Operation analysis system for industrial internet platform

Abstract

The invention belongs to the technical field of Internet platform security, and discloses an operation analysis system for an industrial Internet platform, which comprises a login analysis module used for acquiring login data, extracting login behavior characteristics and generating login credibility; the operation verification module is used for monitoring an equipment operation request and judging compliance, and if the equipment operation request does not meet the rule, behavior consistency analysis is carried out; the behavior feature analysis module is used for acquiring a user operation behavior space and generating a behavior consistency degree; and the security response module is used for executing corresponding security disposal measures according to the behavior consistency and the login credibility. A traditional binary judgment model is replaced by quantizing the login credibility, multi-level safety response is achieved in combination with operation behavior analysis, the problem of login error interception in the industrial environment is solved, the defect that an existing system is insufficient in operation behavior monitoring is overcome, and balance between safety protection and production efficiency is achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet platform security, more particularly, the present application relates to a running analysis system for an industrial Internet platform. BACKGROUND

[0002] As an important infrastructure for industrial digital transformation, the industrial Internet platform connects industrial equipment, production lines, factories, and networks to realize real-time collection, analysis, and application of production data, and promotes production efficiency, reduces operating costs, and improves product quality. With the wide application of the industrial Internet platform in intelligent manufacturing, energy and power, petroleum and chemical industries, and other key industries, platform security has become an important link to protect the safety of national industrial infrastructure and industrial chain.

[0003] Traditional security protection of the industrial Internet platform mainly relies on static identity authentication, network isolation, and firewall technology. With the development of security technology, many systems have begun to use authentication mechanisms based on behavior characteristics, which analyze user login time, login location, login network, and login device behavior characteristics to identify potential abnormal login behavior. These behavior authentication technologies perform well in enterprise information systems and Internet applications, improving account security.

[0004] However, existing authentication mechanisms based on login behavior characteristics usually use a binary judgment model, i.e., simply classifying user login behavior as normal or abnormal, and deciding whether to allow the user to log in to the system accordingly. This simple dichotomy has obvious shortcomings in the industrial Internet environment. The industrial production environment is complex and variable, and operators may need to log in at irregular times, in irregular locations, or using irregular devices due to equipment failure, emergencies, or special process requirements. In this case, authentication mechanisms based on strict behavior patterns are prone to misjudging legitimate but unusual login behavior as abnormal behavior, resulting in system denial of access to critical operators, affecting production continuity and emergency response capabilities. At the same time, existing security technologies lack continuous monitoring and security analysis of subsequent operation behavior after the user successfully logs in. Some systems do implement monitoring of network traffic, resource access, and other external behavior, but rarely perform security analysis on specific device operation instructions themselves. In the industrial Internet environment, operation security is more critical than login security, as improper operation can directly affect the physical device operating state, leading to production interruptions or even safety incidents. For example, after an attacker obtains a legitimate user's identity credentials, they may send abnormal temperature settings or pressure parameters, causing device damage or safety incidents. This threat based on operation content is difficult for existing security systems to effectively prevent. SUMMARY

[0005] In order to overcome the above problems in the prior art, the present application provides an operation analysis system for an industrial internet platform to solve the above problems.

[0006] The present application provides the following technical solutions: An operation analysis system for an industrial internet platform comprises: A login analysis module is configured to obtain current login data, extract login behavior features, identify a login user, and generate login credibility based on a login behavior baseline of the login user. An operation verification module is configured to monitor device operation requests of the login user, determine whether the device operation requests are compliant based on the device operation requests, directly release and continue monitoring if the device operation requests are compliant, and intercept and perform behavior consistency analysis if the device operation requests are not compliant. A behavior feature analysis module is configured to perform behavior consistency analysis, which comprises obtaining an operation space of the login user that is pre-constructed, and generating a behavior consistency degree based on the operation space and the device operation requests. A security response module is configured to execute corresponding security disposal measures according to the behavior consistency degree and the login credibility.

[0007] Preferably, the login behavior features comprise time features, location features, network features, and terminal features, the login behavior baseline is established based on login behavior features of the login user in the last several times, and the login credibility is generated based on the similarity between the login behavior features and the login behavior baseline.

[0008] Preferably, determining whether the device operation requests are compliant based on the device operation requests comprises: extracting operation devices, operation types, and operation parameters according to the device operation requests; obtaining a device operation rule library corresponding to the operation devices, wherein the device operation rule library comprises operation constraint rules and a parameter safety threshold set; judging whether the operation types conform to constraints based on the operation constraint rules according to historical operation sequences of the operation devices; judging whether the operation parameters are within safety thresholds based on the parameter safety threshold set according to current parameters of the operation devices; judging that the operation requests are compliant when the operation types conform to constraints and the operation parameters are within safety thresholds, and otherwise, judging that the operation requests are not compliant.

[0009] Preferably, the construction of the operation space comprises: collecting several times of operation records in the past of the user, wherein the operation records comprise operation types, operation times, operation devices, and previous operations, and the previous operations are operation types in the previous operation record under the same login condition; Count the occurrence times of each operation type, calculate the proportion in the number of records, and form the operation type distribution feature; Divide 24 hours into multiple time periods, count the occurrence times of each operation type in each time period, calculate the proportion of each operation type in each time period, and form the time period distribution feature; Count the execution times of each operation type on different devices, calculate the proportion of each operation type on each device, and form the device distribution feature; Count the pre-operation of each operation type, calculate the proportion of different pre-operations, and form the operation sequence distribution feature; Combine the operation type distribution feature, time period distribution feature, device distribution feature, and operation sequence distribution feature to form the operation space of the user.

[0010] Preferably, the behavior consistency degree based on the operation space and the device operation request comprises: Extract the operation type, operation time, operation device from the device operation request, and obtain the pre-operation; Query the proportion value of the operation type in the operation type distribution feature from the operation space; Determine the time period according to the operation time, and query the proportion value of the operation type in the time period from the operation space; Query the current pre-operation from the operation space as the proportion value of the pre-operation of the operation type; Normalize the proportion values of each dimension to obtain the matching scores of each dimension; Weighted sum the matching scores of each dimension according to the preset weight to obtain the behavior consistency degree.

[0011] Preferably, the step of normalizing the proportion values of each dimension to obtain the matching scores of each dimension comprises: Calculate the corresponding reference value for each dimension proportion value respectively; Divide each dimension current proportion value by the corresponding reference value to obtain the initial ratio value of each dimension; Smooth the initial ratio value using a monotonic transformation function, and map the result to a preset unified score interval to obtain the matching score of each dimension.

[0012] Preferably, the step of performing corresponding security disposal measures according to the behavior consistency degree and the login credibility comprises: Determine the security risk level according to the login credibility and the behavior consistency degree, and perform corresponding security disposal measures according to the security risk level, the security disposal measures including reminding, limiting operation request, secondary authentication, disconnecting, and suspending the account.

[0013] The application provides a running analysis system for an industrial internet platform, which has the following beneficial effects: A user login behavior baseline is constructed through time characteristics, location characteristics, network characteristics and terminal characteristics, a login credibility is generated by calculating the similarity between the current login and the baseline, and fine quantification evaluation of the login behavior is realized. This quantification evaluation mechanism replaces the traditional binary judgment model, so that the system can distinguish login behaviors with different credibilities. Even if the login is at an irregular time, place or device, the system will not directly reject access, but will determine the appropriate security response level according to the credibility and subsequent operation behavior, effectively reducing the false interception in the login process.

[0014] By continuously monitoring each device operation request, the operation compliance is judged based on the pre-established device operation rule library, and the behavior consistency of the operation is analyzed in combination with the user historical operation space. By constructing the user operation space in multiple dimensions, abnormal operations that do not conform to the user historical operation mode are identified. By combining the login credibility and the behavior consistency to determine the security risk level, multi-level security responses from prompting to suspending the account are realized, so that the system can take corresponding security disposal measures for abnormal operations with different risk levels. This deep analysis mechanism based on operation content and behavior mode can effectively prevent abnormal operations after credential theft, and improves the security level of the industrial internet platform. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A module schematic diagram of the running analysis system for the industrial internet platform. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0017] Embodiment 1 Please refer to Figure 1 In this embodiment, the running analysis system for the industrial internet platform comprises: A login analysis module is configured to acquire the current login data, extract login behavior characteristics, identify the login user, and generate login credibility according to the login behavior baseline of the login user. The login behavior characteristics include time characteristics, location characteristics, network characteristics and terminal characteristics, and the login behavior baseline is established based on the login behavior characteristics of the login user in the last several times. The login credibility is generated based on the similarity between the login behavior characteristics and the login behavior baseline.

[0018] In this embodiment, it should be noted that the current login data refers to various types of information generated during the current login process of the user, including but not limited to login timestamp, login geographic location information, login IP address, login network environment characteristics, login device identifier and device type, etc. These data are collected in real time through the system interface when the user logs in, providing raw data for subsequent feature extraction.

[0019] It should be noted that the login behavior features are feature values extracted from the login data that can represent the user's login behavior patterns. Among them, the time feature refers to the time pattern of the user's login, usually including login time point, login period distribution and login frequency, etc.; the location feature refers to the geographic location information of the user's login, usually including latitude and longitude coordinates and administrative division, etc.; the network feature usually includes the network environment information used by the user when logging in, including IP address, network type and operator information, etc.; the terminal feature refers to the device information used by the user when logging in, including device type, device identifier and operating system version, etc.

[0020] It should be noted that the login behavior baseline is a behavior model established by the system based on the user's historical login behavior, reflecting the feature distribution of the user's normal login behavior. Usually, the behavior features of the user's last 10 to 30 successful logins are selected to establish the baseline, which can be adjusted according to the actual application scenario. The login behavior baseline uses a statistical model to describe the distribution range, mean and standard deviation of the user in each dimension, which can reflect the stable pattern and reasonable fluctuation range of the user's login behavior.

[0021] It should be noted that the login credibility is a quantitative indicator that measures the degree of conformity between the current login behavior and the user's historical login behavior, usually represented by a value between 0 and 1, the larger the value, the higher the credibility. The calculation of login credibility is based on the similarity measurement between the current login behavior features and the login behavior baseline, which can use a multi-dimensional feature weighted calculation method. The system will calculate the deviation degree of each dimension feature (time, location, network, terminal) from the baseline, weight the deviation degree of each dimension according to the preset weight, and then map it to the 0-1 interval through the normalization function to get the final login credibility. The weight of different dimension features can be adjusted according to the specific application scenario and security requirements.

[0022] The operation verification module is configured to monitor the device operation request of the login user, determine whether the device operation request is compliant based on the device operation request; if compliant, directly release and continue to monitor; if not compliant, intercept and perform behavior consistency analysis; The determination whether the device operation request is compliant based on the device operation request includes: According to the device operation request, extracting the operation device, operation type and operation parameter; An operation device corresponding device operation rule library is acquired, and the device operation rule library includes operation constraint rules and a parameter safety threshold set; According to a historical operation sequence of the operation device, whether the operation type conforms to the constraint is judged based on the operation constraint rules; According to a current parameter of the operation device, whether the operation parameter is within the safety threshold is judged based on the parameter safety threshold set; When the operation type conforms to the constraint and the operation parameter is within the safety threshold, it is judged that the operation request is compliant; otherwise, it is judged that the operation request is non-compliant.

[0023] In this embodiment, it should be noted that the device operation request refers to a control instruction or parameter setting request sent by a user to an industrial device through an industrial internet platform. In an industrial environment, these requests can involve device start-stop, parameter adjustment, mode switching, data acquisition and other operations.

[0024] It should be noted that the operation device refers to the target device in the request, the operation type refers to the specific operation behavior of the request, such as starting the device, adjusting the temperature, switching the mode, etc., and the operation parameter refers to the specific parameter value contained in the request, such as the temperature set value, the pressure set value, the speed set value, etc.

[0025] It should be noted that the device operation rule library is a set of operation specifications predefined for various industrial devices, usually jointly formulated by device manufacturers, field experts and safety engineers, etc. For each device, the rule library defines operation constraint rules and a parameter safety threshold set. Among them, the operation constraint rules include sequence constraints, timing constraints, permission constraints and state constraints of device operation, etc. For example, a preheating operation is required before a start operation; the parameter safety threshold set includes the safe operating range of each operation parameter, such as the minimum value, the maximum value, the rate limit, etc.

[0026] It should be noted that the historical operation sequence refers to the operation record time sequence of the current device in a recent period of time, usually containing 10 to 20 recent operation records. The system judges whether the operation type conforms to the constraint by checking whether the current operation satisfies various constraint conditions defined in the operation constraint rules, for example, for an operation that needs to follow a specific sequence, it is checked whether the pre-operation has been completed in the historical operation sequence.

[0027] It should be noted that the system compares the parameter value in the operation request with the threshold range defined in the parameter safety threshold set to judge whether the operation parameter is within the safety threshold. Among them, the comparison includes whether the value of the parameter is within the allowed range and whether the parameter change rate is within the change rate limit range.

[0028] It should be noted that when the operation type meets the constraint and the operation parameter is within the safety threshold, it is determined that the operation request is compliant, the request is directly released, and subsequent operation requests are continuously monitored; when the operation type does not meet the constraint or the operation parameter exceeds the safety threshold, the system determines that the operation request is non-compliant, intercepts the request and triggers behavior consistency analysis, and further evaluates whether the operation is a personal behavior or a malicious login behavior.

[0029] The behavior feature analysis module is configured to perform behavior consistency analysis, which includes: obtaining a pre-constructed operation space of a logged-in user, and generating a behavior consistency degree based on the operation space and the device operation request. The operation space construction step includes: Collecting a plurality of operation records in the user's history, the operation records including operation types, operation times, operation devices, and previous operations, the previous operations being operation types in a previous operation record under the same login condition; Counting the number of occurrences of each operation type and calculating its proportion in the record number to form an operation type distribution feature; Dividing 24 hours into a plurality of time periods, counting the number of occurrences of each operation type in each time period, calculating the proportion of each operation type in each time period, and forming a time period distribution feature; Counting the number of executions of each operation type on different devices and calculating the proportion of each operation type on each device to form a device distribution feature; Counting the previous operations of each operation type and calculating the proportion of different previous operations to form an operation sequence distribution feature; Combining the operation type distribution feature, the time period distribution feature, the device distribution feature, and the operation sequence distribution feature to form the operation space of the user.

[0030] The behavior consistency degree is generated based on the operation space and the device operation request, which includes: Extracting the operation type, operation time, operation device, and previous operation from the device operation request; Querying the proportion value of the operation type in the operation type distribution feature from the operation space; Determining the time period according to the operation time, and querying the proportion value of the operation type in the time period from the operation space; Querying the current previous operation from the operation space as the proportion value of the operation type previous operation; Normalizing each dimension proportion value to obtain a matching score of each dimension; Weighted sum of each dimension matching score according to a preset weight to obtain a behavior consistency degree.

[0031] The step of normalizing the proportion of each dimension to obtain the matching score of each dimension includes: For the proportion of each dimension, a corresponding reference value is calculated respectively; Divide the current proportion of each dimension by the corresponding reference value to obtain the initial ratio of each dimension; Smooth the initial ratio using a monotonic transformation function, and map the result to a preset unified score interval to obtain the matching score of each dimension.

[0032] In this embodiment, it should be noted that the behavior feature analysis module is mainly used for in-depth analysis of non-compliant operations, to determine whether the operation conforms to the user's historical operation behavior pattern, thereby identifying potential account theft or abnormal behavior. The operation space is a multidimensional statistical model of user historical operation behavior, reflecting the user's operation habits and behavior patterns under normal circumstances. This space constructs the user's behavior characteristics from four dimensions of operation type, operation time, operation device and operation sequence by analyzing the user's historical operation records.

[0033] It should be noted that the operation record is usually extracted from the system log and contains information such as operation type, operation time, operation device and previous operation. The operation type distribution feature reflects the operation types preferred by the user and their frequency distribution, such as a user may more often perform monitoring operations and less often perform control operations; the time period distribution feature reflects the user's operation habits at different times of the day, such as a user may mainly perform device start operations from 8am to 10am; the device distribution feature reflects the user's operation preference for different devices, such as a user may be mainly responsible for device operations in region A; the operation sequence distribution feature reflects the user's operation sequence pattern, such as a user usually performs parameter recording operations before performing device stop operations. The features of these four dimensions together constitute the user's unique operation space, which can more comprehensively describe the user's operation behavior pattern.

[0034] It should be noted that the purpose of the behavior consistency analysis is to determine the matching degree of the current operation and the historical operation by comparing the current operation with the user's historical operation behavior, and the process is: first, extracting features from the current operation request, then calculating the matching score in each dimension, and obtaining the comprehensive behavior consistency degree by weighted summation. The weight setting of each dimension matching score is usually determined based on the experience of security experts and historical data analysis. For example, the operation sequence distribution feature can more effectively identify abnormal behavior, so it may be given a higher weight. The greater the behavior consistency value, the more consistent the current operation is with the user's historical behavior pattern, and the more likely it is the user's own operation; the smaller the value, the greater the deviation of the behavior, and the more likely it is an unauthorized access or attack behavior. The matching score calculation process can be, for example, in the operation type dimension: query the historical proportion value of the operation type from the operation space, and compare it with the benchmark reference value. The benchmark reference value here is usually the average or median of the proportion of all operation types of the user, used to measure the common degree of the current operation type in the user's historical operation behavior. Divide the proportion value of the current operation type by the benchmark reference value to get the initial ratio value, and then map it to the uniform interval of 0 to 1 through a monotonic transformation function such as Sigmoid to form the matching score of this dimension. Other dimensions can use similar methods to calculate the matching score.

[0035] The security response module is configured to execute corresponding security handling measures according to the behavior consistency degree and the login credibility.

[0036] The security response module is configured to execute corresponding security handling measures according to the behavior consistency degree and the login credibility. According to the login credibility and the behavior consistency degree, a security risk level is determined, and corresponding security handling measures are executed according to the security risk level, wherein the security handling measures include prompting, limiting operation requests, secondary authentication, disconnecting, and suspending an account.

[0037] In the embodiment, it should be noted that the security response module is responsible for determining the security risk level according to the previous analysis results and executing corresponding security handling measures. There are many ways to divide the risk level, and these ways are based on the behavior consistency degree and the login credibility. Generally speaking, the higher the values of the two indicators, the lower the risk level determined by the system. The system can determine the security risk level by multiplying the login credibility and the behavior consistency degree, and then dividing the risk level according to the preset threshold interval. The system can also divide the login credibility and the behavior consistency degree into high, medium and low levels respectively, and then determine the final security risk level through a combination matrix. For example, when the login credibility is high and the behavior consistency degree is high, the risk level is low; when the login credibility is low and the behavior consistency degree is low, the risk level is high.

[0038] It should be noted that the system performs corresponding security handling measures according to the determined security risk level. For example, for low-risk operations, the system usually only sends a reminder message; for low-medium-risk operations, some control-type operation requests can be limited, but query-type requests are allowed; for medium-risk operations, secondary authentication can be performed, such as inputting an SMS verification code, scanning a two-dimensional code, or answering security questions; for medium-high-risk operations, the current connection can be disconnected; and for high-risk operations, the connection can be disconnected while the account is suspended.

[0039] In several embodiments provided by the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the units is only one, and actual implementation can have another division manner. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other form.

[0040] The above describes only the specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be included in the protection scope of the present application.

[0041] Finally, the above describes only the preferred embodiments of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. An operation analysis system for an industrial internet platform, characterized in that, include: The login analysis module is used to acquire the login data, extract login behavior features and identify the login user, and generate login credibility based on the login user's login behavior baseline; The operation verification module is used to monitor the device operation requests of logged-in users and determine whether the device operation requests are compliant based on the device operation requests. If compliant, proceed directly and continue monitoring; If non-compliant, intercept and conduct behavior consistency analysis; The behavior feature analysis module is used to perform behavior consistency analysis, which includes: obtaining a pre-built operation behavior space of logged-in users, and generating a behavior consistency degree based on the operation behavior space and device operation requests; The security response module is used to execute corresponding security measures based on the consistency of behavior and the trustworthiness of login.

2. The operation analysis system for an industrial internet platform according to claim 1, characterized in that, The login behavior features include time features, location features, network features, and terminal features. The login behavior baseline is established based on the login user's most recent login behavior features. The login credibility is generated based on the similarity between the login behavior features and the login behavior baseline.

3. The operation analysis system for an industrial internet platform according to claim 2, characterized in that, The determination of whether a device operation request is compliant based on the device operation request includes: Based on the device operation request, extract the operating device, operation type, and operation parameters; Obtain the device operation rule library corresponding to the operating device, wherein the device operation rule library contains operation constraint rules and parameter safety threshold sets; Based on the historical operation sequence of the operating equipment, determine whether the operation type meets the constraints according to the operation constraint rules; Based on the current parameters of the operating equipment, determine whether the operating parameters are within the safety thresholds based on the parameter safety threshold set; If the operation type meets the constraints and the operation parameters are within the safety threshold, the operation request is deemed compliant; otherwise, the operation request is deemed non-compliant.

4. The operation analysis system for an industrial internet platform according to claim 3, characterized in that, The steps for constructing the operational behavior space include: Collect several operation records from the user's history. The operation records include operation type, operation time, operation device, and previous operation. The previous operation is the operation type in the previous operation record under the same login situation. Count the frequency of each operation type, calculate its proportion in the number of records, and form the distribution characteristics of operation types; Divide 24 hours into multiple time periods, count the number of times each type of operation occurs in each time period, calculate the proportion of each type of operation in each time period, and form the time period distribution characteristics; The number of times each operation type is executed on different devices is counted, and the proportion of each operation type on each device is calculated to form the device distribution characteristics; The preceding operations for each operation type are statistically analyzed, and the proportion of different preceding operations is calculated to form the operation sequence distribution characteristics. The user's operational behavior space is formed by combining the distribution characteristics of operation type, time period, device, and operation sequence.

5. The operation analysis system for an industrial internet platform according to claim 4, characterized in that, The generation of behavior consistency based on operation behavior space and device operation requests includes: Extract the operation type, operation time, operation device, and preceding operations from the device operation request; Query the percentage of this operation type in the operation type distribution characteristics from the operation behavior space; Determine the time period based on the operation time, and query the percentage of that operation type in that time period from the operation behavior space; Query the current preceding operation from the operation behavior space, and use it as the percentage of preceding operations for this operation type; The proportions of each dimension are normalized to obtain the matching scores for each dimension; The matching scores of each dimension are weighted and summed according to preset weights to obtain the behavioral consistency.

6. The operation analysis system for an industrial internet platform according to claim 5, characterized in that, The step of normalizing the proportion values ​​of each dimension to obtain the matching score for each dimension includes: For the percentage value of each dimension, calculate the corresponding benchmark reference value; Divide the current percentage of each dimension by the corresponding benchmark value to obtain the initial ratio of each dimension; The initial ratio is smoothed using a monotonic transformation function, and the result is mapped to a preset unified score range to obtain the matching score for each dimension.

7. The operation analysis system for an industrial internet platform according to claim 6, characterized in that, The corresponding security measures implemented based on behavioral consistency and login trustworthiness include: Security risk levels are determined based on login trust and behavioral consistency, and corresponding security measures are implemented according to the security risk level. These security measures include issuing warnings, restricting operation requests, secondary authentication, disconnecting the connection, and suspending the account.

Images