Cross-domain collaborative zero-trust model for industrial Internet to counter APT data theft

doi:10.3969/j.issn.1671-1122.2026.08.005

Abstract

Abstract:

With the increasing integration of information technology and industrial control systems, advanced persistent threat (APT) have caused increasingly severe sensitive data leaks in the industrial Internet. However, current APT theft defenses have mainly focused on the information technology (IT) domain of the industrial Internet, neglecting cross-domain threats that penetrate into the operational technology (OT) domain after bypassing IT domain defenses. To address this challenge, this paper proposed a cross-domain collaborative zero-trust model for industrial Internet to counter APT data theft. First, a deployment scheme for cross-domain collaborative software defined perimeter (SDP) zero-trust components was designed to simultaneously monitor behavioral data from both IT and OT domains, thereby avoiding missed threat detection caused by insufficient data from a single domain, the behavioral data were normalized and feature-processed to construct a differentiated dynamic trust assessment model. After that, the BiLSTM-MultiHead Attention model was introduced to capture the temporal dependencies of APT cross-domain behaviors, and a mutation factor prediction scheme was developed to enable rapid responses to compromised terminal behaviors and dynamic adjustments of trust values. Furthermore, a cross-domain collaborative decision-making and compromise detection algorithm was designed to identify and promptly block compromised terminals. Experimental results show that the proposed model demonstrates better collaborative defense performance against APT cross-domain threats on the CMU-CERT dataset, with a mutation factor prediction precision of 99.81%, enabling effective identification of compromised terminals.

Key words: industrial Internet, APT data theft, SDP, differentiated dynamic trust assessment

CLC Number:

TP309

Feng Jingyu, Yin Jingyi, Zhang Senyong, Li Jinghui. Cross-domain collaborative zero-trust model for industrial Internet to counter APT data theft[J]. Netinfo Security, 2026, 26(8): 1224-1236.

Figures/Tables 23

References 25

[1]	王灏楠. 工业物联网网关系统设计与实现[D]. 天津: 天津大学, 2020.
[2]	祝剑, 杨珍娜, 庞龙, 等. 基于区块链的工业互联网数据溯源方案[J]. 西安邮电大学学报, 2022, 27(2):102-110.
[3]	Shi Yuanquan, Li Wei, Zhang Yu, et al. Survey on APT attack detection in industrial cyber-physical system[C]// 2021 International Conference on Electronic Information Technology and Smart Agriculture(ICEITSA). New York: IEEE, 2021: 296-301.
[4]	Brown T. The rising threat of cyberattacks on industrial systems[J]. Global Security Journal, 2022, 8(4): 120-135.
[5]	赵新强, 范博, 张东举. 基于威胁发现的APT攻击防御体系研究[J]. 信息网络安全, 2024, 24(7):1122-1128.
[6]	Kumar A, Thing V L L. RAPTOR: advanced persistent threat detection in industrial IoT via attack stage correlation[C]// The 20th Annual International Conference on Privacy, Security and Trust (PST). New York: IEEE, 2023: 1-12.
[7]	Liu Han, An Baoyu, Yin Yaoyao, et al. A trust evaluation and concept drift-based approach for dynamic APT evasion detection[C]// 2024 IEEE Cyber Science and Technology Congress (CyberSciTech). New York: IEEE, 2024: 544-547.
[8]	邢方圆, 董傲, 孙羽羿, 等. 面向大规模物联网的零信任管理研究综述[J]. 电子学报, 2025, 53(8):2993-3025.
[9]	Rose S, Borchert O, Mitchell S, et al. Zero trust architecture: NIST Special Publication 800-207[R]. 2020-08: 1-59.
[10]	Fernandez E B, Brazhuk A. A critical analysis of zero trust architecture (ZTA)[EB/OL]. (2024-01-09)[2026-01-04]. https://doi.org/10.1016/j.csi.2024.103832.
[11]	Smiliotopoulos C, Kambourakis G, Kolias C. Detecting lateral movement: a systematic survey[EB/OL]. (2024-02-15)[2026-01-04]. https://doi.org/10.1016/j.heliyon.2024.e26317.
[12]	Khule M, Motwani D, Chauhan D. Adaptive threat intelligence: an incremental learning approach for detecting evolving APT attacks[C]// International Conference on Advances in Modern Age Technologies for Health and Engineering Science (AMATHE). New York: IEEE, 2025: 1-6.
[13]	Zhang Xiaojian, Chen Liandong, FAN Jie, et al. Power IoT security protection architecture based on zero trust framework[C]// The 5th International Conference on Cryptography, Security and Privacy (CSP). New York: IEEE, 2021: 166-170.
[14]	吴克河, 程瑞, 姜啸晨, 等. 基于SDP的电力物联网安全防护方案[J]. 信息网络安全, 2022, 22(2):32-38.
[15]	陈长松. 零信任架构下的数据安全纵深防御体系研究[J]. 信息网络安全, 2021, 21(S1):105-108.
[16]	袁忠, 王勇, 张成. 零信任SDP技术在云桌面系统中的研究与应用[J]. 网络安全技术与应用, 2025, 25(10):82-86.
[17]	马宁. 工业过程控制中的PLC与SCADA系统集成优化[J]. 自动化应用, 2023, 64(21):54-56.
[18]	黄杰, 何城鋆. 基于软件定义边界的服务保护方案[J]. 信息网络安全, 2023, 23(6):1-10.
[19]	许盛伟, 田宇, 邓烨, 等. 基于零信任的大规模车联网安全模型研究[J]. 物联网技术, 2023, 13(10):80-82.
[20]	夏凡, 马骏文, 薛虎虎, 等. 基于多模型融合深度学习算法的文本情感分析模型[J]. 西安邮电大学学报, 2025, 30(5):85-91.
[21]	Chen Genwen, Zhou Qingfei, Huang Jie, et al. A multidimensional trust assessment method for zero trust dynamic access control[C]// The 40th Youth Academic Annual Conference of Chinese Association of Automation (YAC). New York: IEEE, 2025: 3170-3176.
[22]	冯景瑜, 王锦康, 张宝军, 等. 基于信任过滤的轻量级加密流量异常检测方案[J]. 西安邮电大学学报, 2023, 28(5):56-66.
[23]	Glasser J, Lindauer B. Bridging the gap: a pragmatic approach to generating insider threat data[C]// IEEE Security and Privacy Workshops. New York: IEEE, 2013: 98-104.
[24]	Wang Zhiqiang, El S A. DTITD: an intelligent insider threat detection framework based on digital twin and self-attention based deep learning models[J]. IEEE Access, 2023, 11: 114013-114030.
[25]	Tao Xiaoling, Liu Jianxiang, Yu Yuelin, et al. An insider threat detection method based on improved test-time training model[EB/OL]. (2025-01-14)[2026-01-04]. https://www.sciencedirect.com/science/article/pii/S2667295224000862.

模型	零信任引入	信任评估	突发行为阻断	跨域防御
文献[6]模型	不支持	不支持	不支持	支持
文献[7]模型	不支持	动态	不支持	不支持
文献[12]模型	支持	不支持	不支持	不支持
文献[13]模型	支持	支持	不支持	不支持
文献[14]模型	支持	动态	及时阻断	不支持
本文模型	支持	动态	及时阻断	支持

实验环境	环境配置
操作系统	Windows 10 操作系统
系统类型	64位操作系统
CPU	Intel? Core(TM) Ultra 9 CPU @2.90 GHz
内存大小	32.00 GB
开发环境	PyCharm
深度学习框架	PyTorch
编程语言	Python 3.9
依赖库	numpy、matplotlib、pandas、Polars等

参数	描述	预设值
T	仿真轮数	60
N	工业互联网终端数	1000
M	失陷终端比例	30%

特征类别	特征
Logon特征	首次登录与工作起始时间（8:00）的差值
	末次登录与工作起始时间的差值
	下班后登录时间相对8:00的平均偏移
	下班后登录时间相对19:00的平均偏移
	下班后（19:00后）登录次数
	每日访问的终端数量
	下班后访问的终端数量
	下班后会话时长总和
Email特征	外部收件人数量
	保留占位特征
	未使用附件总数
	平均邮件大小占比
	总收件人数量
HTTP特征	统计访问敏感站点的次数
File特征	每日.exe文件操作次数
Device特征	下班后设备连接次数
Device特征	每日设备总连接次数

模型	AUC	P	R	F1
RNN	84.29%	88.51%	84.29%	84.18%
LSTM	90.97%	92.68%	90.97%	91.08%
Transformer	96.19%	96.55%	96.10%	96.18%
BiLSTM-MultiHead Attention	99.79%	99.81%	99.79%	99.80%