Industrial Network Behavior Analysis Method, Apparatus and System, and Computer-Readable Medium

An industrial network behavior analysis apparatus comprising:

• a first identification module to define a first time window for a target industrial control system, wherein the first time window characterizes a time period for the target industrial control system to perform a corresponding control behavior;
• a deviation calculation module to respectively determine an execution probability deviation of each control instruction within each first time window defined by the first identification module, wherein the execution probability deviation characterizes the fluctuation of the execution probability of the corresponding control instruction, and the execution probability characterizes the ratio of the number of times the corresponding control instruction is executed within a time period to the total number of times the control instruction is executed within the time period;
• an instruction collection module to collect the control instruction executed in the target industrial control system;
• a second identification module to define a second time window according to the control instruction collected by the instruction collection module, wherein the second time window characterizes a time period when the target industrial control system performs the corresponding control behavior, and the control behavior performed by the target industrial control system in the second time window is the same as that performed in the first time window;
• a probability calculation module to, for each second time window defined by the second identification module, calculate the execution probability of a control instruction in the second time window for each of the control instructions executed in the second time window;
• a probability comparison module to, for each second time window defined by the second identification module, for each of the control instructions executed in the second time window, determine whether the execution probability of the control instruction calculated by the probability calculation module meets a target execution probability deviation, wherein the target execution probability deviation is the execution probability deviation of the control instruction in the first time window corresponding to the same control behavior in the second time window as calculated by the deviation calculation module;
• and
• a first analysis module to, based on the result of the probability comparison module, determine that a control instruction is a legal control instruction if the execution probability of the control instruction meets the target execution probability deviation, and that a control instruction is a suspicious control instruction if the execution probability of the control instruction does not meet the target execution probability deviation.