Industrial Control Host Behavior Detection Using Dependency Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems in gas fields face challenges with high resource occupancy, timeliness, and inaccuracy in recognizing safety behaviors, which hampers their defense capabilities and operational reliability.
Innovation Solution
A recognition method for safety behaviors in industrial control systems that involves collecting sample data, generating API and resource dependency graphs, converting them into numerical matrices, and constructing a detection model to identify normal or abnormal program behaviors, utilizing a system comprising a collection unit, generation unit, conversion unit, and recognition unit with specific processes for generating dependency graphs and a detection model including convolution layers and dense layers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malicious code defending technology is used, then manual analysis can extract feature codes, but detection timeliness and accuracy are insufficient
Solution Approach 1:
The system performs preliminary action by pre-collecting sample data and pre-training the detection model offline before actual deployment. The model is trained on historical malicious and normal programs to establish detection capabilities in advance, enabling rapid real-time detection without manual analysis during actual operation.
Solution Approach 2:
The patent replaces the mechanical manual analysis system with an automated machine learning detection model. Instead of manual extraction and comparison of feature codes, the system uses a trained neural network model that automatically analyzes program behavior and detects malicious code, significantly improving both speed and accuracy.
2Reliability
If traditional detection methods are used, then feature codes can be compared with host programs, but resource occupancy is high
Solution Approach 1:
The system changes parameters by transitioning from traditional signature-based detection to behavior-based detection using machine learning. The detection model analyzes program behavior patterns rather than comparing fixed feature codes, improving reliability while optimizing resource consumption through efficient model inference.
Solution Approach 2:
The patent uses copying by creating a virtual execution environment where sample programs are executed to collect behavior data for model training. This allows the system to learn from copies of actual program behavior without deploying resource-intensive detection mechanisms to every endpoint.
3Measurement precision
If comprehensive detection is performed, then safety behavior recognition can be improved, but detection accuracy may decrease due to false alarms
Solution Approach 1:
The system applies segmentation by dividing the detection process into distinct phases: data collection, model training, and detection execution. It also segments the feature extraction into specific behavioral categories (API calls, system calls, file operations), allowing targeted analysis that improves accuracy while reducing false alarms through focused detection criteria.
Data Source
AI summary
A recognition method for safety behaviors in an industrial control system for a gas field and a recognition system thereof are provided. The recognition method includes: S1, collecting sample data of the industrial control system, and obtaining an analysis report based on the sample data; S2, generating a critical application programming interface (API) call dependency graph and a resource dependency graph based on the analysis report; S3, converting the critical API call dependency graph and the resource dependency graph into numerical matrixes; S4, constructing a detection model according to the numerical matrixes, and then detecting a program abnormal behavior of an industrial control host program based on the detection model, to obtain a recognition result, and the recognition result is a normal behavior or an abnormal behavior. The recognition method and system address issues such as high resource occupancy, timeliness, and inaccuracy in safety behavior recognition for industrial control system.