snapshots are stored in a circular buffer in the form of an adjacency list. When the circular buffer is full, the earliest snapshot is overwritten. Record the number of vertices, the number of directed edges, and the sum of all comprehensive weights for each snapshot, as the graph feature triple for that snapshot.
5. The industrial internet security situation awareness system according to claim 4, characterized in that, The step of the update unit calculating the graph edit distance between adjacent snapshots in the snapshot sequence includes: Read the adjacency lists of the k-th snapshot and the (k+1)-th snapshot from the storage unit; The Hungarian algorithm is used to match the vertex correspondence between the k-th snapshot and the (k+1)-th snapshot to determine the number of vertices to be inserted, deleted, or replaced, as well as the number of directed edges. The sum of the change in the number of vertices and the change in the number of directed edges is used as the graph edit distance between the k-th snapshot and the (k+1)-th snapshot; By traversing all adjacent snapshots in the snapshot sequence, a graph edit distance sequence is obtained.
6. The industrial internet security situation awareness system according to claim 5, characterized in that, The step of the updating unit marking abnormal moments according to the rate of change of the distance edited in the graph includes: Calculate the difference between each graph edit distance in the graph edit distance sequence and its previous graph edit distance to obtain the difference sequence; Calculate the moving average of the difference sequence and compare the moving average with a preset threshold; When the moving average exceeds the preset threshold, the update unit marks the corresponding time as an abnormal time and forms a judgment sequence with the graph edit distance of the abnormal time and the three graph edit distances before it. The determination sequence is stored in the anomaly record table.
7. An industrial internet security situation awareness system according to claim 6, characterized in that, The step of highlighting the dynamic directed weighted graph corresponding to the abnormal moment by the display unit includes: Receive the abnormal record table transmitted by the update unit, and extract the sequence number of the abnormal time from the record table; The adjacency list of the corresponding dynamic directed weighted graph is retrieved from the storage unit according to the sequence number; The directed edges whose comprehensive weight exceeds the threshold in the dynamic directed weighted graph at the abnormal moment are rendered as the first color level, and the directed edges whose comprehensive weight is less than or equal to the threshold are rendered as the second color level, generating a situation highlight layer.
8. The industrial internet security situation awareness system according to claim 1, characterized in that, The data acquisition unit captures network packets at fixed intervals, and the steps of extracting the protocol type field, source media access control address, destination media access control address, and payload length from each packet include: Continuously receive port mirroring traffic from the core switching node within the fixed period; For each received message, parse the Ethernet frame header and extract the source media access control address and destination media access control address; Parse the network layer header in the message, identify the protocol type field, and calculate the payload length; The extracted fields are written into the cache queue in order of message arrival time.
9. An industrial internet security situation awareness system according to claim 8, characterized in that, The step of the processing unit constructing a timing sliding window based on the messages captured by the data acquisition unit includes: Read packets from the buffer queue, set the current time as the right boundary of the window, set the left boundary of the window for a fixed duration, and extract all packets located between the left boundary and the right boundary of the window; The captured messages are sorted by arrival time to form the message set of the timing sliding window; When the next fixed period arrives, the right boundary of the window is pushed back by a fixed duration, and the time-series sliding window is updated.
10. An industrial internet security situation awareness system according to claim 9, characterized in that, When updating the time-series sliding window, the interaction frequency and burst weight of historical messages that have been moved out of the left boundary of the window are decremented from the current statistics, and the corresponding statistics of newly included messages are increased.