工业控制系统物理层报警量关联算法

王英州; 张耀方; 徐有方; 赵若菡; 郭舒畅; 刘红梅; 张永铮; 王佰玲; 刘红日

doi:10.11959/j.issn.2096-109x.2025013

您当前的位置：

首页 >

文章列表页 >

工业控制系统物理层报警量关联算法

学术论文 | 更新时间：2025-03-20

- 工业控制系统物理层报警量关联算法
- Physical layer alarm correlation algorithm for industrial control system
- 网络与信息安全学报 2025年11卷第1期页码：178-188
- 作者机构：
  
  1.哈尔滨工业大学（威海）计算机科学与技术学院，山东威海 264209
  2.威海天之卫网络空间安全科技有限公司，山东威海 264209
  3.中国移动通信集团山东有限公司，山东济南 250000
  4.中资网络信息安全科技有限公司，北京 100000
- 作者简介：
  
  [ "王英州（1999- ），男，黑龙江哈尔滨人，哈尔滨工业大学（威海）硕士生，主要研究方向为工业控制系统安全。" ]
  [ "张耀方（1998- ），女，黑龙江哈尔滨人，哈尔滨工业大学（威海）博士生，主要研究方向为工业控制系统攻击路径。" ]
  [ "徐有方（1999- ），男，河南南阳人，哈尔滨工业大学（威海）硕士生，主要方向为工业控制系统安全、网络安全。" ]
  [ "赵若菡（2003- ），女，山东济宁人，主要研究方向为工业控制系统安全。" ]
  [ "郭舒畅（2004- ），女，吉林长春人，主要研究方向为网络与信息安全。" ]
  [ "刘红梅（1975- ），女，山东烟台人，山东大学高级工程师，主要研究方向为网络与信息安全。" ]
  [ "张永铮，男，博士，黑龙江哈尔滨人，中资网络信息安全科技有限公司研究员。" ]
  [ "王佰玲（1978- ），男，黑龙江哈尔滨人，哈尔滨工业大学（威海）计算机科学与技术学院教授、博士生导师，主要研究方向为网络安全、信息内容安全、信息对抗、工业互联网安全。" ]
  [ "刘红日（1982- ），男，山东烟台人，博士，哈尔滨工业大学助理研究员，主要研究方向为工业控制系统流量审计、工控互联网安全。" ]
- 基金信息：
  
  国家重点研发计划(2021YFB2012400)
- DOI：10.11959/j.issn.2096-109x.2025013
  中图分类号： TP393
- 收稿：2024-04-30，
  
  修回：2024-09-28，
  
  纸质出版：2025-02-25
- 稿件说明：
移动端阅览
王英州, 张耀方, 徐有方, 等. 工业控制系统物理层报警量关联算法[J]. 网络与信息安全学报, 2025, 11(1): 178-188.

WANG Y Z, ZHANG Y F, XU Y F, et al. Physical layer alarm correlation algorithm for industrial control system[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 178-188.
王英州, 张耀方, 徐有方, 等. 工业控制系统物理层报警量关联算法[J]. 网络与信息安全学报, 2025, 11(1): 178-188. DOI： 10.11959/j.issn.2096-109x.2025013.

WANG Y Z, ZHANG Y F, XU Y F, et al. Physical layer alarm correlation algorithm for industrial control system[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 178-188. DOI： 10.11959/j.issn.2096-109x.2025013.

摘要

工业控制系统遭到攻击后，可能会导致部分工控设备故障，负责监控设备工作状态的传感器会在物理层产生报警数据。这些传感器变量被称为报警量，它们反映了设备的运行状况。然而，报警数据数量巨大，且相关性难以确定，同时报警信息的源头也很难追溯。针对上述问题，提出了一种针对工业控制系统物理层报警量关联的算法。该算法先通过分析报警记录中的报警开始时间和报警结束时间来量化报警量间的关联度，在关联度的指导下对报警量进行分类关联，构建可能的全局报警关联结构，最后利用K2算法对可能的全局报警关联结构进行评估。同时改进了K2算法的评分函数，从而保证全局报警关联结构的可解释性。实验结果表明，该算法得到的全局报警关联结构具有较好的可解释性，更符合真实工艺流程，有助于分析报警量在物理层的关联关系，对指导工业控制系统安全响应有着重要的意义。

Abstract

Malfunctions of some industrial control equipment may be caused by attacks on industrial control systems

and alarm data was generated at the physical layer by sensors responsible for monitoring the equipment's working status. These sensor variables

referred to as alarm quantities

reflected the operating conditions of the equipment. However

the volume of alarm data was massive

and its correlation was difficult to determine. Simultaneously

tracing the source of the alarm data was also challenging. To address these issues

an algorithm for physical layer alarm correlation in industrial control systems was proposed. The correlation between alarm variables was quantified by analyzing the alarm start time and alarm end time in alarm records. Alarm variables were classified and correlated under the guidance of relevance

and potential global alarm correlation structures were constructed. Finally

the potential global alarm correlation structure was evaluated using the K2 algorithm. Additionally

the scoring function of the K2 algorithm was improved to ensure the interpretability of the global alarm correlation structure. Experimental results demonstrate that the global alarm correlation structure obtained by this algorithm exhibits good interpretability and is more consistent with the real process flow. This structure is helpful in analyzing the correlation between alarm variables at the physical layer and is of significant importance in guiding the security response of industrial control systems.

关键词

Keywords

references

杨婷 , 张嘉元 , 黄在起 , 等 . 工业控制系统安全综述 [J ] . 计算机研究与发展 , 2022 , 59 ( 5 ): 1035 - 1053 .

YANG T , ZHANG J Y , HUANG Z Q , et al . Survey of industrial control systems security [J ] . Journal of Computer Research and Development , 2022 , 59 ( 5 ): 1035 - 1053 .

黄涛 , 王郅伟 , 刘家池 , 等 . 工控协议安全研究综述 [J ] . 通信学报 , 2024 , 45 ( 6 ): 60 - 74 .

HUANG T , WANG Z W , LIU J C , et al . Survey on industrial control protocol security research [J ] . Journal on Communications , 2024 , 45 ( 6 ): 60 - 74 .

唐士杰 , 袁方 , 李俊 , 等 . 工业控制系统关键组件安全风险综述 [J ] . 网络与信息安全学报 , 2022 , 8 ( 3 ): 1 - 17 .

TANG S J , YUAN F , LI J , et al . Review on security risks of key components in industrial control system [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 3 ): 1 - 17 .

ZHOU B Y , HU W K , CHEN T W . Pattern extraction from industrial alarm flood sequences by a modified CloFAST algorithm [J ] . IEEE Transactions on Industrial Informatics , 2022 , 18 ( 1 ): 288 - 296 .

HU W K , CHEN T W , SHAH S L . Detection of frequent alarm patterns in industrial alarm floods using itemset mining methods [J ] . IEEE Transactions on Industrial Electronics , 2018 , 65 ( 9 ): 7290 - 7300 .

LAI S Q , YANG F , CHEN T W . Accelerated multiple alarm flood sequence alignment for abnormality pattern mining [J ] . Journal of Process Control , 2019 , 85 ( C ): 44 - 57 .

NIYAZMAND T , IZADI I . Pattern mining in alarm flood sequences using a modified PrefixSpan algorithm [J ] . ISA Transactions , 2019 , 90 : 287 - 293 .

李俊杰 , 杨博 , 李宏光 . 基于报警时序信息挖掘的报警关联分析方法 [J ] . 信息与控制 , 2019 , 48 ( 1 ): 29 - 34 .

LI J J , YANG B , LI H G . Alarm correlation analysis approach based on alarm time information mining [J ] . Information and Control , 2019 , 48 ( 1 ): 29 - 34 .

鲁显光 , 杜学绘 , 王文娟 . 基于改进FP growth的告警关联算法 [J ] . 计算机科学 , 2019 , 46 ( 8 ): 64 - 70 .

LU X G , DU X H , WANG W J . Alert Correlation Algorithm Based on Improved FP Grown [J ] . Computer Science , 2019 , 46 ( 8 ): 64 - 70 .

RODRIGO V , CHIOUA M , HAGGLUND T , et al . Causal analysis for alarm flood reduction [J ] . IFAC PapersOnLine , 2016 , 49 ( 7 ): 723 - 728 .

SIMEU A , LEFEBVREL A , DERAIN J P . A methodology of alarm filtering using dynamic fault tree [J ] . Reliability Engineering & System Safety , 2011 , 96 ( 2 ): 257 - 266 .

GUO W X , WEN F S , LIAO Z W , et al . An analytic model-based approach for power system alarm processing employing temporal constraint network [J ] . IEEE Transactions on Power Delivery , 2010 , 25 ( 4 ): 2435 - 2447 .

THAMBIRAJAH J , BENEBBAS L , BAUER M , et al . Cause-and-effect analysis in chemical processes utilizing XML, plant connectivity and quantitative process history [J ] . Computers and Chemical Engineering , 2009 , 33 ( 2 ): 503 - 512 .

LIU Y , CHEN H S , WU H B , et al . Simplified granger causality map for data-driven root cause diagnosis of process disturbances [J ] . Process Control , 2020 , 95 : 45 - 54 .

CHEN H S , YAN Z B , ZHANG X L , et al . Root cause diagnosis of process faults using conditional granger causality analysis and maximum spanning tree [J ] . IFAC PapersOnLine , 2018 , 51 ( 18 ): 381 - 386 .

HU W K , CHEN T W , SHAH S L , et al . Cause and effect analysis for decision support in alarm floods [J ] . IFAC PapersOnLine , 2017 , 50 ( 1 ): 13940 - 13945 .

SHU Y D , ZHAO J S , Data-driven causal inference based on a modified transfer entropy [J ] . Computers & Chemical. Engineering , 2013 , 57 : 173 - 180 .

SU J J , WANG D J , ZHANG Y N , et al . Capturing causality for fault diagnosis based on multi-valued alarm series using transfer entropy [J ] . Entropy , 2017 , 19 ( 12 ): 663 .

ABREU D R S , NUNES Y T , et al . A method for detecting causal relationships between industrial alarm variables using transfer entropy and K2 algorithm [J ] . Process Control , 2021 , 106 : 142 - 154 .

WANG J , YANG Z , SU J , et al . Root-cause analysis of occurring alarms in thermal power plants based on Bayesian networks [J ] . International Journal of Electrical Power & Energy Systems , 2018 , 103 : 67 - 74 .

吴越 , 曹国彦 . 面向工业传感网络的时间序列异常检测综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 4 ): 17 - 36 .

WU Y , CAO G Y . Survey of time series anomaly detection for industrial sensor networks [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 4 ): 17 - 36 .

ZHU Q X , MENG Q Q , WANG J P , et al . Novel causal network modeling method integrating process knowledge with modified transfer entropy: a case study of complex chemical processes [J ] . Ind. Eng. Chem. Res , 2017 , 56 : 14282 - 14289 .

MENEGOZZO G , DALL’ALBA D , FIORINI P . CIPCaD-Bench: continuous industrial process datasets for benchmarking causal discovery methods [C ] // Proceedings of IEEE 18th International Conference on Automation Science and Engineering , Piscataway : IEEE Press , 2022 : 2124 - 2131 .

CHEN X L , WANG J , DING S X . Complex system monitoring based on distributed least squares method [J ] . IEEE Transactions on Automation Science and Engineering , 2021 , 18 ( 4 ): 1892 - 1900 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

工业控制系统安全风险传播机理研究