Industrial asset association analysis method and system based on large language model

Abstract

The invention discloses an industrial asset association analysis method and system based on a large model, and relates to the technical field of industrial asset association analysis, and the method comprises the steps: obtaining information which comprises business process data and security data; preprocessing the information to obtain preprocessed data; the preprocessed data are input into a trained big language model, the trained big language model analyzes the business process data and carries out scenario processing on the security data, and analyzed business process information and scenario security information are output; and inputting the analyzed business process information and the situational security information into a trained big language model, and identifying the association between the analyzed business process information and the situational security information by the big language model to obtain an association result. According to the invention, the potential influence of security vulnerabilities, alarms or events on specific business functions and overall operation continuity can be evaluated.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial asset association analysis, and in particular to an industrial asset association analysis method and system based on a large language model. Background Art

[0002] With the development of digital manufacturing and the Industrial Internet, industrial control systems generate massive amounts of data, including equipment operating parameters, sensor readings, control instructions, and various network security logs. However, existing industrial asset correlation analysis faces the following problems:

[0003] 1. Data silos are a serious problem. Industrial control system business data (such as process parameters and equipment status) is often independent of network security data (such as firewall logs and intrusion detection alerts). The lack of a unified model to correlate these two types of data makes it difficult to gain a comprehensive understanding of the security situation.

[0004] 2. The data volume is huge, complex, and diverse. During the manufacturing process, different work sections and equipment generate massive amounts of heterogeneous data. Traditional rule matching or simple correlation analysis is difficult to effectively process, often drowning in massive logs and failing to detect anomalies in a timely manner.

[0005] 3. Poor analysis results. Existing technologies primarily rely on predefined rules or expert experience for correlation analysis, making it difficult to capture complex potential threat relationships across equipment and processes. This results in high rates of missed threats and false positives, and fails to meet the needs of industrial sites for real-time, accurate security monitoring.

[0006] Therefore, an industrial asset association analysis method and system based on a large language model was developed to solve the above problems. Summary of the Invention

[0007] The present invention proposes an industrial asset association analysis method and system based on a large language model to solve the problems of data silos, difficulty in processing large amounts of data, and poor analysis results in the prior art.

[0008] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0009] The present invention provides an industrial asset association analysis method based on a large language model, comprising:

[0010] obtaining information, including business process data and security data;

[0011] Preprocessing the information to obtain preprocessed data;

[0012] Inputting the preprocessed data into a trained large language model, the trained large language model parses the business process data and contextualizes the security data, and outputs the parsed business process information and contextualized security information;

[0013] The parsed business process information and contextual security information are input into a trained large language model, and the large language model identifies the association between the parsed business process information and the contextual security information to obtain an association result.

[0014] Furthermore, information is obtained, including:

[0015] Acquire business process data, including structured process models, natural language process descriptions, and transaction data from ERP or MES systems. The business process data captures the sequence, activities, resources used, goals, and time / cost information of the process to be captured.

[0016] Acquire security data, including asset inventory data, vulnerability data, security logs, network traffic data, alarm data, and configuration data.

[0017] Furthermore, the information is pre-processed, including:

[0018] Perform data completion and outlier correction on the information, standardize time, unit and field format, and remove noise or irrelevant information;

[0019] Expanding the specialized terms and step descriptions in the business process data into sentences containing additional process context and aligning them with industry standard ontologies;

[0020] Map abbreviations, device identifiers, vulnerability numbers, etc. in security incident text to specific entities in the asset inventory and retrieve corresponding security knowledge or threat intelligence summaries;

[0021] Through named entity recognition and ontology mapping, the business process data is aligned with the same assets or concepts appearing in the security log, and these entities and their attributes are encoded into embedding vectors that can be processed by the trained large language model;

[0022] Convert structured table data and log entries into natural language descriptions or semantic embeddings, generate descriptive sentences for important table fields, and convert process text and event text into vector representations respectively.

[0023] Furthermore, the trained large language model parses the business process data, including:

[0024] Parse structured process models or unstructured text descriptions to understand the sequence of activities, decision points, resources / roles involved, process goals, and key performance indicators;

[0025] By analyzing resource allocation information, semantic content of activity descriptions, or asset-related terms, the core industrial assets associated with each business process step are identified.

[0026] Furthermore, the trained large language model contextualizes the security data, including:

[0027] Combined with asset inventory information, interpret security alerts, vulnerability reports, and log entries to map an IP address or device name to a specific asset and its attributes;

[0028] Identify the specific assets, network segments, or software components affected by each security incident or vulnerability.

[0029] Furthermore, the large language model identifies the association between the parsed business process information and the contextualized security information, and obtains an association result, including:

[0030] Perform asset mapping based on the knowledge graph for the core industrial assets and asset inventory information associated with each business process step;

[0031] Integrate mapped asset information, related business process step descriptions, and security incident details into structured input, which is then fed into a trained large language model for deep reasoning.

[0032] Output the association results, which include association judgment results, association strength scores and potential business impacts. The association judgment results include the business process step IDs involved, the relevant security incident IDs, and the affected asset IDs. The association strength score comprehensively considers text semantic similarity, asset relationship, and model confidence. The potential business impact comprehensively considers process criticality, asset criticality, security incident severity, and consequence severity.

[0033] Furthermore, the association strength score The calculation formula is as follows:

[0034] ;

[0035] in, is the preset weight coefficient, satisfying , is the text similarity, is the graph relationship degree, is the confidence of the large language model, the text similarity is obtained by calculating the cosine similarity between the embedding vectors of the asset and event description texts, the graph relationship is determined by the connection relationship between two assets or assets and events in the knowledge graph, and the large language model confidence is the correlation confidence value output by the trained large language model.

[0036] Furthermore, the calculation formula for potential business impact PBI is as follows:

[0037] ;

[0038] Indicates process criticality, Indicates asset criticality, Indicates the severity of the vulnerability, Indicates the severity of the consequences, It is a preset weight coefficient that can be set according to the enterprise's risk preference.

[0039] Furthermore, a readable security threat report is generated based on the association result, and the security threat report includes: a description of the identified risks, the industrial assets and process links involved, details of the associated network threat events, and corresponding security recommendations or disposal measures.

[0040] The present invention also provides an industrial asset association analysis system based on a large language model, comprising:

[0041] A data access module, the data access module is used to obtain information, the information including business process data and security data;

[0042] A data preprocessing module, configured to preprocess the information to obtain preprocessed data;

[0043] a core module, the core module being configured to input the preprocessed data into a trained large language model, the trained large language model parsing the business process data and contextualizing the security data, and outputting the parsed business process information and contextualized security information;

[0044] The association engine module is used to input the parsed business process information and contextual security information into the trained large language model, and the large language model identifies the association between the parsed business process information and contextual security information to obtain the association result.

[0045] The beneficial effects of the present invention are:

[0046] The present invention proposes an industrial asset association analysis method and system based on a large language model, which uses a trained large language model to interpret the semantic content of business process descriptions, identify the industrial assets involved in specific process steps, and associate this with real-time or historical security data involving these assets and their related control systems. This association enables the system to assess the potential impact of security vulnerabilities, alarms or events on specific business functions and overall operational continuity. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a framework diagram of an industrial asset association analysis system based on a large language model in an embodiment of the present application.

[0048] Figure 2 This is a flowchart of an industrial asset association analysis method based on a large language model in an embodiment of the present application. DETAILED DESCRIPTION

[0049] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the embodiments of the present invention. It should be understood that the described embodiments are only a portion of the embodiments of the present invention, not all of them. Generally, the components of the embodiments of the present invention described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations.

[0050] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort shall fall within the scope of protection of the present invention.

[0051] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0052] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0053] like Figure 1 As shown in the figure, an embodiment of the present invention provides an industrial asset correlation analysis system based on a large language model. Its architecture is designed to integrate, process, correlate, and report on business process and OT safety data. This system uniquely combines traditionally separate data sources and processes them using a large language model core (specifically DeepSeek, designed for complex reasoning and heterogeneous data). The system includes the following interconnected modules:

[0054] 1.Data access module.

[0055] 1) Business Process Data Module: This module is configured to receive data defining industrial business processes. Data sources include structured process models (e.g., documents conforming to the BPMN standard), natural language process descriptions (e.g., standard operating procedures, technical documentation, or maintenance manuals), and transaction data from ERP or MES systems (which implicitly captures the process execution steps). This data must capture the process sequence, activities, resources used (manpower, equipment), goals, and time / cost information.

[0056] 2) ICS / OT Security Data Module: This module is configured to receive data related to the security status of the OT environment. Data sources include: asset inventory data (detailed information about OT assets), vulnerability data (from vulnerability scanners or public / private vulnerability databases), security logs (from firewalls, IDS / IPS, endpoint security tools, etc.), network flow data, alert data (from security monitoring platforms), and configuration data.

[0057] 2. Data preprocessing module.

[0058] The data preprocessing module is responsible for thoroughly cleaning and validating incoming business process data and OT safety data, converting them into a unified semantic representation that is easily understood by the large language model. This module incorporates context enhancement and semantic alignment mechanisms to support deep processing of the large language model. First, the raw data is completed and outliers are corrected, time, units, and field formats are standardized, and noise or irrelevant information is removed. Then, semantic processing of the data is performed in conjunction with the domain knowledge base. For example:

[0059] Expand the professional terms and step descriptions in business processes into sentences that include additional process context and align them with industry standard ontologies (such as ISA-95 and IEC62443 industry terminology) so that large language models can accurately understand process intent and constraints;

[0060] Map abbreviations, device identifiers, vulnerability numbers, etc. in security event text (such as IDS / IPS alerts and vulnerability reports) to specific entities in the asset inventory and retrieve corresponding security knowledge or threat intelligence summaries to enrich the semantic information of the event;

[0061] Through named entity recognition and ontology mapping, we align business process data with the same assets or concepts that appear in security logs (for example, matching "PLC-123" in the process with the same PLC entity in the security log). We then encode these entities and their attributes into embedding vectors that can be processed by large language models.

[0062] Convert structured table data and log entries into natural language descriptions or semantic embeddings. Generate descriptive sentences for important table fields and convert process text and event text into vector representations (e.g., embeddings generated using a pre-trained domain embedding model) for subsequent similarity calculations.

[0063] Ultimately, the preprocessing output includes standardized business process text, semantically enriched security incident descriptions, and corresponding semantic embedding vectors. These data are enhanced and aligned at the semantic level, providing sufficient contextual information for DeepSeek model reasoning.

[0064] 3. DeepSeek Large Language Model (LLM) core.

[0065] As the system's intelligent engine, DeepSeek performs joint modeling and cross-domain reasoning on business process information and OT security data. This model is based on the Transformer architecture, built on a large-scale pre-trained language model, and fine-tuned for data from industrial processes and ICS security. During the training phase, multiple tasks are jointly optimized by defining a multi-task loss function, such as:

[0066] ;

[0067] in, Cross entropy loss for language model generation or mask prediction, Classify losses for key entities (such as assets, software, vulnerabilities, etc.), The loss predicted for the relationship between the business process entity and the security incident entity, Comparative learning loss is used to align the semantic vectors of business process descriptions and security incident descriptions. Corresponding respectively , , , The weight coefficient can be adjusted according to the actual scenario.

[0068] During the reasoning phase, DeepSeek employs techniques such as chained thinking and retrieval-enhanced generation to improve reasoning quality. The model can break down complex reasoning into multiple sub-problems by gradually generating intermediate reasoning steps. For example, it can first extract causal relationships within a process and then infer specific impacts based on security incident information. During critical reasoning, the model can also retrieve snippets from relevant industry documents or security knowledge bases and input them as context to enhance the evidence.

[0069] Specifically, given a business process description x and a security incident description z, the model first retrieves the relevant text set R, and then synthesizes x, z, and R to generate the output y:

[0070] ;

[0071] in, Represents the parameter set of the DeepSeek large model, that is, all model weights and biases learned during training.

[0072] The model uses a standard multi-head attention mechanism to efficiently process long sequence inputs. Key-value cache (KV cache) compression technology is also used to significantly improve inference efficiency and reduce memory usage. The core of the attention mechanism is to calculate the similarity between the query and the key to determine the weight of the value.

[0073] The multi-head mechanism captures different relational patterns by computing multiple attention heads in parallel. In industrial scenarios, MLA enables the model to efficiently correlate massive amounts of log and event data from different time points and systems.

[0074] DeepSeek also employs a Mixture of Experts (MoE) model, which activates a subset of experts rather than the entire model for computation, enabling more efficient training and inference. This allows different experts to focus on different types of knowledge or tasks. The MoE selectively activates certain expert networks within the model to process inputs through a gating network. Its lossless load balancing strategy helps maintain a balanced expert utilization without sacrificing performance.

[0075] During the model fine-tuning phase, a training set is first constructed using a variety of data sources, including process documentation, PLC / SCADA system logs, runtime alarm records, known CVE vulnerability databases, and configuration lists. This data provides system behavior and security event scenarios in text or structured formats, covering a rich sample base from different vendors and processes, enabling cross-domain learning.

[0076] Then, instruction fine-tuning is used to enable the model to understand and perform security analysis tasks, such as extracting asset relationships based on prompts. Multi-task learning is used to simultaneously train multiple tasks such as entity recognition, relationship extraction, and text generation to promote the model to learn common representations. At the same time, a comparative learning objective is introduced to map multiple representations of the same asset or the same event into similar vector spaces to enhance semantic consistency within the domain.

[0077] The fine-tuning process utilizes MoE and MLA in its network mechanism, enabling the model to concurrently focus on different information dimensions. In addition to the language modeling loss, supervised losses for entity recognition and relationship extraction are introduced, enabling the model to accurately label asset entities and their relationships during generation. For example, a cross-entropy loss is applied to identified asset nouns, while a binary or multi-classification loss is applied to predicted asset-event relationships. A confidence supervision loss is also introduced to correct the association confidence scores generated by the model, improving the model's ability to estimate prediction uncertainty.

[0078] Through the above training, after fine-tuning, DeepSeek can perform:

[0079] Semantic understanding: Deeply understand the meaning, goals, constraints of business process steps and descriptions of security events.

[0080] Entity Identification: Accurately identify key entities such as industrial assets, network segments, software, vulnerabilities, and security concepts.

[0081] Relationship extraction: Identify complex relationships between business processes, process steps, used assets, network connections, control logic, and security events and assets.

[0082] Complex reasoning: Analyzes the causal chain between security incidents and business impacts, handling complex associations across multiple data points and domains. Leverages techniques such as CoT to perform step-by-step reasoning and explain the association judgment process.

[0083] 4. Correlation engine module.

[0084] The correlation engine module works closely with the DeepSeek large language model core to achieve effective mapping and correlation judgment between business process information and ICS / OT security data. It implements the following logic:

[0085] Receive DeepSeek's preliminary understanding results: The correlation engine receives the structured information output by DeepSeek after performing preliminary interpretation and entity recognition on business process data and ICS / OT security data. This information includes the identified business process steps, a list of associated assets, a description of the security incident, and a list of affected assets.

[0086] Perform asset mapping: The correlation engine uses the asset information identified by DeepSeek and the asset inventory built during the preprocessing phase to perform precise asset mapping based on the knowledge graph. For example, it can associate the device name or function description mentioned in the business process description with the IP address, MAC address, or device ID appearing in the security event log. This mapping may also consider the asset's alias, historical records, or be verified through DeepSeek's semantic understanding.

[0087] Constructing Correlation Analysis Input: The correlation engine integrates the mapped asset information, relevant business process step descriptions, and security event details into structured input, which is then submitted to DeepSeek for deep reasoning. For example, the input might include: "Business process step 'BP-XYZ: Perform Reactor Temperature Control' uses 'PID Controller-101'; security alert 'SA-ABC: Detected abnormal control instructions from IP 192.168.1.50'; IP 192.168.1.50 corresponds to 'PID Controller-101'."

[0088] Collaborating with DeepSeek for deep correlation reasoning: The correlation engine calls DeepSeek's reasoning interface, requesting it to analyze the submitted structured input and identify the correlation between business processes and security events. DeepSeek leverages its fine-tuned capabilities to understand the functionality of the PID controller, the meaning of abnormal control instructions, and infer their potential impact on the temperature control process. DeepSeek outputs the correlation judgment result, correlation strength score, and potential business impact (PBI).

[0089] Organizing and Outputting Correlation Results: The correlation engine receives and structures the correlation results output by DeepSeek. For example, it generates a correlation record containing the ID of the business process step involved, the ID of the related security incident, the ID of the affected asset, the correlation strength score assessed by DeepSeek, the potential business impact (PBI) score, and the natural language explanation generated by DeepSeek. These results are stored in the data storage module.

[0090] In the present invention, in order to quantitatively evaluate the degree of association between assets, an association strength score is introduced. The association strength score comprehensively considers three indicators: text semantic similarity, asset relationship and model confidence. Semantic similarity is obtained by calculating the cosine similarity between the embedding vectors of the asset and event description texts; the asset relationship is determined by the connection relationship between two assets or assets and events in the knowledge graph, for example, it can be quantified using graph theory methods such as the number of paths in the graph, the sum of path weights or the shortest path length; the model confidence is the correlation confidence value output by DeepSeek. The association strength score can be calculated in a weighted form, for example, let is the text similarity, is the graph relationship degree, is the confidence level, then:

[0091] ;

[0092] in, is the preset weight coefficient, satisfying This formula combines the results of semantic matching and structured relationships to score the closeness of the association, allowing for sorting and filtering of different associations. The introduction of structured information in the knowledge graph and model confidence makes the assessment of association strength more objective.

[0093] The association engine goes beyond simple tag or ID matching. Instead, it leverages a large language model to understand the semantic relationship between the two, enabling more advanced association decisions. The association engine is responsible for process control and data organization, while DeepSeek handles the core semantic understanding and reasoning.

[0094] 5. Data storage module.

[0095] The data storage module securely stores incoming raw data, preprocessed data, intermediate representations generated by LLM, correlation results, user configurations, and system status information. A hybrid storage solution is employed, using a relational database to store structured asset information and process model metadata, and a NoSQL database to store unstructured logs and text descriptions.

[0096] 6. Report generation module.

[0097] The report generation module presents the correlation analysis results to users (e.g., security analysts, operations managers, risk managers). The possible presentation formats include:

[0098] Interactive dashboard showing overall risk posture and key indicators.

[0099] A list of risks sorted by business impact (linking security incidents / vulnerabilities to business processes).

[0100] Natural language summaries generated by large language models explain relationships and potential impact.

[0101] Provides drill-down functionality, allowing users to view related raw data or analyze details.

[0102] like Figure 2 As shown, an embodiment of the present invention provides a method for industrial asset association analysis based on a large language model. Its core is to leverage the semantic reasoning capabilities of the large language model to dynamically build a "bridge" between abstract business process representations and the specific underlying OT infrastructure status. This goes beyond simply matching asset tags to understanding "what this process step does" and "how this security incident affects this function." This method directly addresses the practical problems of alarm fatigue and risk prioritization in complex industrial environments, enabling more efficient allocation of mitigation resources by focusing attention on threats that pose the greatest operational risks.

[0103] A method for industrial asset association analysis based on a large language model includes the following steps:

[0104] Step 1: Data collection and preparation.

[0105] Continuously or periodically ingest data from configured business process sources (e.g., BPM systems, document repositories, ERP / MES databases) and OT security sources (e.g., SIEM, vulnerability scanners, asset management systems, network monitoring tools).

[0106] Preprocess the incoming data, including data cleaning (removing duplicates and erroneous data), normalization (unifying formats and units), timestamp synchronization, and necessary format conversion (such as converting tabular data into natural language descriptions or generating embedding vectors) to meet the input requirements of large language models.

[0107] Step 2: Business process explanation.

[0108] Business process data is analyzed using a fine-tuned DeepSeek large language model deployed on the terminal device. This large language model has been fine-tuned and trained on industrial domain data, enabling it to understand industrial terminology, device behavior, and network security patterns, and perform multi-step logical reasoning.

[0109] Parse structured process models (such as BPMN) or unstructured text descriptions (such as SOPs) to understand the sequence of activities, decision points, resources / roles involved (people, equipment), process goals, and key performance indicators (KPIs).

[0110] By analyzing resource allocation information, semantic content of activity descriptions, or asset-related terms, we can identify the core industrial assets associated with each (especially critical) business process step. For example, we can identify that "Step X uses pump P-101 to transfer material from tank T-201 to reactor R-301."

[0111] Step 3: Contextualize OT security.

[0112] Analyze ICS / OT security data using a fine-tuned DeepSeek large language model deployed on endpoint devices.

[0113] Interpret security alerts, vulnerability reports, and log entries in conjunction with asset inventory information. For example, map an IP address or device name to a specific asset and its attributes (model, firmware version, location, etc.).

[0114] Identify the specific assets, network segments, or software components affected by each security event (e.g., malware detection, unusual login attempts, denial of service attacks) or vulnerability.

[0115] Step 4: Use the DeepSeek large language model for cross-domain association reasoning.

[0116] The DeepSeek large language model receives interpreted business process information (including the assets associated with it) and contextualized security information.

[0117] DeepSeek's large language model performs complex reasoning to identify the association between the two. For example:

[0118] Input 1 (Business Process Information): "Business process step 'BP-123: Monitor tank T-101 level' uses 'Sensor S-5', which is connected to 'PLC-A' and located in 'Network Segment OT-Zone-2'."

[0119] Input 2 (Security Information): "Security Alert 'SA-987: Anomaly detected high network traffic from PLC-A on OT-Zone-2'."

[0120] The large language model reasoning process: The large language model identifies that PLC-A, mentioned in the security alert, is directly related (via a connection relationship) to the asset (sensor S-5) used in business process step BP-123. The large language model understands that "monitoring liquid levels" is the function of BP-123, and that abnormal flow at PLC-A could interfere with the transmission or processing of sensor data, thereby affecting the execution of this function.

[0121] Correlation output: Correlate alarm SA-987 with business process step BP-123, and preliminarily mark the potential impact as "may cause unreliable or interrupted level monitoring data."

[0122] The large language model uses its understanding of both domains to infer potential dependencies and causal chains. It uses its knowledge base to understand the typical functions of an asset, for example, a PLC controls a process, an HMI visualizes data, and a sensor provides measurements.

[0123] Step 5: Impact assessment and prioritization.

[0124] Based on the correlation results from step 4, particularly DeepSeek's identification of the connection between the business process and the security incident, the system assesses the potential impact of the security incident / vulnerability on the business. This assessment is quantified by calculating the potential business impact (PBI).

[0125] PBI comprehensively considers factors such as process criticality, asset criticality, security incident severity and consequence severity. Process criticality refers to the importance of the business process in which the associated event occurs; asset criticality refers to the role value of the relevant assets in the production system; the severity of the security incident is derived from the hazard level of the incident itself (for example, the vulnerability severity score given by the CVSS standard); the severity of the consequence measures the damage that the incident may cause to production, personnel and the environment if it occurs. Referring to the industrial security assessment standards, these indicators usually use a scale of 110 or 15. For example, the process criticality can be set to , asset criticality , vulnerability severity , severity of consequences One way to implement this is to calculate PBI as a weighted sum:

[0126] ;

[0127] in, The PBI is a weighting factor that can be set based on the company's risk appetite. In specific implementation, the scoring rules used in ICS risk assessments can be used to standardize and weight indicators. For example, in a simple approach, each indicator is assigned a value range of 1 to 5, with key indicators given higher weights. The final PBI is then derived through linear combination. When the PBI of a related event exceeds the threshold, the system can issue a focused alert. Through PBI assessment, companies can not only understand the strength of the correlation between two assets but also quantify the potential impact of this correlation on production operations.

[0128] Based on the PBI scores, the system generates a prioritized list of associated risks, sorted by potential business impact (rather than just technical severity). This addresses the need for business context in OT security.

[0129] Step 6: Analyze report output.

[0130] The report generation module converts the analysis results into a readable security threat report. This report includes a description of the identified risk, the industrial assets and process involved, details of the associated cyber threat event, and corresponding security recommendations or remediation measures. The system automatically outputs this report and can alert relevant personnel through the monitoring interface, enabling real-time risk awareness and response.

[0131] It should be noted that the present invention is not limited to the above-described embodiments. Without departing from the principles of the present invention, the selection and deployment of the large language model can be adjusted. For example, other large language models with reasoning capabilities can be used, or the model can be deployed in an edge server cluster to improve analysis performance.

[0132] As can be seen from the description of the above embodiments, the method and system provided by the present invention can effectively bridge the analytical gap between industrial control and network security, and realize intelligent perception and response to complex security situations in industrial sites. Its core lies in the integration of industrial process flow and network threat intelligence, and the use of the powerful reasoning ability of large language models to realize innovative security analysis paths, which has significant innovative value and application prospects. The system input and output examples are shown in Table 1:

[0133] Table 1

[0134]

[0135] The core innovation of the present invention is:

[0136] 1. Introduce and fine-tune a large language model (DeepSeek) for industrial use.

[0137] This invention is the first to apply large language models, especially the DeepSeek large language model with advanced architecture (such as multi-head latent attention (MLA) and mixture of experts (MoE) model) and powerful reasoning capabilities, to data analysis in industrial control environments. It is specially fine-tuned for manufacturing-specific business data and security logs, enabling it to accurately understand and analyze terminology, device behavior, and network security events unique to industrial scenarios.

[0138] 2. Cross-domain risk association analysis driven by large language models.

[0139] The core of this invention lies in leveraging large-scale language models to conduct in-depth semantic understanding and automated cross-domain correlation analysis of business process data related to industrial assets (such as BPMN models, SOP documents, and ERP / MES data) and cybersecurity data from industrial control environments (ICS / OT) (such as asset inventories, vulnerability reports, SIEM alerts, and network logs). This goes beyond traditional rule-based or simple data aggregation approaches, enabling a deeper understanding and reasoning of the complex relationships between business functions and technical security status.

[0140] 3. Business impact-driven risk assessment and prioritization.

[0141] Leveraging the semantic association capabilities of LLM, this invention can link identified technical security incidents (such as abnormal traffic flow in a specific PLC) or vulnerabilities to the specific business process steps they may impact (such as key production processes that rely on that PLC data). This approach then assesses the potential impact of the security incident on overall business operations, taking into account the criticality of the business process, the importance of the asset within that process, and the technical severity of the security issue. This business-impact-driven approach to risk assessment and prioritization is a key innovation, distinguishing it from traditional approaches that focus solely on technical severity assessments.

[0142] The advantages of the industrial asset association analysis method and system based on a large language model proposed in the present invention over the existing technology are:

[0143] 1. Improved risk management and decision support.

[0144] By providing a more accurate and operationally relevant view of cybersecurity risks, organizations can make more informed decisions by quantifying risks, developing mitigation strategies, and allocating security resources based on potential business impact rather than just technical indicators.

[0145] 2. Enhanced situational awareness and operational resilience.

[0146] Help operations and security teams understand more clearly and promptly how security incidents affect actual business operations, bridge the information gap between IT and OT, improve overall situational awareness of security threats, and enhance the operational resilience of key business processes.

[0147] 3. Efficient resource allocation and alarm fatigue relief.

[0148] By prioritizing security alerts and vulnerability fixes based on business criticality, the effort invested in low-business-impact alerts can be significantly reduced, effectively alleviating alert fatigue among security analysts and enabling security resources to focus on risk points that truly pose a major threat to the business.

[0149] 4. Proactive threat mitigation and rapid incident response.

[0150] It enables organizations to proactively identify and address high-risk vulnerabilities in assets related to critical business processes before they are exploited. When a security incident occurs, it enables organizations to more quickly understand the potential business impact, enabling them to develop more timely and effective emergency response plans.

[0151] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for industrial asset association analysis based on a large model, characterized in that: include: obtaining information, including business process data and security data; Preprocessing the information to obtain preprocessed data; Inputting the preprocessed data into a trained large language model, the trained large language model parses the business process data and contextualizes the security data, and outputs the parsed business process information and contextualized security information; The parsed business process information and contextualized security information are input into a trained large language model, and the large language model identifies the association between the parsed business process information and the contextualized security information to obtain an association result.

2. The method for industrial asset association analysis based on a large model according to claim 1, characterized in that: Get information, including: Acquire business process data, including structured process models, natural language process descriptions, and transaction data from ERP or MES systems. The business process data captures the sequence, activities, resources used, goals, and time / cost information of the process to be captured. Acquire security data, including asset inventory data, vulnerability data, security logs, network traffic data, alarm data, and configuration data.

3. The method for industrial asset association analysis based on a large model according to claim 1, characterized in that: Preprocessing the information includes: Perform data completion and outlier correction on the information, standardize time, unit and field format, and remove noise or irrelevant information; Expanding the specialized terms and step descriptions in the business process data into sentences containing additional process context and aligning them with industry standard ontologies; Map abbreviations, device identifiers, vulnerability numbers, etc. in security incident text to specific entities in the asset inventory and retrieve corresponding security knowledge or threat intelligence summaries; Through named entity recognition and ontology mapping, the business process data is aligned with the same assets or concepts appearing in the security log, and these entities and their attributes are encoded into embedding vectors that can be processed by the trained large language model; Convert structured table data and log entries into natural language descriptions or semantic embeddings, generate descriptive sentences for important table fields, and convert process text and event text into vector representations respectively.

4. The method for industrial asset association analysis based on a large model according to claim 1, characterized in that: The trained large language model parses the business process data, including: Parse structured process models or unstructured text descriptions to understand the sequence of activities, decision points, resources / roles involved, process goals, and key performance indicators; By analyzing resource allocation information, semantic content of activity descriptions, or asset-related terms, the core industrial assets associated with each business process step are identified.

5. The method for industrial asset association analysis based on a large model according to claim 4 is characterized in that: The trained large language model contextualizes the security data, including: Combined with asset inventory information, interpret security alerts, vulnerability reports, and log entries to map an IP address or device name to a specific asset and its attributes; Identify the specific assets, network segments, or software components affected by each security incident or vulnerability.

6. The method for industrial asset association analysis based on a large model according to claim 5, characterized in that: The large language model identifies the association between the parsed business process information and the contextualized security information, and obtains an association result, including: Perform asset mapping based on the knowledge graph for the core industrial assets and asset inventory information associated with each business process step; The mapped asset information, relevant business process step descriptions, and security incident details are integrated into structured inputs, which are input into a trained large language model for deep reasoning, and the association results are output. The association results include association judgment results, association strength scores, and potential business impacts. The association judgment results include the business process step IDs involved, the relevant security incident IDs, and the affected asset IDs. The association strength score comprehensively considers text semantic similarity, asset relationship, and model confidence. The potential business impact comprehensively considers process criticality, asset criticality, security incident severity, and consequence severity.

7. The method for industrial asset association analysis based on a large model according to claim 6, characterized in that: The association strength score The calculation formula is as follows: ； in, is the preset weight coefficient, satisfying , is the text similarity, is the graph relationship degree, is the confidence of the large language model, the text similarity is obtained by calculating the cosine similarity between the embedding vectors of the asset and event description texts, the graph relationship is determined by the connection relationship between two assets or assets and events in the knowledge graph, and the large language model confidence is the correlation confidence value output by the trained large language model.

8. The method for industrial asset association analysis based on a large model according to claim 7, characterized in that: The calculation formula for potential business impact PBI is as follows: ； Indicates process criticality, Indicates asset criticality, Indicates the severity of the vulnerability, Indicates the severity of the consequences, It is a preset weight coefficient that can be set according to the enterprise's risk preference.

9. The method for industrial asset association analysis based on a large model according to claim 1 or 8, characterized in that: A readable security threat report is generated based on the association results, and the security threat report includes: a description of the identified risks, the industrial assets and process links involved, details of the associated network threat events, and corresponding security recommendations or disposal measures.

10. An industrial asset association analysis system based on a large model, characterized in that: include: A data access module, the data access module is used to obtain information, the information including business process data and security data; A data preprocessing module, configured to preprocess the information to obtain preprocessed data; a core module, the core module being configured to input the preprocessed data into a trained large language model, the trained large language model parsing the business process data and contextualizing the security data, and outputting the parsed business process information and contextualized security information; The association engine module is used to input the parsed business process information and contextual security information into the trained large language model, and the large language model identifies the association between the parsed business process information and contextual security information to obtain the association result.

Images