ICSs (Industrial Control Systems) are gradually transforming towards networking and intelligence, which expose them to extremely severe security threats. To effectively identify cyberattacks, this paper proposes a novel industrial anomaly detection approach which organically integrate the graph attention mechanism with GDN (Graph Deviation Network). Furthermore, by incorporating GRU (Gated Recurrent Unit) and multi-head attention mechanism to enhance the robustness of feature representation, a robust feature extraction algorithm based on the improved graph attention mechanism is introduced to accurately depict the dynamic variation patterns of industrial traffics. Additionally, to strengthen the detection capability, an applicable anomaly detection model based on GDN is designed, whose hyperparameters are optimized by the improved Bayesian optimization algorithm. Finally, we utilize the typical SWaT datasets to conduct experimental evaluations, and the comparative results demonstrate that the proposed approach can exhibit competitive detection performance across three evaluation metrics and maintain a relatively stable detection accuracy.

Due to the mutual collaboration and in-depth integration among multiple defense technologies through information sharing, the cooperative defense in networked control systems has emerged as a feasible solution to counter increasingly diversified cyber threats under the unique security characteristics and requirements of industrial environments. However, one of the chief challenges is how to automatically and intelligently develop effective cooperative working strategies when an attack occurs. Leveraging the advantages of large-scale AI (Artificial Intelligence) models, this paper defines a new concept named "security script", and proposes a security script arrangement approach based on enhanced BERT to achieve fine-grained cooperative defense in networked control systems. Furthermore, this approach introduces intrusion detection and industrial firewall as two practical examples, and can automatically arrange effective security scripts to enable the dynamic interaction of two defense technologies. Additionally, to improve efficiency, the encoder structure adjusting and AdamW optimizing are further presented to enhance the traditional BERT. Experimental results clearly demonstrate that: for one thing, these two optimization ways can make greater achievements in reducing unnecessary time consumption and enhancing accuracy of security script arrangement; for another, compared with other typical BERT and large-scale AI models, the proposed approach can exhibit more favorable performance advantages in achieving cooperative defense based on security script arrangement. In particular, through its successful application and verification in one real-world manufacturing control system, our approach may bring a potential opportunity or direction for further research and improvement of AI-based cooperative defense.

In the field of industrial cyber security, it is an extremely challenging task to effectively detect anomalies and identify specific threat types from industrial data. Building on the constructed graph structure for industrial data, this paper proposes a novel dual-stage intrusion detection approach based on a Hybrid-GNN-DT model, which successfully designs two consecutive engines to identify threat activities. Furthermore, the first-stage Hybrid-GNN engine employs a double-channel architecture with GraphSAGE and GCN convolutional layers to achieve complementary feature representations, and further introduces an attention-based feature fusion method to initially classifies industrial data into normal and abnormal categories. For the obtained abnormal data, the second-stage DT engine constructs a decision tree to not only accomplish threat identification tasks but also filter mislabeled data resulting from potential misclassifications in the first stage. Finally, three typical datasets are used for extensive experimental evaluations, and the experimental results demonstrate that the proposed approach exhibits superior intrusion detection capability and a more balanced overall performance compared to other competitive models.

The abnormal changes of industrial data traffic can directly reflect the occurrence possibility of various cyber threats, which disrupt the normal data interaction in industrial production process. Based on the numerical characteristic and time-series characteristic implied in industrial data traffic, this paper proposes a novel feature extraction algorithm to analyze dual-characteristic prototypical points using a prototypical network. Moreover, CNN (Convolutional Neural Network) with an attention mechanism and GRU (Grated Recurrent Unit) are employed to generate prototypical points for numerical characteristic and time-series characteristic, respectively. Additionally, to enhance detection performance, a one-class classification anomaly detection engine based on SVDD (Support Vector Data Description) is designed, whose key parameters are optimized by an improved grey wolf optimization algorithm. Finally, the typical SWaT dataset is used for experimental evaluations, and the experimental results demonstrate that: on the one hand, in terms of comprehensive detection performance, SVDD is proved to be the optimal detection engine compared to the other three machine learning algorithms; on the other hand, the improved grey wolf optimization algorithm exhibits more efficient parameter optimization capability to further strengthen SVDD's detection performance.

Current networked control systems are facing more and more severe challenges of cyber threats, and various intrinsic network-related vulnerabilities may cause serious damage to industrial production. To strengthen their network defense capabilities, industrial firewalls have been successfully developed to provide the access control service based on the defense-in-defense concept. In this paper, we first give a classified analysis on the intrinsic vulnerabilities from a network-related perspective. After that, we present several representative security technologies applied in today's industrial firewalls, and analyze their basic working principles and effects in practical application. Additionally, we further discuss some applicable security mechanisms which may take full advantage of burgeoning information technologies to provide better security services. Finally, we summarize three application modes of industrial firewalls in networked control systems, and show one application example of our industrial firewall in the real-world control system to verify its relatively fine properties.

Nowadays, recommendation systems have been widely used in various aspects such as news, movies, music, videos, academia, and many more. The advent of personalized recommendation systems has significantly enhanced the efficiency of users' access to information and also improved their overall experience. As an essential component of the recommendation system research field, interpretable recommendations emphasize the need to provide users with recommended results along with the rationale behind them. Unlike traditional recommendation systems, interpretable systems can not only enhance system transparency but also increase user trust and acceptance, the likelihood of users choosing the recommended product, and overall satisfaction. However, most existing interpretable recommendation systems depend on user similarity, item similarity, scoring data, or review a single aspect of the data to produce an interpretation, which makes it challenging to create trustworthy interpretable due to the limited use of these factors and intelligent reasoning. To solve this problem, we propose the Probabilistic Soft Logic (PSL)-based Interpretable Generation Model for Recommendation (called PIGM). Unlike traditional interpretable recommendation models, our PIGM takes into account user similarity, item similarity, and scoring data, employing PSL to model these factors and utilizing intelligent reasoning to generate interpretations. Firstly, based on matrix decomposition to predict the user's score of the item. Secondly, the data is partitioned into observation dataset, target dataset and fact dataset. Thirdly, predicates are defined according to the data and the required results, and rules are defined according to the defined predicates, fact logic and relevant knowledge generated by recommendation system interpretation. Then, the weights of the rules are learned based on the maximum likelihood estimation. Finally, based on PSL reasoning and according to the defined rules, generate a recommendation list and corresponding interpretation for the user. The experimental results demonstrate the effectiveness of our proposed PIGM model on the real dataset.

Automation control, which is one functional core of industrial control system, has become the prime attack target due to its vulnerabilities. Furthermore, many industrial cyber threats can disturb or destroy the correctness of control operation data to cause industrial accidents, when one normal production process is running smoothly and orderly. In order to effectively identify abnormal activities in various control operation data, this paper proposes one BP (Back Propagation) neural network anomaly prediction model based on the double-optimized CS (Cuckoo Search) algorithm. By using the exponential decline strategy and Gaussian perturbation to improve the traditional CS algorithm, this model can obtain one effective anomaly prediction engine based on the optimized BP neural network: for one thing, it can quickly enter the local search through the exponential decline strategy; for another, the information exchange between all local positions and the global optimal positions is realized by Gaussian perturbation. Moreover, the double-optimized CS algorithm not only solves the problem that the traditional BP neural network is prone to fall into local optimal solution, but also eliminates the defect of low vitality in the traditional CS algorithm. Consequently, this model can realize the high-precision prediction of abnormal control operation data. The experimental results show that, compared with other approaches, this model has better prediction performance under both normal and attack states, and can ensure the security of automation control in industrial production.

Recommendation system based on collaborative filtering has attracted much attention because it can make personalized recommendations according to the different needs of different users. However, a training recommender system based on collaborative filtering needs a large amount of user-item interaction information. In practical applications, the collaborative filtering recommender system has problems of cold start and sparsity due to the lack of information in the data. The researchers noticed that the knowledge graph contained a lot of attribute relations and structured information. In order to alleviate and solve the problems of cold start and sparsity in the existing recommendation system, the researchers tried to introduce the knowledge graph into collaborative filtering. However, the existing recommendation systems based on knowledge graphs usually only pay attention to the project information and use the project information to model user preferences, but seldom pay attention to the user information. In this paper, we discuss the necessity of using user information and propose a new convolutional neural network framework, which is an end-to-end framework, which explores the correlation attributes in the knowledge graph to capture the correlation, and then to model high-order user information and high-order project information. It is worth mentioning that we use 9 different ways to aggregate high-order user neighborhood information and high-order project neighborhood information based on 3 different aggregators. The proposed model is applied to two data sets about books and music, and the results show that the accuracy is significantly improved, which proves the superiority of our method.

Due to the rapid development of industrial automation, ICSs (Industrial Control Systems) gradually expose their potential security vulnerabilities, and are facing more and more serious security risks. Although different industrial security technologies have been developed to strengthen industrial security protection, they always struggle for their own because of their standalone and non-related functions, and their actual defense effects are not encouraging. This paper first summarizes some intrinsic security vulnerabilities in ICSs, and analyzes the main causes to generate each class of vulnerabilities. Furthermore, five popular security technologies which have been successfully applied in today's ICSs are introduced, and their advantages and shortages are also compared by explaining each working mechanism. In order to take full advantage of various industrial security technologies, this paper proposes one novel cooperative defense model based P2DR (Policy, Protection, Detection and Response), which establishes the dynamical defense process to integrate five different industrial security technologies. Under the guidance of security policies, this model can comprehensively utilize the resources of various industrial security technologies to learn and judge current security status of the whole system, and effectively adjust the optimum deployment to provide the strongest protection with the lowest risk. Finally, one applicable case based on the proposed model is designed to verify the feasibility of cooperative defense in ICSs.

With the rocketing development of Industrial Internet, the edge control and acquisition networks have become one integral role in determining high-efficiency intelligent manufacturing and flexible production, and the edge security requirements have increasingly drawn widespread attention around the world. In order to strengthen industrial security capabilities, this paper designs a multifunctional deep edge defense system, which is developed on the customized hardware and popular UOS architecture. Furthermore, this system not only supports the basic data routing and forwarding between distinct network boundaries, but also provides some deep content checking and filtering services, which can block malicious attack traffics by setting effective security strategies. Additionally, the multi-scale log audit and authority management can enable the immediate analysis and accurate positioning on abnormal communication behaviors, and further improve the high availability and convenience. The long-term testing shows that this system has fine stability and robust defense capabilities under the comprehensive testing which integrates with different types of data traffics.

工业互联网的信息安全威胁特征仍然由工业控制系统的脆弱性主导,无论是信息系统相关威胁还是过程控制相关威胁,都与工业互联网边缘端点的脆弱性紧密相关.本文首先定义了工业互联网边缘端点的主动防护概念与特点,分析了不同类型边缘端点的脆弱性,并在此基础上给出了现阶段边缘端点的三种主动防护手段,具体包括:基于可信计算的主动免疫机制、面向Linux的主动式自主防护方法和面向Windows的"白名单"防护技术,简析了每种主动防护手段的优势与不足,为工业互联网边缘端点的安全防护提供支撑.

Due to its openness and simplicity, Modbus TCP has wide applications to facilitate the actual management and control in industrial wireless fields. However, its potential security vulnerabilities can also create lots of complicated information security challenges, which are increasingly threatening the availability of industrial real-time traffic delivery. Although anomaly detection has been recognized as a workable security measure to identify attacks, the critical step to successfully extract data characteristics is an extremely difficult task. In this paper, we focus on the continuous control mode in industrial processes and propose a control tracing feature algorithm to extract the function-driven tracing characteristics from Modbus TCP data traffic. Furthermore, this algorithm can flexibly integrate the time factor with critical functional operations and adequately describe the dynamic control change of technological processes. To closely cooperate with this algorithm, one optimized SVM (support vector machine) classifier is introduced as the practicable decision engine. By designing one applicable attack mode, we develop an in-depth and meticulous analysis on the decision accuracy, and all experimental results clearly explain that the extracted features can strongly reflect the changing pattern of continuous functional operations, and the proposed algorithm can effectively cooperate with the optimized SVM classifier to distinguish abnormal Modbus TCP data traffic.

IIoT (Industrial Internet of Things) has gained considerable attention and has been increasingly applied due to its ubiquitous sensing and communication. However, the sparse characteristic of sensing data in distributed IIoT networks may bring out tremendous challenges to implement the security protection measures. Based on the design of centralized data gathering and forwarding, this paper proposes a novel anomaly detection approach for IIoT sparse data, which can successfully collaborate the adaptive CEEMDAN (Complete Ensemble Empirical Mode Decomposition with Adaptive Noise) feature exploitation with one intelligent optimizing classification. Furthermore, in the adaptive CEEMDAN feature exploitation, the CEEMDAN energy entropy based on adaptive IMF (Intrinsic Mode Function) selection is designed to extract the sensing features from IIoT sparse data; in the intelligent optimizing classification, one effective OCSVM (One-Class Support Vector Machine) classifier optimized by the IABC (Improved Artificial Bee Colony) swarm intelligence algorithm is introduced to detect various abnormal sensing features. The experimental results show that, not only does the CEEMDAN energy entropy based on adaptive IMF selection accurately describe the change of industrial production by analyzing the probability distribution and energy distribution of sparse sensing data, but also the proposed IABC-OCSVM classifier has higher detection efficiency compared with the OCSVM classifiers optimized by other swarm intelligence algorithms.

With the deep integration of IT (Information Technology) and OT (Operational Technology), various Linux operating systems have been successfully applied in critical industrial devices, such as Linux-based IIoT (Industrial Internet of Things) controllers or gateways, and the vulnerabilities of these systems may become a new breakthrough for the organized and high-intensity attacks. In order to prevent malwares from corrupting or disabling industrial Linux-based devices, this paper proposes a novel real-time self-defense approach, which can be easily developed without redesigning the basic software and hardware platform. By establishing the customized Netlink connection between kernel mode and user mode, this approach can monitor all application processes, and block each new malicious application process, which cannot conform to the trusted white-listing rules. All experimental results show that the proposed approach has a comparative advantage to effectively detect and prevent the malware-related attacks, and provides a self-defense function for industrial Linux-based devices, which meets their availability due to the millisecond resolution.

Due to the lack of security consideration in the original design of industrial communication protocols, industrial fuzzing test which can successfully exploit various potential security vulnerabilities has become one new research hotspot. However, one critical issue is how to improve its testing efficiency. From this point of view, this paper proposes a novel fuzzing test case optimization approach based on improved genetic algorithm for industrial communication protocols. Moreover, a new individual selection strategy is designed as the selection operator in this genetic algorithm, which can be actively engaged in the fuzzing test case optimization process. In this individual selection strategy, the selection operation based on high and low fitness populations is introduced to enhance the individual selection diversity, which can increase the average fitness value of individuals and further improve the efficiency of test cases. In practice, we construct industrial communication data which conforms to Siemens S7 communication protocol to evaluate the proposed approach, and the experimental results show that, the individual fitness value of output population in the improved genetic algorithm is obviously higher than the one in traditional genetic algorithm under the same iteration, and this approach can enhance the efficiency and accuracy of test cases in Siemens S7 fuzzing vulnerability exploiting.

Under the tendency of interconnection and interoperability in Industrial Internet, anomaly detection, which has been widely recognized, has achieved modest accomplishments in industrial cyber security. However, a significant issue is how to effectively extract industrial control features which can accurately and comprehensively describe industrial control operations. Aiming at the function code field in industrial Modbus/TCP communication protocol, this paper proposes a novel feature extraction algorithm based on weighted function code correlation, which not only indicates the contribution of single function code in the whole function code sequence, but also analyzes the correlation of different function codes. In order to establish a serviceable detection engine, a dynamic adjusting ABC-SVM (Artificial Bee Colony - Support Vector Machine) anomaly detection model is also developed. The experimental results show that the proposed feature extraction algorithm can effectively reflect the changes of functional control behavior in process operations, and the improved ABC-SVM anomaly detection model can improve the detection ability by comparing with other anomaly detection engines.

工业互联网正保持着活跃地创新发展态势,其强调以物理网络为基础的万物互联互通,因此在这种新模式下,工业信息安全将面临严峻的挑战.本文首先以历年代表性的工业安全事件为例,说明了现阶段工业控制系统所面临的安全问题以及威胁形式,并在此基础上给出了工业互联网建设时所应重点考虑的安全脆弱性,然后重点论述了人工智能(AI,Artificial Intel igence)算法在工业入侵检测中的应用以及分类,分析了每类方法的优势与不足,并提出了全互联互通模式下工业AI入侵检测方法的研究重点.

There is an increasing consensus that software-defined networking may become a successful case to provide fine scalability and availability for industrial Internet, and it also brings new opportunities for the development of industrial cyber security. Aligning with the defense in depth strategy, this paper proposes a software-defined data flow detection and control approach for industrial Modbus/TCP communication. Furthermore, this approach designs a novel security strategy configuration service in SDN controllers to publish the flow control rules, and SDN switches match Modbus/TCP data flows with these flow control rules to detect and control abnormal communication behaviors. Specifically, a flow control rule database which stores all flow control rules of the entire control system is managed by SDN controllers, and a security flow table is maintained by each SDN switch according to different requirements of industrial communication. By using the DPI (Deep Packet Inspection) technology, this approach can run a deep analysis of Modbus/TCP packets according to the protocol specification, and block the improper control commands or undesired technology parameters. The qualitative analysis shows that the proposed approach possesses certain advantages and feasibilities.

The valley-to-peak difference in power consumption is a crucial problem in load regulation and control for a power grid. By allowing electric vehicles (EVs) to charge during off-peak hours and feed power back into the grid during peak hours, Vehicle-to-Grid (V2G) technology can help to shave the power peak. Long-distance communication is essential for data exchange between dispersed EVs and charging stations for the realization of V2G systems. However, because of the high mobility of EVs, the highvolume data transmission required and the limitations of the third-party infrastructure, it is challenging to achieve efficient and effective communication. To address these challenges, we propose a new V2G network architecture based on software-defined networking (SDN) technology. (1) We use an IEEE 802.11 WiFibased long-distance (WiLD) network with the TDMA scheme as the backhaul network, and (2) we partially replace the road side units (RSUs) with some of the WiLD nodes to provide access for, and to rapidly broadcast data to, EVs. In addition, we propose: (3) a two-stage flow table mechanism and a double roaming mechanism to address the mobility demands of V2G network terminals; and (4) a rapid data transmission scheme for communication from charging stations to EVs. A testbed was built to validate the proposed network architecture. Experimental results show that the communication time delay is in the order of milliseconds and that the reliability is higher than 99.9%.

Enhancing the security of industrial embedded system is the core issue in the field of industrial information security. Only rely on the software security mechanism has been unable to fully protect the security of information, and the existing trusted platform module is designed for personal computer, can not meet the special needs of industrial embedded systems. Through the research of trusted computing technology, this paper designs an embedded trusted computing platform based on trusted platform module TPM, and from the software structure and hardware structure, the transmission mechanism of trusted platform module and trust chain is analyzed. Finally, the trusted verification is performed on the ZYNQ hardware platform, through the kernel forgery attack test, verify the correctness of the design, so as to ensure the security and reliability of industrial embedded platform.