Industrial big data platform system for intelligent supervision

Abstract

The invention discloses an industrial big data platform system for intelligent supervision, which comprises a management control module, an analysis processing module and a transmission storage module, and is characterized in that the management control module is in network connection with the analysis processing module, and the analysis processing module is in data connection with the transmission storage module; the management control module is used for carrying out login management control on an industrial control system, the analysis processing module is used for carrying out analysis control processing on industrial supervision, and the transmission storage module is used for carrying out transmission storage management on data information. The management control module comprises a login management module, a mutual authentication module and a bill confirmation module, the login management module is in data connection with the mutual authentication module, the mutual authentication module is in network connection with the bill confirmation module, and the login management module is used for managing and controlling user login. The system has the characteristics of efficient management control and high safety.

Description

Technical Field

[0001] The present invention relates to the field of industrial technology, and in particular to an industrial big data platform system for smart supervision. Background Art

[0002] With the integration of full integration and interconnection and the integration of the latest IT technologies with industrial control systems, modern industrial control systems have undergone great changes. New IT technologies will become the core of industrial control systems, such as cloud computing and big data technologies. Industrial control applications, users, enterprise IT systems, production systems and control systems may interact directly with cloud platform systems and provide services through the SaaS (Software as a Service) model. Mobile smart terminals, especially mobile terminals with real-time computing functions, will be widely used in the entire industrial control system, including HMI, field control and detection. However, with the continuous improvement of the integration, networking and informatization of industrial control systems, the interaction and openness of their information are constantly expanding, which makes the information security threats faced by industrial control systems increasingly serious. Therefore, it is necessary to design an industrial big data platform system for intelligent supervision with efficient management control and high security. Summary of the invention

[0003] The purpose of the present invention is to provide an industrial big data platform system for intelligent supervision to solve the problems raised in the above-mentioned background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: an industrial big data platform system for smart supervision, comprising: a management control module, an analysis and processing module and a transmission and storage module, the management control module and the analysis and processing module are network-connected, the analysis and processing module and the transmission and storage module are data-connected, the management control module is used to perform login management and control of the industrial control system, the analysis and processing module is used to perform analysis and control processing of industrial supervision, and the transmission and storage module is used to perform transmission, storage and management of data information.

[0005] According to the above technical solution, the management control module includes a login management module, a mutual authentication module and a ticket confirmation module. The login management module is data-connected to the mutual authentication module, and the mutual authentication module is network-connected to the ticket confirmation module. The login management module is used to manage and control user logins, the mutual authentication module is used to perform user system mutual authentication management, and the ticket confirmation module is used to perform ticket information confirmation control.

[0006] According to the above technical solution, the analysis and processing module includes a model construction module, a data packet processing module and an analysis and calculation module. The model construction module is connected to the data packet processing module through a network, and the data packet processing module is connected to the analysis and calculation module through a network. The model construction module is used to perform industrial safety protection model construction management, the data packet processing module is used to perform industrial data packet control processing, and the analysis and calculation module is used to perform abnormal behavior analysis and calculation.

[0007] According to the above technical solution, the transmission storage module includes a transmission management module and a data storage module. The transmission management module and the data storage module are connected to the network. The transmission management module is used to manage data information transmission, and the data storage module is used to control the storage of data information.

[0008] According to the above technical solution, the method for operating an industrial big data platform system for smart supervision includes the following steps:

[0009] Step S1: In an industrial workshop, user login management is performed on the industrial control system;

[0010] Step S2: After completing the industrial user login management, analyze and control the identity security authentication;

[0011] Step S3: further constructing an industrial safety protection model and performing abnormal behavior analysis and calculation processing;

[0012] Step S4: Control and manage the transmission and storage of industrial data information.

[0013] According to the above technical solution, step S1 further includes the following steps:

[0014] When a user logs in to an industrial control system, the login management is completed through the fully integrated SCADA of the mobile Internet. Specifically, when a user logs in to the industrial control system, he or she will first be authenticated with the AC (Authentication Center). The user uses his or her own identity ID and the AC's identity ID to generate a shared key. When the user sends a ticket request to the AC, the AC receives the message and analyzes the shared key according to the user's identity ID and its own ID to decrypt the encrypted information. If the ticket request is decrypted correctly and the random serial number has no usage record in previous communications, the identity authentication login is completed.

[0015] According to the above technical solution, step S2 further includes the following steps:

[0016] Step S21: After the user completes the authentication login with the AC and obtains the ticket issued by the AC, he can access the mobile Internet fully integrated SCADA application. The application includes the communication entity MTU and RTU, so as to perform industrial communication transmission control. Specifically, the user selects a random serial number nonce to ensure the real-time nature of the message, and at the same time provides a key factor for generating a session key between the user and the application, and sends the message to be accessed to the application. After the application receives the corresponding ticket, it uses its own identity ID and the user's identity ID to obtain a shared key. The application decrypts the message and compares the user ID in the ticket with the user ID in the message. If the two are consistent, the application confirms that the message is sent by the user and allows the user to access. If they are inconsistent, the access is denied.

[0017] Step S22: During the industrial bill access process, if the bill verification request is correctly decrypted and there is no usage record for the nonce corresponding to the user ID, the AC starts to verify the authenticity of the bill. The AC uses the bill's signature key to verify the signature in the bill. If the verification is successful, the bill is the specified bill. The AC sends a pass message to the application to indicate that the bill is authentic. Otherwise, it sends a fail message to indicate that the bill is forged.

[0018] According to the above technical solution, step S3 further includes the following steps:

[0019] Step S31: After completing the login verification supervision and control of the industrial control system, further construct an industrial control system security protection model for industrial control system security protection management. The model includes protocol rule processing, protocol rule matching, task scheduling and log recording, wherein the protocol rule processing includes detection, storage and editing, and consists of three parts: a protocol rule detector, which is used to detect the consistency of the protocol rules; a protocol rule container, which is used to store all the rules of the protocol; a protocol rule editor, which is used to extract the protocol rules corresponding to the protocol, analyze and establish the deterministic finite automaton DFA corresponding to the protocol; protocol rule matching is used to store the protocol DFA and protocol matching detection. The protocol rule matching consists of two parts: a DFA container, which is used to store the DFA corresponding to all protocols supported by the industrial control system; a protocol matching engine uses the DFA corresponding to the protocol to filter the data packets of the protocol. This filtering includes both the inspection and filtering of the syntax format of the data packet and the inspection and filtering of the timing logic of the protocol. Each protocol corresponds to a protocol matching engine;

[0020] Step S32: In the industrial control system security protection model, the industrial data packet is processed and controlled. After the protocol rule establishment phase is completed, the DPI security protection model can start to detect and process the data packet. After the firewall TCP / IP packet header is detected, the data packet is forwarded to the DPI security protection model. According to the TCP port number of the data packet, the data packet of each protocol is split and sent to the protocol matching engine corresponding to the protocol. After the data packet is input, it is first determined whether the protocol matching engine of the protocol corresponding to the data packet has been started. If not, the corresponding protocol matching engine is started for this protocol.

[0021] Step S33: Using the Naive Bayes algorithm to perform abnormal behavior data supervision analysis of the industrial control system, the industrial data tuple to be analyzed X = {X1, X2, ..., X k} to analyze and identify the attribute class value C = {C0, C1, ..., C n}, it is calculated that the industrial data tuple X belongs to class C i The probability P(C i |X), the formula is as follows:

[0022]

[0023] If the difference between the calculated probability value and the set probability threshold exceeds the set range, the industrial data tuple is judged to be abnormal behavior data, otherwise it is normal.

[0024] According to the above technical solution, step S4 further includes the following steps:

[0025] Step S41: After receiving the data information that indicates abnormal behavior, immediately transmit an early warning to the staff;

[0026] Step S42: The industrial data packets that have completed the abnormal analysis, supervision and analysis processing are stored in the blockchain to avoid loss or tampering.

[0027] Compared with the prior art, the beneficial effects achieved by the present invention are: the present invention, by providing a management control module, an analysis and processing module and a transmission and storage module, can make security authentication login more efficient and convenient, effectively improve industrial safety and accuracy, effectively avoid the generation of industrial management and control errors, and at the same time greatly avoid the harm of external attacks to industrial control systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0029] Figure 1 It is a schematic diagram of the system module composition of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] See also Figure 1 The present invention provides a technical solution: an industrial big data platform system for smart supervision, including: a management control module, an analysis and processing module and a transmission and storage module. The management control module is connected to the analysis and processing module through a network, and the analysis and processing module is connected to the transmission and storage module through data. The management control module is used to perform login management and control of the industrial control system, the analysis and processing module is used to perform analysis and control processing of industrial supervision, and the transmission and storage module is used to perform transmission and storage management of data information.

[0032] The management control module includes a login management module, a mutual authentication module and a ticket confirmation module. The login management module and the mutual authentication module are data connected, and the mutual authentication module and the ticket confirmation module are network connected. The login management module is used to manage and control user logins, the mutual authentication module is used to perform user system mutual authentication management, and the ticket confirmation module is used to perform ticket information confirmation control.

[0033] The analysis and processing module includes a model building module, a data packet processing module and an analysis and calculation module. The model building module is connected to the data packet processing module through a network, and the data packet processing module is connected to the analysis and calculation module through a network. The model building module is used for industrial security protection model building management, the data packet processing module is used for industrial data packet control processing, and the analysis and calculation module is used for abnormal behavior analysis and calculation.

[0034] The transmission storage module includes a transmission management module and a data storage module. The transmission management module and the data storage module are connected to the network. The transmission management module is used to manage data information transmission, and the data storage module is used to control the storage of data information.

[0035] A method for operating an industrial big data platform system for smart supervision includes the following steps:

[0036] Step S1: In an industrial workshop, user login management is performed on the industrial control system;

[0037] Step S2: After completing the industrial user login management, analyze and control the identity security authentication;

[0038] Step S3: further constructing an industrial safety protection model and performing abnormal behavior analysis and calculation processing;

[0039] Step S4: Control and manage the transmission and storage of industrial data information.

[0040] Step S1 further comprises the following steps:

[0041] When a user logs in to an industrial control system, login management is completed through the mobile Internet fully integrated SCADA. Specifically, when a user logs in to the industrial control system, he or she will first be authenticated with the AC (Authentication Center). The user uses his or her own identity ID and the AC's identity ID to generate a shared key. After the user sends a ticket request to the AC, the AC receives the message and analyzes the shared key according to the user's identity ID and its own ID to decrypt the encrypted information. If the ticket request is correctly decrypted and there is no usage record of the random serial number in previous communications, the identity authentication login is completed. In industrial control systems under fully interconnected and mobile Internet environments, due to the widespread implementation of factory informatization, the enterprise management layer and the industrial production layer are fully integrated with the equipment control layer. Therefore, through this step, user login management is performed through the fully integrated SCADA system in the mobile Internet environment, which can make secure authentication login more efficient and convenient, and effectively improve industrial safety and accuracy.

[0042] Step S2 further comprises the following steps:

[0043] Step S21: After the user completes the authentication login with the AC and obtains the ticket issued by the AC, he can access the mobile Internet fully integrated SCADA application. The application includes the communication entity MTU and RTU, so as to perform industrial communication transmission control. Specifically, the user selects a random serial number nonce to ensure the real-time nature of the message, and at the same time provides a key factor for generating a session key between the user and the application, and sends the message to be accessed to the application. After the application receives the corresponding ticket, it uses its own identity ID and the user's identity ID to obtain a shared key. The application decrypts the message and compares the user ID in the ticket with the user ID in the message. If the two are consistent, the application confirms that the message is sent by the user and allows the user to access. If they are inconsistent, the access is denied.

[0044] Step S22: During the industrial ticket access process, if the ticket verification request is correctly decrypted and there is no usage record for the nonce corresponding to the user ID, the AC starts to verify the authenticity of the ticket. The AC uses the signature key of the ticket to verify the signature in the ticket. If the verification is successful, the ticket is the specified ticket, and the AC sends a pass message to the application to indicate that the ticket is authentic. Otherwise, it sends a fail message to indicate that the ticket is forged. Through this step, the industrial login verification management is more accurate and detailed, and the security of the industrial control system is effectively guaranteed.

[0045] Step S3 further comprises the following steps:

[0046] Step S31: After completing the login verification supervision and control of the industrial control system, further construct an industrial control system security protection model for industrial control system security protection management. The model includes protocol rule processing, protocol rule matching, task scheduling and log recording, wherein the protocol rule processing includes detection, storage and editing, and consists of three parts: a protocol rule detector for detecting the consistency of protocol rules, a protocol rule container for storing all the rules of the protocol, a protocol rule editor for extracting the protocol rules corresponding to the protocol, analyzing and establishing the deterministic finite automaton DFA corresponding to the protocol, and protocol rule matching for storing protocol DFA and protocol matching detection. The protocol rule matching consists of two parts. Composition: DFA container is used to store the DFA corresponding to all protocols supported by the industrial control system. The protocol matching engine uses the DFA corresponding to the protocol to filter the data packets of this protocol. This filtering includes both checking and filtering the syntax format of the data packet and checking and filtering the timing logic of the protocol. Each protocol corresponds to a protocol matching engine. In this step, task scheduling is to divert data packets of different protocols according to the TCP port number of the data packet. The corresponding protocol matching engine is used to match and detect the rules of the data packet. The log record is used to log all data packets entering the DPI security protection model. It can complete the log storage by connecting to an external log server.

[0047] Step S32: In the industrial control system security protection model, the industrial data packet is processed and controlled. After the protocol rule establishment stage is completed, the DPI security protection model can start to detect and process the data packet. After the firewall TCP / IP packet header is detected, the data packet is forwarded to the DPI security protection model. According to the TCP port number of the data packet, the data packet of each protocol is diverted and sent to the protocol matching engine corresponding to the protocol. After the data packet is input, it is first determined whether the protocol matching engine of the protocol corresponding to the data packet has been started. If not, the corresponding protocol matching engine is started for this protocol. In this step, each protocol matching engine performs rule filtering on the input data packet according to its corresponding DFA. First, the data format of the input data packet is detected. If the format of the data packet is wrong, the industrial control system firewall is notified to take corresponding measures. Otherwise, for the data packet detected by the protocol matching engine, that is, the data packet that meets both the data format detection and the protocol state machine, it is output to the industrial control system through the network firewall, effectively ensuring the efficiency and accuracy of data packet processing.

[0048] Step S33: Using the naive Bayes algorithm to perform abnormal behavior data supervision analysis of the industrial control system, the industrial data tuple X = {X1, X2, ..., Xk} to be analyzed is analyzed and identified to obtain the attribute class value C = {C0, C1, ..., Cn}, and then the probability P (C) that the industrial data tuple X belongs to the class Ci is calculated. i |X), the formula is as follows:

[0049]

[0050] If the difference between the calculated probability value and the set probability threshold exceeds the set range, the industrial data tuple is judged to be abnormal behavior data, otherwise it is normal.

[0051] Step S4 further comprises the following steps:

[0052] Step S41: After receiving the data information that indicates abnormal behavior, immediately transmit an early warning to the staff;

[0053] Step S42: The industrial data packets that have completed the abnormal analysis, supervision and analysis processing are stored in the blockchain to avoid loss or tampering.

[0054] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0055] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An industrial big data platform system for smart supervision, comprising: A management control module, an analysis and processing module and a transmission and storage module, characterized in that: the management control module and the analysis and processing module are connected to the network, the analysis and processing module and the transmission and storage module are connected to the data, the management control module is used to perform login management and control of the industrial control system, the analysis and processing module is used to perform analysis and control processing of industrial supervision, and the transmission and storage module is used to perform transmission, storage and management of data information.

2. The industrial big data platform system for intelligent supervision according to claim 1 is characterized in that: The management control module includes a login management module, a mutual authentication module and a ticket confirmation module. The login management module is data-connected to the mutual authentication module, and the mutual authentication module is network-connected to the ticket confirmation module. The login management module is used to manage and control user logins, the mutual authentication module is used to perform user system mutual authentication management, and the ticket confirmation module is used to perform ticket information confirmation control.

3. The industrial big data platform system for intelligent supervision according to claim 1 is characterized in that: The analysis and processing module includes a model construction module, a data packet processing module and an analysis and calculation module. The model construction module is connected to the data packet processing module through a network, and the data packet processing module is connected to the analysis and calculation module through a network. The model construction module is used for industrial safety protection model construction management, the data packet processing module is used for industrial data packet control processing, and the analysis and calculation module is used for abnormal behavior analysis and calculation.

4. The industrial big data platform system for intelligent supervision according to claim 1 is characterized in that: The transmission storage module includes a transmission management module and a data storage module. The transmission management module and the data storage module are connected to the network. The transmission management module is used to manage data information transmission, and the data storage module is used to control the storage of data information.

5. The industrial big data platform system for intelligent supervision according to claim 1 is characterized in that: The method for operating an industrial big data platform system for smart supervision comprises the following steps: Step S1: In an industrial workshop, user login management is performed on the industrial control system; Step S2: After completing the industrial user login management, analyze and control the identity security authentication; Step S3: further constructing an industrial safety protection model and performing abnormal behavior analysis and calculation processing; Step S4: Control and manage the transmission and storage of industrial data information.

6. The industrial big data platform system for intelligent supervision according to claim 5 is characterized by: The step S1 further comprises the following steps: When a user logs in to an industrial control system, the login management is completed through the fully integrated SCADA of the mobile Internet. Specifically, when a user logs in to the industrial control system, he or she will first be authenticated with the AC (Authentication Center). The user uses his or her own identity ID and the AC's identity ID to generate a shared key. When the user sends a ticket request to the AC, the AC receives the message and analyzes the shared key according to the user's identity ID and its own ID to decrypt the encrypted information. If the ticket request is decrypted correctly and the random serial number has no usage record in previous communications, the identity authentication login is completed.

7. The industrial big data platform system for intelligent supervision according to claim 5 is characterized by: The step S2 further comprises the following steps: Step S21: After the user completes the authentication login with the AC and obtains the ticket issued by the AC, he can access the mobile Internet fully integrated SCADA application. The application includes the communication entity MTU and RTU, so as to perform industrial communication transmission control. Specifically, the user selects a random serial number nonce to ensure the real-time nature of the message, and at the same time provides a key factor for generating a session key between the user and the application, and sends the message to be accessed to the application. After the application receives the corresponding ticket, it uses its own identity ID and the user's identity ID to obtain a shared key. The application decrypts the message and compares the user ID in the ticket with the user ID in the message. If the two are consistent, the application confirms that the message is sent by the user and allows the user to access. If they are inconsistent, the access is denied. Step S22: During the industrial bill access process, if the bill verification request is correctly decrypted and there is no usage record for the nonce corresponding to the user ID, the AC starts to verify the authenticity of the bill. The AC uses the bill's signature key to verify the signature in the bill. If the verification is successful, the bill is the specified bill. The AC sends a pass message to the application to indicate that the bill is authentic. Otherwise, it sends a fail message to indicate that the bill is forged.

8. The industrial big data platform system for intelligent supervision according to claim 5 is characterized by: The step S3 further comprises the following steps: Step S31: After completing the login verification supervision and control of the industrial control system, further construct an industrial control system security protection model for industrial control system security protection management. The model includes protocol rule processing, protocol rule matching, task scheduling and log recording, wherein the protocol rule processing includes detection, storage and editing, and consists of three parts: a protocol rule detector, which is used to detect the consistency of the protocol rules; a protocol rule container, which is used to store all the rules of the protocol; a protocol rule editor, which is used to extract the protocol rules corresponding to the protocol, analyze and establish the deterministic finite automaton DFA corresponding to the protocol; protocol rule matching is used to store the protocol DFA and protocol matching detection. The protocol rule matching consists of two parts: a DFA container, which is used to store the DFA corresponding to all protocols supported by the industrial control system; a protocol matching engine uses the DFA corresponding to the protocol to filter the data packets of the protocol. This filtering includes both the inspection and filtering of the syntax format of the data packet and the inspection and filtering of the timing logic of the protocol. Each protocol corresponds to a protocol matching engine; Step S32: In the industrial control system security protection model, the industrial data packet is processed and controlled. After the protocol rule establishment phase is completed, the DPI security protection model can start to detect and process the data packet. After the firewall TCP / IP packet header is detected, the data packet is forwarded to the DPI security protection model. According to the TCP port number of the data packet, the data packet of each protocol is split and sent to the protocol matching engine corresponding to the protocol. After the data packet is input, it is first determined whether the protocol matching engine of the protocol corresponding to the data packet has been started. If not, the corresponding protocol matching engine is started for this protocol. Step S33: Using the Naive Bayes algorithm to perform abnormal behavior data supervision analysis of the industrial control system, the industrial data tuple to be analyzed X = {X1, X2, ..., X k } to analyze and identify the attribute class value C = {C0, C1, ..., C n }, it is calculated that the industrial data tuple X belongs to class C i The probability P(C i |X), the formula is as follows: If the difference between the calculated probability value and the set probability threshold exceeds the set range, the industrial data tuple is judged to be abnormal behavior data, otherwise it is normal.

9. The industrial big data platform system for intelligent supervision according to claim 5 is characterized by: The step S4 further comprises the following steps: Step S41: After receiving the data information that indicates abnormal behavior, immediately transmit an early warning to the staff; Step S42: The industrial data packets that have completed the abnormal analysis, supervision and analysis processing are stored in the blockchain to avoid loss or tampering.

Images