Unmanned inspection and intelligent fault judgment method

Abstract

The invention discloses an unmanned inspection and intelligent fault judgment method. A security threat model is constructed through deep learning, potential risks are identified, a strategy is made, security analysis modeling based on a comparison technology is utilized, and system state abnormity is detected. In data transmission, confidentiality and integrity are guaranteed by integrating a plurality of security means, a multi-level protection framework is designed, and all-round defense is carried out from a network boundary, a host terminal and an application system. By means of anomaly detection monitoring index data, anomaly and risk are subjected to correlation analysis, and a basis is provided for decision making. And regularly carrying out security assessment and penetration testing, repairing vulnerabilities, and carrying out optimization and reinforcement. The method covers multiple aspects such as threat modeling, safety analysis, data protection, protection framework construction, anomaly detection and evaluation reinforcement, the safety and reliability of the unmanned inspection system are effectively improved, network attacks and illegal access are resisted, and stable operation of the system is guaranteed.

Description

Technical Field

[0001] The invention belongs to the technical field of fault judgment, and in particular relates to an unmanned inspection and intelligent fault judgment method. Background Art

[0002] Security comparison of unmanned inspection system In unmanned inspection systems, security is the primary consideration. By introducing the security mechanism of unmanned inspection system, it is possible to resist network attacks and illegal access. The comparison technology can identify normal and abnormal states in security analysis to help detect and respond to threats. In practical applications, it is necessary to combine security protocols, encryption technology and access control strategies for detailed security architecture design. This includes defining threat models, security strategies and specific technical measures. For example, deep learning-based anomaly detection technology and data encryption can be used to monitor the data transmission of unmanned inspection systems, and potential security risks can be prevented by identifying behaviors that deviate from expected patterns.

[0003] The openness and interconnectedness of the unmanned inspection system make it extremely vulnerable to cyber attacks, including malicious intrusions by hackers, data theft, malware implantation, etc., and the risk of illegal access is also increasing. The confidentiality and integrity of data during transmission and storage are difficult to guarantee. Once the data is leaked or tampered with, it may lead to serious consequences, such as production failures, privacy violations, and economic losses. In addition, existing security protection measures often lack systematicity and depth, making it difficult to cope with the complex and changing security threat environment, and are particularly vulnerable when facing new attack methods.

[0004] In summary, the technical problems to be solved by the present invention are: the unmanned inspection system faces high risks of network attacks and illegal access, the security of data transmission and storage is difficult to ensure, and the overall security protection system is imperfect. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide an unmanned inspection and intelligent fault judgment method. In terms of security threat prevention, an accurate security threat model is constructed through a deep learning algorithm, which can identify potential network attacks and illegal access risks in advance, and formulate targeted strategies in combination with a decision tree algorithm to effectively reduce the possibility of being attacked. The security analysis method based on comparative technology can monitor the system operation status in real time, detect anomalies in time and trigger a response mechanism to ensure the stability of system operation.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is: An unmanned inspection and intelligent fault judgment method, the steps are: S1. According to the business characteristics of the unmanned inspection system, a security threat model of the unmanned inspection system is constructed to identify potential network attacks and illegal access risks, and to formulate security strategies and technical measures. S2. A security analysis method based on comparative technology is used to model the operating status of the unmanned inspection system through a deep learning algorithm to obtain the characteristic patterns of normal and abnormal states. If the operating status of the unmanned inspection system is detected to deviate from the normal mode, it is determined that there is a potential security threat and a real-time response mechanism is triggered. S3. In the data transmission process of the unmanned inspection system, security protocols, encryption technologies and access control strategies are used comprehensively to encrypt and protect the transmitted data and control permissions to prevent data from being illegally intercepted and tampered with, and to ensure the confidentiality and integrity of data transmission. S4. For unmanned inspection scenarios, multiple A hierarchical security protection architecture deploys security protection measures at different levels, including network boundaries, host terminals, and application unmanned inspection systems. By building a deep defense system, the security protection capabilities of the unmanned inspection system are comprehensively improved; S5. Utilize anomaly detection methods to continuously monitor various indicator data during the operation of the unmanned inspection system, and compare and analyze them with the pre-established normal mode to promptly discover abnormal behaviors that deviate from the expected threshold, identify potential security risks, and provide a basis for subsequent security decisions; S6. Regularly conduct security assessments and penetration tests of unmanned inspection systems, comprehensively check for security vulnerabilities and weak links in the unmanned inspection system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned inspection system and its ability to resist external attacks.

[0007] Preferably, the sub-steps of S1 are: S1.1. Based on the business characteristics of the unmanned inspection system, a deep learning algorithm is used to analyze the historical operation data of the unmanned inspection system, build a security threat model for the unmanned inspection system, and identify potential network attacks and illegal access risks; S1.2. For the identified security threats, the decision tree algorithm is used in combination with the preset security policy knowledge base to automatically infer targeted security protection measures; S1.3. Obtain the real-time operation data of the unmanned inspection system, and compare and analyze it with the security threat model to determine in real time whether there is a risk of network attack and illegal access to the unmanned inspection system. If so, trigger the corresponding security protection measures; S1.4. Based on the new security threats identified during the operation of the unmanned inspection system, the existing security threat model and security policy knowledge base are continuously optimized and improved through reinforcement learning algorithms to enhance the security protection capabilities of the unmanned inspection system. S1.5. In view of the characteristics of unmanned inspection business scenarios, a distributed security protection mechanism based on blockchain is deployed to encrypt, store and verify the key business data of the unmanned inspection system to ensure the confidentiality and integrity of the data; S1.6. Adopt zero-trust architecture to strictly authenticate and authorize the identities of all users and devices in the unmanned inspection system, minimize potential internal threats, and further enhance the overall security of the unmanned inspection system; S1.7. Continuously monitor the safe operation status of the unmanned inspection system, and present the security threat situation of the unmanned inspection system in real time through visualization technology, provide intuitive decision-making support for security managers, and continuously optimize the safety protection level of the unmanned inspection system.

[0008] Preferably, the sub-steps of S2 are: S2.1. Based on the deep learning algorithm, feature extraction and representation learning are performed on the operating status data of the unmanned inspection system to build a feature model of the unmanned inspection system status; S2.2, using an unsupervised learning method, clustering the state features of the unmanned inspection system through a clustering algorithm to obtain feature clusters representing normal modes and feature clusters representing abnormal modes; S2.3. During the operation of the unmanned inspection system, the status data of the unmanned inspection system is obtained in real time, the feature vector is extracted, and the similarity between the feature vector and the feature cluster of the normal mode is calculated; S2.4. If the feature vector deviates from the feature cluster of the normal mode by more than the preset threshold, it is determined that the unmanned inspection system is in an abnormal state and there is a potential security threat; S2.5. Dynamically adjust the strategy and intensity of the real-time response mechanism according to the severity and threat level of the abnormal state; S2.6. Through active defense measures, abnormal behaviors are blocked and isolated, the impact range of security threats is reduced, and the safe and stable operation of the unmanned inspection system is ensured; S2.7. Continue to optimize deep learning models and continuously improve the accuracy of anomaly detection and the efficiency of real-time response through incremental learning and online learning.

[0009] Preferably, the sub-steps of S3 are: S3.1. According to the sensitivity of the data and the transmission environment, a secure transmission channel is established through a security protocol to encrypt and protect the transmission process; the security protocol is SSL or TLS; S3.2, using a combination of symmetric encryption and asymmetric encryption to encrypt the transmitted data; S3.3. Ensure the confidentiality and integrity of encryption keys through a secure key management mechanism; S3.4. Before transmitting data, digitally sign the data to ensure data integrity; S3.5. The receiver verifies the digital signature to determine whether the data has been tampered with; S3.6, role-based access control strategy to manage permissions for different users and unmanned inspection systems; S3.7, through identity authentication and authorization mechanisms, restrict illegal users from accessing and operating data; S3.8. During the transmission process, secure routing protocols and network isolation technologies are used to prevent data from being illegally intercepted and eavesdropped during transmission; S3.9. Establish a sound log audit and monitoring mechanism to conduct real-time monitoring of the data transmission process and detect abnormal behavior; S3.10. Identify and warn of potential security threats through machine learning algorithms; S3.11. Regularly evaluate and update security protocols, encryption algorithms, and access control policies to ensure they adapt to changing security situations and technological developments; S3.12. Improve the overall security of data transmission through continuous security reinforcement and optimization.

[0010] Preferably, the sub-steps of S4 are: S4.1. Firewalls and intrusion detection systems are deployed at the network boundary to monitor and filter the data traffic in and out of the network in real time. If malicious traffic or attack behavior is found, it will be immediately blocked and an alarm will be issued. At the same time, relevant logs will be recorded for subsequent analysis and tracking; S4.2. Install anti-virus software and host intrusion detection system on the host terminal to monitor the files, processes and registry on the terminal in real time. Use feature code matching and behavior analysis technology to determine whether there are malicious programs such as viruses and Trojans. If detected, immediately isolate or delete them and report alarm information; S4.3. For the unmanned application inspection system, a Web application firewall is used to conduct in-depth inspection of access traffic. Through the rule engine and machine learning algorithm, common Web attacks such as SQL injection and cross-site scripting are identified and blocked. At the same time, user identity is authenticated and authorized to avoid illegal access and unauthorized operations. S4.4. Establish a security management platform to centrally manage security equipment and unmanned inspection systems at all levels. Through unified policy configuration and management, ensure the consistency and effectiveness of various protection measures. At the same time, conduct correlation analysis on various security events to timely discover potential security threats. S4.5. Regularly carry out security assessment and penetration testing to comprehensively assess the security status of the unmanned inspection system. Through simulated attacks, identify the weak links and loopholes in the unmanned inspection system, and propose targeted rectification measures to continuously improve the security protection capabilities of the unmanned inspection system. S4.6. Strengthen safety awareness education and training, improve the safety awareness and skills of relevant personnel, and enable them to master basic safety operation specifications and emergency response methods through regular safety publicity and training; S4.7. Establish a sound safety management system and process, clarify the safety responsibilities and operating procedures of each position, standardize personnel behavior through institutionalized and process-based management, reduce human errors and internal threats, and provide institutional guarantees for the safe operation of the unmanned inspection system.

[0011] Preferably, the sub-steps of S5 are: S5.1. Obtain various indicator data during the operation of the unmanned inspection system, establish a corresponding time series data model for each indicator, and form a normal pattern of the indicator data; S5.2. Use clustering algorithm to perform cluster analysis on indicator data, determine the normal value range of each indicator according to the clustering results, and obtain the expected threshold value; S5.3. During the operation of the unmanned inspection system, real-time data of various indicators are continuously obtained, and the real-time data is compared with the expected threshold. If the real-time data deviates from the expected threshold, it is judged as abnormal behavior; S5.4. For detected abnormal behaviors, use association rule mining algorithms to analyze the correlation between abnormal behaviors and security risks, and obtain potential security risks that may be caused by abnormal behaviors; S5.5. Based on the severity of abnormal behavior and the size of potential security risks, use the decision tree algorithm to generate corresponding security decision rules to provide a basis for subsequent security decisions; S5.6. Continuously perform anomaly detection and safety risk analysis during the operation of the unmanned inspection system, dynamically adjust the expected threshold and safety decision-making rules based on the analysis results, and improve the accuracy of anomaly detection and the effectiveness of safety decisions; S5.7. Feedback the results of anomaly detection and safety decision-making to the unmanned inspection system administrator in real time to assist the administrator in taking corresponding safety precautions in a timely manner, reduce safety risks, and ensure the safe and stable operation of the unmanned inspection system.

[0012] Preferably, the sub-steps of S6 are: S6.1. Develop a comprehensive security assessment and penetration testing plan based on the architecture and business characteristics of the unmanned inspection system, clarify the scope, methods and frequency of the assessment, and ensure the systematic and continuous nature of the unmanned inspection assessment work; S6.2. Use a combination of automated vulnerability scanning tools and manual penetration testing to fully identify security vulnerabilities and weak links in the unmanned inspection system, and classify and rate the vulnerabilities according to their severity and impact. S6.3. Develop detailed repair and reinforcement plans for identified security vulnerabilities and weak links in a timely manner, clearly define the repair priorities, responsible persons and completion deadlines, and ensure that the vulnerabilities can be repaired in a timely and effective manner; S6.4. After the vulnerability is fixed, the effectiveness of the repair measures shall be verified through regression testing and verification testing, and the unmanned inspection system shall be reinforced after the repair to improve the overall safety performance of the unmanned inspection system; S6.5. Establish a security vulnerability management database to record all identified security vulnerabilities and weaknesses, as well as corresponding repair and reinforcement measures, and conduct regular statistical analysis to understand the changing trends of the security status of the unmanned inspection system; S6.6. Analyze and mine security vulnerability data through machine learning algorithms to identify common problems and weak links in unmanned inspection systems and provide decision support for subsequent security reinforcement; machine learning algorithms include support vector machines, decision trees, and random forests; S6.7. Based on the analysis results of machine learning, continuously optimize and improve the methods and strategies of security assessment and penetration testing, improve the pertinence and effectiveness of the assessment, and continuously improve the overall security performance of the unmanned inspection system and its ability to resist external attacks.

[0013] An unmanned inspection and intelligent fault diagnosis system, comprising: Threat modeling and strategy generation module, which is used to build a security threat model for the unmanned inspection system based on the business characteristics of the unmanned inspection system, identify potential network attacks and illegal access risks, and formulate security strategies and technical measures; The deep learning security analysis module is used to adopt a security analysis method based on contrast technology, model the operating status of the unmanned inspection system through a deep learning algorithm, and obtain the characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is judged that there is a potential security threat and triggers a real-time response mechanism; The data security module is used to encrypt and protect the transmitted data and control the permissions of the transmitted data by comprehensively applying security protocols, encryption technologies and access control strategies during the data transmission process of the unmanned inspection system, so as to prevent the data from being illegally intercepted and tampered with, and ensure the confidentiality and integrity of the data transmission; The multi-level security protection deployment module is used to design a multi-level security protection architecture for unmanned inspection scenarios. Security protection measures are deployed at different levels, including network boundaries, host terminals, and application unmanned inspection systems. By building a defense-in-depth system, the security protection capabilities of the unmanned inspection system are comprehensively improved. The anomaly detection and risk judgment module is used to continuously monitor various indicator data during the operation of the unmanned inspection system using anomaly detection methods. By comparing and analyzing with the pre-established normal mode, it can timely discover abnormal behaviors that deviate from the expected threshold, judge potential safety risks, and provide a basis for subsequent safety decisions; The security assessment and reinforcement module is used to regularly conduct security assessments and penetration tests on the unmanned inspection system, comprehensively check for security vulnerabilities and weak links in the unmanned inspection system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned inspection system and its ability to resist external attacks.

[0014] A computer device comprising: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, an unmanned inspection and intelligent fault judgment method as described is implemented.

[0015] A computer-readable storage medium stores a computer program, which, when executed, implements an unmanned inspection and intelligent fault judgment method as described above.

[0016] The present invention can achieve the following beneficial effects: 1. The present invention constructs a multi-level security protection architecture to target potential network attacks and illegal access risks in unmanned inspection scenarios. The operating status of the unmanned inspection system is modeled through a deep learning algorithm to obtain characteristic patterns of normal and abnormal states. During data transmission, security protocols, encryption technologies, and access control strategies are used in combination to ensure the confidentiality and integrity of data transmission. The present invention utilizes anomaly detection technology to continuously monitor the operating indicators of the unmanned inspection system, and promptly detects abnormal behaviors that deviate from the expected threshold by comparing and analyzing them with the pre-established normal mode. At the same time, security assessments and penetration tests are carried out regularly to comprehensively investigate security vulnerabilities and weak links, and to take timely repair and reinforcement measures. By constructing a defense-in-depth system, the present invention has comprehensively improved the security protection capabilities of the unmanned inspection system and effectively responded to security threats in complex environments.

[0017] 2. The present invention builds an accurate security threat model through deep learning algorithms, which can identify potential network attacks and illegal access risks in advance, and formulate targeted strategies in combination with decision tree algorithms to effectively reduce the possibility of being attacked. The security analysis method based on comparative technology can monitor the system operation status in real time, detect anomalies in time and trigger response mechanisms to ensure the stability of system operation.

[0018] 3. The present invention utilizes a multi-level security protection architecture to provide all-round protection from network boundaries, host terminals to application systems, builds a defense-in-depth system, greatly improves overall security protection capabilities, and reduces security vulnerabilities and weak links.

[0019] 4. The present invention accurately determines potential security risks and provides a basis for decision-making, facilitating timely implementation of preventive measures. Regular security assessments and penetration tests can promptly discover and repair vulnerabilities, and machine learning-based analysis and optimization can continuously improve system security and the ability to resist external attacks, allowing the system to maintain good adaptability and reliability in a complex and changing security environment, reducing operation and maintenance costs and safety accident losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 The present invention is a flowchart of an unmanned inspection and intelligent fault judgment method.

[0021] Figure 2 It is a schematic diagram of an unmanned inspection and intelligent fault judgment method of the present invention.

[0022] Figure 3 This is another schematic diagram of an unmanned inspection and intelligent fault judgment method of the present invention. DETAILED DESCRIPTION

[0023] The preferred solution is Figures 1 to 3 As shown, an unmanned inspection and intelligent fault judgment method, the steps are: S1. According to the business characteristics of the unmanned inspection system, build a security threat model for the unmanned inspection system, identify potential network attacks and illegal access risks, and formulate security strategies and technical measures; S1.1. Based on the business characteristics of the unmanned inspection system, a deep learning algorithm is used to analyze the historical operation data of the unmanned inspection system, build a security threat model for the unmanned inspection system, and identify potential network attacks and illegal access risks; Deep learning algorithms can use convolutional neural networks (CNN) or recurrent neural networks (RNN). For example, if the unmanned inspection system involves a large amount of image data (such as monitoring images of the inspection area), CNN can be used to analyze abnormal patterns in the image, such as unauthorized personnel breaking into the image area. For time-series data such as system operation log data, RNN can better capture the contextual features in the data to identify potential risks. Taking an electric power inspection system as an example, the historical operation data contains time-series data such as power fluctuations and temperature changes of the equipment. By analyzing these data through RNN, some abnormal power and temperature change combination patterns may be found, indicating the possible risk of equipment failure or the risk of network attacks that maliciously tamper with power data.

[0024] S1.2. For the identified security threats, the decision tree algorithm is used in combination with the preset security policy knowledge base to automatically infer targeted security protection measures; The decision tree algorithm works based on a preset security policy knowledge base. For example, the knowledge base contains protection policies for different types of network attacks (such as DDoS attacks, malware intrusions, etc.). When the identified security threat is a suspected DDoS attack (judged by features such as a sudden increase in network traffic and dispersed sources), the decision tree algorithm will automatically infer the corresponding security protection measures based on the policy branches for DDoS attacks in the knowledge base, such as increasing network bandwidth restrictions, enabling traffic cleaning services, etc.

[0025] S1.3. Obtain the real-time operation data of the unmanned inspection system, and compare and analyze it with the security threat model to determine in real time whether there is a risk of network attack and illegal access to the unmanned inspection system. If so, trigger the corresponding security protection measures; Real-time operation data may include network data packet information, device operation status parameters, etc. When comparing with the security threat model, for example, for network data packets, the source address, destination address, port number and other information will be checked to see if they conform to the model characteristics corresponding to the normal business process. If a source address is found to send requests to a large number of different destination addresses in a short period of time, and this behavior does not conform to the network communication characteristics under the normal business model (the connection frequency and target distribution of the normal network communication source address in the security threat model have certain rules), it may be judged that there is a risk of network attack, which in turn triggers security protection measures such as blocking access to the source address.

[0026] S1.4. Based on the new security threats identified during the operation of the unmanned inspection system, the existing security threat model and security policy knowledge base are continuously optimized and improved through reinforcement learning algorithms to enhance the security protection capabilities of the unmanned inspection system. During the operation of the unmanned inspection system, suppose a new type of command tampering attack against a specific type of inspection equipment occurs. The reinforcement learning algorithm will adjust the parameters for judging the legitimacy of commands in the security threat model based on the newly emerged attack data (such as the characteristics of the tampered commands, abnormal responses of the equipment, etc.), and update the security policy knowledge base at the same time, adding protection strategies for this new type of attack, such as upgrading the encryption method for command transmission of this type of equipment, adding command verification steps, etc., thereby improving the system's protection against new threats.

[0027] S1.5. In view of the characteristics of unmanned inspection business scenarios, a distributed security protection mechanism based on blockchain is deployed to encrypt, store and verify the key business data of the unmanned inspection system to ensure the confidentiality and integrity of the data; Taking the distributed security protection mechanism of blockchain as an example, in the unmanned inspection system, for key inspection data (such as the test result data of important equipment), the encrypted hash function of blockchain is used to encrypt and store the data. Each data block contains the hash value of the previous data block, forming a chain structure. When the data is transmitted or stored, the receiver or storage node can verify the hash value to ensure that the data has not been tampered with. For example, in an unmanned inspection system for an oil pipeline, key inspection data such as pipeline pressure and flow are transmitted and stored between different monitoring points and data centers. Blockchain technology ensures the integrity and confidentiality of this data to prevent the data from being maliciously modified or stolen during transmission.

[0028] S1.6. Adopt zero-trust architecture to strictly authenticate and authorize the identities of all users and devices in the unmanned inspection system, minimize potential internal threats, and further enhance the overall security of the unmanned inspection system; Under the zero-trust architecture, users (such as inspection system administrators, data analysts, etc.) and devices (such as inspection robots, data collection terminals, etc.) in the unmanned inspection system need to undergo strict identity authentication and authorization every time they access system resources. For example, when an administrator logs into the system, in addition to the regular username and password verification, multi-factor authentication such as dynamic verification code verification and biometric recognition (such as fingerprint recognition or facial recognition) may also be required. When a device is connected to the system, it is necessary to verify the device's unique identifier (such as the device serial number) and pre-configured access key and other information. Only authenticated and authorized users and devices can access the corresponding system resources. This effectively prevents illegal users or compromised devices from performing malicious operations even in an internal network environment, minimizing internal threats.

[0029] S1.7. Continuously monitor the safe operation status of the unmanned inspection system, and present the security threat situation of the unmanned inspection system in real time through visualization technology, provide intuitive decision-making support for security managers, and continuously optimize the safety protection level of the unmanned inspection system.

[0030] Through visualization technology, for example, the security threat situation can be displayed in the form of a dashboard. The network security status of the unmanned inspection system (such as the number of attacks, type distribution), equipment security status (such as equipment failure rate, number of abnormal devices) and other information are presented in the form of charts. Security managers can intuitively see the changing trend of the overall security level of the system. If it is found that the number of network attacks suddenly increases within a certain period of time and is concentrated in a specific type (such as SQL injection attacks), managers can adjust security policies in a timely manner based on this information, such as strengthening restrictions on database access, updating firewall rules, etc., thereby optimizing the system's security protection level. S2. Using a security analysis method based on comparative technology, the operating status of the unmanned inspection system is modeled through a deep learning algorithm to obtain the characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is judged that there is a potential security threat and a real-time response mechanism is triggered; S2.1. Based on the deep learning algorithm, feature extraction and representation learning are performed on the operating status data of the unmanned inspection system to build a feature model of the unmanned inspection system status; When deep learning algorithms are used for feature extraction and representation learning, for example, for the equipment operating status data in the unmanned inspection system (such as the motor's speed, temperature, vibration frequency, etc.), the complex relationship and feature representation between these data can be automatically learned through a multi-layer neural network. Taking the unmanned equipment inspection system of a factory as an example, the deep learning model can convert the motor's speed, temperature, vibration frequency and other data during normal operation into a low-dimensional feature vector, which can comprehensively reflect the health status characteristics of the motor, thereby building a feature model of the system status.

[0031] S2.2, using an unsupervised learning method, clustering the state features of the unmanned inspection system through a clustering algorithm to obtain feature clusters representing normal modes and feature clusters representing abnormal modes; Unsupervised learning clustering algorithms, such as the K-Means clustering algorithm, can cluster system status features. In an unmanned inspection system, a large amount of equipment operating status feature data is used as input, and the K-Means algorithm divides the data into different clusters based on the similarity of the data. For example, the equipment features in normal operation are clustered into one category (representing the feature cluster of normal mode), while the abnormal features generated when a failure or attack occurs are clustered into another category (representing the feature cluster of abnormal mode). For example, in an unmanned inspection system of an automated production line, the temperature, pressure and other feature data of the equipment during normal production form a relatively stable cluster. When the equipment fails (such as wear of parts leading to increased friction, and then temperature rise and abnormal pressure), the feature data in these abnormal states will form another significantly different cluster.

[0032] S2.3. During the operation of the unmanned inspection system, the status data of the unmanned inspection system is obtained in real time, the feature vector is extracted, and the similarity between the feature vector and the feature cluster of the normal mode is calculated; During system operation, real-time system status data, such as new data collected by device sensors, will be extracted as feature vectors. For example, for an unmanned inspection system of an intelligent building, real-time elevator operation data (such as operating speed, floor dwell time, load, etc.) is extracted as feature vectors, and similarity is calculated with the feature cluster of the normal mode (obtained by clustering a large amount of historical normal operation data). The method for calculating similarity can use a metric such as Euclidean distance to calculate the distance between the feature vector and the center of the normal mode feature cluster. The closer the distance, the higher the similarity.

[0033] S2.4. If the feature vector deviates from the feature cluster of the normal mode by more than the preset threshold, it is determined that the unmanned inspection system is in an abnormal state and there is a potential security threat; The preset threshold can be determined based on the accuracy requirements of the system and the statistical analysis of historical data. For example, in an unmanned traffic monitoring inspection system, the similarity threshold between the feature vector of vehicle flow data and the feature cluster of the normal mode is set to 0.8 (a suitable threshold can be calculated based on a large amount of historical normal flow data). If the similarity calculated at a certain moment is less than 0.8, it means that the vehicle flow pattern is abnormal, and there may be traffic congestion, accidents, or malicious interference with traffic signals leading to abnormal gathering of vehicles. At this time, it is determined that the system is in an abnormal state and there is a potential security threat.

[0034] S2.5. Dynamically adjust the strategy and intensity of the real-time response mechanism according to the severity and threat level of the abnormal state; The severity and threat level of abnormal conditions can be determined based on a variety of factors. For example, in an unmanned inspection system of a financial data center, if an abnormality is found in database access, if it is only an incorrect login attempt by a single user, the threat level may be low; but if it is a large number of intensive access attempts from external unknown IP addresses, and there is a tendency to break through the firewall restrictions, the threat level is high. Depending on the threat level, the strategy and intensity of the real-time response mechanism will be different. For low threat levels, it may only record logs and issue minor alarms; for high threat levels, it may immediately cut off all external network connections, start data backup and encryption, and other high-intensity measures.

[0035] S2.6. Through active defense measures, abnormal behaviors are blocked and isolated, the impact range of security threats is reduced, and the safe and stable operation of the unmanned inspection system is ensured; Active defense measures can take many forms. For example, in an unmanned network service inspection system, once abnormal network traffic (such as suspected DDoS attack traffic) is detected, the active defense system can automatically divert the attack traffic to a dedicated honeypot server, making the attacker mistakenly believe that the attack is successful. At the same time, it protects the real server resources, blocks and isolates abnormal behaviors, avoids affecting normal user services, reduces the impact of security threats, and ensures the safe and stable operation of the system.

[0036] S2.7. Continuously optimize deep learning models to continuously improve the accuracy of anomaly detection and the efficiency of real-time response through incremental learning and online learning.

[0037] Incremental learning and online learning are effective ways to optimize deep learning models. For example, in an unmanned inspection system of an e-commerce platform, as the business develops, new promotional activities, new user behavior patterns, etc. will generate new data features. Incremental learning can only learn and update the model based on the original deep learning model, without the need to retrain the entire model, saving computing resources and time. Online learning can adjust model parameters in real time according to new data. For example, when a new abnormal user login pattern is found (such as using new malware to bypass login verification), the model can learn and update quickly, improve the accuracy of anomaly detection and the efficiency of real-time response, and better adapt to dynamic changes in the system operation process. S3. During the data transmission process of the unmanned inspection system, security protocols, encryption technologies, and access control strategies are used comprehensively to encrypt and protect the transmitted data and control permissions to prevent data from being illegally intercepted and tampered with, and to ensure the confidentiality and integrity of data transmission; S3.1. According to the sensitivity of the data and the transmission environment, a secure transmission channel is established through a security protocol to encrypt and protect the transmission process; the security protocol is SSL or TLS; When the SSL / TLS protocol establishes a secure transmission channel, for example, in a remote medical unmanned inspection system, the patient's medical data (such as physical examination reports, imaging data, etc.) is transmitted from the primary medical site to the data center of the superior hospital. Through the handshake process, the SSL / TLS protocol negotiates encryption algorithms, exchanges keys and other information between the client (primary medical site equipment) and the server (hospital data center server) to establish an encrypted transmission channel. This channel can prevent data from being stolen or tampered with by hackers during Internet transmission, ensuring the confidentiality and integrity of medical data.

[0038] S3.2, using a combination of symmetric encryption and asymmetric encryption to encrypt the transmitted data; The combination of symmetric encryption and asymmetric encryption has many application scenarios. For example, in an unmanned file inspection system within an enterprise, a symmetric encryption algorithm (such as AES) can be used for a large number of ordinary file transmissions because of its fast encryption and decryption speed and the use of the same key to encrypt and decrypt files. For the transmission of important information such as system configuration files or user keys, an asymmetric encryption algorithm (such as RSA) is first used to encrypt and transmit the symmetric encryption key. After the receiver uses the private key to decrypt the symmetric encryption key, the symmetric encryption key is used to decrypt the file. This ensures encryption efficiency and improves security.

[0039] S3.3. Ensure the confidentiality and integrity of encryption keys through a secure key management mechanism; A secure key management mechanism can be implemented using a key distribution center (KDC). In a distributed unmanned warehouse inspection system, data needs to be transmitted between devices in multiple warehouses. KDC is responsible for generating, distributing, and managing encryption keys. For example, when the inventory management device in one warehouse needs to interact with the inventory counting device in another warehouse, KDC generates and distributes appropriate symmetric encryption keys for them based on the identity information and permissions of the devices, and ensures the confidentiality and integrity of the keys during transmission and storage, preventing the keys from being leaked and causing illegal decryption of data.

[0040] S3.4. Before transmitting data, digitally sign the data to ensure data integrity; The process of digital signature is to encrypt the hash value of the data using the sender's private key. For example, in an e-government unmanned inspection system, the official document data issued by the government department is digitally signed before transmission. The sender first calculates the hash value of the official document data, and then uses its own private key to encrypt the hash value to obtain a digital signature, and sends the digital signature and the official document data together. After receiving the data, the receiver first calculates the hash value of the data, and then uses the sender's public key to decrypt the digital signature to obtain the original hash value. If the two hash values ​​are consistent, it means that the data has not been tampered with, ensuring the integrity of the data.

[0041] S3.5. The receiver verifies the digital signature to determine whether the data has been tampered with; The process of the receiver verifying the digital signature is like the example of the unmanned inspection system of e-government mentioned above. The receiver uses the sender's public key to decrypt the digital signature and obtains a hash value, which is compared with the data hash value calculated by itself. If the two do not match, it means that the data has been tampered with during the transmission process. The receiver can refuse to receive the data or take corresponding security measures, such as issuing an alarm and recording a log, so as to trace the source of the data tampering later.

[0042] S3.6, role-based access control strategy to manage permissions for different users and unmanned inspection systems; Role-based access control strategies have clear applications in unmanned inspection systems. For example, in an unmanned equipment inspection system of a large enterprise, the system administrator role can modify the configuration parameters of all equipment and view all inspection data; while the ordinary inspector role can only view the equipment inspection data of the area he is responsible for and cannot modify the equipment configuration. By assigning different permissions to different roles, such as read, write, and modify permissions on database tables, permissions management is performed on different users and systems to prevent illegal users from unauthorized access to data.

[0043] S3.7, through identity authentication and authorization mechanisms, restrict illegal users from accessing and operating data; Identity authentication and authorization mechanisms can use a combination of multiple technologies. For example, in a financial unmanned transaction inspection system, when a user logs in, they first verify their username and password, and then they may need to enter a dynamic verification code (such as a text message verification code or a time-based one-time password TOTP), and they may also perform biometric identification (such as fingerprint recognition or facial recognition). Only after passing these multi-factor authentications will the system authorize the user according to their role and permissions, allowing the user to perform corresponding transaction operations or data access, and restricting illegal users from accessing and operating data.

[0044] S3.8. During the transmission process, secure routing protocols and network isolation technologies are used to prevent data from being illegally intercepted and eavesdropped during transmission; Secure routing protocols and network isolation technologies play an important role in unmanned inspection systems. For example, in an unmanned inspection system of an industrial control network, secure routing protocols such as OSPF are used to isolate and guide network traffic in different areas (such as production areas, management areas, and monitoring areas) by setting routing policies to prevent data from being illegally intercepted and eavesdropped during transmission. For example, equipment data in the production area can only be transmitted to a specific monitoring server and cannot be accessed by equipment or networks in other areas, ensuring the security of the data transmission path.

[0045] S3.9. Establish a sound log audit and monitoring mechanism to conduct real-time monitoring of the data transmission process and detect abnormal behavior; The log audit and monitoring mechanism can record detailed data transmission information. For example, in an unmanned network inspection system of an Internet service provider, the log records include the source address, destination address, transmission time, amount of data transmitted, protocol used, and other information of the data transmission. By monitoring these log information in real time, abnormal behavior can be discovered, such as a source address transmitting data to a large number of different destination addresses in a short period of time (which may be a prelude to malicious data leakage or DDoS attacks), and timely warnings can be issued and corresponding security measures can be taken.

[0046] S3.10. Identify and warn of potential security threats through machine learning algorithms; Machine learning algorithms have many applications in identifying and warning of potential security threats. For example, in an unmanned resource inspection system on a cloud computing platform, the naive Bayes algorithm is used to analyze data transmission logs. By learning a large amount of historical normal data and known attack data, a probability model of data transmission behavior is established. When a new data transmission behavior appears, the probability of it being normal or abnormal is calculated based on the model. If a data transmission behavior is judged to have a high probability of abnormality (such as a large amount of data is transmitted to an unknown external IP address, and this behavior rarely appears in normal data), an early warning is issued to identify and warn of potential security threats.

[0047] S3.11. Regularly evaluate and update security protocols, encryption algorithms, and access control policies to ensure they adapt to changing security situations and technological developments; It is necessary to regularly evaluate and update security protocols, encryption algorithms, and access control policies. For example, with the development of quantum computing technology, traditional encryption algorithms (such as RSA) may face the risk of being cracked. In the unmanned data inspection system of a scientific research institution, it is necessary to regularly evaluate the security of the encryption algorithms currently used, study new encryption algorithms that are resistant to quantum computing attacks (such as quantum key distribution QKD related technologies) and update them. At the same time, with the continuous changes in network attack methods, such as new zero-day vulnerability exploitation attacks, it is necessary to timely update security protocols (such as vulnerability repairs and version upgrades of SSL / TLS protocols) and access control policies (such as permission restriction adjustments for new vulnerabilities) to ensure that they adapt to the ever-changing security situation and technological development.

[0048] S3.12. Improve the overall security of data transmission through continuous security reinforcement and optimization.

[0049] Continuous security reinforcement and optimization can include a variety of measures. For example, in an unmanned inspection system of a mobile application, the implementation code of the encryption algorithm is continuously optimized to reduce resource consumption and time delays in the encryption process and improve data transmission efficiency. At the same time, strengthen the management of access control policies, such as regularly cleaning up expired user accounts and permissions, and adding security verification steps for new device access. Through these continuous security reinforcement and optimization measures, the overall security of data transmission can be improved. S4. For unmanned inspection scenarios, a multi-level security protection architecture is designed, and security protection measures are deployed at different levels including network boundaries, host terminals, and application unmanned inspection systems. By building a defense-in-depth system, the security protection capabilities of the unmanned inspection system are comprehensively improved; S4.1. Firewalls and intrusion detection systems are deployed at the network boundary to monitor and filter the data traffic in and out of the network in real time. If malicious traffic or attack behavior is found, it will be immediately blocked and an alarm will be issued. At the same time, relevant logs will be recorded for subsequent analysis and tracking; When deploying firewalls and intrusion detection systems at the network boundary, for example, in an unmanned inspection system of a campus network, the firewall can set rules to only allow traffic from specific network ports (such as ports used for data transmission of unmanned inspection equipment) and IP address ranges (such as legal device IP addresses on campus) to enter and exit the network. The intrusion detection system monitors network traffic in real time, using feature-based detection methods (such as detecting specific malware traffic features) and anomaly-based detection methods (such as detecting abnormal fluctuations in network traffic, such as sudden increases in traffic or a large number of connection requests from the same source address). When malicious traffic or attack behavior is detected, such as detecting a large amount of port scanning traffic from outside the school, the firewall immediately blocks the traffic and issues an alarm message, and records relevant logs, including attack source address, attack time, attack type, and other information, so that subsequent network security personnel can analyze and track, find the source of the attack, and take further preventive measures.

[0050] S4.2. Install anti-virus software and host intrusion detection system on the host terminal to monitor the files, processes and registry on the terminal in real time. Use feature code matching and behavior analysis technology to determine whether there are malicious programs such as viruses and Trojans. If detected, immediately isolate or delete them and report alarm information; When antivirus software and host intrusion detection systems are installed on host terminals, such as in an unmanned inspection system for office computers in an enterprise, the antivirus software detects viruses by matching virus signature libraries. For example, when new malware spreads and its code features match a virus signature in the virus signature library, the antivirus software immediately isolates or deletes it and reports an alarm.

[0051] S4.3. For the unmanned application inspection system, a Web application firewall is used to conduct in-depth inspection of access traffic. Through the rule engine and machine learning algorithm, common Web attacks such as SQL injection and cross-site scripting are identified and blocked. At the same time, user identity is authenticated and authorized to avoid illegal access and unauthorized operations. When a Web application firewall is used to perform in-depth inspection of access traffic in an unmanned inspection system for an e-commerce platform, for example, in an unmanned inspection system for an e-commerce platform, the rule engine of the Web application firewall can set rules for common attacks such as SQL injection. When the information entered by a user when searching for a product or making an order contains malicious SQL statements (such as SQL injection statements constructed by entering special characters in the search box), the rule engine will identify this as an SQL injection attack attempt based on the preset rules and immediately intercept it to prevent the request from further accessing the backend database. At the same time, the machine learning algorithm can continuously optimize the detection capability of the rule engine by learning a large amount of normal and abnormal access data, and can identify some new and variant SQL injection attack patterns. In terms of user authentication and authorization management, multi-factor authentication is adopted. For example, when a user logs in, in addition to entering a username and password, they must also enter a mobile phone verification code or use biometric authentication such as fingerprint recognition. Different permissions are set for different user roles, such as ordinary users, administrators, merchants, etc. Ordinary users can only browse products and place orders, while administrators can manage products and user information, etc., to avoid illegal access and unauthorized operations, and ensure the security of the application system and the integrity of the data.

[0052] S4.4. Establish a security management platform to centrally manage security equipment and unmanned inspection systems at all levels. Through unified policy configuration and management, ensure the consistency and effectiveness of various protection measures. At the same time, conduct correlation analysis on various security events to timely discover potential security threats. When establishing a security management platform, for example, in a comprehensive unmanned inspection system of a large enterprise, the security management platform can integrate security equipment and system information at all levels, such as firewalls and intrusion detection systems at the network boundary, antivirus software at the host terminal, host intrusion detection systems, and Web application firewalls of the application system. Through unified policy configuration and management, such as setting uniform password strength requirements and network access restriction policies for the entire company, the consistency and effectiveness of various protection measures can be ensured. When a DDoS attack from the outside is detected at the network boundary, the security management platform can correlate and analyze the performance data of the host terminal (such as whether the host response is slow due to the attack) and the access anomalies of the application system (such as a large number of users failing to log in or transaction interruptions), timely discover potential security threats, and coordinate security equipment at all levels to respond according to the preset emergency response strategy, such as starting backup network lines and increasing host resource allocation to resist attacks.

[0053] S4.5. Regularly carry out security assessment and penetration testing to comprehensively assess the security status of the unmanned inspection system. Through simulated attacks, identify the weak links and loopholes in the unmanned inspection system, and propose targeted rectification measures to continuously improve the security protection capabilities of the unmanned inspection system. When security assessment and penetration testing are carried out regularly, for example, in the unmanned inspection system of a financial institution, the security assessment can use vulnerability scanning tools to conduct a comprehensive scan of the system's network architecture, servers, applications, etc. to check whether there are known security vulnerabilities, such as vulnerabilities caused by unpatched operating systems, buffer overflow vulnerabilities in application code, etc. Penetration testing simulates hacker attack methods, and professional security personnel try to break through the system's security defenses, such as obtaining user account passwords through social engineering means, and then using the account password to try to elevate permissions to access sensitive data. Based on the evaluation and test results, weak links and vulnerabilities in the system are found, such as a logical vulnerability in the transfer function of an online banking system, which allows attackers to bypass the transfer amount limit. In response to these problems, targeted rectification measures are proposed, such as timely updating of operating system and application patches, repairing code logic vulnerabilities, and strengthening user account password management, etc., to continuously improve the security protection capabilities of the unmanned inspection system and ensure the safety of financial transactions.

[0054] S4.6. Strengthen safety awareness education and training, improve the safety awareness and skills of relevant personnel, and enable them to master basic safety operation specifications and emergency response methods through regular safety publicity and training; When strengthening security awareness education and training, for example, in an unmanned inspection system of a government department, security training courses are organized regularly to explain the basic knowledge of network security to staff, such as how to identify phishing emails (such as whether the source of the email is suspicious, whether the content contains malicious links or attachments), how to safely use office equipment (such as avoiding logging into sensitive systems in public network environments, regularly updating device passwords) and other basic security operating specifications. At the same time, emergency response method training is carried out, such as when an office computer is found to be infected with a virus, it should be disconnected from the Internet immediately and reported to the security management department, and when a network attack causes the system to fail to work normally, data backup and system recovery should be carried out according to the predetermined emergency process. Through these trainings, the security awareness and skills of relevant personnel are improved, so that they can consciously abide by safety regulations in their daily work, reduce safety accidents caused by human negligence, and form a good atmosphere of full participation and joint prevention.

[0055] S4.7. Establish a sound safety management system and process, clarify the safety responsibilities and operating procedures of each position, standardize personnel behavior through institutionalized and process-based management, reduce human errors and internal threats, and provide institutional guarantees for the safe operation of the unmanned inspection system.

[0056] When establishing a sound security management system and process, for example, in an unmanned inspection system of a medical institution, clearly define the security responsibilities of the system administrator, such as regularly backing up medical data, monitoring the system operation status, and timely installing security patches; the operating procedures of ordinary users such as doctors and nurses, such as only being able to access patient medical information on authorized terminal devices and not sharing account passwords at will. Through institutionalized and process-based management, standardize the behavior of personnel and reduce human errors and internal threats. For example, if there are no strict institutional constraints, doctors may tell their account passwords to others for convenience, thereby increasing the risk of medical data leakage. With a sound system and process, such violations can be supervised and punished, providing institutional guarantees for the safe operation of the unmanned inspection system and ensuring the confidentiality, integrity and availability of patient medical information. S5. Use anomaly detection methods to continuously monitor various indicator data during the operation of the unmanned inspection system, and compare and analyze with the pre-established normal mode to promptly discover abnormal behaviors that deviate from the expected threshold, judge potential security risks, and provide a basis for subsequent security decisions; S5.1. Obtain various indicator data during the operation of the unmanned inspection system, establish a corresponding time series data model for each indicator, and form a normal pattern of the indicator data; Obtain various indicator data during the operation of the unmanned inspection system. For example, in an unmanned inspection system of a smart factory, the indicator data may cover the temperature, vibration amplitude, operating current, production efficiency, product qualification rate, etc. of the equipment. Establish a corresponding time series data model for each indicator. For example, for the equipment temperature indicator, the autoregressive moving average (ARIMA) model can be used. By analyzing the time series characteristics of the historical temperature data and determining the parameters of the model, the normal mode of the equipment temperature indicator data can be constructed. This normal mode can reflect the temperature change law of the equipment over time under normal operation, such as the stable range and fluctuation amplitude of the temperature in different production stages, providing a basic basis for subsequent abnormality detection.

[0057] S5.2. Use clustering algorithm to perform cluster analysis on indicator data, determine the normal value range of each indicator according to the clustering results, and obtain the expected threshold value; When clustering analysis is performed on indicator data using a clustering algorithm, for example, in an unmanned inspection system in a logistics warehouse, multiple indicator data of cargo handling equipment (such as operating speed, load weight, energy consumption, etc.) are used as the objects of cluster analysis. The K-Means clustering algorithm is used to divide the data into different clusters based on their similarity. By clustering a large amount of historical data, the center and range of each cluster are determined, so as to obtain the normal value range of each indicator, that is, the expected threshold. For example, under normal circumstances, the operating speed of cargo handling equipment fluctuates within a certain range, the load weight is within a specific rated range, and the energy consumption is also at a relatively stable level. When real-time data exceeds the range determined by these clusters, it may mean that the equipment is abnormal or there is a potential safety risk.

[0058] S5.3. During the operation of the unmanned inspection system, real-time data of various indicators are continuously obtained, and the real-time data is compared with the expected threshold. If the real-time data deviates from the expected threshold, it is judged as abnormal behavior; During the operation of the unmanned inspection system, real-time data of various indicators are continuously obtained. For example, in an unmanned inspection system of a power substation, the oil temperature, oil pressure, winding temperature and other indicator data of the transformer are collected in real time and converted into feature vectors. These real-time data feature vectors are then compared with the expected threshold. If the real-time data of the transformer oil temperature is higher than the expected threshold, it may indicate that the transformer cooling system has a fault or is overloaded. At this time, it is judged as abnormal behavior. This comparison process is carried out in real time and continuously, so that any abnormal changes in the system operation can be captured in time, providing the possibility of rapid response.

[0059] S5.4. For detected abnormal behaviors, use association rule mining algorithms to analyze the correlation between abnormal behaviors and security risks, and obtain potential security risks that may be caused by abnormal behaviors; When using association rule mining algorithms to analyze the relationship between abnormal behaviors and security risks for detected abnormal behaviors, for example, in an unmanned inspection system in a data center, if an abnormal behavior of abnormally increased CPU usage of a server is detected, the association rule mining algorithm will analyze changes in other related indicator data, such as memory usage, network traffic, etc. By mining the abnormal CPU usage and changes in other indicators in a large amount of historical data, it is found that when the CPU usage increases abnormally and the memory usage also increases rapidly at the same time, and the network traffic fluctuates abnormally, there may be potential security risks of malware intrusion or DDoS attacks. This can provide a deep understanding of the security threats that may be hidden behind abnormal behaviors and provide a basis for formulating targeted security strategies.

[0060] S5.5. Based on the severity of abnormal behavior and the size of potential security risks, use the decision tree algorithm to generate corresponding security decision rules to provide a basis for subsequent security decisions; When using the decision tree algorithm to generate corresponding security decision rules based on the severity of abnormal behavior and the size of potential security risks, for example, in an airport's unmanned security inspection system, if the image recognition accuracy of a security inspection device decreases, the decision tree algorithm will first evaluate the severity of the abnormal behavior. If it is only a slight decrease, it may only be necessary to arrange maintenance personnel to check and calibrate during non-peak hours; but if the accuracy drops significantly and affects the normal progress of security inspection work, the potential security risk is large, and the decision tree algorithm may generate security decision rules such as immediately stopping the operation of the device, enabling backup equipment, and notifying security experts for emergency treatment, etc., to provide a clear and definite basis for subsequent security decisions, ensuring that the system can respond quickly and effectively when faced with abnormal situations.

[0061] S5.6. Continuously perform anomaly detection and safety risk analysis during the operation of the unmanned inspection system, dynamically adjust the expected threshold and safety decision-making rules based on the analysis results, and improve the accuracy of anomaly detection and the effectiveness of safety decisions; During the operation of the unmanned inspection system, anomaly detection and safety risk analysis are continuously performed. For example, in an unmanned inspection system of an intelligent transportation system, the environment and conditions of system operation are constantly changing with changes in traffic flow, changes in weather conditions, and updates to road facilities. Through continuous anomaly detection and safety risk analysis, the expected thresholds and safety decision rules are dynamically adjusted according to new data and actual operation conditions. For example, in heavy rain weather, road waterlogging will affect the data accuracy of vehicle sensors. At this time, the expected thresholds of certain indicators related to vehicle driving stability can be appropriately relaxed; at the same time, if a new type of traffic signal interference is found to cause an increase in abnormal vehicle driving behavior, the safety decision rules should be adjusted in a timely manner, the frequency of safety inspections of traffic signal detection and vehicle autonomous navigation systems should be increased, and the accuracy of anomaly detection and the effectiveness of safety decisions should be improved to adapt to various dynamic changes during system operation and ensure the safe and stable operation of the entire intelligent transportation system.

[0062] S5.7. Feedback the results of anomaly detection and safety decision-making to the unmanned inspection system administrator in real time to assist the administrator in taking corresponding safety precautions in a timely manner, reduce safety risks, and ensure the safe and stable operation of the unmanned inspection system.

[0063] Feedback the results of anomaly detection and safety decision-making to the unmanned patrol system administrator in real time. For example, in an unmanned fire patrol system in a large shopping mall, when the smoke concentration in a certain area is detected to be abnormally high and there may be a fire risk according to analysis, the system immediately feeds back the anomaly detection results (such as smoke concentration value, abnormal area location) and safety decision-making suggestions (such as starting the fire extinguishing device in the area and evacuating nearby personnel) to the administrator in real time. The administrator can quickly verify the situation based on this information and take corresponding safety precautions, such as organizing personnel evacuation, notifying the fire department, etc., to reduce safety risks, ensure the safety of personnel and property in the mall, ensure that the unmanned patrol system plays an effective auxiliary role in ensuring safety, and realize the coordinated safety management of people and systems. S6. Regularly carry out security assessments and penetration tests of unmanned patrol systems, comprehensively check the security vulnerabilities and weak links in the unmanned patrol system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned patrol system and its ability to resist external attacks.

[0064] S6.1. Develop a comprehensive security assessment and penetration testing plan based on the architecture and business characteristics of the unmanned inspection system, clarify the scope, methods and frequency of the assessment, and ensure the systematic and continuous nature of the unmanned inspection assessment work; Formulate a comprehensive security assessment and penetration test plan based on the architecture and business characteristics of the unmanned inspection system. For example, for an unmanned inspection system with a distributed architecture and business involving multi-regional data transmission, the scope of the assessment should cover network nodes, data storage centers, and various business application modules in all regions. The assessment methods may include using vulnerability scanning tools to perform port scanning and vulnerability detection on network devices and servers, manually performing business logic vulnerability analysis, and checking the physical security environment of the system. In terms of frequency, it can be set to conduct a regular vulnerability scan once a month and a comprehensive penetration test once a quarter to ensure the systematic and continuous nature of the assessment work and to promptly discover security issues that may arise in the system at different levels and at different times.

[0065] S6.2. Use a combination of automated vulnerability scanning tools and manual penetration testing to fully identify security vulnerabilities and weak links in the unmanned inspection system, and classify and rate the vulnerabilities according to their severity and impact. A combination of automated vulnerability scanning tools and manual penetration testing is used. Automated vulnerability scanning tools such as Nessus can quickly scan a large number of devices and software in the unmanned inspection system, and detect known security vulnerabilities such as operating system vulnerabilities and common software (such as buffer overflow vulnerabilities in some open source libraries). Manual penetration testing, on the other hand, focuses more on simulating real attack scenarios and mining business logic vulnerabilities that are difficult to find with automated tools. For example, in an e-commerce unmanned inspection system, manual penetration testers will try to construct special order transaction processes to detect business logic vulnerabilities such as order amount tampering and malicious modification of product inventory, and classify and rate the vulnerabilities according to their severity (such as whether they can directly obtain user sensitive information and whether they can cause system paralysis) and scope of impact (such as whether they affect a single user or the entire platform user) in order to determine the priority of subsequent repairs.

[0066] S6.3. Develop detailed repair and reinforcement plans for identified security vulnerabilities and weak links in a timely manner, clearly define the repair priorities, responsible persons and completion deadlines, and ensure that the vulnerabilities can be repaired in a timely and effective manner; Develop detailed repair and reinforcement plans for identified security vulnerabilities and weak links. For example, for a high-risk vulnerability found in a network device (such as a vulnerability that allows remote unauthorized access), it is clearly stated that the priority for repair is the highest, and the person responsible can be the network administrator, who is required to complete the vulnerability repair within 24 hours, which can be solved by upgrading the device firmware. For some low-risk vulnerabilities in some application systems (such as minor information leakage displayed on the interface), the priority is lower, and developers can be arranged to perform code repairs within a week. Through such clear plan formulation, it is ensured that vulnerabilities can be repaired in a timely and effective manner, avoiding the exploitation of vulnerabilities by attackers due to their long-term existence, and ensuring the safe and stable operation of the unmanned inspection system.

[0067] S6.4. After the vulnerability is fixed, the effectiveness of the repair measures shall be verified through regression testing and verification testing, and the unmanned inspection system shall be reinforced after the repair to improve the overall safety performance of the unmanned inspection system; After the vulnerability is fixed, regression testing and verification testing are performed. Regression testing mainly checks whether the operation of fixing the vulnerability has an impact on the original function of the system. For example, in an unmanned inspection system for industrial control, after a data transmission encryption vulnerability is fixed, regression testing is performed on the system's data acquisition, equipment control and other functions to ensure that these functions are still operating normally. Verification testing focuses on verifying whether the repair measures have truly solved the vulnerability problem. This can be verified by scanning again with the vulnerability scanning tool or simulating the attack scenario where the vulnerability was previously discovered. For example, after the previously discovered SQL injection vulnerability is repaired, a special SQL injection test tool is used for verification. If the injection is no longer successful, it means that the repair is effective. Then, the repaired system is further reinforced for security, such as optimizing the system configuration, adding access restriction policies, etc., to improve the overall security performance of the system.

[0068] S6.5. Establish a security vulnerability management database to record all identified security vulnerabilities and weaknesses, as well as corresponding repair and reinforcement measures, and conduct regular statistical analysis to understand the changing trends of the security status of the unmanned inspection system; Establish a security vulnerability management database. For example, in a financial unmanned inspection system, each discovered security vulnerability (such as missing security patches for the server operating system, code vulnerabilities in applications, etc.) and weak links (such as loose access control on a certain network segment in the network architecture) and corresponding repair and reinforcement measures (such as the version number of the installed patch, modifying the specific content of the network access control policy) are recorded in the database. Regularly conduct statistical analysis of the database, such as counting the frequency of occurrence of different types of vulnerabilities, the distribution of repair time, etc., so as to grasp the changing trend of the security status of the unmanned inspection system, so as to predict possible security issues in advance and formulate corresponding prevention strategies, and also facilitate the summary and improvement of the system's security management work.

[0069] S6.6. Analyze and mine security vulnerability data through machine learning algorithms to identify common problems and weak links in unmanned inspection systems and provide decision support for subsequent security reinforcement; machine learning algorithms include support vector machines, decision trees, and random forests; Security vulnerability data is analyzed and mined through machine learning algorithms. Taking the support vector machine algorithm as an example, in a comprehensive unmanned inspection system of a large enterprise, various features in the security vulnerability data (such as vulnerability type, location, affected business module, etc.) are used as input to train the support vector machine model. Through model analysis, common problems in the system can be found, such as discovering that a certain brand of network equipment often has a specific type of vulnerability, or that the code written by a certain development team is prone to a certain type of logical vulnerability and other weak links, to provide decision support for subsequent security reinforcement, such as focusing on monitoring and upgrading the brand of network equipment, and conducting targeted code standard training for relevant development teams.

[0070] S6.7. Based on the analysis results of machine learning, continuously optimize and improve the methods and strategies of security assessment and penetration testing, improve the pertinence and effectiveness of the assessment, and continuously improve the overall security performance of the unmanned inspection system and its ability to resist external attacks.

[0071] Optimize and improve the methods and strategies of security assessment and penetration testing based on the analysis results of machine learning. For example, if machine learning analysis finds that a new business module in the system has many unknown types of vulnerability risks, then in the subsequent security assessment, increase the proportion of manual deep penetration testing of the module, adjust the scanning strategy of the vulnerability scanning tool, and focus on the vulnerability characteristics related to the module. At the same time, update the scenario library of the penetration test according to the analysis results, add simulated attack scenarios for newly discovered common problems, improve the pertinence and effectiveness of the assessment, and continuously improve the overall security performance of the unmanned inspection system and its ability to resist external attacks, so that the system's security protection system can continue to evolve and improve with the development of the system and changes in the external security environment.

[0072] An unmanned inspection and intelligent fault diagnosis system, comprising: Threat modeling and strategy generation module, which is used to build a security threat model for the unmanned inspection system based on the business characteristics of the unmanned inspection system, identify potential network attacks and illegal access risks, and formulate security strategies and technical measures; The deep learning security analysis module is used to adopt a security analysis method based on contrast technology, model the operating status of the unmanned inspection system through a deep learning algorithm, and obtain the characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is judged that there is a potential security threat and triggers a real-time response mechanism; The data security module is used to encrypt and protect the transmitted data and control the permissions of the transmitted data by comprehensively applying security protocols, encryption technologies and access control strategies during the data transmission process of the unmanned inspection system, so as to prevent the data from being illegally intercepted and tampered with, and ensure the confidentiality and integrity of the data transmission; The multi-level security protection deployment module is used to design a multi-level security protection architecture for unmanned inspection scenarios. Security protection measures are deployed at different levels, including network boundaries, host terminals, and application unmanned inspection systems. By building a defense-in-depth system, the security protection capabilities of the unmanned inspection system are comprehensively improved. The anomaly detection and risk judgment module is used to continuously monitor various indicator data during the operation of the unmanned inspection system using anomaly detection methods. By comparing and analyzing with the pre-established normal mode, it can timely discover abnormal behaviors that deviate from the expected threshold, judge potential safety risks, and provide a basis for subsequent safety decisions; The security assessment and reinforcement module is used to regularly conduct security assessments and penetration tests on the unmanned inspection system, comprehensively check for security vulnerabilities and weak links in the unmanned inspection system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned inspection system and its ability to resist external attacks.

[0073] A computer device comprising: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, an unmanned inspection and intelligent fault judgment method as described is implemented.

[0074] A computer-readable storage medium stores a computer program, which, when executed, implements an unmanned inspection and intelligent fault judgment method as described above.

[0075] Embodiment 1: Step S101, based on the business characteristics of the unmanned inspection system, a security threat model of the unmanned inspection system is constructed to determine potential network attacks and illegal access risks, and to formulate security strategies and technical measures in a targeted manner.

[0076] According to the business characteristics of the unmanned inspection system, a deep learning algorithm is used to analyze the historical operation data of the unmanned inspection system, build a security threat model for the unmanned inspection system, and identify potential network attacks and illegal access risks. For the identified security threats, a decision tree algorithm is used, combined with a preset security policy knowledge base, to automatically infer targeted security protection measures. The real-time operation data of the unmanned inspection system is obtained, and by comparing and analyzing it with the security threat model, it is determined in real time whether the unmanned inspection system has network attack and illegal access risks. If so, the corresponding security protection measures are triggered. According to the new security threats identified during the operation of the unmanned inspection system, the existing security threat model and security policy knowledge base are continuously optimized and improved through reinforcement learning algorithms to enhance the security protection capabilities of the unmanned inspection system. According to the characteristics of the unmanned inspection business scenario, a distributed security protection mechanism based on blockchain is deployed to encrypt, store and verify the key business data of the unmanned inspection system to ensure the confidentiality and integrity of the data. A zero-trust architecture is adopted to strictly authenticate and authorize the identities of all users and devices in the unmanned inspection system to minimize potential internal threats, thereby further strengthening the overall security of the unmanned inspection system. Continuously monitor the safe operation status of the unmanned inspection system, and present the security threat situation of the unmanned inspection system in real time through visualization technology, provide intuitive decision-making support for security managers, and continuously optimize the safety protection level of the unmanned inspection system.

[0077] Step S102, using a security analysis method based on comparison technology, the operating status of the unmanned inspection system is modeled through a deep learning algorithm to obtain characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is determined that there is a potential security threat and a real-time response mechanism is triggered.

[0078] According to the deep learning algorithm, the unmanned inspection system operation status data is extracted and represented, and a feature model of the unmanned inspection system status is constructed. The unsupervised learning method is used to cluster the state features of the unmanned inspection system through the clustering algorithm to obtain feature clusters representing normal modes and feature clusters representing abnormal modes. During the operation of the unmanned inspection system, the unmanned inspection system status data is obtained in real time, the feature vector is extracted, and the similarity is calculated between it and the feature cluster of the normal mode. If the feature vector deviates from the feature cluster of the normal mode by more than the preset threshold, the unmanned inspection system is judged to be in an abnormal state and there is a potential security threat. According to the severity of the abnormal state and the threat level, the strategy and strength of the real-time response mechanism are dynamically adjusted. Through active defense measures, abnormal behaviors are blocked and isolated, the impact range of security threats is reduced, and the safe and stable operation of the unmanned inspection system is guaranteed. The deep learning model is continuously optimized, and the accuracy of anomaly detection and the efficiency of real-time response are continuously improved through incremental learning and online learning.

[0079] Step S103, during the data transmission process of the unmanned inspection system, security protocols, encryption technologies and access control strategies are comprehensively used to encrypt and protect the transmitted data and control permissions to prevent the data from being illegally intercepted and tampered with, thereby ensuring the confidentiality and integrity of the data transmission.

[0080] According to the sensitivity of the data and the transmission environment, select appropriate security protocols, such as SSL / TLS, to establish a secure transmission channel and encrypt the transmission process. Use a combination of symmetric encryption and asymmetric encryption to encrypt the transmission data. Ensure the confidentiality and integrity of the encryption key through a secure key management mechanism. Digitally sign the data before transmitting it to ensure its integrity. The receiver verifies the digital signature to determine whether the data has been tampered with. Based on the role-based access control strategy, manage the permissions of different users and unmanned inspection systems. Restrict illegal users from accessing and operating data through identity authentication and authorization mechanisms. During the transmission process, use secure routing protocols and network isolation technologies to prevent data from being illegally intercepted and eavesdropped during transmission. Establish a complete log audit and monitoring mechanism to monitor the data transmission process in real time and detect abnormal behavior. Identify and warn potential security threats through machine learning algorithms. Regularly evaluate and update security protocols, encryption algorithms, and access control strategies to ensure that they adapt to the ever-changing security situation and technological development. Improve the overall security of data transmission through continuous security reinforcement and optimization.

[0081] Step S104, for the unmanned inspection scenario, a multi-level security protection architecture is designed, and security protection measures are deployed at different levels such as network boundaries, host terminals, and application unmanned inspection systems. By building a deep defense system, the security protection capabilities of the unmanned inspection system are comprehensively improved.

[0082] Firewalls and intrusion detection systems are deployed at the network boundary to monitor and filter the data traffic in and out of the network in real time. If malicious traffic or attack behavior is found, it will be immediately blocked and an alarm will be issued. At the same time, relevant logs will be recorded for subsequent analysis and tracking. Antivirus software and host intrusion detection systems are installed on the host terminal to monitor the files, processes, and registry on the terminal in real time. Through signature matching and behavior analysis, it is determined whether there are malicious programs such as viruses and Trojans. If detected, they will be immediately isolated or deleted, and the alarm information will be reported. For the application of unmanned inspection system, a Web application firewall is used to conduct in-depth inspection of access traffic. Through the rule engine and machine learning algorithm, common Web attacks such as SQL injection and cross-site scripting are identified and blocked. At the same time, user identity is authenticated and authorized to avoid illegal access and unauthorized operations. A security management platform is established to centrally manage security equipment and unmanned inspection systems at all levels. Through unified policy configuration and management, the consistency and effectiveness of various protection measures are ensured. At the same time, various security events are correlated and analyzed to timely discover potential security threats. Carry out security assessments and penetration tests regularly, comprehensively evaluate the security status of the unmanned inspection system, discover the weak links and loopholes in the unmanned inspection system through simulated attacks, and propose targeted rectification measures to continuously improve the security protection capabilities of the unmanned inspection system. Strengthen security awareness education and training, improve the security awareness and skills of relevant personnel, and through regular security publicity and training, enable them to master basic safety operating standards and emergency response methods, and form a good atmosphere of full participation and joint prevention. Establish a sound security management system and process, clarify the safety responsibilities and operating procedures of each position, standardize the behavior of personnel through institutionalized and process-based management, reduce human errors and internal threats, and provide institutional guarantees for the safe operation of the unmanned inspection system.

[0083] Step S105, using anomaly detection technology, continuously monitors various indicator data during the operation of the unmanned inspection system, and compares and analyzes them with the pre-established normal mode to promptly discover abnormal behaviors that deviate from the expected threshold, judge potential safety risks, and provide a basis for subsequent safety decisions.

[0084] Obtain the data of various indicators during the operation of the unmanned inspection system, establish a corresponding time series data model for each indicator, and form a normal pattern of the indicator data; use the clustering algorithm to perform cluster analysis on the indicator data, determine the normal value range of each indicator based on the clustering results, and obtain the expected threshold; continuously obtain the real-time data of various indicators during the operation of the unmanned inspection system, compare the real-time data with the expected threshold, and if the real-time data deviates from the expected threshold, it is judged as abnormal behavior; for the detected abnormal behavior, use the association rule mining algorithm to analyze the correlation between the abnormal behavior and the security risk, and obtain the potential security risks that may be caused by the abnormal behavior; according to the severity of the abnormal behavior and the size of the potential security risk, use the decision tree algorithm to generate the corresponding security decision rules to provide a basis for subsequent security decisions; continuously perform anomaly detection and security risk analysis during the operation of the unmanned inspection system, dynamically adjust the expected threshold and security decision rules based on the analysis results, and improve the accuracy of anomaly detection and the effectiveness of security decisions; feedback the results of anomaly detection and security decisions to the unmanned inspection system administrator in real time to assist the administrator to take corresponding security precautions in a timely manner, reduce security risks, and ensure the safe and stable operation of the unmanned inspection system.

[0085] Step S106, regularly carry out security assessment and penetration testing of the unmanned inspection system, comprehensively check the security loopholes and weak links in the unmanned inspection system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned inspection system and its ability to resist external attacks.

[0086] According to the architecture and business characteristics of the unmanned inspection system, a comprehensive security assessment and penetration test plan is formulated, and the scope, method and frequency of the assessment are clarified to ensure the systematic and continuous nature of the unmanned inspection work. A combination of automated vulnerability scanning tools and manual penetration testing is used to comprehensively identify the security vulnerabilities and weak links in the unmanned inspection system, and classify and rate them according to the severity and scope of impact of the vulnerabilities. For the identified security vulnerabilities and weak links, a detailed repair and reinforcement plan is formulated in a timely manner, and the priority, responsible person and completion time limit of the repair are clarified to ensure that the vulnerabilities can be repaired in a timely and effective manner. After the vulnerability is repaired, the effectiveness of the repair measures is verified through regression testing and verification testing, and the repaired unmanned inspection system is reinforced to improve the overall security performance of the unmanned inspection system. A security vulnerability management database is established to record all identified security vulnerabilities and weak links, as well as the corresponding repair and reinforcement measures, and statistical analysis is conducted regularly to grasp the changing trend of the security status of the unmanned inspection system. Through machine learning algorithms, such as support vector machines, decision trees, and random forests, we analyze and mine security vulnerability data, identify common problems and weak links in unmanned inspection systems, and provide decision support for subsequent security reinforcement. Based on the analysis results of machine learning, we continuously optimize and improve the methods and strategies of security assessment and penetration testing, improve the pertinence and effectiveness of assessments, and continuously improve the overall security performance of unmanned inspection systems and their ability to resist external attacks.

[0087] The above embodiments are only preferred technical solutions of the present invention and should not be regarded as limiting the present invention. The protection scope of the present invention shall be the technical solutions recorded in the claims, including equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. An unmanned inspection and intelligent fault judgment method, characterized in that The following steps are involved: S1. According to the business characteristics of the unmanned inspection system, a security threat model of the unmanned inspection system is constructed to identify potential network attacks and illegal access risks, and to formulate security strategies and technical measures. S2. A security analysis method based on comparative technology is used to model the operating status of the unmanned inspection system through a deep learning algorithm to obtain characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is judged that there is a potential security threat and a real-time response mechanism is triggered. S3. During the data transmission process of the unmanned inspection system, security protocols, encryption technologies and access control strategies are used to encrypt and protect the transmitted data and control permissions to prevent the data from being illegally intercepted and tampered with, thus ensuring the confidentiality and integrity of data transmission; S4. Design a multi-level security protection architecture for unmanned inspection scenarios, deploy security protection measures at different levels including network boundaries, host terminals, and application unmanned inspection systems, and build a deep defense system to comprehensively enhance the security protection capabilities of unmanned inspection systems. S5. Utilize anomaly detection methods to continuously monitor various indicator data during the operation of the unmanned inspection system, and compare and analyze them with the pre-established normal mode to promptly discover abnormal behaviors that deviate from the expected threshold, identify potential security risks, and provide a basis for subsequent security decisions. S6. Regularly conduct security assessments and penetration tests of unmanned inspection systems, comprehensively check for security vulnerabilities and weak links in unmanned inspection systems, and take timely repair and reinforcement measures for problems found, so as to continuously improve the overall security of unmanned inspection systems and their ability to resist external attacks.

2. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S1 are: S1.

1. Based on the business characteristics of the unmanned inspection system, a deep learning algorithm is used to analyze the historical operation data of the unmanned inspection system, build a security threat model for the unmanned inspection system, and identify potential network attacks and illegal access risks; S1.

2. For the identified security threats, the decision tree algorithm is used in combination with the preset security policy knowledge base to automatically infer targeted security protection measures; S1.

3. Obtain the real-time operation data of the unmanned inspection system, and compare and analyze it with the security threat model to determine in real time whether there is a risk of network attack and illegal access to the unmanned inspection system. If so, trigger the corresponding security protection measures; S1.

4. Based on the new security threats identified during the operation of the unmanned inspection system, the existing security threat model and security policy knowledge base are continuously optimized and improved through reinforcement learning algorithms to enhance the security protection capabilities of the unmanned inspection system. S1.

5. In view of the characteristics of unmanned inspection business scenarios, a distributed security protection mechanism based on blockchain is deployed to encrypt, store and verify the key business data of the unmanned inspection system to ensure the confidentiality and integrity of the data; S1.

6. Adopt zero-trust architecture to strictly authenticate and authorize the identities of all users and devices in the unmanned inspection system, minimize potential internal threats, and further enhance the overall security of the unmanned inspection system; S1.

7. Continuously monitor the safe operation status of the unmanned inspection system, and present the security threat situation of the unmanned inspection system in real time through visualization technology, provide intuitive decision-making support for security managers, and continuously optimize the safety protection level of the unmanned inspection system.

3. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S2 are: S2.

1. Based on the deep learning algorithm, feature extraction and representation learning are performed on the operating status data of the unmanned inspection system to build a feature model of the unmanned inspection system status; S2.2, using an unsupervised learning method, clustering the state features of the unmanned inspection system through a clustering algorithm to obtain feature clusters representing normal modes and feature clusters representing abnormal modes; S2.

3. During the operation of the unmanned inspection system, the status data of the unmanned inspection system is obtained in real time, the feature vector is extracted, and the similarity between the feature vector and the feature cluster of the normal mode is calculated; S2.

4. If the feature vector deviates from the feature cluster of the normal mode by more than the preset threshold, it is determined that the unmanned inspection system is in an abnormal state and there is a potential security threat; S2.

5. Dynamically adjust the strategy and intensity of the real-time response mechanism according to the severity and threat level of the abnormal state; S2.

6. Through active defense measures, abnormal behaviors are blocked and isolated, the impact range of security threats is reduced, and the safe and stable operation of the unmanned inspection system is ensured; S2.

7. Continue to optimize deep learning models and continuously improve the accuracy of anomaly detection and the efficiency of real-time response through incremental learning and online learning.

4. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S3 are: S3.

1. According to the sensitivity of the data and the transmission environment, a secure transmission channel is established through a security protocol to encrypt and protect the transmission process; the security protocol is SSL or TLS; S3.2, using a combination of symmetric encryption and asymmetric encryption to encrypt the transmitted data; S3.

3. Ensure the confidentiality and integrity of encryption keys through a secure key management mechanism; S3.

4. Before transmitting data, digitally sign the data to ensure data integrity; S3.

5. The receiver verifies the digital signature to determine whether the data has been tampered with; S3.6, role-based access control strategy to manage permissions for different users and unmanned inspection systems; S3.7, through identity authentication and authorization mechanisms, restrict illegal users from accessing and operating data; S3.

8. During the transmission process, secure routing protocols and network isolation technologies are used to prevent data from being illegally intercepted and eavesdropped during transmission; S3.

9. Establish a sound log audit and monitoring mechanism to conduct real-time monitoring of the data transmission process and detect abnormal behavior; S3.

10. Identify and warn of potential security threats through machine learning algorithms; S3.

11. Regularly evaluate and update security protocols, encryption algorithms, and access control policies; S3.

12. Improve the overall security of data transmission through continuous security reinforcement and optimization.

5. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S4 are: S4.

1. Firewalls and intrusion detection systems are deployed at the network boundary to monitor and filter the data traffic in and out of the network in real time. If malicious traffic or attack behavior is found, it will be immediately blocked and an alarm will be issued. At the same time, relevant logs will be recorded for subsequent analysis and tracking; S4.

2. Install anti-virus software and host intrusion detection system on the host terminal to monitor the files, processes and registry on the terminal in real time. Use feature code matching and behavior analysis technology to determine whether there are malicious programs such as viruses and Trojans. If detected, immediately isolate or delete them and report alarm information; S4.

3. For the unmanned application inspection system, a Web application firewall is used to conduct in-depth inspection of access traffic. Through the rule engine and machine learning algorithm, common Web attacks such as SQL injection and cross-site scripting are identified and blocked. At the same time, user identity is authenticated and authorized to avoid illegal access and unauthorized operations. S4.

4. Establish a security management platform to centrally manage security equipment and unmanned inspection systems at all levels. Through unified policy configuration and management, ensure the consistency and effectiveness of various protection measures. At the same time, conduct correlation analysis on various security events to timely discover potential security threats. S4.

5. Regularly carry out security assessment and penetration testing to comprehensively assess the security status of the unmanned inspection system. Through simulated attacks, identify the weak links and loopholes in the unmanned inspection system, and propose targeted rectification measures to continuously improve the security protection capabilities of the unmanned inspection system. S4.

6. Strengthen safety awareness education and training, improve the safety awareness and skills of relevant personnel, and enable them to master basic safety operation specifications and emergency response methods through regular safety publicity and training; S4.

7. Establish a sound safety management system and process, clarify the safety responsibilities and operating procedures of each position, standardize personnel behavior through institutionalized and process-based management, reduce human errors and internal threats, and provide institutional guarantees for the safe operation of the unmanned inspection system.

6. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S5 are: S5.

1. Obtain various indicator data during the operation of the unmanned inspection system, establish a corresponding time series data model for each indicator, and form a normal pattern of the indicator data; S5.

2. Use clustering algorithm to perform cluster analysis on indicator data, determine the normal value range of each indicator according to the clustering results, and obtain the expected threshold value; S5.

3. During the operation of the unmanned inspection system, real-time data of various indicators are continuously obtained, and the real-time data is compared with the expected threshold. If the real-time data deviates from the expected threshold, it is judged as abnormal behavior; S5.

4. For detected abnormal behaviors, use association rule mining algorithms to analyze the correlation between abnormal behaviors and security risks, and obtain potential security risks that may be caused by abnormal behaviors; S5.

5. Based on the severity of abnormal behavior and the size of potential security risks, use the decision tree algorithm to generate corresponding security decision rules to provide a basis for subsequent security decisions; S5.

6. Continuously perform anomaly detection and safety risk analysis during the operation of the unmanned inspection system, dynamically adjust the expected threshold and safety decision-making rules based on the analysis results, and improve the accuracy of anomaly detection and the effectiveness of safety decisions; S5.

7. Feedback the results of anomaly detection and safety decision-making to the unmanned inspection system administrator in real time to assist the administrator in taking corresponding safety precautions in a timely manner, reduce safety risks, and ensure the safe and stable operation of the unmanned inspection system.

7. The unmanned inspection and intelligent fault judgment method according to claim 1 is characterized in that: The sub-steps of S6 are: S6.

1. Develop a comprehensive security assessment and penetration testing plan based on the architecture and business characteristics of the unmanned inspection system, clarify the scope, methods and frequency of the assessment, and ensure the systematic and continuous nature of the unmanned inspection assessment work; S6.

2. Use a combination of automated vulnerability scanning tools and manual penetration testing to fully identify security vulnerabilities and weak links in the unmanned inspection system, and classify and rate the vulnerabilities according to their severity and impact. S6.

3. Develop detailed repair and reinforcement plans for identified security vulnerabilities and weak links in a timely manner, clearly define the repair priorities, responsible persons and completion deadlines, and ensure that the vulnerabilities can be repaired in a timely and effective manner; S6.

4. After the vulnerability is fixed, the effectiveness of the repair measures shall be verified through regression testing and verification testing, and the unmanned inspection system shall be reinforced after the repair to improve the overall safety performance of the unmanned inspection system; S6.

5. Establish a security vulnerability management database to record all identified security vulnerabilities and weaknesses, as well as corresponding repair and reinforcement measures, and conduct regular statistical analysis to understand the changing trends of the security status of the unmanned inspection system; S6.

6. Analyze and mine security vulnerability data through machine learning algorithms to identify common problems and weak links in unmanned inspection systems, and provide decision support for subsequent security reinforcement; Machine learning algorithms include support vector machines, decision trees, and random forests; S6.

7. Based on the analysis results of machine learning, continuously optimize and improve the methods and strategies of security assessment and penetration testing, improve the pertinence and effectiveness of the assessment, and continuously improve the overall security performance of the unmanned inspection system and its ability to resist external attacks.

8. An unmanned inspection and intelligent fault diagnosis system, characterized by: include: Threat modeling and strategy generation module, which is used to build a security threat model for the unmanned inspection system based on the business characteristics of the unmanned inspection system, identify potential network attacks and illegal access risks, and formulate security strategies and technical measures; The deep learning security analysis module is used to adopt a security analysis method based on contrast technology, model the operating status of the unmanned inspection system through a deep learning algorithm, and obtain the characteristic patterns of normal and abnormal states. If it is detected that the operating status of the unmanned inspection system deviates from the normal mode, it is judged that there is a potential security threat and triggers a real-time response mechanism; The data security module is used to encrypt and protect the transmitted data and control the permissions of the transmitted data by comprehensively applying security protocols, encryption technologies and access control strategies during the data transmission process of the unmanned inspection system, so as to prevent the data from being illegally intercepted and tampered with, and ensure the confidentiality and integrity of the data transmission; The multi-level security protection deployment module is used to design a multi-level security protection architecture for unmanned inspection scenarios. Security protection measures are deployed at different levels, including network boundaries, host terminals, and application unmanned inspection systems. By building a defense-in-depth system, the security protection capabilities of the unmanned inspection system are comprehensively improved. The anomaly detection and risk judgment module is used to continuously monitor various indicator data during the operation of the unmanned inspection system using anomaly detection methods. By comparing and analyzing with the pre-established normal mode, it can timely discover abnormal behaviors that deviate from the expected threshold, judge potential safety risks, and provide a basis for subsequent safety decisions; The security assessment and reinforcement module is used to regularly conduct security assessments and penetration tests on the unmanned inspection system, comprehensively check for security vulnerabilities and weak links in the unmanned inspection system, and take timely repair and reinforcement measures for the problems found, so as to continuously improve the overall security of the unmanned inspection system and its ability to resist external attacks.

9. A computer device, characterized in that: include: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, an unmanned inspection and intelligent fault judgment method as described in any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, an unmanned inspection and intelligent fault judgment method as described in any one of claims 1-8 is implemented.

Images