Equipment side safety monitoring method and system based on big data, and electronic equipment

Abstract

The invention relates to the technical field of equipment side safety monitoring, in particular to an equipment side safety monitoring method and system based on big data and electronic equipment. When an equipment operator uses target equipment, identity information, post name information, post task information, names of software of the used target equipment and use duration of the equipment operator are acquired, then an intelligent abnormal operation behavior recognition model of the target equipment is trained, and after model training is completed, the target equipment is subjected to intelligent abnormal operation behavior recognition. The current post name information and post task information of the equipment operator, and the name and the use duration of each software of the used target equipment are comprehensively evaluated, so that intelligent monitoring on whether the subsequent operation of the equipment operator on the target equipment is abnormal or not is realized; the problem that security threats cannot be fundamentally solved due to the fact that protection schemes in the prior art focus on means such as network authentication is solved, and the security, reliability and intelligent degree of security monitoring of the equipment side are improved to a great extent.

Description

Technical Field

[0001] The present invention relates to the technical field of device-side security monitoring, and in particular to a device-side security monitoring method and system based on big data, and electronic equipment. Background Art

[0002] IoT devices are an extension and expansion of the Internet. They connect people, machines and things at any time and any place by combining various information sensing devices with the Internet. However, with the rapid increase in the scale and complexity of access devices, information security issues of IoT devices have been exposed.

[0003] The security protection of existing IoT systems mainly relies on existing network technologies and is implemented through security authentication and other means. However, after a security authentication, permanent permissions are usually obtained, which cannot cope with common security threats such as attacks, deception, and substitution. The emergence of zero-trust networks can be used to deal with the above security threats, but the current protection solutions focus on network authentication and other means, which cannot fundamentally solve the problem of security threats.

[0004] Therefore, the prior art needs to be further developed. Summary of the invention

[0005] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and provide a device-side security monitoring method and system, and electronic equipment based on big data to solve the problems existing in the prior art.

[0006] To achieve the above technical objectives, according to a first aspect of the present invention, the present invention provides a device-side security monitoring method based on big data, comprising: S100, when a device operator uses a target device, obtain the device operator's identity information, the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device used, and form a device operation record data set of the target device according to the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device used; collect a first preset number of device operation record data sets, and divide the collected device operation record data sets into a training data set and a verification data set according to a first preset ratio; S200, using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimize the model parameters, and complete the training of the abnormal operation behavior intelligent recognition model of the target device; S300. After the model training is completed, when the equipment operator uses the target equipment again, the equipment operation record data set of the target equipment is obtained again, and the obtained equipment operation record data set of the target equipment is input into the abnormal operation behavior intelligent recognition model of the target equipment to determine whether the operation of the target equipment by the equipment operator is abnormal, and determine whether to output an alarm signal regarding the abnormal use of the target equipment based on the determination result, and at the same time output the identity information of the equipment operator.

[0007] Specifically, when the equipment operator uses the target equipment, the equipment operator's identity information, the equipment operator's job title information, and the equipment operator's current job task information are obtained, including: When the equipment operator uses the target equipment, the facial image of the equipment operator is obtained, the facial image of the equipment operator is recognized, the equipment operator name and employee code of the equipment operator are obtained, and based on the equipment operator name and employee code of the equipment operator, the job title information of the equipment operator and the current job task information of the equipment operator are called in the MES system.

[0008] Specifically, the method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device includes: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the device operation record data set of the next target device according to the device operation record data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, so as to determine the direction in which the parameter gradient of the abnormal operation behavior intelligent recognition model of the target device is fastest decreasing; the abnormal operation behavior intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, so as to optimize the parameters of the abnormal operation behavior intelligent recognition model of the target device.

[0009] Specifically, the method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device also includes: After each training, the verification data set is input into the preset network layer of the previous training in batches for model parameter verification, and cyclic training is performed, with the total number of training rounds set to the first preset round; the loss value of the preset network layer is recorded, and it is determined whether the loss value meets the first preset condition, and whether to end the training and output the model parameters based on the judgment result.

[0010] Specifically, the determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value meets the first preset condition, the training is terminated and the parameters of the abnormal operation behavior intelligent recognition model of the current target device are output; if the loss value does not meet the first preset condition, the training continues.

[0011] Specifically, the first preset condition is: after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

[0012] Specifically, the model output result of the abnormal operation behavior intelligent recognition model of the target device includes whether the operation of the target device by the device operator is normal or whether the operation of the target device by the device operator is abnormal.

[0013] Specifically, the acquired device operation record data set of the target device is input into the abnormal operation behavior intelligent recognition model of the target device to determine whether the operation of the target device by the device operator is abnormal, and whether to output an alarm signal related to the abnormal use of the target device according to the determination result, and output the identity information of the device operator at the same time, including: If it is determined that the device operator operates the target device normally, a prompt signal indicating that the target device is in normal use is output; If it is determined that the device operator's operation of the target device is abnormal, an alarm signal regarding the abnormal use of the target device is output, and the identity information of the device operator is output at the same time.

[0014] According to a second aspect of the present invention, there is provided a device-side security monitoring system based on big data, comprising: an acquisition module, used to acquire the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to form a device operation record data set of the target equipment according to the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to collect a first preset number of device operation record data sets; A control module is used to divide the collected equipment operation record data set into a training data set and a verification data set according to a first preset ratio; to use the collected training data set to train the abnormal operation behavior intelligent recognition model of the target equipment, and to use the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target equipment to optimize the model parameters and complete the training of the abnormal operation behavior intelligent recognition model of the target equipment; and to obtain the equipment operation record data set of the target equipment again when the equipment operator uses the target equipment again after the model training is completed, input the obtained equipment operation record data set of the target equipment into the abnormal operation behavior intelligent recognition model of the target equipment, determine whether the operation of the target equipment by the equipment operator is abnormal, and determine whether to output an alarm signal regarding the abnormal use of the target equipment according to the determination result, and output the identity information of the equipment operator at the same time.

[0015] According to a third aspect of the present invention, there is provided an electronic device, comprising: a memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the above-mentioned device-side security monitoring method based on big data is implemented.

[0016] Beneficial effects: The present invention obtains the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment, and then trains an intelligent recognition model for abnormal operation behavior of the target equipment. After the model training is completed, a comprehensive evaluation is performed on the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment again, so as to realize intelligent monitoring of whether the subsequent operation of the target equipment by the equipment operator is abnormal, thereby solving the problem that the protection solutions in the prior art all focus on means such as network authentication and cannot fundamentally solve the security threat, and greatly improves the security, reliability and intelligence of device-side security monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of a device-side security monitoring method based on big data provided in a specific embodiment of the present invention; Figure 2 Schematic diagram of the system composition of the device-side security monitoring system based on big data provided in a specific embodiment of the present invention; Figure 3It is a structural diagram of an abnormal operation behavior intelligent recognition model of a target device provided in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the technical solution of the present invention, the technical solution of the present invention is clearly and completely described below in conjunction with the accompanying drawings of the present invention. Based on the embodiments in this application, other similar embodiments obtained by ordinary technicians in this field without making creative work should all fall within the scope of protection of this application. In addition, the directional words mentioned in the following embodiments, such as "up", "down", "left", "right", etc., are only reference to the directions of the accompanying drawings. Therefore, the directional words used are used to illustrate rather than limit the invention.

[0019] The present invention will be further described below in conjunction with the accompanying drawings and preferred embodiments.

[0020] See also Figure 1 The present invention provides a device-side security monitoring method based on big data, comprising: S100. When a device operator uses a target device, the device operator's identity information, the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device are obtained; based on the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device used, a device operation record data set of the target device is formed; a first preset number of device operation record data sets are collected, and the collected device operation record data sets are divided into a training data set and a verification data set according to a first preset ratio.

[0021] Specifically, when the equipment operator uses the target equipment, the equipment operator's identity information, the equipment operator's job title information, and the equipment operator's current job task information are obtained, including: When the equipment operator uses the target equipment, the facial image of the equipment operator is obtained, the facial image of the equipment operator is recognized, the equipment operator name and employee code of the equipment operator are obtained, and based on the equipment operator name and employee code of the equipment operator, the job title information of the equipment operator and the current job task information of the equipment operator are called in the MES system.

[0022] It should be noted here that the MES system stores the names and employee codes of the equipment operators, job title information, and current job task information of each person who can operate the target equipment.

[0023] It should be noted here that when a device operator uses a target device, obtaining a facial image of the device operator, identifying the facial image of the device operator, and obtaining the device operator's name and employee code of the device operator are mature prior arts, and the present invention will not go into details here.

[0024] Specifically, before the device operator uses the target device, the identity authentication is performed. Only if the identity authentication is passed, that is, the device operator has the operation authority of the target device, can the target device be used.

[0025] Specifically, the device operator has the following operating rights for the target device: The MES system stores the name and employee code of the equipment operator, job title information, and current job task information.

[0026] It is understandable that the job title information and current job task information described in the present invention can be specifically set according to the actual needs of the user of the present invention. Preferably, the types of job titles include but are not limited to production positions, technical positions, financial positions, and sales positions. The types of software used in the target device include but are not limited to production software, technical software, financial software, and sales software. The above scheme further improves the intelligence and usability of the present invention and further expands the application scenarios of the present invention.

[0027] It should be noted that the steps before step S100 include: A first preset number, a first preset ratio, a first preset round, and a second preset round are preset in the control module.

[0028] It can be understood that the first preset number, the first preset ratio, the first preset round, and the second preset round can be specifically set according to the actual needs of the user of the present invention. The present invention does not limit the specific values ​​of the above parameters, and there is no regularity in setting the specific values ​​of the above parameters, as long as it is applicable to the device-side security monitoring method based on big data proposed in the present invention.

[0029] Preferably, the present invention sets the first preset number to 100, the present invention sets the first preset ratio to 8:2, the present invention sets the first preset round to 2000 times, and the present invention sets the second preset round to 200. The above settings can further improve the performance of the model and the efficiency of model training, and greatly improve the accuracy and reliability of the prediction of the intelligent recognition model of abnormal operation behavior of the target device of the present invention.

[0030] It is understandable that before the intelligent recognition model of abnormal operation behavior of the target device is officially put into use, the present invention obtains a set of 100 device operation record data of the target device during normal operation, and the relevant management personnel confirm that the operation behaviors of the target device represented by the 100 device operation record data sets are all normal, that is, the device operation record data sets of 100 target devices are used to train the intelligent recognition model of abnormal operation behavior of the target device. After the training of the intelligent recognition model of abnormal operation behavior of the target device is completed, when the device operator uses the target device again, the intelligent recognition model of abnormal operation behavior of the target device is used to identify whether the device operation record data set of the device operator's operation is abnormal. If it is necessary to monitor multiple or multiple target devices, the intelligent recognition model of abnormal operation behavior of each target device can be trained according to the method proposed by the present invention, which further improves the intelligence level and usability of the present invention and greatly expands the application scenarios of the present invention.

[0031] It is understandable that, for example, in the same target device of the same company, under the same position and the same job task, there is a certain coupling relationship between the software usage of the target device, the name of each software used by the target device, and the usage time of each software used by the target device. Software unrelated to the job task will not be used suddenly for a long time. When the equipment operator of a certain target device suddenly uses software unrelated to the job task for a long time, there may be deception or data theft, and at the same time, the coupling relationship will be broken. The present invention determines that the current equipment operation behavior of the equipment operator is abnormal. Based on this, the present invention trains an intelligent recognition model for abnormal operation behavior of the target device.

[0032] S200, using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimize the model parameters, and complete the abnormal operation behavior intelligent recognition model training of the target device.

[0033] Specifically, the method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device includes: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the device operation record data set of the next target device according to the device operation record data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, so as to determine the direction in which the parameter gradient of the abnormal operation behavior intelligent recognition model of the target device is fastest decreasing; the abnormal operation behavior intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, so as to optimize the parameters of the abnormal operation behavior intelligent recognition model of the target device.

[0034] It can be understood that Transformer is a deep learning model based on the self-attention mechanism, which consists of a multi-head attention mechanism and a feedforward neural network. It can process sequence data and capture long-distance dependencies. The Transformer model does not contain traditional convolutional layers, but processes each element in the input sequence through an attention layer. The typical structure of Transformer includes an encoder and a decoder, wherein the encoder is composed of multiple identical layers stacked together, and the decoder adds a self-attention layer on the basis of the encoder to process sequence generation tasks. The present invention uses Transformer to supplement global context information, enhances the model's capabilities in feature extraction and global understanding, greatly improves the performance of the model, and greatly reduces the computational cost.

[0035] Specifically, the preset network layer also includes a ResNet network layer, which is used to classify and predict the output results based on the collected device operation record data set of the target device, and the classification results include normal operation of the target device by the device operator and abnormal operation of the target device by the device operator.

[0036] It should be noted here that ResNet is a deep convolutional neural network, which solves the gradient vanishing problem in deep network training by introducing residual connections. The core component of ResNet is the residual block, which usually contains two or three convolutional layers and a jump connection, which allows the gradient to bypass these convolutional layers directly. The network structure of ResNet can be very deep. These networks extract the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used by stacking multiple residual blocks, and classify and predict the output results through global average pooling and fully connected layers. The classification results include normal operation of the equipment operator on the target equipment and abnormal operation of the equipment operator on the target equipment.

[0037] See also Figure 3 The present invention combines the ResNet network layer and the Transformer network layer. ResNet is good at extracting local features such as the job title information of the equipment operator in the training data set, the current job task information of the equipment operator, the name of each software of the target device used, and the usage time of each software of the target device used, while Transformer can supplement the global context information. This combination can enhance the model's capabilities in feature extraction and global understanding, greatly improve the performance of the model, and greatly reduce the computational cost.

[0038] It can be understood that the ResNet network layer is used to classify and predict the output results through the device operation record data set of the target device collected in the training data set and the verification data set. The specific steps are: (1) First, put the training data set into the Backbones network layer of the model. Backbone refers to a series of convolutional layers that constitute the skeleton of the neural network. The main function of these layers is to extract the features of the input data. The Backbone network is usually composed of multiple convolutional layers, pooling layers, and activation functions. It can extract meaningful feature representations from the original data. Backbones is composed of multiple Backbones, and the core network layer in Backbone is the Resnet network layer. After the data set is input into the model, the device operation record data set of the target device will be input into Backbones for training; (2) When building Backbone, the Resnet network layer and employee coding were added. After the training data set was input, Resnet began to train layer by layer. The training extracted features from the device operation record data set of the target device, assisted Transformer in predicting whether the use of the target device was abnormal. The extracted features obtained the identity information of the employee with the help of the employee coding, which facilitated the relevant management personnel to locate the personnel who operated the target device abnormally.

[0039] Specifically, the method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device also includes: After each training, the verification data set is input into the preset network layer of the previous training in batches for model parameter verification, and cyclic training is performed, with the total number of training rounds set to the first preset round; the loss value of the preset network layer is recorded, and it is determined whether the loss value meets the first preset condition, and whether to end the training and output the model parameters based on the judgment result.

[0040] Specifically, after each training, the verification data set is input into the preset network layer of the previous training in batches to verify the model parameters, and the cyclic training is performed, including the following methods: When the number of training times is not enough and the model needs to be optimized, the training can only be performed from the beginning. Therefore, the present invention develops a method for continuing the following training based on the previously trained model parameter file; (1) Provide custom parameters, which can be set according to user needs to continue training based on any training parameters; (2) Load the parameters of the custom model file; (3) Put the validation data set into the custom parameter network layer for validation, obtain the loss value and record the model parameters of the model corresponding to the minimum loss value during the training process; (4) Based on this set of model parameters, forward propagation training and back propagation are performed, and the optimizer optimizes the parameters to obtain a new set of data; (5) Put the verification data into the new data network layer for inference to obtain the loss value; (6) Perform cyclic training to obtain the best model and complete model optimization.

[0041] It is understandable that the training method adopted by the present invention is batch training, which means that each time the model parameters are updated, only a part of the samples in the validation data set is used, which is called a batch. The advantages of batch training are that it can reduce memory consumption, speed up training, increase randomness, and facilitate the generalization of the model.

[0042] It should be noted here that, in the present invention, batch_size=2, and the batch_size is the batch size. For example, when batch_size=2, it means that two device operation record data sets are selected from the verification data set each time and put into the model for verification.

[0043] Specifically, the determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value satisfies the first preset condition, the training is terminated and the parameters of the abnormal operation behavior intelligent recognition model of the current target device are output; if the loss value does not satisfy the first preset condition, the training is continued; The first preset condition is that after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

[0044] It can be understood that the present invention preferably sets the maximum round of cyclic training to 2000 times, which can effectively ensure the accuracy of the model prediction of the present invention and record the loss value of the model training. The present invention sets the second preset round to 200, that is, when the loss value of the training no longer decreases within 200 rounds of training, the round with the smallest loss value in the 200 rounds of training is saved as the best verification round parameter to generate the best model file. The above setting makes the training rounds no longer rely on manual judgment, but uses the deep learning model for automatic training, which improves the accuracy of the model prediction, and automatically ends the training when the accuracy meets the requirements, which greatly saves the training time, and can also effectively prevent overfitting, which greatly improves the intelligence level of the present invention and the efficiency of model training.

[0045] Furthermore, the specific process of the present invention for training the abnormal operation behavior intelligent recognition model of the target device is as follows: (1) Obtain the latent vector mean mu and logarithmic variance logvar in the forward propagation process of the abnormal operation behavior intelligent recognition model of the target device; (2) Calculate a reasonable loss value representing the training effect: Calculate the divergence: k1=-0.5*(1+logvar-mu^2-(e^logvar)); Calculate the loss between the device operation record data set and the predicted value in the validation data set: loss=L1+k1*k1_weight; Among them, loss is the loss value, k1 is the divergence, k1_weight is the proportion of k1, the value is 10, L1 is the absolute difference between the predicted value and the true value, and the calculation formula of L1 is as follows: ; Among them, A is the L1 loss in pytorch, which calculates the average or sum of the absolute differences between two tensors; the shape of A is N*C*H*W, which indicates that it is a four-dimensional tensor, N represents the number of samples (Batch Size), indicating that there are N data points, C represents the number of channels (Channels), H and W represent the height and width respectively, which are usually the two-dimensional spatial dimensions of the input features; P represents the padding value, which is a Boolean type, and the shape of P is c*h*w*1. The dimensions of P are the same as those of A in terms of channel, height, and width, but there is no sample number N, which means that P is a mask or padding information for a feature map of each sample, and the Boolean value of P may be used to mark whether the elements in A are filled (True) or valid (False).

[0046] (3) The loss value when using the validation data set to validate the current model network; (4) If the validation loss of this round is less than that of the previous round, the best model parameters are replaced with the training model of this round; (5) Put the rounds and loss values ​​into the dictionary one by one; (6) Compare the loss value of the current round with the loss values ​​of the 200 rounds before this round (parameters are provided and can be set according to actual needs, the default is 200), that is, traverse the loss values ​​from epoch-200 to epoch-1 (epoch is the training round, and the comparison is performed when the epoch is greater than 200). If the loss values ​​of the current round of epoch are all greater than the loss values ​​from (epoch-200) to (epoch-1), stop training.

[0047] (7) Save the best model parameters in the cyclic validation as a ckpt model file.

[0048] Specifically, the determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value meets the first preset condition, the training is terminated and the parameters of the abnormal operation behavior intelligent recognition model of the current target device are output; if the loss value does not meet the first preset condition, the training continues.

[0049] Specifically, the first preset condition is: after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

[0050] Specifically, the model output result of the abnormal operation behavior intelligent recognition model of the target device includes whether the operation of the target device by the device operator is normal or whether the operation of the target device by the device operator is abnormal.

[0051] S300. After the model training is completed, when the equipment operator uses the target equipment again, the equipment operation record data set of the target equipment is obtained again, and the obtained equipment operation record data set of the target equipment is input into the abnormal operation behavior intelligent recognition model of the target equipment to determine whether the operation of the target equipment by the equipment operator is abnormal, and determine whether to output an alarm signal regarding the abnormal use of the target equipment based on the determination result, and at the same time output the identity information of the equipment operator.

[0052] Specifically, the acquired device operation record data set of the target device is input into the abnormal operation behavior intelligent recognition model of the target device to determine whether the operation of the target device by the device operator is abnormal, and whether to output an alarm signal related to the abnormal use of the target device according to the determination result, and output the identity information of the device operator at the same time, including: If it is determined that the device operator operates the target device normally, a prompt signal indicating that the target device is in normal use is output; If it is determined that the device operator's operation of the target device is abnormal, an alarm signal regarding the abnormal use of the target device is output, and the identity information of the device operator is output at the same time.

[0053] Specifically, if it is determined that the device operator's operation of the target device is abnormal, the relevant management personnel of the target device can confirm whether the operation behavior of the target device represented by the device operation record data set is indeed abnormal. If the relevant management personnel determine that the operation behavior of the target device represented by the device operation record data set is normal, the device operation record data set can be used as a new training data set to retrain the intelligent recognition model of abnormal operation behavior of the target device, thereby achieving continuous optimization of the intelligent recognition model of abnormal operation behavior of the target device of the present invention, and further improving the reliability and availability of the device-side security monitoring of the present invention.

[0054] Specifically, if it is determined that the device operator's operation on the target device is abnormal, the device operator's operation authority on the target device is deprived, and the target device is controlled to shut down.

[0055] Specifically, depriving the device operator of the operating authority of the target device includes: Delete the current job task information of the equipment operator in the MES system.

[0056] It can be understood that the present invention obtains the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment, and then trains an intelligent recognition model for abnormal operation behavior of the target equipment. After the model training is completed, a comprehensive evaluation is performed on the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment again, thereby realizing intelligent monitoring of whether the subsequent operation of the target equipment by the equipment operator is abnormal, solving the problem that the protection solutions in the prior art all focus on means such as network authentication and cannot fundamentally solve the security threat, and greatly improves the security, reliability and intelligence of device-side security monitoring.

[0057] See also Figure 2 The present invention provides another embodiment, which provides a device-side security monitoring system based on big data, and the device-side security monitoring system based on big data includes: The acquisition module 100 is used to acquire the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to form a device operation record data set of the target equipment according to the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to collect a first preset number of device operation record data sets; The control module 200 is used to divide the collected device operation record data set into a training data set and a verification data set according to a first preset ratio; to use the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, and to use the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device to optimize the model parameters and complete the training of the abnormal operation behavior intelligent recognition model of the target device; and to obtain the device operation record data set of the target device again when the device operator uses the target device again after the model training is completed, input the obtained device operation record data set of the target device into the abnormal operation behavior intelligent recognition model of the target device, determine whether the operation of the target device by the device operator is abnormal, and determine whether to output an alarm signal regarding the abnormal use of the target device based on the determination result, and output the identity information of the device operator at the same time.

[0058] It should be noted here that the present invention obtains the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment, and then trains an intelligent recognition model for abnormal operation behavior of the target equipment. After the model training is completed, a comprehensive evaluation is performed on the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment again, thereby realizing intelligent monitoring of whether the subsequent operation of the target equipment by the equipment operator is abnormal, solving the problem that the protection solutions in the prior art all focus on means such as network authentication and cannot fundamentally solve the security threat, and greatly improves the security, reliability and intelligence of device-side security monitoring.

[0059] In a preferred embodiment, the present application further provides an electronic device, the electronic device comprising: A memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the device-side security monitoring method based on big data is implemented. The computer device can be broadly a server, a terminal, or any other electronic device with necessary computing and / or processing capabilities. In one embodiment, the computer device may include a processor, a memory, a network interface, a communication interface, etc. connected via a system bus. The processor of the computer device can be used to provide necessary computing, processing and / or control capabilities. The memory of the computer device may include a non-volatile storage medium and an internal memory. An operating system, a computer program, etc. may be stored in or on the non-volatile storage medium. The internal memory can provide an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface and the communication interface of the computer device can be used to connect and communicate with external devices through a network. When the computer program is executed by the processor, the steps of the method of the present invention are performed.

[0060] The present invention may be implemented as a computer-readable storage medium having a computer program stored thereon, which causes the steps of the method of an embodiment of the present invention to be executed when executed by a processor. In one embodiment, the computer program is distributed on a plurality of computer devices or processors coupled to a network so that the computer program is stored, accessed and executed in a distributed manner by one or more computer devices or processors. A single method step / operation, or two or more method steps / operations, may be performed by a single computer device or processor or by two or more computer devices or processors. One or more method steps / operations may be performed by one or more computer devices or processors, and one or more other method steps / operations may be performed by one or more other computer devices or processors. One or more computer devices or processors may perform a single method step / operation, or perform two or more method steps / operations.

[0061] It will be appreciated by a person skilled in the art that the method steps of the present invention may be performed by instructing related hardware such as a computer device or a processor through a computer program, and the computer program may be stored in a non-temporary computer-readable storage medium, which causes the steps of the present invention to be performed when the computer program is executed. Depending on the circumstances, any reference to memory, storage, database, or other media herein may include non-volatile and / or volatile memory. Examples of non-volatile memory include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, magnetic tape, floppy disk, magneto-optical data storage device, optical data storage device, hard disk, solid state disk, etc. Examples of volatile memory include random access memory (RAM), external cache memory, etc.

[0062] It can be understood that the present invention obtains the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment, and then trains an intelligent recognition model for abnormal operation behavior of the target equipment. After the model training is completed, a comprehensive evaluation is performed on the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used when the equipment operator uses the target equipment again, thereby realizing intelligent monitoring of whether the subsequent operation of the target equipment by the equipment operator is abnormal, solving the problem that the protection solutions in the prior art all focus on means such as network authentication and cannot fundamentally solve the security threat, and greatly improves the security, reliability and intelligence of device-side security monitoring.

[0063] The various technical features described above can be combined arbitrarily. Although all possible combinations of these technical features are not described, any combination of these technical features should be considered to be covered by this specification as long as there is no contradiction in such combination.

[0064] The specific implementation of the present invention described above does not constitute a limitation on the protection scope of the present invention. Any other corresponding changes and modifications made based on the technical concept of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A device-side security monitoring method based on big data, characterized in that: The method comprises: S100, when a device operator uses a target device, obtain the device operator's identity information, the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device used, and form a device operation record data set of the target device according to the device operator's job title information, the device operator's current job task information, the name of each software of the target device used, and the usage time of each software of the target device used; collect a first preset number of device operation record data sets, and divide the collected device operation record data sets into a training data set and a verification data set according to a first preset ratio; S200, using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimize the model parameters, and complete the training of the abnormal operation behavior intelligent recognition model of the target device; S300. After the model training is completed, when the equipment operator uses the target equipment again, the equipment operation record data set of the target equipment is obtained again, and the obtained equipment operation record data set of the target equipment is input into the abnormal operation behavior intelligent recognition model of the target equipment to determine whether the operation of the target equipment by the equipment operator is abnormal, and determine whether to output an alarm signal regarding the abnormal use of the target equipment based on the determination result, and at the same time output the identity information of the equipment operator.

2. The device-side security monitoring method based on big data according to claim 1 is characterized in that: When the equipment operator uses the target equipment, the equipment operator's identity information, the equipment operator's job title information, and the equipment operator's current job task information are obtained, including: When the equipment operator uses the target equipment, the facial image of the equipment operator is obtained, the facial image of the equipment operator is recognized, the equipment operator name and employee code of the equipment operator are obtained, and based on the equipment operator name and employee code of the equipment operator, the job title information of the equipment operator and the current job task information of the equipment operator are called in the MES system.

3. The device-side security monitoring method based on big data according to claim 1 is characterized in that: The method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device includes: The training data set is input into the preset network layer in batches for training, and the preset network layer includes a Transformer network layer, and the Transformer network layer is used to predict the device operation record data set of the next target device according to the device operation record data set of the current target device by forward propagation, so as to obtain the predicted loss value; the loss value of the preset network layer is calculated and input into the optimizer for optimization, so as to determine the direction in which the parameter gradient of the abnormal operation behavior intelligent recognition model of the target device is fastest decreasing; the abnormal operation behavior intelligent recognition model of the target device is back-propagated according to the loss value and the parameter gradient of the model, so as to optimize the parameters of the abnormal operation behavior intelligent recognition model of the target device.

4. The device-side security monitoring method based on big data according to claim 1 is characterized in that: The method of using the collected training data set to train the abnormal operation behavior intelligent recognition model of the target device, using the verification data set to optimize the model of the abnormal operation behavior intelligent recognition model of the target device, optimizing the model parameters, and completing the abnormal operation behavior intelligent recognition model training of the target device also includes: After each training, the verification data set is input into the preset network layer of the previous training in batches for model parameter verification, and cyclic training is performed, with the total number of training rounds set to the first preset round; the loss value of the preset network layer is recorded, and it is determined whether the loss value meets the first preset condition, and whether to end the training and output the model parameters based on the judgment result.

5. The device-side security monitoring method based on big data according to claim 4 is characterized in that: The determining whether the loss value satisfies the first preset condition, and determining whether to end the training and output the model parameters according to the determination result, includes: If the loss value meets the first preset condition, the training is terminated and the parameters of the abnormal operation behavior intelligent recognition model of the current target device are output; if the loss value does not meet the first preset condition, the training continues.

6. The device-side security monitoring method based on big data according to claim 5 is characterized in that: The first preset condition is that after the second preset round of training, the loss values ​​obtained in the next round of training are greater than or equal to the loss values ​​that occurred during the second preset round of training.

7. The device-side security monitoring method based on big data according to claim 1 is characterized in that: The model output results of the abnormal operation behavior intelligent recognition model of the target device include normal operation of the target device by the device operator and abnormal operation of the target device by the device operator.

8. The device-side security monitoring method based on big data according to claim 7 is characterized in that: The device operation record data set of the acquired target device is input into the abnormal operation behavior intelligent recognition model of the target device to determine whether the operation of the target device by the device operator is abnormal, and whether to output an alarm signal related to the abnormal use of the target device according to the determination result, and output the identity information of the device operator at the same time, including: If it is determined that the device operator operates the target device normally, a prompt signal indicating that the target device is in normal use is output; If it is determined that the device operator's operation of the target device is abnormal, an alarm signal regarding the abnormal use of the target device is output, and the identity information of the device operator is output at the same time.

9. A device-side security monitoring system based on big data, characterized in that: include: an acquisition module, used to acquire the identity information of the equipment operator, the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to form a device operation record data set of the target equipment according to the job title information of the equipment operator, the current job task information of the equipment operator, the name of each software of the target equipment used, and the usage time of each software of the target equipment used; and to collect a first preset number of device operation record data sets; A control module, configured to divide the collected device operation record data set into a training data set and a verification data set according to a first preset ratio; It is used to train the intelligent recognition model of abnormal operation behavior of the target device using the collected training data set, and to optimize the model using the intelligent recognition model of abnormal operation behavior of the target device using the verification data set, optimize the model parameters, and complete the training of the intelligent recognition model of abnormal operation behavior of the target device; it is used to obtain the device operation record data set of the target device again when the device operator uses the target device again after the model training is completed, input the obtained device operation record data set of the target device into the intelligent recognition model of abnormal operation behavior of the target device, determine whether the operation of the target device by the device operator is abnormal, and determine whether to output an alarm signal about the abnormal use of the target device based on the determination result, and output the identity information of the device operator at the same time.

10. An electronic device, characterized in that: include: Memory; and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the device-side security monitoring method based on big data according to any one of claims 1 to 8 is implemented.

Images