Industrial data security management system and method based on 5G network

Abstract

The invention discloses an industrial data security management system and method based on a 5G network, and belongs to the technical field of network data management. The method comprises the following steps: dividing network slices, deploying edge nodes, and constructing a network structure topological graph; monitoring indexes are collected, topological connectivity detection and physical equipment state check are carried out, and network layer fault nodes are positioned; configuring a port mirror image in the UPF device, performing slice flow analysis, auditing a terminal behavior, and positioning a fault node of a service layer; a Bayesian network model is adopted, training is carried out based on the association rule base, the probability that each node serves as a fault root node is calculated, and the node with the highest probability is selected as the fault root node; for network connection faults, software and hardware are repaired and checked; for a network congestion fault, the congestion degree is evaluated, and flow regulation and control and resource allocation are carried out; and for a network configuration fault, obtaining a network configuration file of related equipment, comparing the network configuration file with the standard configuration template, and performing error configuration correction.

Description

Technical Field

[0001] The present invention relates to the field of network data management technology, and specifically to an industrial data security management system and method based on a 5G network. Background Art

[0002] Amid the rapid development of the Energy Internet and new power systems, smart grids are rapidly evolving toward a highly automated, information-based, and interactive environment. 5G networks, with their high bandwidth, low latency, and wide connectivity, are ideal communications platforms for supporting massive terminal access, real-time data exchange, and precise control in smart grids. However, the complexity of smart grid industrial data security management and network operations makes traditional technologies difficult to meet these stringent requirements.

[0003] In existing technologies, network architecture lacks flexibility and security. Traditional networks adopt a "one-size-fits-all" resource allocation model and are unable to dynamically allocate resources according to the differentiated needs of real-time control, monitoring and acquisition services in smart grids. Fault location and processing are inefficient. Traditional operation and maintenance methods that rely on manual inspections and experience-based judgments are difficult to quickly identify the root cause of complex faults intertwined at the network and business layers, often leading to delayed fault repairs and affecting the stable operation of the power grid. Industrial data security protection is weak, and data is susceptible to theft and tampering during transmission and storage. Existing protection technologies cannot effectively protect data throughout its entire life cycle, threatening the security of the core services of smart grids. Summary of the Invention

[0004] The purpose of the present invention is to provide an industrial data security management system and method based on 5G network to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solutions: In the first aspect, the present application provides an industrial data security management method based on a 5G network, comprising the following steps: Divide the network into slices and deploy edge nodes, including UPF devices and MEC servers; build a network topology based on network slices and edge nodes; Based on the network topology diagram, monitoring indicators are collected to perform topology connectivity detection and physical device status inspection to locate network layer fault nodes. Port mirroring is configured on UPF devices to perform slice traffic analysis, audit terminal behavior, and locate service layer fault nodes. Based on the business process of smart grid industrial data security management, the association relationship between the network layer and the business layer is obtained to form an association rule library. A Bayesian network model is used for training based on the association rule library to calculate the probability of each node being a fault root node, and the node with the highest probability is selected as the fault root node. The network fault type of the root node is handled separately as follows: For network connection failures, the specific location of the faulty link is confirmed, and software and hardware repairs are carried out. For network congestion failures, the congestion level is assessed based on the traffic monitoring data of the network structure topology diagram, and traffic regulation and resource allocation are carried out. For network configuration failures, the network configuration files of the relevant devices are obtained, compared with the standard configuration template, and the incorrect configuration is corrected.

[0006] In combination with the first aspect, in a first implementation of the first aspect of the present application, the dividing of network slices and the deployment of edge nodes, including UPF devices and MEC servers, include: Smart grid services are categorized into real-time control, monitoring and acquisition, management and operation, and emergency communications. For real-time control, fixed resource slicing is implemented, with dedicated bandwidth, CPU cores, and memory pre-allocated, and dynamic resource migration prohibited. For monitoring and acquisition, elastic resource slicing is implemented, with minimum guaranteed bandwidth and maximum burst bandwidth set, supporting dynamic resource adjustment based on load. Slice priority levels are defined, with emergency communications preempting idle resources in other slices by default. End-to-end latency thresholds are set for real-time control, with local forwarding at edge nodes reducing the number of transmission hops. Rate limits are set for management and operation to avoid occupying core service bandwidth. AES-256 encryption and the national secret SM4 algorithm are enabled, and access authentication requires verification of the device MAC address, digital certificate, and dynamic token simultaneously. Network slicing is implemented. Define core edge nodes, lightweight edge nodes, and deployment principles, and deploy edge nodes according to the preset hardware configuration plan.

[0007] In combination with the first aspect, in a second implementation of the first aspect of the present application, the constructing of a network structure topology graph based on network slices and edge nodes includes: For real-time control slices, a one-to-one vertical mapping of core edge nodes is adopted; for monitoring and acquisition slices, a one-to-many vertical mapping of lightweight edge nodes is adopted; for management and operation slices, network resources are shared with monitoring and acquisition slices; for emergency communication slices, elastic vertical mapping is adopted. Under normal circumstances, network resources are shared with monitoring and acquisition slices, and resources are dynamically preempted through the slice management system in emergencies; redundant connections are established between adjacent core edge nodes, and lightweight edge nodes are clustered by substation to form cluster groups. Each cluster group establishes a primary connection with a core edge node and a backup connection with another adjacent core edge node; the real-time status and smart grid service category are marked on the edge nodes; Import the smart grid geographic information system base map, divide the area by voltage level, connect the links, create logical groups according to the smart grid business category, and include the nodes, terminals and links in the group to build the network structure topology diagram.

[0008] In combination with the first aspect, in a third implementation of the first aspect of the present application, collecting monitoring indicators based on the network structure topology map, performing topology connectivity detection and physical device status inspection, and locating network layer fault nodes includes: Collect monitoring indicators, including node layer indicators and link layer indicators; group by divided slice subnets, perform polling detection on the downlink link, and verify the connectivity of the downlink interface of the edge node; send a directional test packet from the UPF device to the 5G base station to verify whether the base station correctly identifies the slice tunnel, receive the synchronization signal returned by the base station, and trigger a link quality degradation warning when the signal strength is lower than the threshold; simulate the GTP-U tunnel establishment process between the core network UPF device and the edge node UPF device, record the number of handshake failures, and monitor the user plane data transmission delay in the tunnel; verify the slice instance registration status through the slice management system SMF, and detect the signaling interaction between the core network control plane and the edge node; Based on the abnormal type of monitoring indicators, the fault scope is narrowed down to the node layer or link layer, and marked with color on the topology map. Starting from the abnormal terminal or abnormal slice, the path along the topology map is traced upward in the following order: terminal, downlink link, edge node, fronthaul link and core network. The detection timestamp of each node or link is recorded, and the device with the first abnormality is located as the network layer fault node.

[0009] In combination with the first aspect, in a fourth implementation of the first aspect of the present application, configuring port mirroring on the UPF device, performing slice traffic analysis, auditing terminal behavior, and locating service layer fault nodes includes: Select the fronthaul link port of the UPF device connected to the 5G base station as the mirror source port, covering all slice downlink traffic. Configure an independent monitoring port for traffic output and connect to a dedicated analysis server. Set mirroring rules based on slice identifiers, and support dynamic adjustment of the mirroring range. Use bidirectional mirroring, including inbound and outbound directions, to ensure capture of terminal uplink requests and downlink instructions, and configure traffic rate limits. Collect traffic data and perform preprocessing. Based on traffic data, the behavior space is divided by slice type, including production control terminals and monitoring and acquisition terminals, and statistical methods are used to calculate baseline parameters. Filtering is performed by anomaly type, with traffic anomalies pointing to terminals or links, and instruction anomalies pointing to MEC servers or master stations. The mapping table of slices and terminals is used to locate the edge node to which the abnormal terminal belongs. Path tracing is performed from the abnormal terminal to locate the fault node at the business layer.

[0010] In combination with the first aspect, in a fifth implementation of the first aspect of the present application, the Bayesian network model is used to perform training based on an association rule base, the probability of each node being a fault root node is calculated, and the node with the highest probability is selected as the fault root node, including: Define observation nodes, corresponding to fault detection indicators at the network layer and business layer, and define hidden nodes, specifically potential fault root nodes. Take binary states for observation nodes, with abnormality as 1 and normality as 0. Continuous indicators are converted through thresholds, and multi-state values are taken for hidden nodes. Extract causal relationships from the association rule base and construct a directed acyclic graph. Initialize the conditional probability table and use Laplace smoothing to correct the probability for low-frequency events, merging similar faults. Train the Bayesian network model, perform real-time inference and root node determination after training, and select the node with the highest probability as the fault root node.

[0011] In conjunction with the first aspect, in a sixth implementation of the first aspect of the present application, for a network connection failure, confirming the specific location of the faulty link and performing software and hardware repair and troubleshooting includes: Mark the device icon corresponding to the fault root node and all links associated with the fault root node in the network structure topology diagram; verify the topology logic, compare the slice and terminal mapping table, and check whether the link hierarchy relationship matches. The judgment standard is that the slice hierarchy of the nodes at both ends of the link is consistent; verify real-time data and extract three indicators, including traffic flow, latency, and packet loss rate curves before and after the fault. The judgment standard is that the change rate of these three indicators is greater than 50% and lasts for more than w minutes, where w is a positive integer set by the user; verify the root node attributes, and the judgment standard is that the hardware root node corresponds to a physical link interruption, and the software root node corresponds to a configuration parameter abnormality. The physical path of the fault link is automatically generated through the topology map GIS module, and the abnormal timeline of the fault root node is drawn. For hardware repair and troubleshooting, port-level troubleshooting and full-segment cable detection are performed based on the abnormal timeline. For software repair and troubleshooting, multi-source configuration calibration is performed based on the abnormal timeline, checking whether the MEC server correctly parses GOOSE messages, verifying whether the ACSI service port is blocked by the firewall error, capturing GTP-U messages, confirming whether the TEID tunnel identifier is consistent with the SMF allocation value, checking whether the slice selection function correctly maps the S-NSSAI to the target UPF, and executing the configuration repair strategy.

[0012] In combination with the first aspect, in a seventh implementation of the first aspect of the present application, for a network congestion fault, evaluating the congestion level based on traffic monitoring data of a network structure topology diagram, and performing traffic regulation and resource allocation include: Traffic monitoring data, including bandwidth utilization, latency, and packet loss rate, is collected from the network structure topology diagram. The congestion levels are classified into mild, moderate, and severe. Corresponding judgment conditions are set for each level, and the congestion level is evaluated based on the traffic monitoring data. Universal traffic shaping is enabled on the UPF device at the congested edge node, and queues are divided according to slice priority. Traffic that exceeds the queue limit is cached or discarded. Non-critical business traffic is migrated to adjacent low-load nodes through the link load heat map of the topology diagram, and equal-cost multi-path routing is enabled to disperse traffic from the core network to the edge node to the backup links. Slice-level resource reallocation is performed accordingly for different congestion levels.

[0013] In conjunction with the first aspect, in an eighth implementation of the first aspect of the present application, for a network configuration failure, obtaining a network configuration file of a related device, comparing it with a standard configuration template, and correcting the incorrect configuration includes: Use the NETCONF protocol to remotely pull the current configuration files of devices related to the root node of the fault. For devices that cannot be remotely accessed, export the configurations through the local console interface. Retrieve the standard configuration template from the version management system. Use the configuration comparison software Beyond Compare to compare the network configuration files of the relevant devices with the standard configuration template, generate a difference report, and correct the incorrect configuration.

[0014] Secondly, this application provides an industrial data security management system based on 5G network, including: Network structure topology map construction module: includes: network deployment unit and topology map construction unit; wherein, the network deployment unit divides the network slices and deploys edge nodes, including UPF devices and MEC servers; the topology map construction unit constructs the network structure topology map based on the network slices and edge nodes; Fault Node Location Module: This module includes a network layer fault node location unit and a service layer fault node location unit. The network layer fault node location unit collects monitoring indicators based on the network topology diagram, performs topology connectivity detection and physical device status checks, and locates network layer fault nodes. The service layer fault node location unit configures port mirroring on the UPF device, performs slice traffic analysis, audits terminal behavior, and locates service layer fault nodes. The fault root node determination module includes an association rule base construction unit and a fault root node determination unit. The association rule base construction unit obtains the association relationship between the network layer and the business layer based on the business process of smart grid industrial data security management to form an association rule base. The fault root node determination unit uses a Bayesian network model and is trained based on the association rule base to calculate the probability of each node being a fault root node and select the node with the highest probability as the fault root node. Fault handling module: includes: network connection fault handling unit, network congestion fault handling unit and network configuration fault handling unit; among them, the network connection fault handling unit confirms the specific location of the faulty link for network connection faults and performs software and hardware repair and troubleshooting; the network congestion fault handling unit assesses the congestion level based on the traffic monitoring data of the network structure topology diagram for network congestion faults, and performs traffic regulation and resource allocation; the network configuration fault handling unit obtains the network configuration file of the relevant equipment for network configuration faults, compares it with the standard configuration template, and corrects the incorrect configuration.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. This application uses network slicing technology to achieve precise resource allocation and secure business isolation, and customizes slicing parameters according to different business needs, which not only ensures low latency and high reliability of real-time control services, but also improves the processing efficiency of monitoring and collection services.

[0016] 2. This application constructs a network structure topology map and combines it with multi-dimensional monitoring to quickly locate network layer and business layer faults, significantly shortening the troubleshooting time; it uses the Bayesian network model and association rule library to scientifically calculate the probability of fault root nodes, making fault diagnosis more accurate and scientific.

[0017] 3. This application formulates differentiated processing strategies for different types of faults such as network connection, congestion, and configuration, which significantly improves the pertinence and effectiveness of fault handling. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic diagram of the steps of the industrial data security management method based on 5G network of the present invention; Figure 2 This is a system structure diagram of the industrial data security management system based on 5G network of the present invention. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0020] Example: Figure 1-Figure 2 As shown, the present invention provides a technical solution. like Figure 1 As shown in the schematic diagram of the steps of the industrial data security management method based on the 5G network, this application provides an industrial data security management method based on the 5G network, including the following steps: Step S100: Divide the network into slices and deploy edge nodes, including UPF devices and MEC servers; build a network topology map based on the network slices and edge nodes; Specifically, smart grid business categories are divided into real-time control, monitoring and acquisition, management and operation, and emergency communications. For real-time control, fixed resource slicing is performed, dedicated bandwidth, CPU cores, and memory are pre-allocated, and dynamic resource migration is prohibited. For monitoring and acquisition, elastic resource slicing is performed, minimum guaranteed bandwidth and maximum burst bandwidth are set, and dynamic resource adjustment based on load is supported. Slice priority levels are defined, and emergency communications preempt idle resources in other slices by default. End-to-end delay thresholds are set for real-time control, and local forwarding at edge nodes is used to reduce the number of transmission hops. Rate limits are set for management and operation to avoid occupying core business bandwidth. AES-256 encryption and the national secret SM4 algorithm are enabled, and access authentication requires verification of the device MAC address, digital certificate, and dynamic token at the same time. Network slicing is implemented. Define core edge nodes, lightweight edge nodes, and deployment principles, and deploy edge nodes according to the preset hardware configuration plan.

[0021] Furthermore, for real-time control slices, a one-to-one vertical mapping of core edge nodes is adopted; for monitoring and acquisition slices, a one-to-many vertical mapping of lightweight edge nodes is adopted; for management and operation slices, network resources are shared with monitoring and acquisition slices; for emergency communication slices, elastic vertical mapping is adopted. Under normal circumstances, network resources are shared with monitoring and acquisition slices, and resources are dynamically preempted through the slice management system in emergencies; redundant connections are established between adjacent core edge nodes, and lightweight edge nodes are clustered by substation to form cluster groups. Each cluster group establishes a primary connection with a core edge node and a backup connection with another adjacent core edge node; the real-time status and smart grid service category are marked in the edge nodes; Import the smart grid geographic information system base map, divide the area by voltage level, connect the links, create logical groups according to the smart grid business category, and include the nodes, terminals and links in the group to build the network structure topology diagram.

[0022] In a specific embodiment, the system was implemented in a demonstration area in City A of a provincial power grid in North China. The area covers three 220kV substations, 15 110kV substations, and 80 distribution stations. 350,000 smart meters, 3,200 distribution automation terminals, and 8,500 sensors of various types were deployed. The overall data traffic during peak hours of electricity consumption can reach 8.2Gbps.

[0023] Smart grid services are divided into four categories and sliced accordingly. For real-time control services, such as distribution automation control command transmission, fixed resource slices are allocated. Each slice pre-allocated 50 Mbps of dedicated bandwidth, four CPU cores, and 8 GB of memory to ensure resource stability during command transmission. Dynamic resource migration is prohibited, and an end-to-end latency threshold of 8 ms is set. Local forwarding is performed on edge nodes, keeping the actual average transmission latency within 7.2-7.8 ms. Monitoring and collection services, responsible for smart meter data collection, utilize elastic resource slicing with a minimum guaranteed bandwidth of 25 Mbps and a maximum burst bandwidth of 200 Mbps. During peak hours, when traffic on a single slice reaches 180 Mbps, dynamic adjustments are triggered, temporarily borrowing 15 Mbps of bandwidth from the management and operation slice. This ensures stable data collection and an average data collection success rate of 99.8%. For management and operation services, such as remote device firmware upgrades, the average rate is limited to 40 Mbps, with a burst rate not exceeding 80 Mbps, to avoid occupying bandwidth for core services like real-time control. Emergency communication slices are given the highest priority and, under normal circumstances, share resources with monitoring and acquisition slices. During a simulated typhoon disaster emergency drill, the slice management system completed resource preemption within 230ms, ensuring that the transmission latency of emergency command instructions was less than 12ms. All production control slices utilize dual encryption using AES-256 and the national SM4 algorithm. Access authentication requires verification of the device's MAC address, digital certificate, and dynamic token, successfully intercepting 23 unauthorized device access attempts. Ultimately, the area was divided into four production control slices, 12 monitoring and acquisition slices, and one global emergency communication slice.

[0024] According to the deployment plan, core edge nodes were deployed at 220kV substations. Each node was equipped with a UPF device with four 10 Gigabit Ethernet interfaces and supported DPDK data acceleration technology. The MEC server was equipped with an 8-core CPU, 32GB of memory, and 2TB of storage capacity. A single core node covered distribution stations and end devices within a 4.8km radius. Lightweight edge nodes were deployed at distribution stations, equipped with a simplified UPF module. The MEC server used a 4-core CPU, 8GB of memory, and 512GB of storage. Each lightweight node connected to an average of 2,200 end devices. Real-time control slices were mapped vertically one-to-one, with three core edge nodes hosting production control slices for their respective areas. Monitoring and acquisition slices were mapped one-to-many, with each monitoring and acquisition slice associated with six to eight lightweight edge nodes. 50Mbps redundant connections were established between adjacent core edge nodes. Lightweight edge nodes were clustered by substation area, with each cluster consisting of six to seven substation areas. The primary bandwidth of the connection to the core node was 1Gbps, and the backup bandwidth was 500Mbps. In actual operation, the average CPU utilization of core nodes remains at 35%-42%, and the average latency of lightweight node data preprocessing is 28ms.

[0025] A smart grid GIS base map with an accuracy of 1 meter was imported, and three 220kV substation areas and 15 110kV substation areas were divided according to voltage levels. The fronthaul link uses 25G optical fiber to connect edge nodes and 5G base stations, with an average latency of 5.3ms. The downlink link uses industrial Ethernet or wireless private network to connect edge nodes and terminal devices, with a latency of 12-26ms. Logical groupings are created according to business categories. The production control group includes three core nodes, related fronthaul and downlink links, and 3,200 distribution automation terminals; the monitoring and acquisition group covers 12 slices, 80 lightweight nodes, and 350,000 smart meter connection links. In the topology map, node status is annotated in real time, such as core node UPF device port traffic, MEC server memory usage, and business category. Production control nodes are highlighted in red, and monitoring and acquisition nodes are blue. The topology diagram clearly shows the data flow of each slice. For example, during a certain period of time, the monitoring and collection slice S-007 aggregates data from 1,200 smart meters through lightweight node No. 2 and forwards it to the main station system through core node 3. The entire transmission path is dynamically displayed in the topology diagram.

[0026] Step S200: Based on the network topology diagram, collect monitoring indicators, perform topology connectivity detection and physical device status inspection, and locate network layer fault nodes; configure port mirroring on the UPF device, perform slice traffic analysis, audit terminal behavior, and locate service layer fault nodes; Specifically, it collects monitoring indicators, including node layer indicators and link layer indicators; groups the slice subnets according to the division, performs polling detection on the downlink link, and verifies the connectivity of the downlink interface of the edge node; sends a directional test packet from the UPF device to the 5G base station to verify whether the base station correctly identifies the slice tunnel, receives the synchronization signal returned by the base station, and triggers a link quality degradation warning when the signal strength is lower than the threshold; simulates the GTP-U tunnel establishment process between the core network UPF device and the edge node UPF device, records the number of handshake failures, and monitors the user plane data transmission delay in the tunnel; verifies the slice instance registration status through the slice management system SMF, and detects the signaling interaction between the core network control plane and the edge node; Based on the abnormal type of monitoring indicators, the fault scope is narrowed down to the node layer or link layer, and marked with color on the topology map. Starting from the abnormal terminal or abnormal slice, the path along the topology map is traced upward in the following order: terminal, downlink link, edge node, fronthaul link and core network. The detection timestamp of each node or link is recorded, and the device with the first abnormality is located as the network layer fault node.

[0027] Furthermore, the fronthaul link port of the UPF device connected to the 5G base station is selected as the mirror source port, covering all slice downlink traffic. An independent monitoring port is configured for traffic output and connected to a dedicated analysis server. Mirroring rules are set according to slice identifiers, and dynamic adjustment of the mirroring range is supported. Bidirectional mirroring is adopted, including both inbound and outbound directions, to ensure the capture of terminal uplink requests and downlink instructions, and traffic rate limits are configured. Traffic data is collected and pre-processed. Based on traffic data, the behavior space is divided by slice type, including production control terminals and monitoring and acquisition terminals, and statistical methods are used to calculate baseline parameters. Filtering is performed by anomaly type, with traffic anomalies pointing to terminals or links, and instruction anomalies pointing to MEC servers or master stations. The mapping table of slices and terminals is used to locate the edge node to which the abnormal terminal belongs. Path tracing is performed from the abnormal terminal to locate the fault node at the business layer.

[0028] In a specific embodiment, the scenario of the smart grid demonstration zone in City A in North China is continued. During the stable operation of the network, various fault scenarios are simulated. By real-time collection of monitoring indicators and analysis of slice traffic, the fault nodes at the network layer and business layer are accurately located.

[0029] At 2:20 PM on a certain weekday, the system detected abnormal command transmission within the region's real-time control services. Monitoring metrics collected at the node and link layers revealed that the CPU utilization of the UPF device at core edge node #3 instantly soared to 92%. The packet loss rate of the connected 25G fronthaul link increased dramatically from 0.1% to 8%, and latency plummeted from 5.3ms to 28ms.

[0030] When testing by slice subnet group, polling of the downlink link revealed that 8 of the 12 lightweight edge nodes connected to the core node reported connection interruptions. A directional test packet was sent to the 5G base station, and the slice tunnel recognition error rate returned by the base station reached 70%, and the received base station synchronization signal strength was -105dBm, far below the threshold of -90dBm, triggering a link quality degradation warning. Simulating the GTP-U tunnel establishment process, 5 consecutive handshakes failed, and the average user plane data transmission delay in the tunnel reached 55ms. Through SMF verification, it was found that the registration status of the production control slice instance carried by the core node showed "abnormal", and the success rate of signaling interaction between the core network control plane and the edge node dropped to 30%.

[0031] Based on the anomaly indicators, the topology map pinpointed the fault to the node layer, highlighting the core edge node #3 and its associated links in red. Starting from the terminal experiencing the command transmission anomaly, the path along the topology map was traced: terminal → downlink (normal) → edge node (UPF device anomaly) → fronthaul link (high packet loss) → core network (signaling anomaly). The recorded timestamp indicated that the CPU usage of the UPF device at core edge node #3 began to increase abnormally at 2:18 PM, confirming that the UPF device was the faulty node at the network layer.

[0032] During a routine inspection, traffic data from monitoring and collection slices was collected through UPF device port mirroring. The fronthaul link port of the No. 3 core edge node connected to the 5G base station was selected as the mirror source port. An independent monitoring port was configured to output traffic to a dedicated analysis server, using bidirectional mirroring mode and a data collection rate limit of 1 Gbps.

[0033] After preprocessing and analyzing the traffic data, we found that in monitoring and collection slice S-007, the smart meter with ID IMEI_861234567890123 continuously sent invalid data frames for an hour, with a data frame format error rate as high as 45%. Based on statistical methods to calculate the baseline of terminal behavior within this slice, a normal data frame error rate should be less than 5%. This meter's behavior was clearly abnormal. Based on the anomaly type, the traffic anomaly was attributed to the terminal device.

[0034] Using the slice-terminal mapping table, the abnormal terminal was located at Lightweight Edge Node 2. Tracing the path from this terminal: abnormal terminal → Lightweight Edge Node 2 downlink (normal) → Lightweight Edge Node 2 MEC server (normal data processing) → Core Edge Node 3 UPF device (normal traffic forwarding) → 5G base station (receiving abnormal data). Further inspection revealed a vulnerability in the smart meter's firmware, resulting in data encapsulation errors, confirming that the smart meter was a faulty node at the service layer.

[0035] Furthermore, when simulating a traffic surge on emergency communication slices, port mirroring revealed that while the emergency communication slices were seizing resources, some downlink instructions from the monitoring and acquisition slices were lost. Analysis revealed that this was due to a flaw in the slice priority scheduling algorithm of the UPF device, which failed to adjust the traffic forwarding strategy in a timely manner. Ultimately, the UPF device software configuration was identified as the cause of the service layer failure.

[0036] Step S300: Based on the business process of smart grid industrial data security management, the association relationship between the network layer and the business layer is obtained to form an association rule base; a Bayesian network model is used to train based on the association rule base to calculate the probability of each node being a fault root node, and the node with the highest probability is selected as the fault root node; Specifically, observation nodes are defined, corresponding to fault detection indicators at the network layer and business layer, and hidden nodes are defined, specifically potential fault root nodes. Observation nodes take binary states, with abnormality being 1 and normality being 0. Continuous indicators are converted through thresholds, and multi-state values are taken for hidden nodes. Causal relationships are extracted from the association rule base and a directed acyclic graph is constructed. The conditional probability table is initialized, and for low-frequency events, Laplace smoothing is used to correct the probability and merge similar faults. The Bayesian network model is trained, and real-time inference and root node determination are performed after training. The node with the highest probability is selected as the fault root node.

[0037] In a specific embodiment, during the daily operation of the smart grid demonstration zone in City A in North China, more than 2,000 fault records were collected in the past six months, and the association relationship between the network layer and the business layer was sorted out to form an association rule library containing more than 500 rules.

[0038] Observation nodes and hidden nodes are defined. Observation nodes cover network-layer metrics, such as CPU utilization of core edge node UPF devices, fronthaul link packet loss rate, and GTP-U tunnel handshake failures, as well as service-layer metrics, such as the proportion of invalid data frames in smart meters and the terminal command loss rate. A total of 30 observation nodes are set, each with a binary state and a threshold value used to convert continuous metrics. For example, a UPF device CPU utilization >85% is recorded as 1 (abnormal), otherwise 0 (normal). Hidden nodes include potential fault root nodes, such as "UPF device hardware failure," "smart meter firmware vulnerability," and "slice priority scheduling algorithm flaw." A total of 20 hidden nodes are defined, with multi-state values. For example, a "UPF device hardware failure" is divided into three states: "port failure," "power module failure," and "heat dissipation failure."

[0039] Causal relationships are extracted from the association rule base to construct a directed acyclic graph. For example, the two observation nodes "Abnormal UPF Device CPU Utilization" and "Abnormal Fronthaul Link Packet Loss Rate" point to the hidden node "UPF Device Hardware Fault"; "Abnormal Smart Meter Invalid Data Frame Ratio" points to the hidden node "Smart Meter Firmware Vulnerability." When initializing the conditional probability table, Laplace smoothing is used to correct the probability of low-frequency events, such as "Satellite Link Disruption." Similarly, similar faults are merged, such as port faults of different UPF device models, into "UPF Port Faults," to improve data adequacy.

[0040] A Bayesian network model was trained using over 2,000 collected fault records, employing the Expectation Maximization (EM) algorithm to handle missing data. After 100 iterations of training, the model's joint probability on historical data reached stability. After training, real-time inference and root node determination were performed.

[0041] Step S400: Process the network fault according to the type of the root node of the fault, as follows: for network connection failure, confirm the specific location of the faulty link and perform software and hardware repair and troubleshooting; for network congestion failure, evaluate the congestion level based on the traffic monitoring data of the network structure topology diagram, and perform traffic regulation and resource allocation; for network configuration failure, obtain the network configuration file of the relevant equipment, compare it with the standard configuration template, and correct the incorrect configuration.

[0042] Specifically, mark the device icon corresponding to the fault root node and all links associated with the fault root node in the network structure topology diagram; verify the topology logic, compare the slice and terminal mapping table, and check whether the link hierarchy relationship matches. The judgment standard is that the slice hierarchy of the nodes at both ends of the link is consistent; verify real-time data and extract three indicators, including traffic flow, latency, and packet loss rate curves before and after the fault. The judgment standard is that the change rate of the three indicators is greater than 50% and lasts for more than w minutes, where w is a positive integer set by the user; verify the root node attributes, and the judgment standard is that the hardware root node corresponds to a physical link interruption, and the software root node corresponds to a configuration parameter abnormality; automatically generate the physical path of the fault link through the topology map GIS module, and draw the abnormal timeline of the fault root node; For hardware repair and troubleshooting, port-level troubleshooting and full-segment cable detection are performed based on the abnormal timeline. For software repair and troubleshooting, multi-source configuration calibration is performed based on the abnormal timeline, checking whether the MEC server correctly parses GOOSE messages, verifying whether the ACSI service port is blocked by the firewall error, capturing GTP-U messages, confirming whether the TEID tunnel identifier is consistent with the SMF allocation value, checking whether the slice selection function correctly maps the S-NSSAI to the target UPF, and executing the configuration repair strategy.

[0043] Furthermore, traffic monitoring data, including bandwidth utilization, latency, and packet loss rate, is collected from the network structure topology diagram, and the congestion levels are classified into mild, moderate, and severe. Corresponding judgment conditions are set for each level, and the congestion level is evaluated based on the traffic monitoring data. General traffic shaping is enabled on the UPF device at the congested edge node, and queues are divided according to slice priority. Traffic that exceeds the queue limit is cached or discarded. Non-critical business traffic is migrated to adjacent low-load nodes through the link load heat map of the topology diagram, and equal-cost multi-path routing is enabled to disperse traffic from the core network to the edge node to the backup links. Slice-level resource reallocation is performed accordingly for different congestion levels.

[0044] Furthermore, the current configuration files of the devices related to the root node of the fault are remotely pulled through the NETCONF protocol. For devices that cannot be remotely accessed, the configuration is exported through the local console interface. The standard configuration template is retrieved from the version management system. The configuration comparison software Beyond Compare is used to compare the network configuration files of the relevant devices with the standard configuration template, generate a difference report, and correct the incorrect configuration.

[0045] In one specific example, a fiber break in the fronthaul link between Core Edge Node 3 and a 5G base station was simulated, triggering a network outage. The Core Edge Node 3 icon in the topology diagram flashed red, and the associated fronthaul link displayed a break icon with the label "Link Down." The slice-to-terminal mapping table confirmed that both nodes at both ends of the link (core node and base station) belonged to the production control slice level, and the logical relationships matched. Before the failure, link traffic was stable at 35 Mbps, latency was 5.3 ms, and packet loss was 0.1%. After the failure, traffic returned to zero, latency exceeded, and packet loss was 100%. All three metrics experienced a change rate exceeding 50% for 10 minutes (w = 10). A timeline was generated. On-site inspection revealed contamination in the fiber connector. After cleaning, signal strength returned to -18 dBm, but a break at 2 km remained (confirmed by OTDR testing). The faulty fiber segment (2.3 km) was replaced, and link connectivity was tested. Traffic returned to 35 Mbps, latency was 6.1 ms, and packet loss was 0.2%. Software verification confirmed no configuration anomalies and required no adjustments.

[0046] During peak electricity consumption, the number of lightweight node access terminals connected to the monitoring and collection slice S-005 suddenly increased to 2,500 (designed capacity: 2,000), triggering congestion. The lightweight node bandwidth utilization reached 95%, latency increased from 30ms to 80ms, and the packet loss rate was 4%. This situation was classified as severe congestion (bandwidth utilization > 90%, latency increase > 50%).

[0047] Enable GTS on the lightweight node UPF and divide the queues: Production control slice (queue 1): guaranteed bandwidth 50 Mbps, burst bandwidth 100 Mbps (priority 1). Monitoring and collection slice S-005 (queue 3): average bandwidth is limited to 150 Mbps, and excess traffic is discarded.

[0048] Using the topology heat map, traffic from 500 terminals was migrated to the adjacent lightweight node LN-012, alleviating pressure on the existing node. ECMP was enabled, distributing traffic from the core network to edge nodes across three backup links, reducing latency to 45ms. 20Mbps of bandwidth was borrowed from the management and operations slice, increasing the minimum guaranteed bandwidth of the monitoring and collection slice S-005 to 45Mbps.

[0049] The lightweight node MEC server mistakenly shut down the IEC61850 port (port 102) of the production control slice, interrupting network configuration. Remotely pulling the lightweight node configuration file and comparing it with the standard template revealed that the ACSI service port (port 102) of the production control slice was "closed" (the standard configuration is "open"). Critical service ports are shut down and have the highest priority. The "port102open" command was issued via the NETCONF protocol to restart the MEC data processing service. Verifying port connectivity: A telnet test of port 102 confirmed a successful connection, and GOOSE message parsing accuracy returned to 100%. Capturing GTP-U messages confirmed that the TEID was consistent with the SMF allocation. Testing the slice selection function confirmed that the S-NSSAI was correctly mapped to the target UPF.

[0050] like Figure 2 As shown in the system structure diagram of the industrial data security management system based on the 5G network, this application provides an industrial data security management system based on the 5G network, including: Network structure topology map construction module: includes: network deployment unit and topology map construction unit; wherein, the network deployment unit divides the network slices and deploys edge nodes, including UPF devices and MEC servers; the topology map construction unit constructs the network structure topology map based on the network slices and edge nodes; Fault Node Location Module: This module includes a network layer fault node location unit and a service layer fault node location unit. The network layer fault node location unit collects monitoring indicators based on the network topology diagram, performs topology connectivity detection and physical device status checks, and locates network layer fault nodes. The service layer fault node location unit configures port mirroring on the UPF device, performs slice traffic analysis, audits terminal behavior, and locates service layer fault nodes. The fault root node determination module includes an association rule base construction unit and a fault root node determination unit. The association rule base construction unit obtains the association relationship between the network layer and the business layer based on the business process of smart grid industrial data security management to form an association rule base. The fault root node determination unit uses a Bayesian network model and is trained based on the association rule base to calculate the probability of each node being a fault root node and select the node with the highest probability as the fault root node. Fault handling module: includes: network connection fault handling unit, network congestion fault handling unit and network configuration fault handling unit; among them, the network connection fault handling unit confirms the specific location of the faulty link for network connection faults and performs software and hardware repair and troubleshooting; the network congestion fault handling unit assesses the congestion level based on the traffic monitoring data of the network structure topology diagram for network congestion faults, and performs traffic regulation and resource allocation; the network configuration fault handling unit obtains the network configuration file of the relevant equipment for network configuration faults, compares it with the standard configuration template, and corrects the incorrect configuration.

[0051] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

Claims

1. The industrial data security management method based on 5G network is characterized by: The following steps are involved: Divide the network into slices and deploy edge nodes, including UPF devices and MEC servers; build a network topology based on network slices and edge nodes; Based on the network topology diagram, collect monitoring indicators, perform topology connectivity detection and physical device status inspection, and locate network layer fault nodes; Configure port mirroring on the UPF device to perform slice traffic analysis, audit terminal behavior, and locate service layer fault nodes; Based on the business process of smart grid industrial data security management, the association relationship between the network layer and the business layer is obtained to form an association rule library. A Bayesian network model is used for training based on the association rule library to calculate the probability of each node being a fault root node, and the node with the highest probability is selected as the fault root node. The network fault type of the root node is handled separately as follows: For network connection failures, the specific location of the faulty link is confirmed, and software and hardware repairs are carried out. For network congestion failures, the congestion level is assessed based on the traffic monitoring data of the network structure topology diagram, and traffic regulation and resource allocation are carried out. For network configuration failures, the network configuration files of the relevant devices are obtained, compared with the standard configuration template, and the incorrect configuration is corrected.

2. The industrial data security management method based on 5G network according to claim 1 is characterized in that: The network slicing and deployment of edge nodes, including UPF devices and MEC servers, include: Smart grid services are categorized into real-time control, monitoring and acquisition, management and operation, and emergency communications. For real-time control, fixed resource slicing is implemented, with dedicated bandwidth, CPU cores, and memory pre-allocated, and dynamic resource migration prohibited. For monitoring and acquisition, elastic resource slicing is implemented, with minimum guaranteed bandwidth and maximum burst bandwidth set, supporting dynamic resource adjustment based on load. Slice priority levels are defined, with emergency communications preempting idle resources in other slices by default. End-to-end latency thresholds are set for real-time control, with local forwarding at edge nodes reducing the number of transmission hops. Rate limits are set for management and operation to avoid occupying core service bandwidth. AES-256 encryption and the national secret SM4 algorithm are enabled, and access authentication requires verification of the device MAC address, digital certificate, and dynamic token simultaneously. Network slicing is implemented. Define core edge nodes, lightweight edge nodes, and deployment principles, and deploy edge nodes according to the preset hardware configuration plan.

3. The industrial data security management method based on 5G network according to claim 1 is characterized in that: The construction of a network structure topology map based on network slices and edge nodes includes: For real-time control slices, a one-to-one vertical mapping of core edge nodes is adopted; for monitoring and acquisition slices, a one-to-many vertical mapping of lightweight edge nodes is adopted; for management and operation slices, network resources are shared with monitoring and acquisition slices; for emergency communication slices, elastic vertical mapping is adopted. Under normal circumstances, network resources are shared with monitoring and acquisition slices, and resources are dynamically preempted through the slice management system in emergencies; redundant connections are established between adjacent core edge nodes, and lightweight edge nodes are clustered by substation to form cluster groups. Each cluster group establishes a primary connection with a core edge node and a backup connection with another adjacent core edge node; the real-time status and smart grid service category are marked on the edge nodes; Import the smart grid geographic information system base map, divide the area by voltage level, connect the links, create logical groups according to the smart grid business category, and include the nodes, terminals and links in the group to build the network structure topology diagram.

4. The industrial data security management method based on 5G network according to claim 1 is characterized in that: The method of collecting monitoring indicators based on the network structure topology diagram, performing topology connectivity detection and physical device status inspection, and locating network layer fault nodes includes: Collect monitoring indicators, including node layer indicators and link layer indicators; group by divided slice subnets, perform polling detection on the downlink link, and verify the connectivity of the downlink interface of the edge node; send a directional test packet from the UPF device to the 5G base station to verify whether the base station correctly identifies the slice tunnel, receive the synchronization signal returned by the base station, and trigger a link quality degradation warning when the signal strength is lower than the threshold; simulate the GTP-U tunnel establishment process between the core network UPF device and the edge node UPF device, record the number of handshake failures, and monitor the user plane data transmission delay in the tunnel; verify the slice instance registration status through the slice management system SMF, and detect the signaling interaction between the core network control plane and the edge node; Based on the abnormal type of monitoring indicators, the fault scope is narrowed down to the node layer or link layer, and marked with color on the topology map. Starting from the abnormal terminal or abnormal slice, the path along the topology map is traced upward in the following order: terminal, downlink link, edge node, fronthaul link and core network. The detection timestamp of each node or link is recorded, and the device with the first abnormality is located as the network layer fault node.

5. The industrial data security management method based on 5G network according to claim 1 is characterized in that: Configuring port mirroring on the UPF device, performing slice traffic analysis, auditing terminal behavior, and locating service layer fault nodes includes: Select the fronthaul link port of the UPF device connected to the 5G base station as the mirror source port, covering all slice downlink traffic. Configure an independent monitoring port for traffic output and connect to a dedicated analysis server. Set mirroring rules based on slice identifiers, and support dynamic adjustment of the mirroring range. Use bidirectional mirroring, including inbound and outbound directions, to ensure capture of terminal uplink requests and downlink instructions, and configure traffic rate limits. Collect traffic data and perform preprocessing. Based on traffic data, the behavior space is divided by slice type, including production control terminals and monitoring and acquisition terminals, and statistical methods are used to calculate baseline parameters. Filtering is performed by anomaly type, with traffic anomalies pointing to terminals or links, and instruction anomalies pointing to MEC servers or master stations. The mapping table of slices and terminals is used to locate the edge node to which the abnormal terminal belongs. Path tracing is performed from the abnormal terminal to locate the fault node at the business layer.

6. The industrial data security management method based on 5G network according to claim 1 is characterized in that: The Bayesian network model is used for training based on an association rule base to calculate the probability of each node being a fault root node, and the node with the highest probability is selected as the fault root node, including: Define observation nodes, corresponding to fault detection indicators at the network layer and business layer, and define hidden nodes, specifically potential fault root nodes. Take binary states for observation nodes, with abnormality as 1 and normality as 0. Continuous indicators are converted through thresholds, and multi-state values are taken for hidden nodes. Extract causal relationships from the association rule base and construct a directed acyclic graph. Initialize the conditional probability table and use Laplace smoothing to correct the probability for low-frequency events, merging similar faults. Train the Bayesian network model, perform real-time inference and root node determination after training, and select the node with the highest probability as the fault root node.

7. The industrial data security management method based on 5G network according to claim 1 is characterized in that: For network connection failures, identify the specific location of the faulty link and perform software and hardware repair and troubleshooting, including: Mark the device icon corresponding to the fault root node and all links associated with the fault root node in the network structure topology diagram; verify the topology logic, compare the slice and terminal mapping table, and check whether the link hierarchy relationship matches. The judgment standard is that the slice hierarchy of the nodes at both ends of the link is consistent; verify real-time data and extract three indicators, including traffic flow, latency, and packet loss rate curves before and after the fault. The judgment standard is that the change rate of these three indicators is greater than 50% and lasts for more than w minutes, where w is a positive integer set by the user; verify the root node attributes, and the judgment standard is that the hardware root node corresponds to a physical link interruption, and the software root node corresponds to a configuration parameter abnormality. The physical path of the fault link is automatically generated through the topology map GIS module, and the abnormal timeline of the fault root node is drawn. For hardware repair and troubleshooting, port-level troubleshooting and full-segment cable detection are performed based on the abnormal timeline. For software repair and troubleshooting, multi-source configuration calibration is performed based on the abnormal timeline, checking whether the MEC server correctly parses GOOSE messages, verifying whether the ACSI service port is blocked by the firewall error, capturing GTP-U messages, confirming whether the TEID tunnel identifier is consistent with the SMF allocation value, checking whether the slice selection function correctly maps the S-NSSAI to the target UPF, and executing the configuration repair strategy.

8. The industrial data security management method based on 5G network according to claim 1 is characterized in that: For network congestion failures, the congestion level is assessed based on the traffic monitoring data of the network topology diagram, and traffic regulation and resource allocation are performed, including: Traffic monitoring data, including bandwidth utilization, latency, and packet loss rate, is collected from the network structure topology diagram. The congestion levels are classified into mild, moderate, and severe. Corresponding judgment conditions are set for each level, and the congestion level is evaluated based on the traffic monitoring data. Universal traffic shaping is enabled on the UPF device at the congested edge node, and queues are divided according to slice priority. Traffic that exceeds the queue limit is cached or discarded. Non-critical business traffic is migrated to adjacent low-load nodes through the link load heat map of the topology diagram, and equal-cost multi-path routing is enabled to disperse traffic from the core network to the edge node to the backup links. Slice-level resource reallocation is performed accordingly for different congestion levels.

9. The industrial data security management method based on 5G network according to claim 1 is characterized in that: For network configuration failures, the network configuration files of related devices are obtained, compared with the standard configuration template, and the incorrect configuration is corrected, including: Use the NETCONF protocol to remotely pull the current configuration files of devices related to the root node of the fault. For devices that cannot be remotely accessed, export the configurations through the local console interface. Retrieve the standard configuration template from the version management system. Use the configuration comparison software Beyond Compare to compare the network configuration files of the relevant devices with the standard configuration template, generate a difference report, and correct the incorrect configuration.

10. An industrial data security management system based on a 5G network, using the industrial data security management method based on a 5G network according to any one of claims 1 to 9, comprising: Network structure topology map construction module: includes: network deployment unit and topology map construction unit; wherein, the network deployment unit divides the network slices and deploys edge nodes, including UPF devices and MEC servers; the topology map construction unit constructs the network structure topology map based on the network slices and edge nodes; Fault Node Location Module: This module includes a network layer fault node location unit and a service layer fault node location unit. The network layer fault node location unit collects monitoring indicators based on the network topology diagram, performs topology connectivity detection and physical device status checks, and locates network layer fault nodes. The service layer fault node location unit configures port mirroring on the UPF device, performs slice traffic analysis, audits terminal behavior, and locates service layer fault nodes. The fault root node determination module includes an association rule base construction unit and a fault root node determination unit. The association rule base construction unit obtains the association relationship between the network layer and the business layer based on the business process of smart grid industrial data security management to form an association rule base. The fault root node determination unit uses a Bayesian network model and is trained based on the association rule base to calculate the probability of each node being a fault root node and select the node with the highest probability as the fault root node. Fault handling module: includes: network connection fault handling unit, network congestion fault handling unit and network configuration fault handling unit; among them, the network connection fault handling unit confirms the specific location of the faulty link for network connection faults and performs software and hardware repair and troubleshooting; the network congestion fault handling unit assesses the congestion level based on the traffic monitoring data of the network structure topology diagram for network congestion faults, and performs traffic regulation and resource allocation; the network configuration fault handling unit obtains the network configuration file of the relevant equipment for network configuration faults, compares it with the standard configuration template, and corrects the incorrect configuration.

Images