An AI large model-based distributed industrial control protocol threat detection management method

Abstract

The application provides an AI large model-based distributed industrial control protocol threat detection management method, relates to the technical field of industrial control systems, performs semantic threat detection on structured conversation data, obtains threat detection features containing threat types and threat confidence, performs threat path deduction on the threat detection features based on an industrial control asset knowledge graph and an attack chain model, obtains risk confidence levels on cross-region threat paths and corresponding cross-region alarm events, maps the risk confidence levels to risk classification disposal templates, generates risk alarm information, performs threat intention recognition on the cross-region alarm events through the risk alarm information, obtains risk disposal strategies, and issues the risk disposal strategies to industrial control security devices to generate threat management actions to block abnormal flows corresponding to the cross-region alarm events. The application can perform global intention recognition and dynamic strategy issuance on distributed alarm events to improve the accuracy of threat management.

Description

Technical Field

[0001] This application relates to the field of industrial control system technology, and more specifically, to a distributed industrial control protocol threat detection and control method based on an AI large model. Background Technology

[0002] Industrial control systems are specialized computer systems used for real-time monitoring, control, and management of industrial production processes. They are widely used in critical infrastructure sectors such as power, petrochemicals, and rail transportation. Their general implementation framework typically includes a field device layer, a process monitoring layer, and a production management layer. Data acquisition and command issuance are achieved through industrial Ethernet or fieldbus, ensuring the continuity and stability of the production process. As a component of critical information infrastructure, the safe and stable operation of industrial control systems is directly related to public safety and the economic lifeline. Their security protection technologies have become crucial technical support for protecting automated industrial production from network threats and maintaining process continuity.

[0003] However, existing industrial control system security solutions typically employ static rule-matching mechanisms deployed based on a single network area boundary for threat detection and mitigation. This means that when faced with complex attacks launched collaboratively across security areas, each area's security devices can only independently assess and respond based on their local traffic perspective. This results in an inability to effectively correlate attack intent characteristics across multiple areas and generate a globally coordinated response strategy, leading to delayed threat control actions, incomplete blocking of abnormal traffic, and increased risk of lateral movement. Therefore, how to perform global intent identification and dynamic policy distribution for distributed alarm events to improve the accuracy of threat control is a challenge facing the industry. Summary of the Invention

[0004] This application provides a distributed industrial control protocol threat detection and control method based on an AI large model, which can perform global intent recognition and dynamic policy distribution on distributed alarm events to improve the accuracy of threat control.

[0005] Firstly, this application provides a distributed industrial control protocol threat detection and control method based on an AI large model, the method comprising the following steps: Industrial control network traffic is collected by distributed detection probes, and structured session data is extracted from the industrial control network traffic; Semantic threat detection is performed on the structured session data to obtain threat detection features that include threat type and threat confidence. Threat path deduction is performed on the threat detection features based on the industrial control asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path. The risk confidence level is mapped to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions. Threat intent is identified for the cross-regional alarm event through the risk alarm information to obtain a risk handling strategy. The risk handling strategy is distributed to industrial control security devices and risk filtering control is executed to generate threat management actions to block the abnormal traffic corresponding to the cross-regional alarm event.

[0006] In this embodiment, semantic threat detection is performed on the structured session data to obtain threat detection features that include threat type and threat confidence. Specifically, this includes: Extract the protocol instruction code and key payload fields from the structured session data, and generate a protocol-level semantic query vector for industrial control communication behavior; The current process stage and security parameter constraint threshold of the associated assets are analyzed, and the protocol-level semantic query vector is aligned across domains with the process stage and the security parameter constraint threshold to generate a semantic input sequence that integrates the business context. The semantic input sequence is input into a generative large model that has been incrementally pre-trained in the industrial control domain for intent reasoning, and the output is threat detection features that include threat type and threat confidence.

[0007] In this embodiment, threat path deduction is performed on the threat detection features based on the industrial control asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path, specifically including: The threat detection features are mapped to the industrial control asset knowledge graph to locate the controlled asset nodes, and the attack chain model is used to identify the current attack tactical stage of the threat. Starting from the controlled asset node, subgraph traversal is performed based on the cross-domain topology connection relationship and attack chain stage transfer rules to generate cross-regional candidate threat propagation paths; Calculate the cumulative risk confidence level of each candidate threat propagation path, and encapsulate the candidate threat propagation paths and associated assets that meet the preset risk threshold into cross-regional alarm events.

[0008] In this embodiment, mapping the risk confidence level to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions specifically includes: Based on the risk confidence level, match the risk level range in the risk classification and handling template to determine the corresponding control action combination type and execution priority; Extract a subset of control actions applicable to the current industrial control asset node from the control action combination type, and generate a control execution instruction sequence based on asset operation status constraints; The control execution instruction sequence, the execution priority, and the associated cross-regional alarm event identifier are encapsulated to generate risk alarm information.

[0009] In this embodiment, the risk handling strategy obtained by identifying the threat intent of the cross-regional alarm event through the risk alarm information specifically includes: The risk alarm information extracts control action combinations, and combines them with the propagation path characteristics of the cross-regional alarm events to construct a threat intent feature vector; The threat intent feature vector is matched with the standard intent patterns in the preset attack tactics knowledge base to determine the final attack intent category of the cross-regional alarm event; Based on the final attack intent category, the corresponding action sequence and timing constraints are extracted from the risk strategy library, and a risk handling strategy is generated.

[0010] In this embodiment, the threat intent feature vector is matched with standard intent patterns in a preset attack tactic knowledge base to determine the final attack intent category of the cross-regional alarm event. This specifically includes: Calculate the feature distance between the threat intent feature vector and each standard intent pattern in the preset attack tactic knowledge base, and generate an intent similarity score set; Extract the score limits that meet the confidence threshold from the intent similarity score set, and label the standard intent pattern corresponding to the score limit as the final attack intent category.

[0011] In this embodiment, the risk handling strategy is distributed to industrial control security devices and risk filtering control is executed to generate threat management actions to block the abnormal traffic corresponding to the cross-regional alarm event. Specifically, this includes: The risk handling strategy is parsed into a set of filtering rules that can be identified by industrial control security devices, and the target execution device is determined based on the device type and network topology location; The set of filtering rules is sent to the target execution device to trigger the local filtering policy and perform risk filtering control on the matched abnormal traffic; The target execution device generates a threat management action record based on the filtering control results and feeds the threat management action record back to the central control platform.

[0012] In this embodiment, the risk handling strategy is parsed into a set of filtering rules that can be identified by industrial control security devices, and the target execution device is determined based on the device type and network topology location, specifically including: Extract the sequence of actions and timing constraints from the risk management strategy and convert them into a set of filtering rules that can be recognized by the underlying protocol of the industrial control security equipment. Obtain the device type identifier and network topology location information of each security device in the industrial control network, and construct a mapping matrix between device handling capabilities and network topology nodes; The mapping matrix is ​​matched according to the execution requirements of the set of filtering rules to select target execution devices that have the ability to handle abnormal traffic and are located on the abnormal traffic forwarding path.

[0013] Secondly, this application provides a computer device, which includes a memory and a processor. The memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the computer device executes the aforementioned distributed industrial control protocol threat detection and control method based on an AI large model.

[0014] Thirdly, this application provides a computer-readable storage medium storing instructions or code that, when executed on a computer, cause the computer to implement the aforementioned distributed industrial control protocol threat detection and control method based on an AI large model.

[0015] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects: Industrial control network (ICS) traffic is collected using distributed detection probes, and structured session data is extracted from the ICS traffic. Semantic threat detection is performed on the structured session data to obtain threat detection features containing threat type and threat confidence level. Threat path deduction is performed on the threat detection features based on the ICS asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path. The risk confidence level is mapped to a risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions. Threat intent identification is performed on the cross-regional alarm events using the risk alarm information to obtain risk handling strategies. The risk handling strategies are then distributed to ICS security devices and risk filtering control is executed to generate threat control actions to block abnormal traffic corresponding to the cross-regional alarm events.

[0016] Therefore, this application demonstrates that the risk handling strategy can be distributed to industrial control security devices and risk filtering control can be executed to generate threat management actions to block abnormal traffic corresponding to the cross-regional alarm events. Identifying cross-regional alarm events provides a panoramic view of associated attack behaviors covering multiple security regions, thus overcoming the inherent deficiency in existing industrial control system security protection schemes where devices in each region can only independently assess based on local traffic perspectives and cannot effectively identify cross-domain collaborative attack intentions. This feature, by aggregating isolated alarm data scattered across different network regions in a spatiotemporal dimension and reconstructing causal chains, enables the system to accurately reconstruct the attacker's lateral movement trajectory and true tactical objectives across multi-level networks, thereby significantly improving the detection accuracy and threat characterization capabilities for complex penetration behaviors. Determining the risk handling strategy yields a set of executable filtering rules adapted to the underlying protocol of the target industrial control security device and containing temporal constraints, thus overcoming the technical shortcomings of existing technologies where static rules are difficult to respond to dynamic cross-domain threats, handling actions are delayed, and blocking is incomplete. This feature transforms global assessment results into refined control instructions with protocol compatibility and execution timing, ensuring that the handling strategy is loaded and strictly executed in real time at the optimal node on the abnormal traffic forwarding path, effectively avoiding rule conflicts and execution delays.

[0017] In summary, the technical solution adopted in this application can perform global intent recognition and dynamic policy distribution for distributed alarm events, thereby improving the accuracy of threat control. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this embodiment of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is an exemplary flowchart of a distributed industrial control protocol threat detection and control method based on an AI large model provided in this application; Figure 2 This is a flowchart illustrating the process of determining risk management strategies provided in this application; Figure 3 This is a schematic diagram of the structure of a computer device according to a distributed industrial control protocol threat detection and control method based on an AI large model provided in this application. Detailed Implementation

[0020] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0021] This application provides a distributed industrial control protocol threat detection and control method based on an AI large model. Its core is to collect industrial control network traffic through distributed deployment of detection probes and extract structured session data from the industrial control network traffic; perform semantic threat detection on the structured session data to obtain threat detection features containing threat type and threat confidence level; perform threat path deduction on the threat detection features based on the industrial control asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path; map the risk confidence level to a risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions; identify the threat intent of the cross-regional alarm events through the risk alarm information to obtain a risk handling strategy; distribute the risk handling strategy to industrial control security devices and execute risk filtering control to generate threat control actions to block the abnormal traffic corresponding to the cross-regional alarm events.

[0022] Example 1: To better understand the above technical solution, the following will provide a detailed description of the technical solution in conjunction with the accompanying drawings and specific implementation methods. (Refer to...) Figure 1 As shown in the figure, this is an exemplary flowchart of a distributed industrial control protocol threat detection and control method based on an AI large model according to this embodiment of the application. The method includes the following steps: In step S1, industrial control network traffic is collected by distributed detection probes, and structured session data is extracted from the industrial control network traffic.

[0023] In practice, detection probes are first deployed in the production management area, process monitoring area, and field control area of ​​the industrial control system. Each probe captures the industrial control network traffic in its area via switch port mirroring or network splitters in a bypass manner. The probes have a built-in deep packet inspection engine. When a raw packet enters the probe, the engine first extracts the packet header fields and matches them against a pre-defined industrial control protocol identification rule base based on the transport layer port number and payload feature code to determine the specific industrial control protocol type of the current traffic. After protocol identification, the probe calls the parsing template corresponding to the protocol type and extracts the session quintuple composed of the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and transport layer protocol type from the packet payload field by field. Simultaneously, it extracts key industrial control protocol fields such as protocol function code, instruction code, register address, and data write value. These fields are then normalized and encoded according to a predefined data structure to form structured session data.

[0024] It should be noted that, in this application, industrial control network traffic refers to the raw network communication data containing industrial control protocol messages transmitted in the network of each level of the industrial control system; structured session data refers to the standardized dataset containing communication quintuples and key protocol fields extracted after parsing the industrial control protocol messages.

[0025] In step S2, semantic threat detection is performed on the structured session data to obtain threat detection features that include threat type and threat confidence. Threat path deduction is performed on the threat detection features based on the industrial control asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path.

[0026] In this embodiment, semantic threat detection of the structured session data to obtain threat detection features containing threat type and threat confidence can be achieved through the following steps: Extract the protocol instruction code and key payload fields from the structured session data, and generate a protocol-level semantic query vector for industrial control communication behavior; The current process stage and security parameter constraint threshold of the associated assets are analyzed, and the protocol-level semantic query vector is aligned across domains with the process stage and the security parameter constraint threshold to generate a semantic input sequence that integrates the business context. The semantic input sequence is input into a generative large model that has been incrementally pre-trained in the industrial control domain for intent reasoning, and the output is threat detection features that include threat type and threat confidence.

[0027] In practical implementation, firstly, the system extracts protocol command codes and key payload fields from structured session data and generates protocol-level semantic query vectors for industrial control communication behavior. After parsing the protocol command codes and key payload fields from the structured session data, the system uses a pre-trained industrial control protocol word embedding model to map discrete protocol fields into dense vector representations of fixed dimensions. This word embedding model is trained based on massive historical industrial control traffic logs and can capture the co-occurrence relationships and semantic associations between protocol fields. Subsequently, the system weights and concatenates the protocol command code vector and key payload field vector according to preset weights, and performs a nonlinear transformation through a fully connected neural network to output a protocol-level semantic query vector of unified dimensions. Then, the system parses the current process stage and safety parameter constraint threshold of the associated asset, aligns the protocol-level semantic query vector with the process stage and safety parameter constraint threshold across domains, and generates a semantic input sequence that integrates the business context. The system queries the real-time operating condition database based on the asset identifier in the structured session data to obtain the current process stage number and corresponding safety parameter constraint threshold of the asset. The process stage number is converted into a stage semantic vector through an embedding layer after one-hot encoding. The safety parameter constraint threshold is normalized and then mapped to a parameter semantic vector through linear projection. The system employs a cross-attention mechanism, using the protocol-level semantic query vector as the query key and the stage semantic vector and parameter semantic vector as key-value pairs for attention calculation, resulting in a protocol semantic representation enhanced with business context. Finally, this enhanced representation is concatenated with the original protocol-level semantic query vector after layer normalization to generate a semantic input sequence incorporating business context. This semantic input sequence is then fed into a generative large-scale model incrementally pre-trained in the industrial control domain for intent reasoning, outputting threat detection features including threat type and threat confidence. The generative large-scale model is based on a general language model and incrementally pre-trained using industrial control protocol specifications, equipment operation manuals, and historical attack samples, enabling it to understand industrial control domain knowledge. During reasoning, the semantic input sequence is positionally encoded and input into the decoder layer of the large-scale model. The model generates structured output text token by token through an autoregressive approach. The output text follows a predefined template format and includes threat type labels and threat confidence values. The system performs regular expression parsing on the generated text, extracts the threat type field and maps it to the standard threat classification system, and converts the confidence field into a floating-point number between zero and one. This process transforms unstructured semantic reasoning results into machine-readable threat detection features.

[0028] It should be noted that, in this application, semantic threat detection refers to a threat assessment process that utilizes a large model to deeply understand the business intent and contextual logic of industrial control protocol instructions; threat type refers to the standardized classification label output by semantic threat detection that describes the category of attack behavior; threat confidence refers to the probability value output by semantic threat detection that quantitatively represents the reliability of the threat assessment result; protocol instruction code refers to the numerical encoding field in the industrial control protocol message used to identify specific operation functions or command types; key payload field refers to the core data field in the industrial control protocol message that carries process parameters, register addresses, or control data; and protocol-level semantic query vector refers to the vector used to analyze the protocol instruction code and key payload. The semantic embedding representation generated after vectorization of the payload field; the current process stage refers to the specific stage of the production process in which the asset equipment in the industrial control system is located at the moment of detection; the safety parameter constraint threshold refers to the range of process parameter safety boundary values ​​that the industrial control asset is allowed to operate in the current process stage; the semantic input sequence refers to the input tensor for large model inference generated after merging protocol semantics and business context and undergoing alignment processing; the industrial control domain incremental pre-training refers to the process of using industrial control-specific corpus to continue pre-training the general large model to inject domain knowledge; the threat detection feature refers to the structured judgment result data of semantic threat detection output, which includes threat type and threat confidence.

[0029] In this embodiment, the threat path deduction of the threat detection features based on the industrial control asset knowledge graph and attack chain model can be achieved by the following steps to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path: The threat detection features are mapped to the industrial control asset knowledge graph to locate the controlled asset nodes, and the attack chain model is used to identify the current attack tactical stage of the threat. Starting from the controlled asset node, subgraph traversal is performed based on the cross-domain topology connection relationship and attack chain stage transfer rules to generate cross-regional candidate threat propagation paths; Calculate the cumulative risk confidence level of each candidate threat propagation path, and encapsulate the candidate threat propagation paths and associated assets that meet the preset risk threshold into cross-regional alarm events.

[0030] In practical implementation, firstly, threat detection features are mapped to the industrial control system (ICS) asset knowledge graph to locate controlled asset nodes, and the current attack tactical stage of the threat is identified using an attack chain model. The ICS asset knowledge graph is stored as a graph database, where nodes represent ICS asset entities and edges represent network connections and business logic relationships between assets. The system extracts the ICS asset internet protocol address and protocol port information from the threat detection features, performs precise node attribute matching queries in the ICS asset knowledge graph, and locates the corresponding controlled asset node. Simultaneously, the system invokes the attack chain model, which adopts an attack tactical stage framework for industrial control systems, dividing the attack process into eleven standard tactical stages: reconnaissance, initial access, execution, persistence, privilege escalation, detection evasion, discovery, lateral movement, collection, command and control, and final impact. Based on the threat type in the threat detection features, the system looks up the corresponding attack tactical stage number in the attack chain model's tactical stage mapping table to complete the tactical stage identification of the current threat. Then, starting from the controlled asset node, the system traverses the subgraph according to the cross-domain topology connections and attack chain stage transition rules to generate cross-regional candidate threat propagation paths. The system starts from the controlled asset node and performs a depth-first traversal along the directed edges in the industrial control asset knowledge graph. During the traversal, the system checks whether the target node connected to each edge belongs to a different physical security zone than the current node. If it is a cross-zone connection, the path branch is retained. Simultaneously, the system constrains the traversal path according to the attack chain phase transition rules. These rules define the legal sequential relationships between tactical phases; for example, after the lateral movement phase, the system can transition to the collection phase or the command and control phase, but cannot reverse to the reconnaissance phase. When the tactical phase sequence in the traversal path violates the transition rules, the system prunes the branch. The traversal terminates when the preset maximum number of hops is reached or a critical core asset node is reached, and all legal paths are output as candidate threat propagation paths for cross-zone propagation. Finally, the system calculates the cumulative risk confidence level of each candidate threat propagation path and encapsulates candidate threat propagation paths that meet the preset risk threshold and their associated assets into cross-zone alarm events. For each candidate threat propagation path, the system extracts the threat confidence from the threat detection features corresponding to each node on the path and obtains the critical weight value of the asset represented by each node. The asset criticality weight is pre-set based on the asset's core importance in the production process, with core control equipment having a higher weight than ordinary monitoring equipment. The system uses a weighted geometric average formula to calculate the cumulative risk confidence level of the path, which is the geometric mean of the product of the threat confidence level of each node and the corresponding asset criticality weight. The preset risk threshold is set to 0.7, which is determined based on the statistical average risk value of real attack paths in historical attack cases.When the cumulative risk confidence level of a candidate threat propagation path is greater than or equal to a preset risk threshold, the system encapsulates the path and all associated asset nodes, threat detection features, and attack tactical phase sequences into a standardized cross-regional alarm event object.

[0031] It should be noted that, in this application, the industrial control asset knowledge graph is a graph-structured data describing asset entities within an industrial control system and their interconnections and spatial logical relationships; the attack chain model refers to the logical framework of the standard tactical stages that a network attack undergoes from initial reconnaissance to achieving its target; threat path deduction refers to the analytical process of searching and mapping cross-regional alert events in the knowledge graph to reconstruct the attack evolution route; cross-regional threat path refers to the complete propagation route of an attack across different physical security zones or logical partitions; controlled asset nodes refer to asset entities identified in the knowledge graph as currently under attack, as indicated by threat detection features; and attack tactical stages refer to the standard tactical classifications defined in the attack chain model that describe the attacker's current behavioral objectives. Tags; Cross-domain topological connectivity in a knowledge graph refers to the set of directed edges connecting asset nodes in different physical security zones; Attack chain phase transition rules refer to the set of constraint rules that define the legal sequence of tactical phases in an attack chain model; Candidate threat propagation paths refer to potential attack paths generated by subgraph traversal that conform to topological connectivity and phase transition rules; Cumulative risk confidence level refers to the comprehensive score obtained by weighted aggregation of the risk values ​​of each node on the candidate threat propagation path; Preset risk threshold refers to the minimum threshold value for determining the cumulative risk confidence level used to screen high-risk candidate threat propagation paths; Cross-regional alert events are standardized events that describe attack behaviors that cross multiple security zones and their associated asset and path information.

[0032] In step S3, the risk confidence level is mapped to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions. Threat intent is identified for the cross-regional alarm event through the risk alarm information to obtain a risk handling strategy.

[0033] In this embodiment, mapping the risk confidence level to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions can be achieved through the following steps: Based on the risk confidence level, match the risk level range in the risk classification and handling template to determine the corresponding control action combination type and execution priority; Extract a subset of control actions applicable to the current industrial control asset node from the control action combination type, and generate a control execution instruction sequence based on asset operation status constraints; The control execution instruction sequence, the execution priority, and the associated cross-regional alarm event identifier are encapsulated to generate risk alarm information.

[0034] In practice, the system first matches the risk level ranges in the risk grading and handling template with the risk confidence level to determine the corresponding control action combination type and execution priority. The risk grading and handling template pre-sets four consecutive and mutually exclusive risk level ranges: low risk (0.0-0.3), medium risk (0.3-0.6), high risk (0.6-0.8), and critical risk (0.8-1.0). The system compares the calculated risk confidence level with these ranges, matching the corresponding control action combination type based on which range it falls into. The low-risk range matches an observation-type combination of logging only; the medium-risk range matches a suppression-type combination of traffic rate limiting and protocol auditing; the high-risk range matches an isolation-type combination of command filtering and session blocking; and the critical risk range matches a circuit breaker-type combination of port closure and host isolation. Simultaneously, the system determines the execution priority based on the lower limit of the matched risk level range: the highest priority is level one for the critical risk range, level two for the high-risk range, level three for the medium-risk range, and level four for the low-risk range. Then, the system extracts a subset of control actions applicable to the current industrial control asset node from the control action combination types and generates a control execution instruction sequence based on asset operating status constraints. The system first obtains the device type, security zone, and real-time operating status of the current controlled asset node. Asset operating status includes three states: normal operation, maintenance, and standby. Each state corresponds to a different whitelist of executable control actions. The system filters actions from the full list of actions included in the determined control action combination types, selecting actions that simultaneously meet the device type support requirements and are within the current operating status whitelist, forming a control action subset. Subsequently, the system performs topological sorting of the control action subset according to the dependencies between actions, for example, executing session blocking first and then instruction filtering, generating an ordered control execution instruction sequence. Finally, the control execution instruction sequence, execution priority, and associated cross-regional alarm event identifiers are encapsulated to generate risk alarm information. The system uses a predefined message encapsulation format, with the control execution instruction sequence as the core payload of the message body, the execution priority as the scheduling weight field in the message header, and the cross-regional alarm event identifier as the unique association index field of the message. Cross-regional alarm event identifiers consist of globally unique strings assigned at the time of event generation, used to trace the original threat path and attack context corresponding to the risk alarm information. After encapsulation, the system calculates an integrity checksum for the message body and appends it to the end of the message to prevent data tampering during transmission. The final generated risk alarm information, as a complete structured data object, is written to the pending queue to await scheduler consumption. This step, by uniformly encapsulating the handling instructions, scheduling priority, and event tracing identifier, forms a self-contained risk alarm information.

[0035] It should be noted that, in this application, the risk classification and handling template refers to a pre-set mapping rule library of different risk levels and corresponding control action combinations and execution parameters; the control action combination refers to a set of multiple safety control actions defined in the risk classification and handling template for dealing with a specific risk level; the control execution instruction refers to a specific configuration command that transforms the control action combination into an industrial control security device that can be recognized and executed; the risk level range refers to a continuous numerical range divided in the risk classification and handling template for matching risk confidence levels; the control action combination type refers to a set of action categories with the same handling intensity and strategy orientation bound to the risk level range; the execution priority refers to a weight value that determines the order in which risk alarm information is processed and issued in the scheduling queue; the control action subset refers to a set of executable actions adapted to the current asset status and type selected from the control action combination types; the control execution instruction sequence refers to an ordered execution list of each instruction in the control action subset sorted by dependency; the cross-regional alarm event identifier is a string index used to uniquely associate risk alarm information with the original cross-regional alarm event; and the risk alarm information refers to a comprehensive alarm data carrier containing risk confidence level, control action combination, and control execution instruction.

[0036] Preferably, in this embodiment, the risk alarm information is used to identify the threat intent of the cross-regional alarm event to obtain a risk handling strategy, which is then referred to... Figure 2 As shown in the figure, this is a flowchart illustrating the process of determining a risk management strategy in some embodiments of this application. In this embodiment, determining the risk management strategy can be achieved through the following steps: In step S31, control action combinations are extracted from the risk alarm information, and threat intent feature vectors are constructed by combining the propagation path characteristics of the cross-regional alarm events. In step S32, the threat intent feature vector is matched with the standard intent patterns in the preset attack tactics knowledge base to determine the final attack intent category of the cross-regional alarm event. In step S33, the corresponding action sequence and timing constraints are extracted from the risk strategy library according to the final attack intent category, and a risk handling strategy is generated.

[0037] In practice, the system first extracts control action combinations from risk alert information and constructs a threat intent feature vector by combining the propagation path characteristics of cross-regional alert events. The system parses the risk alert information payload, extracting the control action combination type identifiers and specific action lists contained within. Simultaneously, it extracts propagation path features from associated cross-regional alert events, including the number of path hops, the number of security zones crossed, the total weight of the criticality of involved assets, and the length of the attack tactical phase sequence. The system performs one-hot encoding of the control action combination types and performs minimum-maximum normalization on the numerical fields in the propagation path features. Then, it concatenates the encoded action combination vector with the normalized path feature vector according to a preset dimension and performs non-linear mapping through a fully connected neural network to output a fixed-dimensional threat intent feature vector. Next, it performs similarity matching between the threat intent feature vector and standard intent patterns in a preset attack tactical knowledge base to determine the final attack intent category of the cross-regional alert event. The preset attack tactical knowledge base stores twelve standard intent patterns, each corresponding to a pre-calculated baseline feature vector. These baseline vectors are generated based on clustering of historical real attack cases and expert-annotated data. The system calculates the cosine similarity between the current threat intent feature vector and the baseline vectors of each standard intent pattern in the knowledge base, obtaining twelve similarity scores. The system selects the standard intent pattern with the highest similarity score as the matching result. When the highest score is below a confidence threshold of 0.6, it is marked as an unknown intent category. The confidence threshold of 0.6 is determined based on the similarity distribution statistics of positive and negative samples in the validation set, ensuring that the matching results have sufficient discriminative power. The final attack intent category is the category label corresponding to the matched standard intent pattern. Finally, based on the final attack intent category, the system extracts the corresponding action sequence and timing constraints from the risk strategy library and generates a risk handling strategy. The risk strategy library stores the mapping relationship between each final attack intent category and the handling plan in key-value pairs. The system uses the calibrated final attack intent category as the query key to retrieve the corresponding action sequence and timing constraints. The action sequence includes specific security control actions arranged in execution order and their target device identifiers. The timing constraints define the minimum waiting time and maximum allowable interval between adjacent actions to ensure the process stability of the industrial control system during the handling process. The system encapsulates the sequence of actions and timing constraints into structured risk management strategy objects, and adds a strategy version number and an effective timestamp.

[0038] It should be noted that, in this application, threat intent identification refers to the judgment process of determining the type of attacker's ultimate purpose by analyzing alarm information and propagation paths; control action combination refers to the set of planned or executed security control actions carried in risk alarm information; propagation path features are a set of quantitative attributes describing the propagation topology and situation of cross-regional alarm events in a knowledge graph; threat intent feature vector refers to the embedded representation for intent matching generated after fusing control action and propagation path information; the preset attack tactic knowledge base refers to a structured knowledge set that stores standard attack intent patterns and their baseline feature vectors; standard intent patterns refer to the standardized intent patterns defined in the preset attack tactic knowledge base that represent typical attack purposes. Graph template; similarity matching refers to the process of comparing the geometric distance between the feature vector of threat intent and the baseline vector of standard intent pattern; final attack intent category refers to the standardized classification label describing the core purpose of the attacker after similarity matching; risk strategy library refers to the structured strategy data set that stores the mapping relationship between each attack intent category and the corresponding handling plan; handling action sequence refers to the specific security control actions and their target device list defined in the risk strategy library; timing constraints refer to the time interval and execution order restriction rules that must be met between adjacent actions in the handling action sequence; risk handling strategy refers to the structured plan that includes the handling action sequence and timing constraints to guide the security response.

[0039] Furthermore, in this embodiment, the final attack intent category of the cross-regional alarm event can be determined by performing similarity matching between the threat intent feature vector and the standard intent patterns in the preset attack tactic knowledge base, using the following steps: Calculate the feature distance between the threat intent feature vector and each standard intent pattern in the preset attack tactic knowledge base, and generate an intent similarity score set; Extract the score limits that meet the confidence threshold from the intent similarity score set, and label the standard intent pattern corresponding to the score limit as the final attack intent category.

[0040] In practice, the system first calculates the feature distance between the threat intent feature vector and each standard intent pattern in the pre-defined attack tactic knowledge base, generating an intent similarity score set. The system first performs L2 normalization on the threat intent feature vector, making its magnitude one. Each of the twelve standard intent patterns stored in the pre-defined attack tactic knowledge base corresponds to a baseline feature vector, which have already undergone the same normalization process during the knowledge base construction phase. The system uses the Euclidean distance formula to calculate the feature distance between the normalized threat intent feature vector and the baseline vector of each standard intent pattern. The calculation formula is the L2 norm of the difference between the two vectors. Subsequently, the system converts the twelve calculated feature distance values ​​into similarity scores using a Gaussian kernel function. The bandwidth parameter of the Gaussian kernel function is set to 0.5, which is determined based on the mean of the feature distance distribution of similar intent samples in the validation set. The twelve converted similarity scores constitute the intent similarity score set, with each score ranging from zero to one; a larger value indicates a higher degree of matching with the corresponding standard intent pattern. Then, the system extracts score limits from the intent similarity score set that meet the confidence threshold, and labels the standard intent pattern corresponding to the score limit as the final attack intent category. The system's preset confidence threshold is set to 0.75, which is determined by receiver operating characteristic (ROC) curve analysis of the intent similarity score distribution between historical attack samples and normal traffic samples, selecting the score point that maximizes the difference between the true positive rate and the false positive rate as the threshold. The system iterates through the intent similarity score set, filtering out all score values ​​greater than or equal to the confidence threshold. If the filtering result is empty, the final attack intent category is labeled as unknown intent, and a manual review process is triggered. If the filtering result is not empty, the system selects the score with the largest value as the score limit, and labels the standard intent pattern corresponding to this score limit as the final attack intent category.

[0041] It should be noted that, in this application, feature distance refers to the geometric distance measure between the threat intent feature vector and the standard intent pattern baseline vector in high-dimensional space; intent similarity score set refers to the quantitative score set of the matching degree between each standard intent pattern and the current threat intent feature vector; confidence threshold is the minimum threshold value used to filter valid intent similarity scores; score limit refers to the similarity score with the largest value in the intent similarity score set that meets the confidence threshold.

[0042] In step S4, the risk handling strategy is sent to the industrial control security equipment and risk filtering control is executed to generate threat management actions to block the abnormal traffic corresponding to the cross-regional alarm event.

[0043] In this embodiment, the risk handling strategy is distributed to industrial control security devices and risk filtering control is executed to generate threat management actions to block the abnormal traffic corresponding to the cross-regional alarm event. This can be achieved through the following steps: The risk handling strategy is parsed into a set of filtering rules that can be identified by industrial control security devices, and the target execution device is determined based on the device type and network topology location; The set of filtering rules is sent to the target execution device to trigger the local filtering policy and perform risk filtering control on the matched abnormal traffic; The target execution device generates a threat management action record based on the filtering control results and feeds the threat management action record back to the central control platform.

[0044] In practice, the system first reads the sequence of actions from the risk management strategy and compiles it into a set of filtering rules recognizable by industrial control system (ICS) security devices using a syntax conversion engine. This set includes five-tuple matching conditions and drop instructions. The system then queries the ICS asset knowledge graph to obtain the device type and network topology location of the controlled asset nodes. Device types include industrial firewalls and intrusion prevention systems, and network topology location refers to the boundary gateway of the security zone where the asset is located. Based on the protocol parsing depth required for the filtering rule set, the system uses a shortest path algorithm to select the boundary node closest to the controlled asset and possessing the corresponding processing capabilities as the target execution device. Then, the system pushes the filtering rule set to the target execution device through a secure encrypted channel. Upon receiving the data, the target execution device performs digital signature verification. If the verification passes, it loads the filtering rule set into the policy matching table in its local memory, triggering a local filtering policy update. When network traffic flows through the target execution device, the device extracts the source Internet Protocol (IP) address, destination IP address, source port, destination port, and transport layer protocol type of the data packets and compares them against the five-tuple conditions in the policy matching table. If a drop instruction rule is matched, the device directly blocks the data packet and releases connection resources, thereby performing risk filtering control on the matched abnormal traffic. Finally, after completing each risk filtering control, the target execution device extracts the packet header information, matching rule identifier, interception timestamp, and action type of the intercepted data packet, serializes and assembles these fields according to a predefined log format, and generates a structured threat management action record. The device writes this record to a local circular buffer and uploads the threat management action record to the central management platform in fixed batches via an asynchronous message queue. After receiving the data, the central management platform reverse-references the original cross-regional alarm event based on the rule identifier in the record, updates the event status to blocked, and persistently stores the record in the audit database.

[0045] It should be noted that, in this application, industrial control security equipment refers to security protection hardware or software entities deployed in industrial control networks for performing access control and traffic filtering; risk filtering control refers to security control behavior that intercepts or drops network data packets according to preset rules to block threat propagation; threat management actions refer to specific security interventions and blocking behaviors implemented by industrial control security equipment in response to handling strategies for abnormal network traffic; abnormal traffic refers to a set of network data packets that meet attack characteristics or violate business communication baselines and are judged to have security threats; the filtering rule set refers to the underlying device executable rule library containing matching conditions and handling instructions generated by risk handling strategy parsing; device type refers to the classification label of the specific security protection functions and product forms undertaken by industrial control security equipment in industrial control networks; network topology location refers to the spatial node coordinates of security equipment or controlled assets in the physical connection and logical partition of industrial control networks; target execution device refers to the underlying security protection device selected after topology evaluation to receive filtering rules and actually execute abnormal traffic blocking; threat management action record is a structured audit log describing the specific time, matching rules and handling results of the security equipment performing risk filtering control.

[0046] In addition, in this embodiment, parsing the risk handling strategy into a set of filtering rules recognizable by industrial control security devices, and determining the target execution device based on device type and network topology location, can be achieved through the following steps: Extract the sequence of actions and timing constraints from the risk management strategy and convert them into a set of filtering rules that can be recognized by the underlying protocol of the industrial control security equipment. Obtain the device type identifier and network topology location information of each security device in the industrial control network, and construct a mapping matrix between device handling capabilities and network topology nodes; The mapping matrix is ​​matched according to the execution requirements of the set of filtering rules to select target execution devices that have the ability to handle abnormal traffic and are located on the abnormal traffic forwarding path.

[0047] In practical implementation, firstly, the sequence of actions and timing constraints in the risk handling strategy are extracted and converted into a set of filtering rules recognizable by the underlying protocol of the industrial control system (ICS) security device. The system first parses the risk handling strategy object, reads the sequentially arranged sequence of actions, and extracts the target protocol type, operation instructions, and matching parameters for each action. Then, the system reads the minimum waiting time and maximum allowed interval between actions defined in the timing constraints. Using a pre-built protocol syntax conversion engine, the system compiles the above operation instructions and matching parameters into a set of filtering rules conforming to the underlying configuration syntax of the target device. Each filtering rule includes rule priority, a five-tuple matching field, an execution action identifier, and an effective time window. The timing constraints are converted into state dependency markers between rules, ensuring that the device strictly adheres to the time interval requirements during execution. Next, the system obtains the device type identifier and network topology location information of each security device in the ICS network, constructing a mapping matrix between device handling capabilities and network topology nodes. The system polls all security devices in the ICS network using a simple network management protocol to obtain the device type identifier for each device, which clearly indicates whether the device is an industrial firewall, intrusion prevention system, or one-way gateway, etc. Simultaneously, the system reads the link-layer discovery protocol data from the network management system, extracts the switch ports connected to each device and their respective VLAN IDs, forming network topology location information. The system constructs a mapping matrix using the device's unique ID as the row index and the device type identifier's supported action types and network topology location information as column dimensions. Finally, based on the execution requirements of the filtering rule set, the system matches the mapping matrix to filter target execution devices with handling capabilities located on abnormal traffic forwarding paths. The system parses the protocol parsing depth and action type required by the filtering rule set to form an execution requirement vector. The system performs an element-wise logical AND operation between the execution requirement vector and each row of the mapping matrix, filtering out a set of candidate devices whose capabilities fully cover the execution requirements. Subsequently, based on the source and destination Internet Protocol addresses recorded in cross-regional alarm events, the system queries the industrial control network routing table to calculate the actual forwarding hops and necessary nodes of the abnormal traffic from the source to the destination, determining the abnormal traffic forwarding path. The system selects the device from the candidate device set whose network topology location information is located on the abnormal traffic forwarding path and has the fewest hops from the controlled asset, marking it as the final target execution device.

[0048] It should be noted that, in this application, the sequence of handling actions refers to the list of specific security control actions and their target parameters defined in the risk handling strategy to be executed in sequence; the timing constraints refer to the time interval and execution order restrictions that must be met between adjacent actions in the sequence of handling actions; the device type identifier refers to the standardized code that distinguishes the product form and security protection function category of industrial control security equipment; the network topology location information is the attribute set describing the spatial node of the security device in the physical connection and logical partition of the industrial control network; the mapping matrix refers to the two-dimensional Boolean data structure that shows the correspondence between the handling capabilities of the entire network security devices and the network topology nodes in which they are located; and the abnormal traffic forwarding path refers to the sequence of nodes that abnormal network data packets actually pass through in the industrial control network from the source end to the destination end.

[0049] Therefore, this application demonstrates that the risk handling strategy can be distributed to industrial control security devices and risk filtering control can be executed to generate threat management actions to block abnormal traffic corresponding to the cross-regional alarm events. Identifying cross-regional alarm events provides a panoramic view of associated attack behaviors covering multiple security regions, thus overcoming the inherent deficiency in existing industrial control system security protection schemes where devices in each region can only independently assess based on local traffic perspectives and cannot effectively identify cross-domain collaborative attack intentions. This feature, by aggregating isolated alarm data scattered across different network regions in a spatiotemporal dimension and reconstructing causal chains, enables the system to accurately reconstruct the attacker's lateral movement trajectory and true tactical objectives across multi-level networks, thereby significantly improving the detection accuracy and threat characterization capabilities for complex penetration behaviors. Determining the risk handling strategy yields a set of executable filtering rules adapted to the underlying protocol of the target industrial control security device and containing temporal constraints, thus overcoming the technical shortcomings of existing technologies where static rules are difficult to respond to dynamic cross-domain threats, handling actions are delayed, and blocking is incomplete. This feature transforms global assessment results into refined control instructions with protocol compatibility and execution timing, ensuring that the handling strategy is loaded and strictly executed in real time at the optimal node on the abnormal traffic forwarding path, effectively avoiding rule conflicts and execution delays.

[0050] In summary, the technical solution adopted in this application can perform global intent recognition and dynamic policy distribution for distributed alarm events, thereby improving the accuracy of threat control.

[0051] The foregoing detailed an example of a distributed industrial control protocol threat detection and control method based on an AI large model provided in this application. It is understood that the corresponding apparatus, in order to achieve the above functions, includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should readily recognize that, in conjunction with the units and algorithm steps of the examples described in the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0052] In some embodiments, this application also provides a computer device, the computer device including a memory and a processor, the memory for storing a computer program, and the processor for calling and running the computer program from the memory, so that the computer device executes the above-described distributed industrial control protocol threat detection and control method based on an AI large model.

[0053] In some embodiments, reference Figure 3 The dashed lines in the figure indicate that the unit or module is optional. This figure is a structural schematic diagram of a computer device implementing a distributed industrial control protocol threat detection and control method based on an AI large-scale model, according to an embodiment of this application. The distributed industrial control protocol threat detection and control method based on an AI large-scale model described in the above embodiment can... Figure 3 The computer device shown is used to implement this, and the computer device includes at least one processor 301, a memory 302 and at least one communication unit 305. The computer device may be a terminal device, a server or a chip.

[0054] Processor 301 can be a general-purpose processor or a special-purpose processor. For example, processor 301 can be a central processing unit (CPU), which can be used to control computer devices, execute software programs, and process data from software programs. The computer device may also include a communication unit 305 for inputting (receiving) and outputting (transmitting) signals.

[0055] For example, the computer device may be a chip, and the communication unit 305 may be the input and / or output circuit of the chip, or the communication unit 305 may be the communication interface of the chip, which may be a component of a terminal device, network device or other device.

[0056] For example, the computer device may be a terminal device or a server, and the communication unit 305 may be a transceiver of the terminal device or the server, or the communication unit 305 may be a transceiver circuit of the terminal device or the server.

[0057] The computer device may include one or more memories 302 storing a program 304. The program 304 can be executed by a processor 301 to generate instructions 303, causing the processor 301 to execute the method described in the above method embodiments according to the instructions 303. Optionally, the memory 302 may also store data (such as a target audit model). Optionally, the processor 301 may also read data stored in the memory 302, which may be stored at the same storage address as the program 304, or it may be stored at a different storage address than the program 304.

[0058] The processor 301 and memory 302 can be configured separately or integrated together, for example, integrated on the system on chip (SOC) of the terminal device.

[0059] It should be understood that each step of the above method embodiment can be completed by hardware logic circuits or software instructions in the processor 301. The processor 301 can be a CPU, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, such as discrete gate, transistor logic devices, or discrete hardware components.

[0060] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0061] For example, in some embodiments, this application also provides a computer-readable storage medium storing instructions or code that, when executed on a computer, cause the computer to implement the aforementioned distributed industrial control protocol threat detection and control method based on an AI large model.

[0062] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0063] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A distributed industrial control protocol threat detection and control method based on an AI large-scale model, characterized in that, The method includes: Industrial control network traffic is collected by distributed detection probes, and structured session data is extracted from the industrial control network traffic; Semantic threat detection is performed on the structured session data to obtain threat detection features that include threat type and threat confidence. Threat path deduction is performed on the threat detection features based on the industrial control asset knowledge graph and attack chain model to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path. The risk confidence level is mapped to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions. Threat intent is identified for the cross-regional alarm event through the risk alarm information to obtain a risk handling strategy. The risk handling strategy is distributed to industrial control security devices and risk filtering control is executed to generate threat management actions to block the abnormal traffic corresponding to the cross-regional alarm event.

2. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 1, characterized in that, Semantic threat detection is performed on the structured session data to obtain threat detection features that include threat type and threat confidence. Specifically, these features include: Extract the protocol instruction code and key payload fields from the structured session data, and generate a protocol-level semantic query vector for industrial control communication behavior; The current process stage and security parameter constraint threshold of the associated assets are analyzed, and the protocol-level semantic query vector is aligned across domains with the process stage and the security parameter constraint threshold to generate a semantic input sequence that integrates the business context. The semantic input sequence is input into a generative large model that has been incrementally pre-trained in the industrial control domain for intent reasoning, and the output is threat detection features that include threat type and threat confidence.

3. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 1, characterized in that, Based on the knowledge graph and attack chain model of industrial control assets, threat path deduction is performed on the threat detection features to obtain the risk confidence level and corresponding cross-regional alarm events on the cross-regional threat path, specifically including: The threat detection features are mapped to the industrial control asset knowledge graph to locate the controlled asset nodes, and the attack chain model is used to identify the current attack tactical stage of the threat. Starting from the controlled asset node, subgraph traversal is performed based on the cross-domain topology connection relationship and attack chain stage transfer rules to generate cross-regional candidate threat propagation paths; Calculate the cumulative risk confidence level of each candidate threat propagation path, and encapsulate the candidate threat propagation paths and associated assets that meet the preset risk threshold into cross-regional alarm events.

4. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 1, characterized in that, Mapping the risk confidence level to the risk classification and handling template to generate risk alarm information containing control action combinations and control execution instructions specifically includes: Based on the risk confidence level, match the risk level range in the risk classification and handling template to determine the corresponding control action combination type and execution priority; Extract a subset of control actions applicable to the current industrial control asset node from the control action combination type, and generate a control execution instruction sequence based on asset operation status constraints; The control execution instruction sequence, the execution priority, and the associated cross-regional alarm event identifier are encapsulated to generate risk alarm information.

5. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 1, characterized in that, The risk handling strategy specifically includes identifying the threat intent of the cross-regional alarm events based on the risk alarm information: The risk alarm information extracts control action combinations, and combines them with the propagation path characteristics of the cross-regional alarm events to construct a threat intent feature vector; The threat intent feature vector is matched with the standard intent patterns in the preset attack tactics knowledge base to determine the final attack intent category of the cross-regional alarm event; Based on the final attack intent category, the corresponding action sequence and timing constraints are extracted from the risk strategy library, and a risk handling strategy is generated.

6. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 5, characterized in that, The threat intent feature vector is matched with standard intent patterns in a preset attack tactic knowledge base to determine the final attack intent category of the cross-regional alert event. This specifically includes: Calculate the feature distance between the threat intent feature vector and each standard intent pattern in the preset attack tactic knowledge base, and generate an intent similarity score set; Extract the score limits that meet the confidence threshold from the intent similarity score set, and label the standard intent pattern corresponding to the score limit as the final attack intent category.

7. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 1, characterized in that, The risk handling strategy is distributed to industrial control security devices and risk filtering control is executed. Threat management actions are generated to block the abnormal traffic corresponding to the cross-regional alarm event. Specifically, this includes: The risk handling strategy is parsed into a set of filtering rules that can be identified by industrial control security devices, and the target execution device is determined based on the device type and network topology location; The set of filtering rules is sent to the target execution device to trigger the local filtering policy and perform risk filtering control on the matched abnormal traffic; The target execution device generates a threat management action record based on the filtering control results and feeds the threat management action record back to the central control platform.

8. The distributed industrial control protocol threat detection and control method based on an AI large model as described in claim 7, characterized in that, The risk handling strategy is parsed into a set of filtering rules that can be identified by industrial control security devices, and the target execution device is determined based on the device type and network topology location, specifically including: Extract the sequence of actions and timing constraints from the risk management strategy and convert them into a set of filtering rules that can be recognized by the underlying protocol of the industrial control security equipment. Obtain the device type identifier and network topology location information of each security device in the industrial control network, and construct a mapping matrix between device handling capabilities and network topology nodes; The mapping matrix is ​​matched according to the execution requirements of the set of filtering rules to select target execution devices that have the ability to handle abnormal traffic and are located on the abnormal traffic forwarding path.

9. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to call and run the computer programs from the memory, so that the computer device executes the distributed industrial control protocol threat detection and control method based on an AI large model as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions or code that, when executed on a computer, cause the computer to implement the distributed industrial control protocol threat detection and control method based on an AI large model as described in any one of claims 1 to 8.

Images