Asset data fusion and atlas analysis method and system in industrial control network environment

Abstract

The invention discloses an asset data fusion and mapping analysis method and system in an industrial control network environment, which ensure that asset nodes are unique and the relationships are diversified through asset data fusion, improve the data quality and consistency, greatly improve the data storage and query efficiency through a graphical model, adapt to large data volume and high concurrency scenes, and improve the data storage and query efficiency. According to the method, the limitation of a traditional storage technology in processing industrial control network environment asset dynamic behavior data construction and display is solved, the expandability and the intelligent level of the whole system are improved, a powerful tool is provided for industrial control network management and safety monitoring, and efficient operation and maintenance decision is promoted.

Description

Technical Field

[0001] The present invention belongs to the field of industrial Internet technology, and specifically relates to an asset data fusion and graph analysis method and system in an industrial control network environment. Background Art

[0002] With the rapid development of Industry 5.0 and the Internet of Things (IoT), the management and analysis of dynamic behavior data of assets in the industrial control Internet environment has become increasingly complex. In the existing technology, the flow data generated between assets is usually stored and managed using relational databases or text files. For example, the communication behavior and data transmission volume between assets are recorded through SQL databases, or the flow data is serialized and saved in the form of log files. However, these traditional methods have significant limitations when processing large-scale real-time industrial control network flow data:

[0003] Performance bottleneck: When relational databases process massive, highly concurrent data insertion, query, and complex graph relationship retrieval, due to their table and index-based design, they often require a large amount of computing resources and storage space, resulting in slower system response speed and inability to meet the needs of real-time monitoring and rapid decision-making in a big data environment.

[0004] Architectural inadaptability: Traditional data models cannot effectively express the complex network topology and dynamically changing relationships between assets. When displaying traffic data in a graphical manner, complex join operations must be performed to construct an asset association view. This process is not only inefficient, but also prone to data redundancy and consistency issues.

[0005] Difficulty in analysis: In a big data environment, deep mining and visual analysis of dynamic asset interaction data are crucial, but the existing storage methods are not conducive to direct graph analysis. The application of algorithms such as node clustering, path search, and community discovery requires additional design and implementation of complex data preprocessing and conversion logic.

[0006] In view of the above situation, the main problem with current asset dynamic behavior data management technologies is that they cannot effectively cope with large-scale, high-speed industrial control network traffic data flows, especially for the graphical representation of data and relational query requirements. The existing relational database architecture and technical means have obvious deficiencies in scalability and performance. At the same time, they are not easy for users to intuitively understand the interaction patterns and potential risk associations between assets, which poses a substantial challenge in the security monitoring, performance optimization and fault diagnosis of industrial control systems.

[0007] Therefore, those skilled in the art have been seeking a more efficient, intuitive and suitable asset dynamic behavior data storage solution for big data analysis scenarios, which can effectively represent and support rapid query and visualization of complex network topology structures. Summary of the invention

[0008] In view of the above-mentioned deficiencies in the prior art, the present application provides an asset data fusion and graph analysis method and system in an industrial control network environment.

[0009] In the first aspect, the present application proposes an asset data fusion and graph analysis method in an industrial control network environment, comprising the following steps:

[0010] Collect and pre-process the asset data of all terminals in the industrial control Internet environment;

[0011] Analyze asset node data and access relationship data from pre-processed asset data according to asset type, ownership relationship and action record;

[0012] Importing the asset node data and access relationship data into a graph database and formulating asset fusion rules to perform asset data fusion to obtain asset data fusion results;

[0013] The asset data fusion results are visualized on the data canvas through the graph canvas interface, and a query interface is provided to perform data query and analysis based on the graph.

[0014] In some embodiments, the asset data of all terminals in the industrial control Internet environment are collected and preprocessed, including:

[0015] The asset data from different industrial control equipment sources are consumed by a unified message queue, and data with missing or duplicate key attributes is preliminarily filtered out;

[0016] According to the differences in data matching formats of different asset types, they are divided into different consumption queues for subsequent parallel task processing.

[0017] In some embodiments, the asset node data, asset relationship data and asset tag attributes are analyzed from the pre-processed asset data according to the asset type, the ownership relationship and the action record, including:

[0018] According to the action record polling and processing of data from different asset queues, asset node data and asset relationship data are obtained. The asset node data includes the device unique identification code SN, MAC address, login credentials, device ID, device IP, host name, geographic location and network location. The asset relationship data includes source IP, source port, destination IP, destination port, access time and data source.

[0019] In some embodiments, the importing of the asset node data and the access relationship data into the graph database and formulating asset fusion rules to perform asset data fusion to obtain asset data fusion results include:

[0020] Data import: import the asset node data and access relationship data into the graph database through write database statements;

[0021] Matching nodes: First, match any two device nodes of asset types with similar attributes from the graph database, including device unique identifier sn, device id, device ip, device mac, host name, geographic location, network location, and login credentials;

[0022] Set weights: According to the characteristics of the attributes, a corresponding weight value is set for the device unique identification code sn, device id, device ip, device mac, host name, geographic location, network location and login credentials to indicate the contribution of the attribute to the similarity of the device node;

[0023] Calculate similarity: Use the CASE statement to determine whether the similarity values ​​of two device nodes on each attribute are exactly the same. If they are the same, use the current weight value of the attribute for subsequent calculations. Otherwise, the weight value is calculated as 0 until all attributes are determined.

[0024] Calculate the weighted sum: The weighted sum of all attribute values ​​after judgment is calculated to obtain the overall similarity of the two nodes, and the weighted sum of all attribute values ​​before judgment is calculated to obtain the total weight;

[0025] Filter similar nodes: obtain the similarity rate according to the overall similarity and the total weight, the formula is: overall similarity / total weight=similarity rate, if the similarity rate is greater than the threshold, the two device nodes are judged to be similar nodes;

[0026] Merge nodes: merge two similar nodes into one node. During the merging process, if multiple nodes have different values ​​on a certain attribute, a merging strategy is selected to merge multiple attribute values ​​to obtain an asset data fusion result. The merged node in the asset data fusion result will be returned as a result.

[0027] In some embodiments, the visual display of the asset data fusion result on the data canvas through the graph canvas interface includes:

[0028] Front-end initiates request: When loading the canvas on the Web front-end interface, the front-end sends a GET / api / graph request to the back-end;

[0029] Backend processes the request: The backend queries all device nodes and the relationships between them from the graph database;

[0030] The backend formats the graph database query results into JSON format suitable for front-end rendering, including node information and relationship information;

[0031] Return data: The backend returns the node and relationship data to the frontend, and the frontend displays the data graphically.

[0032] Front-end display chart: The front-end draws a graph based on the node and relationship data.

[0033] In some embodiments, the simultaneously providing a query interface to perform data query analysis on a graphical basis includes:

[0034] Enter the device's unique device identification code SN or device IP on the web interface to query specific asset information;

[0035] The frontend sends a GET / api / device / {sn} or GET / api / device / ip / {ip} request to the backend;

[0036] The backend uses the incoming device unique identification code sn or device ip map database to perform a MATCH query to obtain detailed information about the device;

[0037] Obtain detailed data of a device by querying the device's attributes and the relationships associated with the device;

[0038] The backend returns the detailed information and relationships of the devices to the frontend for display in JSON format.

[0039] In the second aspect, the present application proposes a data collection preprocessing module, an asset data preliminary analysis module, an asset data fusion module and a graphical analysis module;

[0040] The data collection and preprocessing module is used to collect and preprocess the asset data of all terminals in the industrial control Internet environment;

[0041] The asset data preliminary analysis module is used to analyze asset node data and access relationship data from the pre-processed asset data according to asset type, ownership relationship and action record;

[0042] The asset data fusion module is used to import the asset node data and access relationship data into the graph database and formulate asset fusion rules to perform asset data fusion to obtain asset data fusion results;

[0043] The graphical analysis module is used to visualize the asset data fusion results on the data canvas through a graphical canvas interface, and provides a query interface to perform data query and analysis based on the graphical analysis.

[0044] In some embodiments, a data cleaning interface is also included to provide an interface for external parties to actively clean up obsolete data.

[0045] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0046] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0047] Beneficial effects of the present invention:

[0048] Using graph database technology to store and display asset interaction data in the industrial control Internet environment has achieved the following significant results:

[0049] 1. Performance improvement: The graphical model greatly improves data storage and query efficiency, adapting to large data volumes and high concurrency scenarios.

[0050] 2. Convenient in-depth analysis: Native support for graph analysis simplifies the complex relationship mining process and enables real-time and intuitive display of the correlation between assets.

[0051] 3. Effective deduplication and fusion: Ensure that asset nodes are unique and relationships are diverse, improving data quality and consistency.

[0052] 4. Enhanced visualization: Provides a dynamic and easy-to-understand network view, which helps to quickly identify system risks and optimization points.

[0053] 5. Timely and accurate decision support: It provides powerful tools for industrial control network management and security monitoring, and promotes efficient operation and maintenance decision-making.

[0054] In general, this solution effectively solves the limitations of traditional storage technology in processing the construction and display of dynamic behavior data of assets in industrial control network environments, and improves the scalability and intelligence level of the overall system. It solves the performance bottlenecks, insufficient big data processing capabilities, and inconvenient graph analysis that exist in existing technologies when using relational databases or text to store traffic data between assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is the overall flow chart of the present invention.

[0056] Figure 2 This is a schematic diagram of parallel analysis of data.

[0057] Figure 3 It is a system principle block diagram of the present invention. DETAILED DESCRIPTION

[0058] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments described herein; on the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

[0059] On the one hand, this application proposes an asset data fusion and graph analysis method in an industrial control network environment, such as Figure 1 As shown, the following steps are included:

[0060] S100: collects and preprocesses asset data of all terminals in the industrial control Internet environment;

[0061] In some embodiments, the asset data of all terminals in the industrial control Internet environment are collected and preprocessed, including:

[0062] The asset data from different industrial control equipment sources are consumed by a unified message queue, and data with missing or duplicate key attributes is preliminarily filtered out;

[0063] According to the differences in data matching formats of different asset types, they are divided into different consumption queues for subsequent parallel task processing.

[0064] Among them, Figure 2 As shown in the figure, the Syslog log system, Kafka and other efficient message queue mechanisms are used to achieve real-time capture and centralized processing of asset interaction data in the industrial control Internet environment. By configuring a flexible and scalable data source interface, it is ensured that massive, multi-source, and heterogeneous traffic data can be accurately received and initially integrated. For example, terminal devices (such as PLCs, sensors, and gateways) in the industrial control network report asset data through a unified message queue (such as Kafka), and the data fields include device SN, MAC address, IP, geographic location, etc.

[0065] Filter redundancy: remove missing or duplicate records of key attributes (such as SN, IP), specifically filtering and accurately extracting the collected information in real time, eliminating non-target attributes and redundant data, and focusing on retaining key asset dynamic behavior information. This process can leverage the power of ETL tools (such as the open source tool DataX) to support dynamic rule configuration and complex event processing, ensuring that the preprocessing stage can meet high throughput requirements and accurately identify and retain valuable asset relationship data; format normalization: convert heterogeneous data of different device types into a unified format according to preset templates; queue distribution: distribute to independent consumption queues according to asset type (such as network communication assets, security protection assets) to achieve parallel processing.

[0066] S200: Analyze asset node data and access relationship data from the pre-processed asset data according to asset type, ownership relationship and action record;

[0067] In some embodiments, the asset node data, asset relationship data and asset tag attributes are analyzed from the pre-processed asset data according to the asset type, the ownership relationship and the action record, including:

[0068] According to the action record polling and processing of data from different asset queues, asset node data and asset relationship data are obtained. The asset node data includes the device unique identification code SN, MAC address, login credentials, device ID, device IP, host name, geographic location and network location. The asset relationship data includes source IP, source port, destination IP, destination port, access time and data source.

[0069] Among them, assets can be divided into: network communication assets, video monitoring assets, security protection assets, etc., and the attribution relationship can be divided into: asset access relationship, asset attack relationship, asset management relationship, etc. from the data source. Asset node attributes are extracted from pre-processed data, including: device unique identification code (SN), MAC address, device ID, IP address, host name, geographic location, network location, login credentials (encrypted storage); relationship data is generated based on action records (such as access, management, attack), including: source IP, source port, destination IP, destination port, access time, data source (such as log file);

[0070] S300: Importing the asset node data and access relationship data into a graph database and formulating asset fusion rules to perform asset data fusion to obtain an asset data fusion result;

[0071] Among them, the graph database used in this embodiment is Neo4j. Before data import, it is necessary to deploy the Neo4j service. After the deployment is completed, basic Cypher queries are executed through the Neo4j browser to ensure normal operation;

[0072] In some embodiments, the importing of the asset node data and the access relationship data into the graph database and formulating asset fusion rules to perform asset data fusion to obtain asset data fusion results include:

[0073] Data import: import the asset node data and access relationship data into the graph database through write database statements;

[0074] Among them, the write statement of asset node data is:

[0075] / / Create an asset node (Device) containing device information

[0076] CREATE (d:Device {

[0077] sn: 'sn_12345', / / device serial number

[0078] deviceId: 'device_001', / / device ID

[0079] ip: '192.168.1.1', / / IP address of the device

[0080] mac: '00:14:22:01:23:45', / / MAC address of the device

[0081] hostname: 'device-hostname', / / device hostname

[0082] location: 'Room A', / / Equipment location

[0083] networkLocation: 'Network segment 1', / / Network location

[0084] credentials: 'admin_password' / / Device credential information (such as password)

[0085] })

[0086] RETURN d; / / Return the created device node

[0087] The write statement to access relational data is:

[0088] / / Match two device nodes, sn_12345 and sn_67890

[0089] MATCH (a:Device {sn: 'sn_12345'}), (b:Device {sn: 'sn_67890'})

[0090] / / Create an access relationship and set related properties for the relationship

[0091] CREATE (a)-[r:ACCESS {

[0092] sourceIp: '192.168.1.1', / / source IP

[0093] sourcePort: 8080, / / source port

[0094] destinationIp: '192.168.1.2', / / destination IP

[0095] destinationPort: 80, / / destination port

[0096] accessTime: datetime(), / / access time, current time

[0097] dataSource: 'log_file' / / Data source (such as log file)

[0098] }]->(b)

[0099] / / Return two device nodes and their access relationship

[0100] RETURN a, r, b;

[0101] Matching nodes: First, match any two device nodes of asset types with similar attributes from the graph database, including device unique identifier sn, device id, device ip, device mac, host name, geographic location, network location, and login credentials;

[0102] (I) Assume that there are two device nodes:

[0103] n1 (device 1): sn="sn_12345", deviceId="dev_001", ip="192.168.1.1", mac="00:14:22:01:23:45", hostname="device1", location="Room A", networkLocation="Network segment 1", credentials="admin";

[0104] n2 (device 2): sn="sn_12345", deviceId="dev_001", ip="192.168.1.2", mac="00:14:22:01:23:46", hostname="device2", location="Room A", networkLocation="Network segment 2", credentials="admin";

[0105] Set weights: According to the characteristics of the attributes, a corresponding weight value is set for the device unique identification code sn, device id, device ip, device mac, host name, geographic location, network location and login credentials to indicate the contribution of the attribute to the similarity of the device node;

[0106] The specific weight settings are shown in Table 1 below:

[0107] Table 1

[0108] property characteristic Weight Unique device identification code sn Unique SN code as identity 10 mac address MAC address spoofing or MAC address cloning may be used to hide the real MAC 7 Login Credentials May change due to software reinstallation, data clearing, or user privacy settings 6 Device ID May change due to software reinstallation, data clearing, or user privacy settings 5 Device IP May change due to software reinstallation, data clearing, or user privacy settings 4 Host Name May change due to software reinstallation, data clearing, or user privacy settings 3 Location May be updated dynamically as devices migrate 2 Network location May be dynamically updated as the network system is reconfigured 1

[0109] In this embodiment, the device unique identification code SN weight (10), the device MAC address weight (7), the login credential weight (6), the device ID weight (5), the device IP weight (4), the host name weight (3), the physical location weight (2), the network location weight (1),

[0110] Calculate similarity: Use the CASE statement to determine whether the similarity values ​​of two device nodes on each attribute are exactly the same. If they are the same, use the current weight value of the attribute for subsequent calculations. Otherwise, the weight value is calculated as 0 until all attributes are determined.

[0111] (III) Based on the calculation of n1 and n2 devices, the following preliminary conclusions are obtained:

[0112] The devices have the same sn, so snSim=10 (i.e. weight 10);

[0113] The device id deviceId is the same, so deviceIdSim = 5 (i.e. weight 5);

[0114] The device ipip is different, so ipSim=0 (no match);

[0115] The device macmac is the same, so macSim=7 (i.e. weight 7);

[0116] The hostname is the same, so hostnameSim=3 (i.e. weight 3);

[0117] The geographical location is the same, so locationSim=4 (i.e. weight 4);

[0118] The network location networkLocation is different, so networkLocationSim = 0 (no match);

[0119] The login credentials are the same, so credentialsSim=6 (i.e. weight 6);

[0120] Calculate the weighted sum: The weighted sum of all attribute values ​​after judgment is calculated to obtain the overall similarity of the two nodes, and the weighted sum of all attribute values ​​before judgment is calculated to obtain the total weight;

[0121] Overall Similarity = 10+5+7+0+0+4+3+6=35

[0122] Total weight (overall) = 10 + 7 + 6 + 5 + 4 + 3 + 2 + 1 = 38

[0123] Filter similar nodes: obtain the similarity rate according to the overall similarity and the total weight, the formula is: overall similarity / total weight=similarity rate, if the similarity rate is greater than the threshold, the two device nodes are judged to be similar nodes;

[0124] Similarity (simVal) = 35 / 38 = 92.1%

[0125] Merge nodes: merge two similar nodes into one node. During the merging process, if multiple nodes have different values ​​on a certain attribute, a merging strategy is selected to merge multiple attribute values ​​to obtain an asset data fusion result. The merged node in the asset data fusion result will be returned as a result.

[0126] N3 (data fusion of device 1 and device 2): sn="sn_12345", deviceId="dev_001", ip="[192.168.1.1 , 192.168.1.2]", mac="00:14:22:01:23:45", hostname="device1",location="Room A", networkLocation="[Network segment 1 , Network segment 2]", credentials="admin";

[0127] For example, in an industrial control network, device A (SN: sn_001) and device B (SN: sn_002) are mistakenly identified as two independent nodes due to IP changes. Through fusion rule calculation, the SN and MAC addresses of the two devices are the same, and the similarity is (10+7) / 17=100%, triggering the merge operation and finally generating a unified node.

[0128] S400: The asset data fusion result is visualized on the data canvas through a graph canvas interface, and a query interface is provided to perform data query and analysis based on the graph.

[0129] In some embodiments, the visual display of the asset data fusion result on the data canvas through the graph canvas interface includes:

[0130] Front-end initiates request: When loading the canvas on the Web front-end interface, the front-end sends a GET / api / graph request to the back-end;

[0131] Backend processes the request: The backend queries all device nodes and the relationships between them from the graph database;

[0132] The backend formats the graph database query results into JSON format suitable for front-end rendering, including node information and relationship information;

[0133] Return data: The backend returns the node and relationship data to the frontend, and the frontend displays the data graphically.

[0134] Front-end display chart: The front-end draws a graph based on the node and relationship data.

[0135] The execution code for visual display is:

[0136] / / Front-end: Request to load graph data

[0137] fetch(' / api / graph', { method: 'GET',})

[0138] .then(response => response.json())

[0139] .then(data => { / / Draw the graph based on the returned data

[0140] renderGraph(data.nodes, data.relationships);

[0141] }) .catch(error => console.error('Error fetching graph data:',error));

[0142] In some embodiments, the simultaneously providing a query interface to perform data query analysis on a graphical basis includes:

[0143] Enter the device's unique device identification code SN or device IP on the web interface to query specific asset information;

[0144] The frontend sends a GET / api / device / {sn} or GET / api / device / ip / {ip} request to the backend;

[0145] The backend uses the incoming device unique identification code sn or device ip map database to perform a MATCH query to obtain detailed information about the device;

[0146] Obtain detailed data of a device by querying the device's attributes and the relationships associated with the device;

[0147] The backend returns the detailed information and relationships of the devices to the frontend for display in JSON format.

[0148] The execution code for data query is:

[0149] / / Front-end: Send a request to obtain information about the specified device

[0150] fetch(' / api / device / sn_12345', { method: 'GET',})

[0151] .then(response => response.json())

[0152] .then(data => { / / Display device information

[0153] showDeviceDetails(data.device);

[0154] }) .catch(error => console.error('Error fetching device data:',error));

[0155] In the second aspect, the present application proposes a data collection preprocessing module, an asset data preliminary analysis module, an asset data fusion module and a graphical analysis module;

[0156] The data collection and preprocessing module is used to collect and preprocess the asset data of all terminals in the industrial control Internet environment;

[0157] The asset data preliminary analysis module is used to analyze asset node data and access relationship data from the pre-processed asset data according to asset type, ownership relationship and action record;

[0158] The asset data fusion module is used to import the asset node data and access relationship data into the graph database and formulate asset fusion rules to perform asset data fusion to obtain asset data fusion results;

[0159] The graphical analysis module is used to visualize the asset data fusion results on the data canvas through a graphical canvas interface, and provides a query interface to perform data query and analysis based on the graphical analysis.

[0160] In some embodiments, a data cleaning interface is also included to provide an interface for external parties to actively clean up obsolete data.

[0161] In a third aspect, the present application proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0162] In a fourth aspect, the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0163] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0164] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0165] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0166] In the embodiments provided in the present disclosure, it should be understood that the disclosed apparatus / computer equipment and methods can be implemented in other ways. For example, the apparatus / computer equipment embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of the apparatus or unit, which may be electrical, mechanical or other forms.

[0167] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0169] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0170] The above are only preferred implementations of the present invention. It should be pointed out that a number of modifications and improved technical solutions made by those skilled in the art without departing from the technical solution should also be deemed to fall within the scope of protection required by the claims.

Claims

1. Asset data fusion and graph analysis method in industrial control network environment, characterized by: The following steps are involved: Collect and pre-process the asset data of all terminals in the industrial control Internet environment; Analyze asset node data and access relationship data from pre-processed asset data according to asset type, ownership relationship and action record; Importing the asset node data and access relationship data into a graph database and formulating asset fusion rules to perform asset data fusion to obtain asset data fusion results; The asset data fusion results are visualized on the data canvas through the graph canvas interface, and a query interface is provided to perform data query and analysis based on the graph.

2. The method according to claim 1, characterized in that: The asset data of all terminals in the industrial control Internet environment are collected and preprocessed, including: The asset data from different industrial control equipment sources are consumed by a unified message queue, and data with missing or duplicate key attributes is preliminarily filtered out; According to the differences in data matching formats of different asset types, they are divided into different consumption queues for subsequent parallel task processing.

3. The method according to claim 2, characterized in that: The asset node data, asset relationship data and asset tag attributes are analyzed from the pre-processed asset data according to the asset type, ownership relationship and action record, including: According to the action record polling and processing of data from different asset queues, asset node data and asset relationship data are obtained. The asset node data includes the device unique identification code SN, MAC address, login credentials, device ID, device IP, host name, geographic location and network location. The asset relationship data includes source IP, source port, destination IP, destination port, access time and data source.

4. The method according to claim 3, characterized in that: The asset node data and access relationship data are imported into the graph database and asset fusion rules are formulated to perform asset data fusion to obtain asset data fusion results, including: Data import: import the asset node data and access relationship data into the graph database through write database statements; Matching nodes: First, match any two device nodes of asset types with similar attributes from the graph database, including device unique identifier sn, device id, device ip, device mac, host name, geographic location, network location, and login credentials; Set weights: According to the characteristics of the attributes, a corresponding weight value is set for the device unique identification code sn, device id, device ip, device mac, host name, geographic location, network location and login credentials to indicate the contribution of the attribute to the similarity of the device node; Calculate similarity: Use the CASE statement to determine whether the similarity values ​​of two device nodes on each attribute are exactly the same. If they are the same, use the current weight value of the attribute for subsequent calculations. Otherwise, the weight value is calculated as 0 until all attributes are determined. Calculate the weighted sum: The weighted sum of all attribute values ​​after judgment is calculated to obtain the overall similarity of the two nodes, and the weighted sum of all attribute values ​​before judgment is calculated to obtain the total weight; Filter similar nodes: obtain the similarity rate according to the overall similarity and the total weight, the formula is: overall similarity / total weight=similarity rate, if the similarity rate is greater than the threshold, the two device nodes are judged to be similar nodes; Merge nodes: merge two similar nodes into one node. During the merging process, if multiple nodes have different values ​​on a certain attribute, a merging strategy is selected to merge multiple attribute values ​​to obtain an asset data fusion result. The merged node in the asset data fusion result will be returned as a result.

5. The method according to claim 4, characterized in that: The asset data fusion result is visualized on the data canvas through the map canvas interface, including: Front-end initiates request: When loading the canvas on the Web front-end interface, the front-end sends a GET / api / graph request to the back-end; Backend processes the request: The backend queries all device nodes and the relationships between them from the graph database; The backend formats the graph database query results into JSON format suitable for front-end rendering, including node information and relationship information; Return data: The backend returns the node and relationship data to the frontend, and the frontend displays the data graphically. Front-end display chart: The front-end draws a graph based on the node and relationship data.

6. The method according to claim 5, characterized in that: The query interface provided at the same time performs data query and analysis on the basis of graphing, including: Enter the device's unique device identification code SN or device IP on the web interface to query specific asset information; The frontend sends a GET / api / device / {sn} or GET / api / device / ip / {ip} request to the backend; The backend uses the incoming device unique identification code sn or device ip map database to perform a MATCH query to obtain detailed information about the device; Obtain detailed data of a device by querying the device's attributes and the relationships associated with the device; The backend returns the detailed information and relationships of the devices to the frontend for display in JSON format.

7. Asset data fusion and graph analysis system in industrial control network environment, characterized by: It includes data collection preprocessing module, asset data preliminary analysis module, asset data fusion module and graph analysis module; The data collection and preprocessing module is used to collect and preprocess the asset data of all terminals in the industrial control Internet environment; The asset data preliminary analysis module is used to analyze asset node data and access relationship data from the pre-processed asset data according to asset type, ownership relationship and action record; The asset data fusion module is used to import the asset node data and access relationship data into the graph database and formulate asset fusion rules to perform asset data fusion to obtain asset data fusion results; The graphical analysis module is used to visualize the asset data fusion results on the data canvas through a graphical canvas interface, and provides a query interface to perform data query and analysis based on the graphical analysis.

8. The system according to claim 7, characterized in that: It also includes a data cleaning interface for providing an interface for external parties to actively clean up obsolete data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images