Physical layer alarm correlation algorithm for industrial control system

WANG Yingzhou; ZHANG Yaofang; XU Youfang; ZHAO Ruohan; GUO Shuchang; LIU Hongmei; ZHANG Yongzheng; WANG Bailing; LIU Hongri

doi:10.11959/j.issn.2096-109x.2025013

您当前的位置：

首页 >

文章列表页 >

Physical layer alarm correlation algorithm for industrial control system

Papers | 更新时间：2025-03-20

- Physical layer alarm correlation algorithm for industrial control system
- Chinese Journal of Network and Information Security Vol. 11, Issue 1, Pages: 178-188(2025)
- 作者机构：
  
  1.哈尔滨工业大学（威海）计算机科学与技术学院，山东威海 264209
  2.威海天之卫网络空间安全科技有限公司，山东威海 264209
  3.中国移动通信集团山东有限公司，山东济南 250000
  4.中资网络信息安全科技有限公司，北京 100000
- 作者简介：
- 基金信息：
  
  The Nationai Key R&D Program of China(2021YFB2012400)
- DOI：10.11959/j.issn.2096-109x.2025013
  CLC： TP393
- Received：30 April 2024，
  
  Revised：2024-09-28，
  
  Published：25 February 2025
- 稿件说明：
移动端阅览
王英州, 张耀方, 徐有方, 等. 工业控制系统物理层报警量关联算法[J]. 网络与信息安全学报, 2025, 11(1): 178-188.

WANG Y Z, ZHANG Y F, XU Y F, et al. Physical layer alarm correlation algorithm for industrial control system[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 178-188.
王英州, 张耀方, 徐有方, 等. 工业控制系统物理层报警量关联算法[J]. 网络与信息安全学报, 2025, 11(1): 178-188. DOI： 10.11959/j.issn.2096-109x.2025013.

WANG Y Z, ZHANG Y F, XU Y F, et al. Physical layer alarm correlation algorithm for industrial control system[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 178-188. DOI： 10.11959/j.issn.2096-109x.2025013.

摘要

工业控制系统遭到攻击后，可能会导致部分工控设备故障，负责监控设备工作状态的传感器会在物理层产生报警数据。这些传感器变量被称为报警量，它们反映了设备的运行状况。然而，报警数据数量巨大，且相关性难以确定，同时报警信息的源头也很难追溯。针对上述问题，提出了一种针对工业控制系统物理层报警量关联的算法。该算法先通过分析报警记录中的报警开始时间和报警结束时间来量化报警量间的关联度，在关联度的指导下对报警量进行分类关联，构建可能的全局报警关联结构，最后利用K2算法对可能的全局报警关联结构进行评估。同时改进了K2算法的评分函数，从而保证全局报警关联结构的可解释性。实验结果表明，该算法得到的全局报警关联结构具有较好的可解释性，更符合真实工艺流程，有助于分析报警量在物理层的关联关系，对指导工业控制系统安全响应有着重要的意义。

Abstract

Malfunctions of some industrial control equipment may be caused by attacks on industrial control systems

and alarm data was generated at the physical layer by sensors responsible for monitoring the equipment's working status. These sensor variables

referred to as alarm quantities

reflected the operating conditions of the equipment. However

the volume of alarm data was massive

and its correlation was difficult to determine. Simultaneously

tracing the source of the alarm data was also challenging. To address these issues

an algorithm for physical layer alarm correlation in industrial control systems was proposed. The correlation between alarm variables was quantified by analyzing the alarm start time and alarm end time in alarm records. Alarm variables were classified and correlated under the guidance of relevance

and potential global alarm correlation structures were constructed. Finally

the potential global alarm correlation structure was evaluated using the K2 algorithm. Additionally

the scoring function of the K2 algorithm was improved to ensure the interpretability of the global alarm correlation structure. Experimental results demonstrate that the global alarm correlation structure obtained by this algorithm exhibits good interpretability and is more consistent with the real process flow. This structure is helpful in analyzing the correlation between alarm variables at the physical layer and is of significant importance in guiding the security response of industrial control systems.

关键词

Keywords

references

杨婷 , 张嘉元 , 黄在起 , 等 . 工业控制系统安全综述 [J ] . 计算机研究与发展 , 2022 , 59 ( 5 ): 1035 - 1053 .

YANG T , ZHANG J Y , HUANG Z Q , et al . Survey of industrial control systems security [J ] . Journal of Computer Research and Development , 2022 , 59 ( 5 ): 1035 - 1053 .

黄涛 , 王郅伟 , 刘家池 , 等 . 工控协议安全研究综述 [J ] . 通信学报 , 2024 , 45 ( 6 ): 60 - 74 .

HUANG T , WANG Z W , LIU J C , et al . Survey on industrial control protocol security research [J ] . Journal on Communications , 2024 , 45 ( 6 ): 60 - 74 .

唐士杰 , 袁方 , 李俊 , 等 . 工业控制系统关键组件安全风险综述 [J ] . 网络与信息安全学报 , 2022 , 8 ( 3 ): 1 - 17 .

TANG S J , YUAN F , LI J , et al . Review on security risks of key components in industrial control system [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 3 ): 1 - 17 .

ZHOU B Y , HU W K , CHEN T W . Pattern extraction from industrial alarm flood sequences by a modified CloFAST algorithm [J ] . IEEE Transactions on Industrial Informatics , 2022 , 18 ( 1 ): 288 - 296 .

HU W K , CHEN T W , SHAH S L . Detection of frequent alarm patterns in industrial alarm floods using itemset mining methods [J ] . IEEE Transactions on Industrial Electronics , 2018 , 65 ( 9 ): 7290 - 7300 .

LAI S Q , YANG F , CHEN T W . Accelerated multiple alarm flood sequence alignment for abnormality pattern mining [J ] . Journal of Process Control , 2019 , 85 ( C ): 44 - 57 .

NIYAZMAND T , IZADI I . Pattern mining in alarm flood sequences using a modified PrefixSpan algorithm [J ] . ISA Transactions , 2019 , 90 : 287 - 293 .

李俊杰 , 杨博 , 李宏光 . 基于报警时序信息挖掘的报警关联分析方法 [J ] . 信息与控制 , 2019 , 48 ( 1 ): 29 - 34 .

LI J J , YANG B , LI H G . Alarm correlation analysis approach based on alarm time information mining [J ] . Information and Control , 2019 , 48 ( 1 ): 29 - 34 .

鲁显光 , 杜学绘 , 王文娟 . 基于改进FP growth的告警关联算法 [J ] . 计算机科学 , 2019 , 46 ( 8 ): 64 - 70 .

LU X G , DU X H , WANG W J . Alert Correlation Algorithm Based on Improved FP Grown [J ] . Computer Science , 2019 , 46 ( 8 ): 64 - 70 .

RODRIGO V , CHIOUA M , HAGGLUND T , et al . Causal analysis for alarm flood reduction [J ] . IFAC PapersOnLine , 2016 , 49 ( 7 ): 723 - 728 .

SIMEU A , LEFEBVREL A , DERAIN J P . A methodology of alarm filtering using dynamic fault tree [J ] . Reliability Engineering & System Safety , 2011 , 96 ( 2 ): 257 - 266 .

GUO W X , WEN F S , LIAO Z W , et al . An analytic model-based approach for power system alarm processing employing temporal constraint network [J ] . IEEE Transactions on Power Delivery , 2010 , 25 ( 4 ): 2435 - 2447 .

THAMBIRAJAH J , BENEBBAS L , BAUER M , et al . Cause-and-effect analysis in chemical processes utilizing XML, plant connectivity and quantitative process history [J ] . Computers and Chemical Engineering , 2009 , 33 ( 2 ): 503 - 512 .

LIU Y , CHEN H S , WU H B , et al . Simplified granger causality map for data-driven root cause diagnosis of process disturbances [J ] . Process Control , 2020 , 95 : 45 - 54 .

CHEN H S , YAN Z B , ZHANG X L , et al . Root cause diagnosis of process faults using conditional granger causality analysis and maximum spanning tree [J ] . IFAC PapersOnLine , 2018 , 51 ( 18 ): 381 - 386 .

HU W K , CHEN T W , SHAH S L , et al . Cause and effect analysis for decision support in alarm floods [J ] . IFAC PapersOnLine , 2017 , 50 ( 1 ): 13940 - 13945 .

SHU Y D , ZHAO J S , Data-driven causal inference based on a modified transfer entropy [J ] . Computers & Chemical. Engineering , 2013 , 57 : 173 - 180 .

SU J J , WANG D J , ZHANG Y N , et al . Capturing causality for fault diagnosis based on multi-valued alarm series using transfer entropy [J ] . Entropy , 2017 , 19 ( 12 ): 663 .

ABREU D R S , NUNES Y T , et al . A method for detecting causal relationships between industrial alarm variables using transfer entropy and K2 algorithm [J ] . Process Control , 2021 , 106 : 142 - 154 .

WANG J , YANG Z , SU J , et al . Root-cause analysis of occurring alarms in thermal power plants based on Bayesian networks [J ] . International Journal of Electrical Power & Energy Systems , 2018 , 103 : 67 - 74 .

吴越 , 曹国彦 . 面向工业传感网络的时间序列异常检测综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 4 ): 17 - 36 .

WU Y , CAO G Y . Survey of time series anomaly detection for industrial sensor networks [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 4 ): 17 - 36 .

ZHU Q X , MENG Q Q , WANG J P , et al . Novel causal network modeling method integrating process knowledge with modified transfer entropy: a case study of complex chemical processes [J ] . Ind. Eng. Chem. Res , 2017 , 56 : 14282 - 14289 .

MENEGOZZO G , DALL’ALBA D , FIORINI P . CIPCaD-Bench: continuous industrial process datasets for benchmarking causal discovery methods [C ] // Proceedings of IEEE 18th International Conference on Automation Science and Engineering , Piscataway : IEEE Press , 2022 : 2124 - 2131 .

CHEN X L , WANG J , DING S X . Complex system monitoring based on distributed least squares method [J ] . IEEE Transactions on Automation Science and Engineering , 2021 , 18 ( 4 ): 1892 - 1900 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Research on the mechanism of industrial control system security risk propagation

Related Author

WANG Hongmin

WEI Qiang

WANG Lanmin

Related Institution

Information Engineering University

Tianjin Polytechnic University

⁰