Unit communication method and system

Abstract

The invention provides a unit communication method and system, the method is applied to a unit communication system, after receiving encrypted data transmitted by any unit access device, a system access device can perform decryption processing according to a security encryption protocol between the system access device and the unit access device to obtain corresponding decrypted data, and the decrypted data are sent to the unit communication system. And then analyzing and processing the decrypted data by adopting a pre-obtained attack identification model, determining whether the corresponding communication link is abnormally attacked, if the corresponding communication link is determined to be abnormally attacked, synchronizing to intelligent terminal equipment of a user through an exception indication message, and in real time based on the characteristic change generated after the transmission data is attacked, sending the data to the intelligent terminal equipment of the user. The attacked link is identified and synchronized to the user, so that the attacked link can be safely processed in time, the communication safety of the unit in the intelligent factory is ensured, and the serious influence caused by the fact that confidential data leakage is not found in time is avoided.

Description

Technical Field

[0001] The present application relates to the technical field of Internet of Things, and in particular to a machine unit communication method and system. Background Art

[0002] With the improvement of industrialization level and the rapid development of technologies such as artificial intelligence, it has become a trend to equip production enterprises with various advanced units and equipment to achieve efficient and automated production processes.

[0003] In today's smart factories, various advanced units are often equipped with automated production lines, intelligent warehousing systems, Internet of Things equipment, intelligent control systems, etc. However, these units need to communicate with the network or the server of the control center during the daily coordination and generation process. Due to hardware, software, network topology and other reasons, the communication process is vulnerable to external attacks and is not easy to detect in the routine production process, resulting in the paralysis of the unit communication system or data leakage.

[0004] To sum up, how to solve the communication security of units in smart factories has become an urgent problem to be solved. Summary of the invention

[0005] The present application provides a unit communication method and system to solve the communication security of units in smart factories, which has become an urgent problem to be solved.

[0006] In a first aspect, the present application provides a unit communication method, which is applied to a unit communication system, wherein the unit communication system includes a system access device, a plurality of unit access devices that respectively establish communication channels with the system access device through a secure encryption protocol, and an intelligent terminal device, wherein the method includes:

[0007] After receiving the first encrypted data transmitted by any unit access device, the system access device decrypts the first encrypted data based on the security encryption protocol between the system access device and the unit access device to obtain first decrypted data;

[0008] The system access device uses the pre-acquired attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and determines whether the communication link between the system access device and each unit access device is attacked abnormally; wherein the attack identification model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm;

[0009] The system access device sends a first abnormal indication message to the intelligent terminal device for at least one target unit access device of a communication link that is abnormally attacked, wherein the first abnormal indication message carries an identifier of each target unit access device.

[0010] In a specific embodiment, the method further comprises:

[0011] For any unit access device, after the unit access device receives the second encrypted data transmitted by other unit access devices or the system access device, the second encrypted data is decrypted based on the security encryption protocol between the other party to obtain second decrypted data;

[0012] The unit access device uses a pre-configured attack identification model to perform abnormal attack identification on the second decrypted data to determine whether the communication link transmitting the second encrypted data is abnormally attacked;

[0013] If it is determined that the communication link for transmitting the second encrypted data is attacked abnormally, the unit access device reports an abnormal attack message to the system access device, wherein the abnormal attack message includes an identifier of the unit access device involved in the communication link for transmitting the second encrypted data;

[0014] After receiving the abnormal attack message, the system access device sends a second abnormal indication message to the intelligent terminal device, wherein the second abnormal indication message carries an identifier of a unit access device involved in a communication link for transmitting the second encrypted data.

[0015] In a specific implementation manner, the system access device uses a preset attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and before determining whether the communication link between the system access device and each unit access device is attacked abnormally, the method further includes:

[0016] Acquire a network intrusion data set, wherein the network intrusion data set includes a plurality of normal data, a plurality of DOS attack data, a plurality of probe attack data, a plurality of U2R attack data, and a plurality of RL2 attack data;

[0017] Performing feature extraction processing on each data in the network intrusion data set to extract multiple data features corresponding to each data;

[0018] Calibrate each data in the network intrusion data set, and calibrate a label corresponding to each data, wherein the label includes normal or attack;

[0019] Based on the network intrusion data set, multiple features and labels corresponding to each data, construct a training data set;

[0020] Training the pre-acquired initial classification model according to the training data set to obtain the attack recognition model;

[0021] The attack identification model is configured in each unit access device respectively.

[0022] In a specific implementation, the training of the pre-acquired initial classification model according to the training data set to obtain the attack identification model includes:

[0023] Splitting the training data set into a training set and a test set according to a preset ratio;

[0024] The initial classification model is trained according to the training set, and during the training process, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized to obtain a trained attack recognition model;

[0025] The trained attack test model is tested according to the test set to obtain the final attack recognition model.

[0026] In a specific implementation, the initial classification model is trained according to the training set, and during the training process, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized to obtain a trained attack recognition model, including:

[0027] Initialize the population size, search range and maximum number of iterations of the swarm intelligence optimization algorithm to obtain an initial population set, wherein each individual in the initial population set is a set of parameter combinations of the classification model, and the parameter combination includes a learning rate, a minimum loss function descent value and a minimum leaf node weight;

[0028] Randomly assigning a location and direction for searching for food to each individual in the initial population set, and updating the location information of each individual;

[0029] The parameter combination corresponding to each individual is respectively configured in the classification model, and the configured classification model is used to classify and identify the samples in the sample set, and the concentration judgment value corresponding to each configured classification model is calculated according to a preset concentration judgment function, and based on the concentration judgment value corresponding to each configured classification model, a target individual with the highest concentration judgment value is selected, and the position of the target individual is used as the target position, and other individuals are moved to the position of the target individual, and the position information of each individual is re-updated, and this step is repeated until the maximum number of iterations is reached to obtain a target population set;

[0030] The learning rate, the minimum loss function descent value and the minimum leaf node weight corresponding to the target individual with the highest concentration judgment value in the target population set are configured in the classification model to obtain a classification model after parameter optimization;

[0031] The parameter-optimized classification model is trained according to the training set to obtain the attack recognition model.

[0032] In a specific embodiment, the method further comprises:

[0033] During the parameter optimization process, the concentration judgment value of the classification model corresponding to each individual is calculated based on the distance between the updated position information of each individual and the coordinate origin.

[0034] In a specific implementation manner, after receiving the encrypted data transmitted by any unit access device, the system access device decrypts the first encrypted data based on the security encryption protocol between the system access device and the unit access device, and before obtaining the decrypted data, the method further includes:

[0035] For each unit access device, the system access device selects a target security encryption protocol between the system access device and the unit access device based on the network environment and security requirements between the system access device and the unit access device;

[0036] The system access device performs a security negotiation process with the unit access device according to the target security encryption protocol to determine a session key;

[0037] Correspondingly, the decrypting of the first encrypted data based on the security encryption protocol between the unit access device to obtain the decrypted data includes:

[0038] The first encrypted data is decrypted based on the session key corresponding to the unit access device to obtain the first decrypted data.

[0039] In a specific implementation, the system access device includes a system access base station or a system control server;

[0040] The multiple unit access devices include: computer equipment of the unit, access router of the unit, server of the unit and industrial robot.

[0041] In a second aspect, the present application provides a crew communication system, comprising:

[0042] System access equipment, multiple unit access equipment and intelligent terminal equipment;

[0043] The system access device and the plurality of unit access devices respectively establish communication channels through a secure encryption protocol;

[0044] The system access device is used to: after receiving the first encrypted data transmitted by any unit access device, decrypt the first encrypted data based on the security encryption protocol between the unit access device and the unit access device to obtain the first decrypted data; use the pre-acquired attack recognition model to perform abnormal attack recognition on the first decrypted data corresponding to each unit access device, and determine whether the communication link between the system access device and each unit access device is attacked abnormally; wherein the attack recognition model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm;

[0045] For at least one target unit access device of a communication link that is abnormally attacked, a first abnormal indication message is sent to the intelligent terminal device, wherein the first abnormal indication message carries an identifier of each target unit access device;

[0046] Any unit access device is used to: after receiving the second encrypted data transmitted by other unit access devices or the system access device, decrypt the second encrypted data based on the security encryption protocol between the other party to obtain the second decrypted data; use the pre-configured attack recognition model to perform abnormal attack recognition on the second decrypted data to determine whether the communication link transmitting the second encrypted data is attacked abnormally;

[0047] If it is determined that the communication link for transmitting the second encrypted data is abnormally attacked, an abnormal attack message is reported to the system access device, wherein the abnormal attack message includes an identifier of the unit access device involved in the communication link for transmitting the second encrypted data;

[0048] The system access device is also used to: after receiving the abnormal attack message, send a second abnormal indication message to the intelligent terminal device, and the second abnormal indication message carries the identifier of the unit access device involved in the communication link for transmitting the second encrypted data.

[0049] In a third aspect, the present application provides an electronic device, including:

[0050] Memory, processor and communication interface;

[0051] The memory is used to store computer-executable instructions;

[0052] The processor is used to execute the computer execution instruction to implement the unit communication method described in any one of the first aspects.

[0053] The present application provides a unit communication method and system, which is applied to a unit communication system, including a system access device, multiple unit access devices that respectively establish communication channels with the system access device through a secure encryption protocol, and an intelligent terminal device. In this scheme, after receiving encrypted data transmitted by any unit access device, the system access device can perform decryption processing according to the secure encryption protocol between the system access device and the unit access device to obtain corresponding decrypted data, and then use a pre-obtained attack identification model to analyze and process the decrypted data to determine whether the corresponding communication link has been attacked abnormally. If it is determined that it has been attacked abnormally, the intelligent terminal device synchronized to the user through an abnormal indication message can identify the attacked link in real time based on the characteristic changes that occur after the transmission data itself is attacked, and synchronize it to the user, so that the attacked link can be securely processed in time, thereby ensuring the communication security of the units in the smart factory and avoiding the serious impact caused by the leakage of confidential data that is not discovered in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0055] Figure 1 A schematic diagram of an architecture based on a unit communication system provided for this application;

[0056] Figure 2 A flow chart of a first embodiment of a unit communication method provided in an embodiment of the present application;

[0057] Figure 3 A flow chart of a second embodiment of the unit communication method provided in the embodiment of the present application;

[0058] Figure 4 A flow chart of a third embodiment of the unit communication method provided in the embodiment of the present application;

[0059] Figure 5 A structural diagram of a first embodiment of a communication device for a machine group provided in an embodiment of the present application;

[0060] Figure 6 A schematic diagram of the structure of a second embodiment of a communication device for a machine group provided in an embodiment of the present application;

[0061] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0062] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0063] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0064] As the core area of ​​intelligent manufacturing, smart factories have developed rapidly around the world in recent years. Based on digital factories, smart factories use emerging technologies such as the Internet of Things, monitoring technology, and intelligent means to build an efficient, energy-saving, green, environmentally friendly, comfortable and humanized factory environment, realizing the automation, digitization and intelligence of the production process, significantly improving production efficiency, reducing costs and promoting industrial upgrading. They are widely used in many industries such as machinery manufacturing, automobile manufacturing, and electronic devices.

[0065] Smart factories are often equipped with various advanced units such as automated production lines, smart warehousing systems, IoT devices, and smart control systems. However, these units must communicate with the network or the server in the control center during daily production. The communication process is vulnerable to external attacks. The attack problem cannot be discovered in time during the routine production process, resulting in the paralysis of the unit communication system or data leakage.

[0066] In view of the above problems, the present invention aims to solve the above-mentioned problem of safe communication by developing a unit communication method and system, and at the same time overcome the defects of the prior art in terms of system aggregation, data utilization efficiency, parameter system rapid scheduling optimization mechanism and noise processing. In particular, the present invention aims to use a swarm intelligence optimization algorithm to optimize the classification model to obtain an attack identification model to achieve status monitoring of the unit communication system, which not only makes the system unified and flexible access network architecture and centralized communication control and management, but also the intelligent fault diagnosis and repair mechanism can automatically discover and solve communication failures, reduce manual intervention and downtime, and reduce operation and maintenance costs. Of course, the system also enhances the generalization and adaptability of the model in different environments and unit states, and at the same time enhances the ability to filter noise and outliers in the data, and finally forms a deterministic unit communication system with elastic channels, high security, low latency, flexible adaptation and centralized control.

[0067] The unit communication system and method provided by the present invention are briefly introduced below through several specific embodiments.

[0068] Figure 1A schematic diagram of the architecture of a unit communication system provided in this application, such as Figure 1 As shown, the unit communication system at least includes: a system access device, multiple unit access devices and a smart terminal device. The system access device and the multiple unit access devices respectively establish communication channels through a secure encryption protocol. The system access device and the smart terminal device establish a communication connection through a wireless method, and a notification message can be pushed to the smart terminal device.

[0069] In this solution, the system access device can be a system access base station or a system control server and other devices; multiple unit access devices include: computer equipment of the unit, access router of the unit, server of the unit and industrial robot and the like.

[0070] In smart factories, industrial robots are robots used to perform various industrial tasks to improve production efficiency and reduce costs, including but not limited to handling robots, welding robots, assembly robots, inspection robots, collaborative robots, sorting robots, etc. This solution does not impose any restrictions on this.

[0071] The units in the smart factory include but are not limited to production and processing units, control system units, detection and monitoring system units, energy management units, environmental protection and safety system units, etc. The computer equipment of some units is directly included in the units, and some units need to be controlled and managed through special control equipment. The computer equipment of the units designed in this solution refers to the control equipment or computer equipment that controls the units. This solution does not limit the specific equipment form.

[0072] In this solution, the main function of the smart terminal device is to receive the attack detection results transmitted by the system access device, and it needs to push and display them to the user. Therefore, the smart terminal device must at least have communication function and display interface or voice output function, such as: mobile phones, computers, tablets, wearable devices, industrial terminals, etc. This solution does not limit the specific device form.

[0073] Based on the above-mentioned unit communication system, the implementation process of the unit communication method provided by the present application is described in detail below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0074] Figure 2 A flow chart of a first embodiment of a unit communication method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the unit communication method specifically includes the following steps:

[0075] S101: Any unit access device transmits first encrypted data to the system access device.

[0076] In this step, during the production or operation of the smart factory, any unit access device needs to cooperate with the unit's work to upload production data, maintenance data and other data to the factory's system access device, that is, the system server or system management device. The system access device here plays the role of data aggregation and processing and analysis.

[0077] Since a secure communication channel is established between each unit access device and the system equipment through a secure encryption protocol when establishing the communication system provided in the present application, the data transmitted between the devices is encrypted according to the secure encryption protocol corresponding to the link.

[0078] S102: After receiving the first encrypted data transmitted by any unit access device, the system access device decrypts the first encrypted data based on the security encryption protocol between the system access device and the unit access device to obtain first decrypted data.

[0079] In this step, the data transmission between the system access device and the unit access device may involve key operating instructions, and unencrypted data can be easily intercepted, tampered with or stolen during the transmission process, thereby causing safety hazards to the unit system. Therefore, when establishing the communication system provided by this application, a secure communication channel is established between each unit access device and the system device through a secure encryption protocol. The data transmitted between each device is encrypted according to the secure encryption protocol corresponding to the link. Through decryption, the system access device can restore the original data content transmitted by the unit access device.

[0080] Data decryption is the reverse process of data encryption, that is, to restore the encrypted data to the original data through a specific algorithm and key. The decryption process needs to use the same algorithm and key as the encryption process. Encryption technology is mainly divided into symmetric encryption and asymmetric encryption, so the decryption method is also divided into symmetric decryption and asymmetric decryption. In symmetric encryption, the same key is used for encryption and decryption, and the process is relatively simple. The original data can be restored by using the same key through the corresponding algorithm; in asymmetric encryption, a pair of public and private keys are required for encryption and decryption. The public key is used to encrypt data, and the private key is used to decrypt data. Since the public key can be made public, the private key is generated by the public key during the encryption process. Anyone can use the public key to encrypt, but only those who have the private key can decrypt the data, which provides higher security.

[0081] In a specific implementation, for each unit access device, a suitable target security encryption protocol is selected based on the network environment and security requirements between the system access device and the unit access device; the system access device performs security negotiation with the unit access device based on the target security encryption protocol to determine the session key.

[0082] In a possible implementation of the scheme, a suitable target security encryption protocol is selected according to the network environment and security requirements between the system access device and the unit access device. For example, if the network environment is relatively complex and high security is required, the system access device and the unit access device can select the Transport Layer Security (TLS) protocol as the target security encryption protocol. Through the TLS handshake process, the system access device and the unit access device negotiate to use a symmetric encryption algorithm, such as the AES (Advanced Encryption Standard, AES) encryption algorithm, and generate a session key through a key exchange algorithm based on elliptic curve cryptography (Elliptic Curve Diffie-Hellman Ephemeral, ECDHE). This session key is usually a 256-bit random number for subsequent data encryption transmission. If it is necessary to protect IP layer data transmission, the system access device and the unit access device can select Internet Key Exchange version 2 (IKEv2) in the Internet Protocol Security (IPSec) protocol as the target security encryption protocol for negotiation. The IKEv2 protocol generates a shared session key through the Diffie-Hellman key exchange algorithm. This session key can be a 128-bit or 256-bit random number to protect subsequent IP data packet transmission. If you need to remotely log in and manage the unit access device, the system access device and the unit access device can choose the Secure Shell (SSH) protocol as the target security encryption protocol. When establishing a connection, the SSH protocol uses the Diffie-Hellman key exchange algorithm to generate a session key. This session key is usually a 256-bit random number used to encrypt subsequent communication data. In addition, the SSH protocol also uses a hash-based Message Authentication Code (HMAC) to ensure data integrity and authenticity.

[0083] Specifically, the session key corresponding to the unit access device is used to decrypt the first encrypted data to obtain the first decrypted data. This not only ensures the security and integrity of data transmission, but also improves the reliability and stability of the unit system, supports real-time monitoring and management, optimizes the production process, and thus improves overall production efficiency.

[0084] S103: The system access device uses the pre-acquired attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and determines whether the communication link between the system access device and each unit access device is attacked abnormally. The attack identification model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm.

[0085] In this step, although encryption technology plays an important role in protecting data transmission, it cannot completely prevent all types of attacks. By identifying attacks on decrypted data, encryption technology can be prevented from being bypassed, internal threats can be detected, complex attack patterns can be identified, data integrity can be ensured, and multi-level security protection can be provided, thereby further ensuring the security and stability of the system.

[0086] The attack identification model uses a swarm intelligence optimization algorithm to optimize the training of the classification model. The swarm intelligence optimization algorithm has strong global search capabilities, adaptability, and parallel processing capabilities. It can find the global optimal solution in a complex search space and avoid falling into the local optimal solution. At the same time, it can dynamically adjust the search strategy to adapt to different optimization problems and environmental changes, and improve the generalization and robustness of the model. In addition, the swarm intelligence optimization algorithm can process multiple candidate solutions in parallel, use distributed computing resources to accelerate the optimization process, and improve training efficiency.

[0087] Specifically, the system access device uses the attack identification model to identify abnormal attacks on the first decrypted data corresponding to each unit access device. The attack identification model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm to determine whether the communication link between the system access device and each unit access device is attacked abnormally. This helps to provide the overall stability of the unit system, and by quickly identifying and handling abnormal situations, it reduces communication mid-segment and equipment failures caused by attacks, ensuring the continuity and reliability of the production process.

[0088] S104: The system access device sends a first abnormal indication message to the intelligent terminal device for at least one target unit access device whose communication link is identified to be abnormally attacked. The first abnormal indication message carries the identifier of each target unit access device.

[0089] In this step, the system access device sends an abnormal indication message of the determined unit access device to the smart terminal device for the target unit access device of the communication link that is attacked abnormally. The identification of each target unit access device carried in the abnormal indication message usually includes a unique identifier, such as the ID of the unit access device, the device location, the device type and other key information.

[0090] Specifically, the system access device uses the attack identification model to identify abnormal attacks on the first decrypted data corresponding to each unit access device, and sends an abnormal indication message with the identification of the determined unit access device to the smart terminal device for the target unit access device of the communication link that is attacked abnormally. These identification information helps users quickly locate and identify the attacked target unit access device, which is convenient for subsequent security processing and maintenance. By sending abnormal indication messages in real time, real-time abnormal monitoring and rapid response are achieved, ensuring that users can understand the security status of the unit system in a timely manner and take corresponding measures, such as isolating the attacked unit access device, checking and repairing vulnerabilities, updating security policies, etc., to prevent the spread of attacks and further damage, thereby reducing security risks and ensuring the normal operation of the system.

[0091] In the unit communication method provided in this embodiment, after receiving the encrypted data transmitted by any unit access device, the system access device performs decryption processing according to the security encryption protocol between the system access device and the unit access device to obtain the first decrypted data. Then, the first decrypted data is identified for abnormal attacks using a pre-obtained attack identification model to determine whether the communication link transmitting the first encrypted data is attacked abnormally. Finally, the system access device synchronizes the unit access device of the communication link that is identified to be attacked abnormally to the user's smart terminal device through an abnormal indication message. Through the above method, real-time abnormal monitoring and rapid response are achieved, ensuring that the user can perform security processing on the attacked link in a timely manner, ensuring the communication security of the units in the smart factory, and avoiding the serious impact caused by the leakage of confidential data that is not discovered in time.

[0092] Figure 3 A flow chart of the second embodiment of the unit communication method provided in the present application is shown in FIG. Figure 3 As shown, unlike the above embodiment in which the system access device analyzes the received data, the system access device also transmits data to the unit access device, and the unit access devices also transmit data as needed. In this case, the unit access device at the receiving end performs attack identification on the received data. In another implementation of the unit communication method, the following steps are specifically included:

[0093] S201: Any other unit access device or system access device transmits second encrypted data to the unit access device.

[0094] In this step, during the production or operation of the smart factory, the system access device will also transmit data to the unit access device, and the unit access devices will also transmit data as needed. In this case, there is two-way communication and collaboration between the system access device and the unit access device. The system access device is not only the center of data aggregation and processing analysis, but also plays the role of data distribution and command issuance. The system access device will transmit the necessary information, instructions or adjustment parameters back to each unit access device based on the analysis results or the preset production plan to optimize the production process or perform maintenance operations.

[0095] When establishing the unit communication system provided in the present application, a secure communication channel is established between the unit access device and the system access device, and between the unit access device and the unit access device through a secure encryption protocol. Therefore, the data transmitted between the devices is encrypted according to the security protocol corresponding to the link.

[0096] S202: After the unit access device receives the second encrypted data transmitted by other unit access devices or system access devices, the second encrypted data is decrypted based on the security encryption protocol between the other party to obtain second decrypted data.

[0097] In this step, data transmission between the system access device and the unit access device and between the unit devices and the unit access devices may involve key operating instructions, and unencrypted data can be easily intercepted, tampered with or stolen during transmission, resulting in security risks in the unit communication system. Therefore, when establishing the unit communication system provided by this application, a secure communication channel is established between the unit access device and the system access device and between the unit access device and the unit access device through a secure encryption protocol. Therefore, the data transmitted between the devices is encrypted according to the security protocol corresponding to the link. Through decryption, the system access device and the unit access device at the receiving end can restore the original data content transmitted by the unit access device.

[0098] The specific decryption principle and process are similar to the principle and process of any unit access device transmitting the first encrypted data to the system access device and decrypting the first encrypted data, and will not be repeated here.

[0099] S203: The unit access device uses a pre-configured attack identification model to perform abnormal attack identification on the second decrypted data to determine whether the communication link transmitting the second encrypted data is attacked abnormally.

[0100] In this step, the unit access device uses a pre-configured attack model to identify abnormal attacks on the second decrypted data. The principle and attack identification process for determining whether the communication link for transmitting the second encrypted data is attacked abnormally are similar to the principle and attack identification process for the system access device to use a pre-configured total identification model to identify abnormal attacks on the first decrypted data. The principle and attack identification process for determining whether the communication link for transmitting the first encrypted data is attacked abnormally are similar, and will not be repeated here.

[0101] S204: If it is determined that the communication link for transmitting the second encrypted data is attacked abnormally, the unit access device reports an abnormal attack message to the system access device, wherein the abnormal attack message includes an identifier of the unit access device involved in the communication link for transmitting the second encrypted data.

[0102] In this step, since the system access device plays the role of central control and data processing in the network architecture of the entire smart factory, it has stronger computing power and higher authority, can aggregate, analyze and make decisions on data, and is responsible for managing the communication and data flow of the entire factory; the unit access device is mainly responsible for collecting and uploading production data, maintenance data, etc., with relatively limited functions and permissions, mainly focusing on the processing and uploading of local data. Therefore, the system access device has the authority and ability to send messages to the smart terminal to ensure the accuracy and security of information transmission.

[0103] Specifically, in order to ensure the security and stability of the entire system, the unit access device first reports the abnormal attack message to the system access device, and then the system access device sends the abnormal attack message to the intelligent terminal device. Among them, the abnormal attack message contains the identifier of the unit access device involved in the communication link for transmitting the second encrypted data. The meaning and function of the identifier are similar to the meaning and function of the identifier of each target unit access device carried in the first abnormal indication message, and will not be repeated here.

[0104] S205: After receiving the abnormal attack message, the system access device sends a second abnormal indication message to the intelligent terminal device. The second abnormal indication message carries the identifier of the unit access device involved in the communication link for transmitting the second encrypted data.

[0105] In this step, the system access device receives an abnormal attack message and sends a second abnormal indication message carrying the identification of the unit access device involved in the communication link that transmits the second encrypted data to the smart terminal device. The principle and function of this message are similar to the principle and function of the system access device sending the first abnormal indication message carrying the identification of the unit access device involved in the communication link that transmits the first encrypted data to the smart terminal device, and will not be repeated here.

[0106] The unit communication method provided in this embodiment is that after the unit access device receives the encrypted data transmitted by any other unit access device or system access device, it performs decryption processing according to the security encryption protocol between the unit access device and any other unit access device or system access device to obtain the second decrypted data. Then, the pre-selected attack recognition model is used to identify abnormal attacks on the second decrypted data to determine whether the communication link transmitting the second encrypted data is attacked abnormally. If it is determined that the communication link transmitting the second encrypted data is attacked abnormally, the unit access device reports the abnormal attack message to the system access device. Finally, the system access device synchronizes the abnormal indication message to the user's smart terminal device. Through the above method, real-time abnormal monitoring and rapid response are achieved, ensuring that the user can perform security processing on the attacked link in a timely manner, ensuring the communication security of the unit in the smart factory, and avoiding the serious impact caused by the leakage of confidential data that is not discovered in time.

[0107] Figure 4 The flowchart of the third embodiment of the communication method for the machine group provided in the embodiment of the present application is as follows: Figure 4 As shown, based on the above embodiment, in step 103, the system access device uses a preset attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and before determining whether the communication link between the system access device and each unit access device is attacked abnormally, the unit communication method also includes:

[0108] S301: Acquire a network intrusion data set, where the network intrusion data set includes a plurality of normal data, a plurality of DOS attack data, a plurality of probe attack data, a plurality of U2R attack data, and a plurality of RL2 attack data.

[0109] In this step, firstly, the 10% KDD Cupp99 network intrusion data set is obtained to the storage device of the unit access device through operations such as user security authentication. The 10% KDD Cupp99 network intrusion data set contains various types of network traffic, including normal traffic and various types of intrusion traffic. Each data point includes various characteristics about the network connection, such as the duration of the connection, service type, source and destination addresses, transport layer protocol, flags, etc.

[0110] Specifically, the 10% KDD Cupp99 network intrusion dataset contains 97,278 normal network data, 391,458 DOS attack data, 4,107 Probe attack data, 52 U2R attack data, and 1,126 R2L attack data. Each data contains 41-dimensional features, providing a benchmark test dataset for the subsequent construction of attack recognition models.

[0111] S302: Perform feature extraction processing on each data in the network intrusion data set to extract multiple data features corresponding to each data.

[0112] In a specific implementation, the acquired data is preprocessed based on the unit access device, and the preprocessing process includes but is not limited to operations such as data cleaning, feature encoding and normalization.

[0113] Specifically, in the data cleaning operation, 10% of the outliers and missing values ​​in the KDD Cupp99 network intrusion data set that may be caused by equipment failure and other reasons are deleted to improve the data quality and ensure the accuracy and reliability of subsequent data analysis and model training.

[0114] In the feature encoding operation, the 3-dimensional discrete features in the data set are the protocol type, the service type of the target host, and the connection status, and the remaining 38-dimensional discrete features are numerical features. In order to enable these discrete features to be processed by the machine learning model, the one-hot encoding method is used to convert these discrete features into binary vectors represented by numerical values, in which only one position is 1 and the rest are 0. For example, if the protocol type has three possible values, such as the Transmission Control Protocol (TCP) will be encoded as [1,0,0], the User Data Protocol (UDP) will be encoded as [0,1,0], and the Internet Control Message Protocol (ICMP) will be encoded as [0,0,1]. The one-hot encoding will convert the value of each protocol type into a binary vector of length 3, increasing the data dimension. In order to ensure that all data samples have the same dimension, the data is supplemented with 0 to expand the dimension, which is convenient for subsequent data input and processing.

[0115] In the normalization operation, in order to improve the convergence speed and learning ability of the subsequently constructed model, the data in the dataset is normalized, and each value x in the data is converted to a new value x' so that all data points fall within the range of 0 to 1. First, the minimum value x of the column is subtracted from the original value x. min , change the minimum value of the column to 0. Then, divide the difference by the difference between the maximum and minimum values ​​of the column x max -x min , the maximum value of the column is changed to 1. Through this process, all data points are linearly scaled to between 0 and 1, maintaining the relative distribution of the data.

[0116] Through a series of preprocessing operations, the data quality is improved, thereby improving the analysis and prediction effects and enhancing the stability and reliability of the model.

[0117] Feature extraction is performed on each data in the network intrusion dataset to extract multiple data features corresponding to each data, so that the subsequent machine learning model can better perform tasks such as classification and regression. This is crucial to improving the accuracy of the model and enhancing the generalization ability of the model.

[0118] Specifically, the Pandas library is used in Python to read, process and convert the data in the CSV file, and then the SlectKBest method in the scikit-learn library and the PySpark framework are used to select multiple important features, including but not limited to source IP address, destination IP address, source port, destination port, protocol type, traffic size, connection duration, flag bit, service type, etc. These features reduce the data dimension and computational complexity, making model training and prediction more efficient, thereby improving the accuracy and generalization ability of the model.

[0119] S303: Calibrate each data in the network intrusion data set and calibrate the label corresponding to each data, where the label includes normal or attack.

[0120] In this step, calibrating each data in the network intrusion dataset and assigning a normal or attack label to each data is a key step to ensure network security and the effectiveness of the machine learning model. By calibrating the data, a supervised learning environment can be created, allowing the machine learning algorithm to learn and identify the difference between normal behavior and attack behavior, so as to make accurate classifications later. This calibration not only improves the accuracy and reliability of the model, but also reduces the false alarm rate and missed alarm rate, making the network security system more efficient and reliable. In addition, the calibration dataset can also be used to evaluate and verify the performance of the model. By comparing the model's prediction results with the actual labels, the model's performance indicators such as accuracy and recall rate are calculated to further optimize the model.

[0121] S304: Based on the network intrusion data set, multiple features and labels corresponding to each data, a training data set is constructed.

[0122] In this step, based on the multiple features and labels corresponding to each data in the 10% KDD Cupp99 network intrusion dataset, the extracted features and corresponding labels are combined to construct a training data set. Usually, this data will be stored in a CSV file, JSON file, or database for subsequent analysis and model training. Building a training data set helps evaluate and optimize model performance and ensure its effectiveness and reliability in practical applications.

[0123] S305: Train the pre-acquired initial classification model according to the training data set to obtain an attack recognition model.

[0124] In a specific implementation, splitting the training data set into a training set and a test set according to a preset ratio is a key step to ensure that the model can be effectively generalized, avoid overfitting, and optimize parameters. This not only improves the performance and accuracy of the model, but also enhances the reliability and stability of the model in practical applications. Specifically, 20% of the data in the training data set is randomly selected as the test set, and 80% of the data is used as the training set.

[0125] In a specific implementation, the initial classification model is trained according to the training set, and during the training process, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized to obtain a trained attack recognition model.

[0126] In this step, swarm optimization searches for the optimal solution by simulating swarm behaviors in nature, such as particle swarm optimization and genetic algorithms. The purpose of this is to find the optimal hyperparameter combination in the high-dimensional parameter space so that the model can perform well on both training data and test data. During the training process, the learning rate determines the pace at which the model updates the parameters. A too high learning rate may cause the model to oscillate around the optimal solution, while a too low learning rate may cause the training process to be too slow or fall into a local optimum. The minimum loss function descent value is a stopping condition used to determine whether the model has converged. If the loss function descent value is less than this threshold, the training will stop. The minimum leaf node is a parameter in the decision tree model, which is used to prevent the model from overfitting by limiting the minimum weight of the leaf node.

[0127] In this solution, the system access device uses the initial classification algorithm model to classify the normal data and intrusion data in the training set to achieve the purpose of training the model. This type of algorithm is usually a machine learning algorithm based on a gradient boosting decision tree. It builds a prediction model by integrating multiple weak learners (usually decision trees). The core idea is to gradually build a new tree to correct the errors of the previous tree, that is, the process from initializing the model to gradual optimization.

[0128] Specifically, before training the classification algorithm model, the model parameters are initialized, such as the number of trees, the depth of the tree, and the regularization parameter. Then, for each iteration, the prediction value of each sample and the first-order g of the loss function are calculated. i and the second-order derivative h i Then, the greedy method and the first and second order derivatives of the loss function are used to construct an optimal tree function to minimize the value of the objective function and update the predicted value of each sample.

[0129] Assuming that the classification algorithm model already has t-1 decision trees, the tth decision tree is expressed as:

[0130]

[0131] Where t is the number of trees (the default model contains 100 trees, the maximum depth of the tree is 6, the proportion of random sampling and the proportion of columns of each tree are 1, and the maximum step length of each tree weight change is 1). represents the predicted value of the t-th decision tree, represents the sum of all predictions from the 1st decision tree to the t-1th decision tree, f i Represents a specific classification and regression tree, x i represents the i-th sample of the input.

[0132] The objective optimization function expression of the tth iteration can be expressed as follows after removing the constant term:

[0133]

[0134] Where Obj represents the target optimization function, which is the function that needs to be minimized or maximized in machine learning or optimization problems, K is the total number of regression trees, and Ω(f k ) represents the regularization term, Represents the loss function, which is used to measure the model prediction value and the true value y i The difference between.

[0135] In general, the Taylor series of the objective optimization function is generalized to the second order, the constant term is removed, and the regularization term is added to prevent overfitting. Then the objective optimization function of the tth iteration is:

[0136]

[0137] In the formula, g i and h i They represent the first-order derivative and second-order derivative of the Taylor expansion of the sample point respectively, T is the number of leaf nodes, ω is the leaf weight, λ is the weight penalty coefficient, γ is the leaf tree penalty coefficient, and both λ and γ are 1 by default.

[0138] For the t-th decision tree, we can solve the objective function by determining a tree structure and obtain:

[0139]

[0140] In the formula, I j is the sample set of the jth leaf node. Therefore, we only need to find the tree structure that minimizes the objective function to complete the establishment of the tth decision tree model.

[0141] Traverse and calculate the information gain of all nodes of all features of the data in the training set to obtain better split nodes, and split at the point with the maximum information gain. This process can be performed simultaneously on multiple processors or computing nodes, thereby accelerating the calculation process and improving calculation efficiency. The process of selecting the best split node is a greedy algorithm, that is, at each step, the split point with the largest information gain is selected for splitting, rather than trying to find the global optimal splitting solution for the entire tree. The information gain expression can be expressed as:

[0142]

[0143] In the formula, I is the set before segmentation, I L and I R is the set of left nodes and right nodes after splitting.

[0144] Specifically, the classification algorithm model traverses all the eigenvalues ​​of all samples in the data set, calculates the information gain obtained by segmentation with the eigenvalue, selects the eigenvalue corresponding to the maximum information gain, and segments with the eigenvalue to generate left leaf nodes and right leaf nodes. Repeat the above operation for the left and right leaf nodes, and stop traversing when the set threshold is reached, so as to determine the classification and regression tree structure. The greater the information gain, the better the corresponding classification effect. The above greedy algorithm can always find the node segmentation method with the largest information gain. Therefore, the classification effect of the determined classification and regression tree is the best, and the corresponding loss function value is the smallest, so as to achieve the purpose of optimizing the objective function. During the training process, the model will automatically calculate the total number of times each feature is used as the importance index of the feature.

[0145] In a specific implementation, the population size, search range and maximum number of iterations of the swarm intelligence optimization algorithm are initialized to obtain an initial population set, each individual in the initial population set is a set of parameter combinations for the classification model, and the parameter combination includes a learning rate, a minimum loss function descent value and a minimum leaf node weight.

[0146] In this step, since there are many parameters in the classification algorithm model and the parameter adjustment is random, in order to improve the classification prediction accuracy of the model, parameter optimization is required. The swarm intelligence optimization algorithm is used to optimize some of the parameters (including learning rate, minimum loss function descent value, λ and γ in the regularization term, and minimum leaf node weight sum).

[0147] Specifically, the swarm intelligence optimization algorithm imitates the characteristics of individuals in a population set looking for food, and searches for the global optimal value of the parameter through continuous iteration. First, the parameters of the swarm intelligence optimization algorithm are initialized, and the initial population position of the parameter to be optimized is randomly given. Search range [x umin ,y umax ] and the maximum number of iterations.

[0148] In a specific implementation, a location and direction for searching for food is randomly assigned to each individual in the initial population, and the location information of each individual is updated.

[0149] In this step, in order to simulate the random behavior of individuals in nature and thus increase the diversity and exploration ability of the algorithm, the diversity of the initial population is crucial to avoid falling into the local optimal solution and improving the global search capability, which can more effectively search the solution space and increase the probability of finding the optimal solution.

[0150] Specifically, determine the position coordinates of each individual in the population, randomly assign each individual a position and direction to search for food, and update the position information of each individual. The position update expression can be expressed as:

[0151]

[0152] Where rand() is the random search distance.

[0153] In a specific implementation, the parameter combination corresponding to each individual is respectively configured in the classification model, and the configured classification model is used to classify and identify the samples in the sample set. The concentration judgment value corresponding to each configured classification model is calculated according to a preset concentration judgment function. Based on the concentration judgment value corresponding to each configured classification model, the target individual with the highest concentration judgment value is selected, the position of the target individual is used as the target position, and other individuals are moved to the position of the target individual, and the position information of each individual is re-updated. This step is repeated until the maximum number of iterations is reached to obtain the target population set.

[0154] In this step, since the specific location of the food cannot be determined at the beginning, the population individuals calculate the distance between themselves and the origin, and determine the flavor concentration judgment value by the inverse of the distance. The population individual with the highest flavor concentration among the population individuals is found, that is, the population individual closest to the food source is found, that is, the optimal solution in the solution space is found. The optimal flavor concentration value and coordinates are retained, and the population individuals all fly to the location of this optimal solution. Enter the iterative optimization stage, and repeat this step until the maximum number of iterations is reached. At this point, the target population set is obtained.

[0155] Specifically, determine the distance D between the individual coordinates of the population and the coordinate origin ut , calculate the concentration judgment value S ut :

[0156]

[0157] The accuracy of the classification algorithm model prediction is used as the concentration judgment function f s , substitute the concentration judgment value S utDetermine the flavor concentration of individuals in the population. Find the flavor concentration value σ corresponding to the food found by each individual in the population and bring it into the objective function of the classification algorithm model for optimization.

[0158] The accuracy of the above classification algorithm model prediction is precision = TP / TP + FP, where TP represents the number of samples that are actually positive examples and predicted as positive examples by the model, and FP represents the number of samples that are actually negative examples and predicted as negative examples by the model.

[0159] Find the optimal value and find the individual F closest to the food in the population 1ymax , which is the concentration determination function f s The maximum value f smax The corresponding individual I best :

[0160] f smax = argmaxf s (σ1,σ2,...,σ Z )

[0161] I best =F 1ymax

[0162] Determine the optimal odor concentration for individual populations and the corresponding optimal position (x t+1 ,y t+1 ), which is the optimal position for the next iteration:

[0163]

[0164] Enter the iterative optimization phase and repeat this step until the maximum number of iterations is reached. At this point, the target population set is obtained.

[0165] In a specific implementation, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node corresponding to the target individual with the highest concentration judgment value in the target population set are configured in the classification model to obtain a classification model with optimized parameters.

[0166] In this step, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node are the key hyperparameters that affect the performance of the classification model. By optimizing these parameters, the generalization ability and classification accuracy of the model can be effectively improved. By selecting these hyperparameters corresponding to the target individuals with the highest concentration judgment values, it can be ensured that the selected parameter combination is optimal in the current population, thereby improving the overall performance of the classification model. Ultimately, the classification model after parameter optimization can classify samples more accurately, has better generalization ability and robustness, and significantly improves the effect of the model in practical applications.

[0167] In a specific implementation, the classification model after parameter optimization is trained according to the training set to obtain the attack recognition model.

[0168] In this step, the classification model with optimized parameters is first used to classify the normal data and intrusion data in the training data set to achieve the purpose of training the model, effectively evaluate and verify the actual detection ability and generalization ability of the model, and ensure its reliability and effectiveness in the real environment.

[0169] Specifically, the parameter-optimized classification algorithm model is trained based on the sample set until the preset loss function converges to obtain an attack recognition model.

[0170] In a specific implementation, the trained attack test model is tested according to the test set to obtain a final attack recognition model.

[0171] In this step, the system access device imports the test data set into the trained classification algorithm model for identification and detection, and obtains the final attack identification model, that is, the final abnormal communication data prediction model. Specifically, through verification on the test data set, the actual performance indicators of the model, such as accuracy, precision, recall rate, and F1 score, can be evaluated to ensure the reliability and effectiveness of the model in a real environment, thereby providing a solid guarantee for the safe operation of the unit system.

[0172] In an optional specific embodiment, the above-mentioned attack identification model is a classification algorithm model based on a swarm optimization algorithm combined with an extreme gradient boosting regression tree. Optionally, the swarm optimization algorithm can use a fruit fly optimization algorithm (Fruit Fly Optimization Algorithm, FOA), a new type of swarm intelligence optimization algorithm proposed based on the bionic principle of fruit fly foraging behavior; the extreme gradient boosting regression tree algorithm can use the XGBoost algorithm. Optionally, the learning rate, the minimum loss function descent value, the λ and γ in the regularization term in the trained XGBoost classification algorithm model before optimizing the parameters, and the minimum leaf node weight and are 0.3, 0, 1, 1, 1, respectively. After optimizing the parameters of the FOA algorithm, the optimization results of these five parameters are 0.341, 0.123, 0.456, 0.348, and 0.700, respectively. In addition, the training time of the FOA-XGBoost model can reach 265.35s, and the prediction time can reach 0.94s. The optional FOA-XGBoost-based attack identification model can quickly respond to and identify potential attack behaviors in the prediction stage, and the optimized learning rate and regularization parameters can balance the complexity and fitting ability of the model. The adjustment of the minimum loss function descent value and the minimum leaf node weight can improve the model's resistance to noise and outliers, so that the model can better adapt to specific detection data and improve the classification accuracy and generalization ability of the model. In summary, the FOA-XGBoost-based attack identification model not only performs well in accuracy and efficiency, but also has significant improvements in the stability and robustness of the model. This comprehensive performance improvement makes the model more practical in practical applications.

[0173] S306: configuring the attack identification model to each unit access device respectively.

[0174] In this step, the attack identification model is configured in each unit access device to achieve distributed intrusion detection, thereby improving the security and response speed of the entire system. By deploying the attack identification model on each unit access device, real-time monitoring and rapid response can be achieved, and potential intrusion behaviors can be detected and blocked in a timely manner to prevent them from spreading and causing greater damage, thereby improving the overall protection capability of the system and being able to handle intrusion behaviors as soon as they occur.

[0175] Specifically, the trained attack identification model can be packaged into a deployable form, and then the final abnormal communication data prediction model can be deployed to the access device of each unit through remote update or manual configuration.

[0176] In a specific implementation, the final abnormal communication data prediction model deployed in each unit access device is used to detect decrypted data. If abnormal data is detected, the system access device immediately communicates with the terminal device, and the actuator and relevant personnel respond.

[0177] The unit communication method provided in this embodiment first obtains a network intrusion data set, pre-processes each data in the data set, extracts multiple data features corresponding to each data, and calibrates the corresponding normal or attack label for each data. Then, a training data set is constructed based on the data set, multiple features corresponding to each data, and the label, and the training data set is split into a training set and a test set according to a preset ratio. Then, the initial classification model is trained according to the training set, and the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized during the training process to obtain a trained attack recognition model. Finally, the trained attack test model is tested according to the test set to obtain the final attack recognition model. Through the above method, the final attack recognition model can effectively identify different types of network attacks, and can be quickly deployed to each unit access device in practical applications, thereby enhancing the network security protection capability.

[0178] Figure 5 This is a structural diagram of the first embodiment of the communication device for a machine group provided in the embodiment of the present application; Figure 5 As shown, the unit communication device 10 includes:

[0179] The receiving module 11 is used to receive first encrypted data transmitted by any unit access device.

[0180] The processing module 12 is used for:

[0181] After receiving the first encrypted data transmitted by any unit access device, decrypting the first encrypted data based on the security encryption protocol between the unit access device and the unit access device to obtain first decrypted data;

[0182] Using the pre-acquired attack identification model, abnormal attack identification is performed on the first decrypted data corresponding to each unit access device to determine whether the communication link between the system access device and each unit access device is attacked abnormally; wherein, the attack identification model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm.

[0183] The sending module 13 is used to send a first abnormal indication message to the intelligent terminal device for at least one target group access device of the communication link identified to be abnormally attacked, and the first abnormal indication message carries the identification of each target group access device.

[0184] The unit communication device provided in this embodiment is used to implement the technical solution of the system access device side in the aforementioned method embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0185] Based on the above embodiment, the processing module 12 is further used for:

[0186] Obtain a network intrusion data set, which includes multiple normal data, multiple DOS attack data, multiple probe attack data, multiple U2R attack data, and multiple RL2 attack data;

[0187] Perform feature extraction processing on each data in the network intrusion data set to extract multiple data features corresponding to each data;

[0188] Calibrate each data in the network intrusion data set and calibrate the label corresponding to each data, including normal or attack;

[0189] Based on the network intrusion data set, multiple features and labels corresponding to each data are used to build a training data set;

[0190] The pre-acquired initial classification model is trained according to the training data set to obtain an attack recognition model;

[0191] The attack identification model is configured in each unit access device respectively.

[0192] Optionally, the processing module 12 is specifically used for:

[0193] Split the training data set into a training set and a test set according to a preset ratio;

[0194] The initial classification model is trained according to the training set, and the learning rate, minimum loss function descent value, and weight of the classification leaf nodes in the model are group optimized during the training process to obtain the trained attack recognition model;

[0195] The trained attack test model is tested according to the test set to obtain the final attack recognition model.

[0196] Optionally, the processing module 12 is specifically used for:

[0197] Initialize the population size, search range and maximum number of iterations of the swarm intelligence optimization algorithm to obtain the initial population set. Each individual in the initial population set is a set of parameter combinations of the classification model, including the learning rate, the minimum loss function descent value and the weight of the minimum leaf node;

[0198] Randomly assign each individual in the initial population a location and direction to search for food, and update the location information of each individual;

[0199] The parameter combination corresponding to each individual is respectively configured in the classification model, and the configured classification model is used to classify and identify the samples in the sample set, and the concentration judgment value corresponding to each configured classification model is calculated according to the preset concentration judgment function, and based on the concentration judgment value corresponding to each configured classification model, the target individual with the highest concentration judgment value is selected, and the position of the target individual is used as the target position, and other individuals are moved to the position of the target individual, and the position information of each individual is re-updated, and this step is repeated until the maximum number of iterations is reached to obtain the target population set;

[0200] The learning rate, the minimum loss function descent value, and the weight of the minimum leaf node corresponding to the target individual with the highest concentration judgment value in the target population set are configured in the classification model to obtain a classification model with optimized parameters;

[0201] The classification model with optimized parameters is trained according to the training set to obtain the attack recognition model.

[0202] Optionally, the processing module 12 is further used for:

[0203] During the parameter optimization process, the concentration judgment value of the classification model corresponding to each individual is calculated based on the distance between the updated position information of each individual and the coordinate origin.

[0204] Optionally, the processing module 12 is further used for:

[0205] For each unit access device, the system access device selects a target security encryption protocol between the system access device and the unit access device based on the network environment and security requirements between the system access device and the unit access device;

[0206] Conduct security negotiation with the unit access device according to the target security encryption protocol to determine the session key;

[0207] Based on the session key corresponding to the unit access device, the first encrypted data is decrypted to obtain first decrypted data.

[0208] The unit communication device provided in any of the aforementioned embodiments is used to implement the technical solution on the system access device side in the aforementioned method embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0209] Figure 6 The structural diagram of the second embodiment of the communication device of the machine group provided in the embodiment of the present application is as follows: Figure 6 As shown, the communication device 20 of the machine group includes:

[0210] The receiving module 21 is used to receive second encrypted data transmitted by other unit access devices or system access devices.

[0211] The processing module 22 is used for:

[0212] After receiving the second encrypted data transmitted by other unit access devices or system access devices, the second encrypted data is decrypted based on the security encryption protocol between the other party to obtain second decrypted data;

[0213] The pre-configured attack identification model is used to identify abnormal attacks on the second decrypted data to determine whether a communication link transmitting the second encrypted data is attacked abnormally.

[0214] The sending module 13 is used for reporting an abnormal attack message to the system access device by the unit access device if it is determined that the communication link transmitting the second encrypted data is abnormally attacked. The abnormal attack message includes the identifier of the unit access device involved in the communication link transmitting the second encrypted data.

[0215] The unit communication device provided in the aforementioned embodiment is used to implement the technical solution of the unit access device side in the aforementioned method embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0216] Optionally, based on the aforementioned embodiment, the sending module 13 in the unit communication device 10 is also used to: after receiving an abnormal attack message, send a second abnormal indication message to the intelligent terminal device, and the second abnormal indication message carries the identifier of the unit access device involved in the communication link for transmitting the second encrypted data.

[0217] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Figure 7 As shown, the electronic device 300 includes: a memory 302, a processor 302, and a communication interface 303;

[0218] The memory 301 is used to store computer-executable instructions, and the processor 302 is used to execute the computer-executable instructions to implement the technical solution in any of the aforementioned method embodiments.

[0219] In actual implementation, the electronic device 300 can be implemented as a unit access device or a system access device, and this solution does not limit this.

[0220] This embodiment provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the unit communication method in the above embodiment.

[0221] This embodiment also provides a computer program product, including a computer program, and when the computer program is executed by a processor, the unit communication method provided by any one of the above embodiments is implemented.

[0222] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0223] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A unit communication method, characterized in that: Applied to a unit communication system, the unit communication system includes a system access device, multiple unit access devices that respectively establish communication channels with the system access device through a secure encryption protocol, and an intelligent terminal device, the method includes: After receiving the first encrypted data transmitted by any unit access device, the system access device decrypts the first encrypted data based on the security encryption protocol between the system access device and the unit access device to obtain first decrypted data; The system access device uses the pre-acquired attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and determines whether the communication link between the system access device and each unit access device is attacked abnormally; wherein the attack identification model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm; The system access device sends a first abnormal indication message to the intelligent terminal device for at least one target unit access device of a communication link that is abnormally attacked, wherein the first abnormal indication message carries an identifier of each target unit access device.

2. The method according to claim 1, characterized in that The method further comprises: For any unit access device, after the unit access device receives the second encrypted data transmitted by other unit access devices or the system access device, the second encrypted data is decrypted based on the security encryption protocol between the other party to obtain second decrypted data; The unit access device uses a pre-configured attack identification model to perform abnormal attack identification on the second decrypted data to determine whether the communication link transmitting the second encrypted data is abnormally attacked; If it is determined that the communication link for transmitting the second encrypted data is attacked abnormally, the unit access device reports an abnormal attack message to the system access device, wherein the abnormal attack message includes an identifier of the unit access device involved in the communication link for transmitting the second encrypted data; After receiving the abnormal attack message, the system access device sends a second abnormal indication message to the intelligent terminal device, wherein the second abnormal indication message carries an identifier of a unit access device involved in a communication link for transmitting the second encrypted data.

3. The method according to claim 1, characterized in that The system access device uses a preset attack identification model to perform abnormal attack identification on the first decrypted data corresponding to each unit access device, and before determining whether the communication link between the system access device and each unit access device is attacked abnormally, the method further includes: Acquire a network intrusion data set, wherein the network intrusion data set includes a plurality of normal data, a plurality of DOS attack data, a plurality of probe attack data, a plurality of U2R attack data, and a plurality of RL2 attack data; Performing feature extraction processing on each data in the network intrusion data set to extract multiple data features corresponding to each data; Calibrate each data in the network intrusion data set, and calibrate a label corresponding to each data, wherein the label includes normal or attack; Based on the network intrusion data set, multiple features and labels corresponding to each data, construct a training data set; Training the pre-acquired initial classification model according to the training data set to obtain the attack recognition model; The attack identification model is configured in each unit access device respectively.

4. The method according to claim 3, characterized in that The step of training the pre-acquired initial classification model according to the training data set to obtain the attack identification model includes: Splitting the training data set into a training set and a test set according to a preset ratio; The initial classification model is trained according to the training set, and during the training process, the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized to obtain a trained attack recognition model; The trained attack test model is tested according to the test set to obtain the final attack recognition model.

5. The method according to claim 4, characterized in that The initial classification model is trained according to the training set, and the learning rate, the minimum loss function descent value, and the weight of the minimum leaf node in the model are group optimized during the training process to obtain a trained attack recognition model, including: Initialize the population size, search range and maximum number of iterations of the swarm intelligence optimization algorithm to obtain an initial population set, wherein each individual in the initial population set is a set of parameter combinations of the classification model, and the parameter combination includes a learning rate, a minimum loss function descent value and a minimum leaf node weight; Randomly assigning a location and direction for searching for food to each individual in the initial population set, and updating the location information of each individual; The parameter combination corresponding to each individual is respectively configured in the classification model, and the configured classification model is used to classify and identify the samples in the sample set, and the concentration judgment value corresponding to each configured classification model is calculated according to a preset concentration judgment function, and based on the concentration judgment value corresponding to each configured classification model, a target individual with the highest concentration judgment value is selected, and the position of the target individual is used as the target position, and other individuals are moved to the position of the target individual, and the position information of each individual is re-updated, and this step is repeated until the maximum number of iterations is reached to obtain a target population set; The learning rate, the minimum loss function descent value and the minimum leaf node weight corresponding to the target individual with the highest concentration judgment value in the target population set are configured in the classification model to obtain a classification model after parameter optimization; The parameter-optimized classification model is trained according to the training set to obtain the attack recognition model.

6. The method according to claim 5, characterized in that The method further comprises: During the parameter optimization process, the concentration judgment value of the classification model corresponding to each individual is calculated based on the distance between the updated position information of each individual and the coordinate origin.

7. The method according to any one of claims 1 to 6, characterized in that: After receiving the encrypted data transmitted by any unit access device, the system access device decrypts the first encrypted data based on the security encryption protocol between the system access device and the unit access device, and before obtaining the decrypted data, the method further includes: For each unit access device, the system access device selects a target security encryption protocol between the system access device and the unit access device based on the network environment and security requirements between the system access device and the unit access device; The system access device performs a security negotiation process with the unit access device according to the target security encryption protocol to determine a session key; Correspondingly, the decrypting of the first encrypted data based on the security encryption protocol between the unit access device to obtain the decrypted data includes: The first encrypted data is decrypted based on the session key corresponding to the unit access device to obtain the first decrypted data.

8. The method according to claim 7, characterized in that The system access device includes a system access base station or a system control server; The multiple unit access devices include: computer equipment of the unit, access router of the unit, server of the unit and industrial robot.

9. A unit communication system, characterized in that: include: System access equipment, multiple unit access equipment and intelligent terminal equipment; The system access device and the plurality of unit access devices respectively establish communication channels through a secure encryption protocol; The system access device is used to: after receiving the first encrypted data transmitted by any unit access device, decrypt the first encrypted data based on the security encryption protocol between the unit access device and the unit access device to obtain the first decrypted data; use the pre-acquired attack recognition model to perform abnormal attack recognition on the first decrypted data corresponding to each unit access device, and determine whether the communication link between the system access device and each unit access device is attacked abnormally; wherein the attack recognition model is obtained by optimizing and training the classification model using a swarm intelligence optimization algorithm; For at least one target unit access device of a communication link that is abnormally attacked, a first abnormal indication message is sent to the intelligent terminal device, wherein the first abnormal indication message carries an identifier of each target unit access device; Any unit access device is used to: after receiving the second encrypted data transmitted by other unit access devices or the system access device, decrypt the second encrypted data based on the security encryption protocol between the other party to obtain the second decrypted data; use the pre-configured attack recognition model to perform abnormal attack recognition on the second decrypted data to determine whether the communication link transmitting the second encrypted data is attacked abnormally; If it is determined that the communication link for transmitting the second encrypted data is abnormally attacked, an abnormal attack message is reported to the system access device, wherein the abnormal attack message includes an identifier of the unit access device involved in the communication link for transmitting the second encrypted data; The system access device is also used to: after receiving the abnormal attack message, send a second abnormal indication message to the intelligent terminal device, and the second abnormal indication message carries the identifier of the unit access device involved in the communication link for transmitting the second encrypted data.

10. An electronic device, characterized in that: include: Memory, processor, and communication interface; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions to implement the unit communication method described in any one of claims 1 to 8.

Images