Industrial internet network security situation awareness analysis method and system

Abstract

The invention relates to the technical field of industrial internet network security, and discloses an industrial internet network security situation awareness analysis method and system, and the method comprises the steps: carrying out the deep comparison analysis of a network instruction, an actual production process state, equipment operation conditions, material characteristics, final product quality requirements, and other information; instructions which seem legal in the network level but have potential destructiveness in the process level can be identified. For example, for a hidden attack which slowly destroys the production process through small parameter tampering or suboptimal path selection, the method can find and give an alarm in time through comparison of a simulation result and a safety threshold, thereby avoiding false alarm and a safety blind area caused by a fixed reference behavior mode of a traditional system. Therefore, the accuracy and effectiveness of industrial internet network security situation awareness are remarkably improved, and the method is particularly suitable for complex industrial environments such as high-precision aviation component manufacturing and the like which have extremely high requirements on the production process and the product quality.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial internet network security, and particularly relates to an industrial internet network security situation awareness analysis method and system. BACKGROUND

[0002] In modern industrial production, especially in complex production environments such as high-precision aviation part manufacturing, the deep integration of industrial control systems (ICS) and manufacturing execution systems (MES) greatly improves production flexibility and efficiency, but also brings unprecedented challenges to network security. Traditional network security situation awareness systems often rely on pre-set, relatively fixed communication patterns to identify abnormalities. However, when faced with the continuously changing communication behavior generated by MES system real-time scheduling, these systems often struggle, resulting in a large number of false positives, which in turn causes "alarm fatigue" for security operation personnel. In order to deal with this situation, operation personnel sometimes adopt a global filtering strategy, which inadvertently opens a security blind spot for hidden attack behavior.

[0003] Under this background, high-level attackers can use their deep understanding of the internal logic and production process of the MES system to inject instructions that appear to be legitimate at the network level but have potential destructive effects at the process level. These instructions can slowly erode product quality or operational integrity through minor parameter tampering or suboptimal path selection, and often evade regular quality detection and existing security detection mechanisms. For example, an attacker may instruct the MES system to send a specific batch of high-precision parts to a surface treatment line with minor deviations, resulting in slightly lower surface hardness or corrosion resistance than the design standard, and such defects are difficult to immediately detect through conventional final quality detection methods.

[0004] Traditional situation awareness systems cannot effectively adapt to such highly variable changes because their reference behavior patterns are based on relatively stable data. They also cannot perform cross-analysis of network instructions with actual production process status, equipment operating conditions, material characteristics, and product quality requirements, so they cannot identify hidden attacks that slowly destroy the production process through minor parameter tampering or path selection deviations. SUMMARY

[0005] The present application provides an industrial internet network security situation awareness analysis method and system, aiming to solve the problem that traditional network security situation awareness systems cannot effectively identify hidden attacks in the continuously changing communication behavior generated by MES system real-time scheduling in complex industrial production environments, and cannot perform cross-analysis of network instructions with actual production process status, equipment operating conditions, material characteristics, and product quality requirements, resulting in a large number of false positives or security blind spots.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides an industrial internet network security situation awareness and analysis method, comprising: The system acquires communication instructions between the manufacturing execution system and the industrial control system, and parses the communication instructions to obtain operating parameters, source device identifier, target device identifier, and instruction timestamp. The operation parameters are compared with the process rule base to obtain the operation procedures, material characteristics and product quality standards corresponding to the operation parameters, and thus obtain the process context of the communication command. Based on the process context, the operating parameters, and real-time production line status data, obtain the simulation results of the communication commands on production indicators; The simulation results are compared with a preset safety threshold. If the threshold is exceeded, a risk alarm is generated.

[0007] Preferably, after obtaining the simulation results of the communication command on the production indicators based on the process context, the operating parameters, and real-time production line status data, the method further includes: Obtain actual physical measurement data from the production line; Based on the actual physical measurement data, the actual physical impact of the communication command on the production indicators is calculated; The actual physical effects are compared with the simulation results; If there is a deviation between the actual physical effects and the simulation results, the simulation model parameters used for the simulation are adjusted according to the deviation.

[0008] Preferably, the step of comparing the operation parameters with a process rule base to obtain the corresponding operation procedures, material characteristics, and product quality standards, and thus obtaining the process context of the communication command, includes: Acquire real-time physical measurement data of the material to be processed; Based on the real-time physical measurement data, the actual physical property parameters of the material to be processed are deduced. The actual physical characteristic parameters are compared with the material characteristic data stored in the process rule base to obtain the deviation; If the deviation is greater than a preset threshold, the actual physical characteristic parameters are used to calibrate the operating parameters in the manufacturing execution system instructions; The calibrated operating parameters are then sent to the industrial control system. The calibrated operating parameters are compared with the process rule base to obtain the operating procedure, material characteristics, and product quality standards corresponding to the calibrated operating parameters, thereby obtaining the process context of the communication command.

[0009] Preferably, obtaining the simulation results of the communication command on the production indicators based on the process context, the operating parameters, and real-time production line status data includes: Identify process relationships between multiple communication commands; Multiple operation instructions associated with the process are combined into a composite operation instruction; Based on the process context of the communication command, the composite operation command, and the real-time production line status data, the cumulative physical impact of the composite operation command on the production indicators is deduced, and the simulation results are obtained.

[0010] Preferably, the simulation results, derived by inferring the cumulative physical impact of the composite operation command on the production indicators based on the process context of the communication command, the composite operation command, and the real-time production line status data, include: Before extrapolating the cumulative physical impact of the composite operation command on the production indicators, real-time operating status data of key execution components in the industrial control system is obtained. The real-time operating status data includes the component's operating time, operating load, and the degree of wear detected by the sensor. Based on the real-time operating status data, calculate the current performance degradation level of the key execution components; The degree of performance degradation is used as input to adjust the parameters related to the key execution components; Based on the process context, the composite operation command, and the real-time production line status data, the cumulative physical impact of the composite operation command on the production indicators is deduced, and the simulation results are obtained.

[0011] Preferably, the step of deducing the cumulative physical impact of the composite operation command on production indicators based on the process context, the composite operation command, and the real-time production line status data to obtain the simulation results includes: Acquire real-time measurement data of key physical parameters under the current operating conditions; Determine whether the current operating condition is an extreme operating condition; If the current operating condition is an extreme condition, then the nonlinear effect parameters related to the key physical parameters are dynamically adjusted based on the real-time measurement data. Based on the process context, the composite operation command, the nonlinear effect parameters, and the real-time production line state number, the cumulative physical impact of the composite operation command on production indicators is deduced, and the simulation results are obtained.

[0012] Preferably, comparing the simulation result with a preset safety threshold, and generating a risk alarm if the threshold is exceeded, includes: Before comparing the simulation results with the preset safety threshold, the real-time production line status data is obtained, which includes equipment operating status, material batch information, and environmental parameters. The preset safety threshold is dynamically calculated based on the real-time production line status data. The simulation results are compared with the dynamically calculated safety threshold. If the simulation result exceeds the dynamically calculated safety threshold, a risk alarm is generated.

[0013] Preferably, comparing the simulation results with the dynamically calculated safety threshold includes: Obtain the real-time deviation between the simulation result and the dynamically calculated safety threshold; Time series analysis is performed on the real-time deviation to identify its fluctuation patterns and cumulative trends. The fluctuation pattern and the cumulative trend are compared with a preset risk pattern library to determine whether there is a cumulative risk pattern related to potential process deviations.

[0014] Preferably, the step of comparing the fluctuation pattern and the cumulative trend with a preset risk pattern library to determine whether there is a cumulative risk pattern related to potential process deviations further includes: If no risk pattern matching the volatility pattern and the cumulative trend can be found, then multi-dimensional feature extraction is performed on the volatility pattern and the cumulative trend; Contextual analysis is performed on the multi-dimensional features by combining the material characteristics, equipment operating parameters, and environmental conditions of the current production batch. Determine whether the fluctuation pattern and the cumulative trend are related to the evolution of physical processes such as material fatigue, stress corrosion, or structural failure in the manufacturing of aerospace components; If it exists, a risk warning will be generated.

[0015] Secondly, the present invention provides an industrial internet network security situation awareness and analysis system, comprising: The detection end is used to acquire communication instructions between the manufacturing execution system and the industrial control system, and to parse the communication instructions to obtain operating parameters, source device identifier, target device identifier and instruction timestamp; The processing end is used to compare the operation parameters with the process rule base, obtain the operation procedures, material characteristics and product quality standards corresponding to the operation parameters, and obtain the process context of the communication command; based on the process context, the operation parameters and real-time production line status data, it obtains the simulation results of the communication command on the production indicators. The output terminal is used to compare the simulation results with a preset safety threshold. If the threshold is exceeded, a risk alarm is generated.

[0016] This application provides a method and system for industrial internet network security situational awareness analysis. By acquiring and parsing communication commands between a manufacturing execution system (MES) and an industrial control system, it obtains operating parameters, source device identifiers, target device identifiers, and command timestamps. Subsequently, the operating parameters are compared with a process rule base to obtain operating procedures, material characteristics, and product quality standards, thus obtaining the process context of the communication commands. Based on this, combined with the process context, operating parameters, and real-time production line status data, the simulation results of the communication commands on production indicators are obtained. Finally, the simulation results are compared with preset safety thresholds; if they are exceeded, a risk alarm is generated.

[0017] Through the above technical solution, this application effectively solves the problem that traditional network security situational awareness systems in the prior art struggle to identify covert attacks when faced with continuously changing communication behaviors generated by the real-time scheduling of MES systems. Specifically, this application, by conducting in-depth comparative analysis of network commands with information such as actual production process status, equipment operating conditions, material characteristics, and final product quality requirements, can identify commands that appear legitimate at the network level but have potential destructiveness at the process level. For example, for covert attacks that slowly disrupt the production process through minor parameter tampering or suboptimal path selection, this application can promptly detect and alert by comparing simulation results with security thresholds, thereby avoiding false alarms and security blind spots caused by fixed reference behavior patterns in traditional systems. Therefore, this application significantly improves the accuracy and effectiveness of network security situational awareness in the industrial internet, and is particularly suitable for complex industrial environments with extremely high requirements for production processes and product quality, such as high-precision aerospace component manufacturing. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of a method for industrial internet network security situation awareness and analysis provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of another industrial internet network security situation awareness and analysis method provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of another industrial internet network security situation awareness and analysis method provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the system structure of an industrial internet network security situation awareness and analysis method provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Reference Figure 1 The present invention provides a flowchart of an industrial internet network security situation awareness and analysis method, which includes the following steps: S1, acquire the communication instructions between the manufacturing execution system and the industrial control system, and parse the communication instructions to obtain the operation parameters, source device identifier, target device identifier and instruction timestamp; S2, compare the operation parameters with the process rule library to obtain the operation procedures, material characteristics and product quality standards corresponding to the operation parameters, and obtain the process context of the communication command; S3, based on the process context, the operating parameters, and the real-time production line status data, obtain the simulation results of the communication command on the production indicators; S4. The simulation results are compared with a preset safety threshold. If the threshold is exceeded, a risk alarm is generated.

[0021] This application, by deeply integrating network communication commands with production processes and real-time production line status, can effectively identify covert attacks that are difficult for traditional security systems to detect, thereby improving the accuracy and effectiveness of industrial internet network security situational awareness.

[0022] The "Manufacturing Execution System (MES)" mentioned in this application refers to an integrated computerized system used to monitor and manage the entire production process from order placement to product completion. It runs on top of the Industrial Control System (ICS) and is responsible for functions such as production scheduling, process management, quality management, and data acquisition. The "Industrial Control System (ICS)" is a type of system used to control industrial processes, including Programmable Logic Controllers (PLCs), Distributed Control Systems (DCS), and Supervisory Control and Data Acquisition Systems (SCADA). These systems interact directly with physical equipment and execute instructions issued by the MES. The "Process Rule Base" is a database storing all process parameters, operating procedures, material characteristics, and product quality standards during the production process; it is the core basis for guiding production and quality control. "Production Indicators" refer to key quantitative indicators that measure the efficiency, quality, and safety of the production process, such as output, energy consumption, yield rate, and equipment utilization rate. "Preset Safety Thresholds" refer to the allowable fluctuation range or maximum / minimum limits of production indicators under normal production conditions; exceeding these thresholds may indicate safety risks or production anomalies.

[0023] In practical implementation, the industrial internet network security situation awareness and analysis method of this application can be carried out in the following manner: First, the communication commands between the Manufacturing Execution System (MES) and the Industrial Control System (ICS) are acquired and parsed to obtain operating parameters, source device identifiers, target device identifiers, and command timestamps. This step can be achieved by deploying network traffic monitoring equipment on the communication link between the MES and ICS. For example, a Deep Packet Inspection (DPI) module can be deployed to capture and parse industrial Ethernet protocol messages such as Modbus / TCP, EtherNet / IP, and PROFINET in real time. During parsing, specific operating parameters contained in the commands can be extracted, such as temperature setpoints, pressure regulation amounts, and valve opening percentages. Simultaneously, the source device identifier (such as the MES server IP address or device ID), target device identifier (such as the PLC IP address or device ID), and command transmission timestamp can be identified. Alternatively, a log collection agent can be configured on the gateway device of the MES or ICS to acquire communication logs in real time and perform structured parsing of the log content to extract the required operating parameters, device identifiers, and timestamp information.

[0024] Secondly, the operation parameters are compared with the process rule base to obtain the corresponding operation procedures, material characteristics, and product quality standards, thus obtaining the process context of the communication command. This step aims to associate the "intent" of the network command with the "specification" of actual production. For example, for an operation parameter of "heating to 200 degrees Celsius," the system will query the process rule base to find the corresponding operation procedures (such as heating rate and holding time), the characteristics of the material to be processed (such as melting point and specific heat capacity), and the quality standards that the final product should meet in this heating stage (such as hardness and crystal phase structure) for that operation parameter at a specific production stage. As one implementation method, a matching system based on a rule engine can be constructed, using the parsed operation parameters as query conditions to perform fuzzy or exact matching in the process rule base, thereby extracting relevant process information.

[0025] Next, based on the process context, the operating parameters, and real-time production line status data, the simulation results of the communication command on production indicators are obtained. This step is one of the core innovations of this application; it predicts the potential physical impact of the command through simulation. For example, suppose a communication command requests that the stirring speed of a reactor be adjusted from 50 RPM to 60 RPM, and the process context indicates that a high-viscosity polymer is currently being processed. Real-time production line status data may include real-time temperature, pressure, material level within the reactor, and real-time current and vibration data of the stirring motor 100. Based on this information, a pre-established physical simulation model (e.g., based on finite element analysis or computational fluid dynamics models) can be used to simulate the impact of changes in stirring speed on production indicators such as material mixing uniformity, reaction rate, energy consumption, and final product quality (e.g., molecular weight distribution). As another implementation, a machine learning-based predictive model can be used. This model is trained using historical production data to learn the changing patterns of production indicators under different combinations of operating parameters, process context, and production line status, thereby predicting the simulation results of the current command.

[0026] Finally, the simulation results are compared with preset safety thresholds. If any threshold is exceeded, a risk alarm is generated. This step is crucial for determining whether an instruction carries a potential risk. For example, if the simulation results show that adjusting the stirring speed to 60 RPM will lead to uneven material mixing, resulting in a final product qualification rate below the preset safety threshold of 95%, or causing the energy consumption of the stirring motor 100 to exceed the normal range by 15%, the system will immediately generate a risk alarm. This alarm can include a detailed risk description, such as "Adjusting the stirring speed may lead to a decrease in the product qualification rate; please check immediately." As an implementation method, multiple levels of safety thresholds can be set. For example, a warning is generated if the threshold is slightly exceeded, and an emergency alarm is generated if the threshold is severely exceeded, triggering an automated response mechanism, such as suspending the relevant operation or notifying maintenance personnel for manual intervention.

[0027] The industrial internet network security situational awareness analysis method proposed in this application, by deeply integrating network communication commands with production processes and real-time production line status, can effectively identify covert attacks that are difficult for traditional security systems to detect. Traditional situational awareness systems, because their reference behavior patterns are based on relatively stable data, cannot effectively adapt to the high variability brought about by the real-time scheduling of MES systems, nor can they compare and analyze network commands with actual production process status, equipment operating conditions, material characteristics, and final product quality requirements. Therefore, traditional systems cannot identify covert attacks that slowly disrupt the production process through minute parameter tampering or path selection deviations.

[0028] This application acquires and parses communication instructions between MES and ICS, extracting not only network layer information such as operating parameters, equipment identifiers, and timestamps, but also, more importantly, comparing these operating parameters with a process rule base to obtain operating procedures, material characteristics, and product quality standards, thereby constructing the process context of the communication instructions. This innovation enables the system to understand the true "intention" and "specification" of the instructions at the production process level. Based on this, this application combines the process context, operating parameters, and real-time production line status data to obtain simulation results of the communication instructions' impact on production indicators through simulation or prediction models. This step is the core advantage of this application; it quantifies the potential physical impact of network instructions, enabling the system to predict the potential destructive impact of instructions on production indicators such as product quality, energy consumption, and equipment lifespan. Finally, by comparing the simulation results with preset safety thresholds, this application can promptly detect hidden attacks that appear legitimate at the network level but are potentially destructive at the process level, and generate risk alerts.

[0029] Compared to traditional situational awareness systems that rely on preset communication patterns, the solution presented in this application can more accurately identify legitimate but abnormal communication behaviors generated by real-time scheduling of the MES system, significantly reducing the false alarm rate. Simultaneously, by performing process context analysis and production index simulation on instructions, this application can detect covert attacks that slowly erode product quality or operational integrity by exploiting minute parameter tampering or suboptimal path selection, effectively filling the blind spots of traditional security systems. Therefore, this application greatly improves the accuracy and effectiveness of situational awareness in industrial internet cybersecurity, providing more reliable security guarantees for complex industrial production environments such as high-precision aerospace component manufacturing.

[0030] In some embodiments described above, this application proposes obtaining simulation results of communication commands on production indicators based on process context, operating parameters, and real-time production line status data, and then issuing risk alerts based on these simulation results. However, in actual industrial production environments, the accuracy of simulation models may be affected by various factors, such as equipment wear, material batch differences, environmental condition fluctuations, or incompletely modeled physical phenomena. These factors may cause deviations between simulation results and actual physical effects. If not corrected, this may lead to false alarms or missed alarms, thereby affecting the reliability and effectiveness of network security situational awareness.

[0031] In response, this application further proposes that after obtaining the simulation results of production indicators based on the process context, operating parameters, and real-time production line status data, it also includes: Obtain actual physical measurement data from the production line; Based on the actual physical measurement data, the actual physical impact of the communication command on the production indicators is calculated; The actual physical effects are compared with the simulation results; If there is a deviation between the actual physical effects and the simulation results, the simulation model parameters used for the simulation are adjusted according to the deviation.

[0032] Specifically, acquiring actual physical measurement data from the production line refers to the real-time collection of physical quantity data related to the production process through various sensors, detection equipment, and IoT terminals deployed on the industrial production line. This data can include, but is not limited to, temperature, pressure, flow rate, vibration, current, voltage, position, speed, and chemical concentration. For example, in chemical production, the temperature, pressure, and stirring speed inside the reaction vessel can be acquired; in machining, the wear of cutting tools, the dimensional accuracy of the workpiece, and the vibration frequency of the spindle can be obtained. This actual physical measurement data is crucial information reflecting the true operating status of the production line.

[0033] Specifically, calculating the actual physical impact of the communication command on the production indicators based on the actual physical measurement data can be understood as using these real-time collected physical measurement data, combined with known physical models, empirical formulas, or machine learning algorithms, to deduce the actual and quantifiable impact of the execution of a specific communication command on key production line indicators (such as output, energy consumption, product quality, equipment lifespan, etc.). For example, by analyzing the changes in parameters such as temperature and pressure before and after the execution of a specific command, the actual impact on product conversion rate or energy consumption can be calculated.

[0034] In practical applications, comparing the actual physical impact with the simulation results specifically means comparing the calculated actual physical impact with the simulation results predicted by the simulation model. This comparison can be achieved through various statistical methods or error analysis techniques, such as calculating the absolute error, relative error, and root mean square error between the two. The purpose is to quantify the difference between the simulation results and the actual situation.

[0035] Furthermore, if there is a deviation between the actual physical effects and the simulation results, the simulation model parameters used for the simulation are adjusted according to the deviation. This means that when a significant difference is detected between the simulation results and the actual physical effects, the system will use this deviation information to iteratively optimize or adaptively adjust the parameters within the simulation model. For example, if the simulation results consistently exceed the actual output, it may be necessary to adjust the efficiency-related parameters in the model; if the simulation results fail to accurately predict equipment wear, it may be necessary to update the parameters related to material fatigue or wear rate in the model. This adjustment can be based on preset rules or on machine learning algorithms, such as updating parameters through backpropagation, Kalman filtering, or reinforcement learning. The aim is to improve the accuracy and predictive ability of the simulation model, enabling it to better reflect the real dynamics of the industrial production line.

[0036] This application's solution effectively addresses the accuracy limitations of traditional simulation methods by introducing a feedback calibration mechanism that combines actual physical measurement data with simulation results. Specifically, firstly, by acquiring actual physical measurement data from the production line, the system obtains real physical state information about the production process, providing a reliable basis for subsequent calculations of actual impacts. Secondly, based on this actual physical measurement data, the system calculates the actual physical impact of communication commands on production indicators, enabling it to objectively assess the real effects of command execution, rather than relying solely on theoretical predictions. Thirdly, comparing the actual physical impacts with the simulation results is crucial for identifying potential defects in the simulation model, quantifying the gap between simulation and reality. Finally, if a deviation is detected, the simulation model parameters are adjusted accordingly. This closed-loop feedback mechanism allows the simulation model to continuously learn and adapt to the real operating conditions of the production line, thereby continuously improving its predictive accuracy and reliability. It is precisely this real-time feedback and adaptive adjustment that enables the simulation model to more accurately reflect the potential impact of industrial control system commands on production indicators, thereby enhancing the accuracy and effectiveness of network security situational awareness.

[0037] Through the above technical solution, this application can significantly improve the accuracy and robustness of industrial internet network security situational awareness analysis. By introducing actual physical measurement data and comparing it with simulation results, the system can promptly detect deviations between the simulation model and the actual production process, and adaptively adjust the simulation model parameters accordingly. This allows the simulation model to be continuously optimized, more accurately predicting the potential impact of communication commands on production indicators, thereby avoiding false alarms or missed alarms caused by inaccurate models. Furthermore, this real-time feedback and calibration mechanism enhances the system's adaptability to changes in the production environment, maintaining high situational awareness accuracy even in complex and dynamically changing industrial production scenarios, providing a more reliable guarantee for the safe and stable operation of industrial production.

[0038] In some preferred embodiments, a specific example is given below. Suppose that in a semiconductor wafer manufacturing plant, there is a communication command between a manufacturing execution system and an industrial control system to adjust the etching gas flow rate.

[0039] First, the system acquires the communication instructions between the manufacturing execution system and the industrial control system, and parses them to obtain operating parameters (such as gas flow setpoint), source device identifier, target device identifier, and instruction timestamp.

[0040] Next, the operating parameters are compared with the process rule library to obtain the corresponding operating procedures, material characteristics and product quality standards, thus obtaining the process context of the communication command.

[0041] Then, based on the process context, operating parameters, and real-time production line status data, the simulation results of the communication command on production indicators such as wafer etching rate and uniformity are obtained through the simulation model.

[0042] Following the steps described above, the solution proposed in this application will further acquire actual physical measurement data from the production line. For example, by using sensors such as mass spectrometers and optical detectors deployed within the etching chamber, data such as etching gas composition, chamber pressure, and wafer surface morphology can be collected in real time.

[0043] Based on these actual physical measurement data, the actual physical impact of the communication command on the wafer etching rate and uniformity is calculated. For example, the actual etching effect is evaluated by analyzing the actual thickness and surface roughness of the wafer after etching.

[0044] Subsequently, the calculated actual physical effects were compared with the simulation results obtained through the simulation model.

[0045] If the actual etching rate is found to be 5% slower than the simulation result, or the uniformity deviation exceeds the preset range, it indicates that there is a certain deviation in the simulation model. The system will adjust the parameters related to the etching rate in the simulation model, such as the gas reaction rate constant or plasma density parameter, based on this 5% deviation. In this way, the simulation model can be continuously calibrated and optimized, enabling it to more accurately predict actual production results in subsequent command simulations, thereby improving its ability to identify process deviations caused by potential cyberattacks or abnormal operations.

[0046] In some embodiments described above, when comparing operating parameters with a process rule base to obtain the process context for communication instructions, the operating parameters are typically set based on preset or ideal material characteristics. However, in actual industrial production, the physical characteristics of the materials to be processed may vary due to factors such as batch size, environment, or supplier. If these material characteristics are not perceived and calibrated in real time, the obtained process context may not match the actual production situation, thereby affecting the accuracy of subsequent production indicator simulation results and increasing the risk of misjudgment in network security situational awareness analysis.

[0047] In this regard, refer to Figure 2 S2 includes: S21, Obtain real-time physical measurement data of the material to be processed; S22, Based on the real-time physical measurement data, deduce the true physical characteristic parameters of the material to be processed; S23, compare the actual physical characteristic parameters with the material characteristic data stored in the process rule base to obtain the deviation; S24, if the deviation is greater than a preset threshold, the actual physical characteristic parameters are used to calibrate the operating parameters in the manufacturing execution system instructions; S25, the calibrated operating parameters are sent to the industrial control system; S26, compare the calibrated operating parameters with the process rule base, obtain the operating procedure, material characteristics and product quality standard corresponding to the calibrated operating parameters, and obtain the process context of the communication command.

[0048] Specifically, acquiring real-time physical measurement data of the materials to be processed refers to collecting physical property data of the materials in the current batch or current process section in real time through various sensors deployed on the production line, such as temperature sensors, pressure sensors, flow sensors, densitometers, spectrometers, or viscometers. This data can reflect the actual state of the materials, such as their composition, purity, viscosity, density, and temperature.

[0049] The deduction of the true physical properties of the material to be processed based on the real-time physical measurement data can be understood as using data analysis models or physicochemical models to process and calculate the collected real-time physical measurement data, thereby obtaining the true and accurate physical properties of the material under the current operating conditions. For example, machine learning models can be used to comprehensively determine the actual purity or activity of the material based on data from multiple sensors.

[0050] In practical applications, the deviation is obtained by comparing the actual physical characteristic parameters with the material characteristic data stored in the process rule base. This involves comparing the derived actual physical characteristic parameters with the standard or ideal material characteristic data preset for the material in the process rule base, quantifying the degree of difference between the two. The deviation can be an absolute value or a relative percentage.

[0051] Furthermore, if the deviation exceeds a preset threshold, the actual physical characteristic parameters are used to calibrate the operating parameters in the manufacturing execution system (MES) instructions. This means that when the actual characteristics of the material differ significantly from the standard characteristics, the original operating parameters in the MES instructions need to be adjusted. The calibration process can be based on a predefined calibration algorithm or model. For example, if the material viscosity is higher than the standard value, it may be necessary to adjust operating parameters such as stirring speed or heating temperature to ensure the stability of the process and product quality.

[0052] Therefore, the calibrated operating parameters are sent to the industrial control system to ensure that the industrial control system can perform operations based on parameters that are more in line with the actual material conditions, thereby avoiding production abnormalities or safety hazards caused by deviations in material characteristics.

[0053] Finally, the calibrated operating parameters are compared with the process rule base to obtain the corresponding operating procedures, material characteristics, and product quality standards, thus obtaining the process context of the communication command. This step ensures that the generated process context is based on calibrated and more accurate operating parameters and material characteristic information, thereby improving the authenticity and reliability of the process context.

[0054] Through the above technical solutions, this application can significantly improve the accuracy and reliability of industrial internet network security situational awareness analysis. Because real-time material characteristics are taken into account and used to calibrate operating parameters, the generated process context can more realistically reflect the actual production process, effectively avoiding simulation result deviations caused by fluctuations in material characteristics. This makes the simulation results of the impact of communication commands on production indicators more accurate, thereby enabling more accurate identification of potential process anomalies or network attack behaviors, reducing the risk of false alarms and false negatives. Furthermore, by dynamically adjusting operating parameters to adapt to material changes, this application also helps optimize the stability of the production process and product quality, indirectly improving the overall resilience of the industrial system.

[0055] In some preferred embodiments, a specific example is given below. Suppose that in a fine chemical production process, two liquid raw materials A and B need to be mixed in a specific ratio and reacted at a specific temperature. The Manufacturing Execution System (MES) issues instructions based on a standard formula, which includes operating parameters such as the flow rates of raw materials A and B, and the mixing temperature. However, due to batch variations in raw material A, its viscosity may fluctuate.

[0056] In this application, before raw material A enters the mixing tank, its viscosity data is acquired in real time via an online viscosity sensor. This real-time viscosity data is transmitted to an analysis module, which derives the true viscosity parameters of raw material A based on a preset fluid dynamics model. Subsequently, these true viscosity parameters are compared with standard viscosity values ​​stored in the process rule base. If the deviation between the real-time viscosity and the standard viscosity exceeds a preset 5% threshold, the system triggers a calibration mechanism. For example, the calibration algorithm adjusts the flow rate parameters of raw material A in the MES command based on the viscosity deviation to ensure that the effective mixing ratio and reaction conditions of the two raw materials still meet the process requirements during actual mixing. The calibrated flow rate parameters are then sent to the Industrial Control System (ICS), which adjusts the pump speed accordingly. Simultaneously, the system uses these calibrated operating parameters (including the adjusted flow rate) to re-reference the process rule base, obtaining updated operating procedures, material characteristics, and product quality standards, thereby obtaining a process context for communication commands that better reflects the current actual material conditions. In this way, even if the characteristics of raw materials fluctuate, the simulation results of subsequent communication commands on production indicators can remain highly accurate, thereby effectively identifying production anomalies or safety risks that may be caused by unexpected material characteristics or malicious command tampering.

[0057] In some embodiments described above, simulation results of communication commands on production indicators are obtained based on process context, operating parameters, and real-time production line status data. However, in actual industrial production environments, many operations are not performed in isolation but consist of a series of interrelated communication commands, the cumulative effect of which can significantly impact production indicators. Simulating only individual communication commands may not fully reveal these cumulative risks.

[0058] In this regard, refer to Figure 3 S3 includes: S31 identifies process relationships between multiple communication commands; S32, combine multiple operation instructions associated with the process into a composite operation instruction; S33, based on the process context of the communication command, the composite operation command, and the real-time production line status data, the cumulative physical impact of the composite operation command on the production indicators is deduced to obtain the simulation results.

[0059] Specifically, identifying process relationships between multiple communication commands involves analyzing the source device identifier, target device identifier, command timestamp, and operational parameters of the communication commands, combined with the process flow and logical relationships defined in the process rule base, to determine which communication commands have dependencies or sequential relationships in time, function, or logic. For example, graph databases or rule engines can be used to store and query these process relationships. The aim is to reveal the inherent logic and interactions of command execution in industrial production processes.

[0060] Combining multiple operation instructions associated with the process into a composite operation instruction can be understood as follows: once a process-related sequence of communication instructions or a group of parallel instructions is identified, it is logically encapsulated into a single, higher-level composite operation instruction. For example, a sequence of "start heating - maintain temperature - stop heating" can be considered a composite operation instruction. The purpose is to abstract discrete instruction behaviors into holistic operations with specific process significance, facilitating subsequent cumulative impact analysis.

[0061] In practical applications, based on the process context of the communication command, the composite operation command, and the real-time production line status data, the cumulative physical impact of the composite operation command on the production indicators is deduced to obtain the simulation results. Specifically, using simulation models or digital twin technology, the composite operation command is input as a whole, combined with its process context and current real-time production line status data, to simulate the comprehensive and cumulative changes in key production indicators (such as output, energy consumption, quality, equipment wear, etc.) caused by the composite operation command throughout the entire execution cycle. For example, simulation models based on physical laws, chemical reaction kinetics, or machine learning can be constructed to predict the impact of composite operation commands on long-term indicators such as product quality and equipment lifespan. The aim is to obtain more comprehensive and accurate simulation results of production indicators, thereby more effectively assessing potential risks.

[0062] This application's solution identifies the process relationships between multiple communication commands and combines these related commands into composite operation commands, thereby enabling the analysis of a series of interdependent operations in industrial production as a whole. It is precisely this holistic analysis that allows the system to deduce the cumulative physical impact on production indicators based on the process context of the composite operation commands and real-time production line status data. This method overcomes the limitations of simulating only individual commands, and can more accurately capture the complex, nonlinear cumulative effects caused by the synergistic or sequential execution of multiple commands, such as material fatigue, accelerated equipment wear, or gradual decline in product quality. In this way, even if an individual command itself does not pose a risk, its combined effect can be effectively identified and assessed.

[0063] Through the above technical solutions, this application enables a more comprehensive and in-depth understanding of potential risks in industrial production processes. By considering the process correlations between communication commands and forming composite operation commands, the system can identify and simulate cumulative physical effects that cannot be revealed by a single command, such as major quality problems or equipment failures resulting from a series of minor deviations. This allows security situation awareness analysis to move beyond instantaneous anomalies and provide early warnings of long-term, progressive risks, significantly improving the accuracy and foresight of industrial internet network security situation awareness, thereby effectively avoiding production accidents or quality problems caused by cumulative effects.

[0064] In some preferred embodiments, a specific example is given below. Assume a fine chemical production line with a series of communication commands for controlling the temperature and pressure of a reactor. Conventional methods might only simulate the effect of a single "heat up" or "pressurize" command. However, the approach of this application identifies the process relationships between the series of commands "heat up - maintain temperature - cool down - pressurize - depressurize" and combines them into a composite operation command for "batch reaction control." When simulating this composite operation command, the system comprehensively considers the execution sequence and duration of each sub-command, as well as their cumulative effects on reactant conversion, byproduct generation, and reactor wall corrosion rate. For example, if the execution time of the "maintain temperature" command is slightly longer than standard, and the pressure value of the "pressurize" command is slightly higher than the set value, although a single deviation may not trigger an alarm, this application, by extrapolating the cumulative physical effects of the composite operation command, may find that this leads to a significant decrease in product purity or accelerated reactor wall fatigue, thereby generating a risk alarm before the risk accumulates to a critical point.

[0065] This application further proposes a method to optimize the acquisition of simulation results. By introducing real-time operating status data of key execution components, the simulation model parameters are dynamically adjusted, thereby improving the accuracy of the simulation results.

[0066] Specifically, based on the process context of communication commands, composite operation commands, and real-time production line status data, the cumulative physical impact of composite operation commands on production indicators is deduced, and simulation results are obtained, including: Before extrapolating the cumulative physical impact of the composite operation command on the production indicators, real-time operating status data of key execution components in the industrial control system is obtained. The real-time operating status data includes the component's operating time, operating load, and the degree of wear detected by the sensor. Based on the real-time operating status data, calculate the current performance degradation level of the key execution components; The degree of performance degradation is used as input to adjust the parameters related to the key execution components; Based on the process context, the composite operation command, and the real-time production line status data, the cumulative physical impact of the composite operation command on the production indicators is deduced, and the simulation results are obtained. Acquiring real-time operational status data of key actuators in an industrial control system refers to monitoring and collecting operational information related to these components in real time through various sensors, controllers, or data acquisition modules integrated within the industrial control system. This information specifically includes the component's cumulative operating time, current operating load (e.g., motor current, pressure, temperature), and the degree of wear detected by vibration sensors, acoustic sensors, or visual inspection systems. This data is used to comprehensively reflect the component's current health and operational status.

[0067] Furthermore, various methods can be used to calculate the current performance degradation level of key execution components based on real-time operational status data. For example, a component performance degradation model can be built based on historical data, such as using machine learning algorithms (e.g., support vector machines, neural networks) or statistical methods (e.g., regression analysis) to predict the component's remaining lifespan or performance decline. Alternatively, the performance deviation can be quantified by comparing the current operating parameters with the component's baseline performance parameters at the time of manufacture, thereby obtaining the degree of performance degradation. The aim is to transform abstract operational status data into quantifiable performance indicators.

[0068] Furthermore, using the degree of performance degradation as input to adjust parameters related to key actuators means incorporating the calculated performance degradation level as a critical correction factor in the simulation model. For example, when simulating physical effects, if the performance degradation of a certain actuator is high, its corresponding efficiency, response time, or output power parameters in the simulation model will be reduced or adjusted accordingly to more realistically reflect its performance under actual operating conditions. The aim is to enable the simulation model to dynamically adapt to the actual physical state of the components, thereby improving the accuracy of the simulation.

[0069] The proposed solution first acquires real-time operating status data of key actuators in the industrial control system before simulating the cumulative physical impact of compound operation commands on production indicators, and then calculates the performance degradation degree of the actuators based on this data. Subsequently, this performance degradation degree is used as input to dynamically adjust the parameters related to the key actuators in the simulation model. Because the simulation model can reflect the actual physical state of the actuators in real time, the subsequent cumulative physical impact simulation based on process context, compound operation commands, and real-time production line status data more closely approximates reality, thus effectively solving the problem of inaccurate simulation results caused by component performance degradation in traditional methods.

[0070] The above technical solutions significantly improve the accuracy and reliability of cybersecurity situational awareness analysis in the industrial internet. By incorporating the real-time performance degradation of key execution components into the simulation process, the actual physical impact of operational commands on production indicators can be predicted more accurately, effectively avoiding misjudgments or omissions of potential security risks caused by component performance degradation. This not only enhances the early warning capability for production process anomalies but also provides a more reliable basis for timely intervention, thereby ensuring the continuity and security of industrial production.

[0071] In some preferred embodiments, a specific example is given below. Assume a critical milling machine in a CNC machine tool machining workshop, where spindle motor and tool wear are the main factors affecting machining accuracy. Traditional simulation methods may only simulate based on ideal machine tool parameters. However, the solution of this application first obtains the real-time operating load, cumulative operating time of the milling machine's spindle motor, and the degree of tool wear detected by a vibration sensor. Based on this real-time data, the current performance degradation of the spindle motor and the actual wear of the tool are calculated. For example, if the tool wear reaches a preset threshold, the cutting force, vibration frequency, and other parameters related to the tool in the simulation model will be dynamically adjusted when simulating the impact of milling operations on the surface roughness of the product. Subsequently, based on the adjusted parameters, combined with the process context of the composite milling command and real-time production line status data, the cumulative physical impact of the composite milling command on production indicators such as product surface roughness and dimensional accuracy is deduced. In this way, even when the parts are worn to a certain extent, the simulation results can more accurately reflect the actual machining effect, thereby more accurately assessing the physical damage that potential cyberattacks (e.g., tampering with milling commands) may cause, and generating risk warnings in a timely manner.

[0072] In some embodiments described above in this application, the simulation model parameters are adjusted by acquiring real-time operating status data of key execution components and calculating their performance degradation, thereby improving the accuracy of the inference of the cumulative physical effects of composite operation commands. However, in actual industrial production processes, especially under extreme conditions, key physical parameters may exhibit significant nonlinear effects. This makes it difficult for simulation models that only consider component performance degradation to accurately capture the real changes in production indicators, which may lead to a large deviation between the simulation results and the actual situation, affecting the accuracy of risk warnings.

[0073] In response, this application further proposes the following steps for deriving the cumulative physical impact of the composite operation command on production indicators based on the process context, the composite operation command, and the real-time production line status data, to obtain the simulation results: Acquire real-time measurement data of key physical parameters under the current operating conditions; Determine whether the current operating condition is an extreme operating condition; If the current operating condition is an extreme condition, then the nonlinear effect parameters related to the key physical parameters are dynamically adjusted based on the real-time measurement data. Based on the process context, the composite operation command, the nonlinear effect parameters, and the real-time production line state number, the cumulative physical impact of the composite operation command on production indicators is deduced, and the simulation results are obtained.

[0074] Specifically, the real-time measurement data of key physical parameters under the current operating conditions refers to physical quantities that have a decisive impact on the production process and product quality, collected in real time by various sensors during the operation of the production line. For example, in chemical production, this may include temperature, pressure, flow rate, and material concentration within the reactor; in machining, it may include cutting force, tool wear, vibration frequency, and surface roughness. These data are continuously monitored to reflect the immediate state of the production process.

[0075] Determining whether the current operating condition is an extreme condition can be understood as comparing the key physical parameters measured in real time with preset normal operating ranges or safe operating intervals. If any key physical parameter exceeds the upper or lower limit of its normal range, or if the combined value of multiple parameters falls into a predefined extreme condition region, then the current operating condition can be determined as an extreme condition. For example, when the reaction temperature or pressure deviates significantly from the set value, or when the equipment load remains high for an extended period, these can be considered extreme conditions. The purpose is to identify special operating environments that may cause nonlinear changes in system behavior.

[0076] In practical applications, if the current operating condition is an extreme condition, the nonlinear effect parameters related to the key physical parameters are dynamically adjusted based on the real-time measurement data. Nonlinear effect parameters refer to the mathematical model parameters used to describe the complex relationships in a physical system under extreme conditions when its behavior no longer follows a simple linear relationship. For example, under high temperature and pressure, the strength, viscosity, or reaction rate of a material may exhibit exponential changes. In such cases, it is necessary to introduce or adjust parameters such as nonlinear coefficients, exponential terms, or higher-order terms to more accurately describe these physical processes. Dynamic adjustment means that these parameters are not fixed but are corrected and optimized in real time based on the measurement data to ensure that the simulation model maintains high accuracy under extreme conditions.

[0077] Through the above technical solutions, this application can significantly improve the accuracy and robustness of industrial internet network security situational awareness analysis. Especially when facing extreme operating conditions, by dynamically adjusting the nonlinear effect parameters, the simulation model can more realistically reflect the complex physical behavior of the production process, avoiding simulation deviations caused by model simplification or fixed parameters. As a result, the generated risk warnings will be more accurate, effectively identifying and alerting potential safety risks or production anomalies caused by nonlinear effects that might be overlooked under conventional models, thus providing a more reliable guarantee for the safe and stable operation of industrial production.

[0078] In some preferred embodiments, a specific example is given below. Suppose that in a fine chemical production line, it is necessary to monitor the reaction process of a certain highly active catalyst. Under normal operating conditions, the temperature and pressure fluctuations are small, and the product yield has an approximately linear relationship with the reaction time. However, when the production load suddenly increases or the cooling system experiences a minor malfunction, the temperature and pressure inside the reactor may rise rapidly, entering extreme operating conditions.

[0079] At this point, the method of this application first acquires real-time measurement data of key physical parameters such as temperature, pressure, and material concentration within the reactor. The system determines whether these real-time measurement data exceed preset extreme operating condition thresholds, for example, temperature exceeding the safety limit by 5% or pressure exceeding the safety limit by 10%. Once an extreme operating condition is determined, the system dynamically adjusts nonlinear effect parameters related to reaction rate, catalyst activity decay, etc., based on these real-time measurement data. For example, under high temperature and high pressure, the catalyst deactivation rate may increase exponentially; in this case, the exponential term parameter describing catalyst deactivation in the simulation model will be corrected in real time.

[0080] Subsequently, based on the adjusted nonlinear effect parameters, process context, combined operation commands (e.g., a series of continuous feeding, heating, and stirring commands), and real-time production line status data, the system deduces the cumulative physical impact of these combined operation commands on production indicators such as final product yield and by-product generation. For example, under extreme high temperatures, even if the operation command itself does not pose a safety issue, the product yield may drop sharply due to nonlinear effects, or even harmful by-products may be generated. Through this dynamic adjustment, the simulation results can accurately predict this nonlinear behavior, thus enabling timely detection and generation of risk warnings when comparing the simulation results with preset safety thresholds. For example, warnings such as "catalyst deactivation is accelerated under high temperature and pressure, the product yield is expected to be lower than the qualified standard, and there is a risk of excessive by-products" can be generated, thereby avoiding production accidents or product quality problems caused by model inaccuracies.

[0081] In some embodiments described above, simulation results are compared with preset safety thresholds; if the thresholds are exceeded, a risk alarm is generated. However, in actual industrial production environments, the state of the production line is dynamically changing; for example, equipment operating status, material batches, and environmental parameters may fluctuate in real time. Using a fixed preset safety threshold may fail to accurately reflect the true safety boundary under current operating conditions, leading to false alarms or missed alarms, thus affecting the accuracy and timeliness of situational awareness. Therefore, this application further proposes an optimization scheme that aims to improve the accuracy of risk alarms by dynamically adjusting the safety thresholds to adapt to the complexity and variability of industrial production.

[0082] Specifically, the steps described above, which compare the simulation results with a preset safety threshold and generate a risk alarm if the threshold is exceeded, include: Before comparing the simulation results with the preset safety threshold, real-time production line status data is obtained. The real-time production line status data includes equipment operating status, material batch information, and environmental parameters. Based on real-time production line status data, the preset safety threshold is dynamically calculated; The simulation results are compared with the dynamically calculated safety thresholds; If the simulation results exceed the dynamically calculated safety threshold, a risk alarm will be generated. The purpose of acquiring real-time production line status data is to comprehensively understand various key indicators of the current production environment. This real-time production line status data can be understood as a comprehensive set of information reflecting the current operating status of the production line, specifically including equipment operating status, material batch information, and environmental parameters. Equipment operating status can encompass real-time monitoring data such as equipment load, speed, temperature, and vibration; material batch information can include the source, composition, and physical properties of the currently processed materials; and environmental parameters can refer to external conditions such as workshop temperature, humidity, and air pressure. The aim is to provide comprehensive and accurate input for subsequent dynamic calculation of safety thresholds.

[0083] Furthermore, dynamically calculating the preset safety threshold based on real-time production line status data refers to adjusting the safety threshold value in real time based on the currently acquired equipment operating status, material batch information, and environmental parameters, using a preset algorithm model or rule set. For example, when the equipment is operating under high load, the safety threshold can be appropriately tightened; when processing a specific batch of materials, if the material has high risk characteristics, the safety threshold can also be adjusted accordingly. This dynamic calculation process can be implemented using machine learning models, expert systems, or simulations based on physical models, with the aim of ensuring that the safety threshold accurately matches the current operating conditions and avoiding misjudgments caused by inappropriate thresholds.

[0084] Therefore, comparing the simulation results with dynamically calculated safety thresholds aims to ensure the accuracy of risk assessment. By comparing the simulation results with safety thresholds adjusted for real-time operating conditions, it is possible to more accurately determine whether the impact of communication commands on production indicators truly exceeds the safe range.

[0085] If the simulation results exceed the dynamically calculated safety threshold, it indicates that the communication command may cause actual production risks. In this case, a risk alarm is generated so that timely intervention measures can be taken.

[0086] Through the above technical solution, this application can significantly improve the accuracy and adaptability of industrial internet network security situational awareness. Compared with the solution using fixed preset security thresholds, this application acquires production line status data in real time and dynamically calculates security thresholds, making risk assessment no longer static but adaptively adjustable according to real-time changes in the production environment. This not only effectively reduces the false alarm rate caused by changes in operating conditions, avoiding unnecessary downtime or manual intervention, but also identifies potential risks that may be ignored by traditional fixed thresholds under specific operating conditions more promptly and accurately, thereby significantly reducing the false alarm rate. Therefore, the solution of this application can provide more refined and intelligent security protection for industrial production, ensuring the continuity, stability, and security of the production process, thereby improving overall production efficiency and product quality.

[0087] In some preferred embodiments, a specific example is given below. Suppose that in a semiconductor wafer fabrication plant, a critical etching device is executing a communication command involving the adjustment of the etching gas flow rate. In conventional solutions, there may be a fixed safe threshold for the gas flow rate. However, in actual production, batch characteristics of the wafers (e.g., doping concentration, surface flatness), real-time temperature and pressure of the etching chamber, and the wear of the device nozzles all affect the sensitivity of the etching process.

[0088] The proposed solution first acquires real-time production line status data. For example, the system obtains detailed material characteristic data for the current wafer batch, real-time temperature and pressure sensor data within the etching chamber, and data such as the operating time and load of the etching equipment nozzles, and calculates the current wear level of the nozzles accordingly. Based on this real-time data, the system dynamically calculates a safe threshold for etching gas flow rate suitable for the current operating conditions. For example, if the current wafer batch is particularly sensitive to changes in gas flow rate, or if the nozzle wear is high, the system will appropriately tighten the safe threshold, meaning the allowable gas flow rate fluctuation range will be reduced.

[0089] Subsequently, the simulated result of the etching gas flow rate based on the communication command is compared with this dynamically calculated safety threshold. If the simulation result exceeds this dynamically adjusted threshold, even if it may be within the traditional fixed threshold range, the system will immediately generate a risk alarm. For example, if the simulation result shows that the gas flow rate will exceed the dynamically tightened threshold, even if it does not exceed the traditional fixed threshold, the system will issue an alarm, indicating that the command may cause wafer etching defects. In this way, this application can more accurately identify potential risks that may affect product quality or equipment safety under specific operating conditions, thereby avoiding production losses caused by misjudgments of fixed thresholds.

[0090] In some embodiments described above, a method is proposed to compare simulation results with dynamically calculated safety thresholds to determine the existence of risks and generate alarms. However, in actual industrial production environments, simple threshold comparison alone may not be sufficient to effectively identify potentially harmful, cumulative, or evolving process deviations that do not immediately exceed the threshold. For example, some cyberattacks may cause the production process to slowly deviate from its normal trajectory through minute, continuous parameter tampering, while the simulation results at a single moment may still be within the dynamic threshold range, thus failing to detect and issue timely warnings.

[0091] In this regard, this application further proposes the following steps for comparing the simulation results with the dynamically calculated safety threshold: Obtain the real-time deviation between the simulation result and the dynamically calculated safety threshold; Time series analysis is performed on the real-time deviation to identify its fluctuation patterns and cumulative trends. The fluctuation pattern and the cumulative trend are compared with a preset risk pattern library to determine whether there is a cumulative risk pattern related to potential process deviations.

[0092] Specifically, the real-time deviation refers to the numerical difference between the simulation result and the dynamically calculated safety threshold at each time point. This deviation is used to quantify the degree to which the simulation result deviates from the safety threshold, regardless of whether the deviation has reached a level that would trigger an alarm.

[0093] The time series analysis of the real-time deviations can be understood as using statistical or machine learning methods to process and model real-time deviation data at continuous time points. Its purpose is to reveal the inherent patterns of deviation changes over time, such as periodic fluctuations, trends of increase or decrease, and sudden jumps. By identifying the fluctuation patterns and cumulative trends of the real-time deviations, a deeper understanding of the stability of the production process, potential abnormal behaviors, and the evolution of risks can be achieved. Fluctuation patterns can include characteristics such as amplitude, frequency, and periodicity, while cumulative trends can reflect the long-term cumulative effect of deviations.

[0094] In practical applications, the preset risk pattern library can pre-store various known anomaly patterns related to industrial production safety, such as parameter fluctuation characteristics and cumulative drift characteristics caused by specific network attacks, equipment failures, or process anomalies. Comparing these fluctuation patterns and cumulative trends with the preset risk pattern library aims to identify whether there are characteristics similar to known risk patterns in the current production process through pattern matching, thereby determining whether there are cumulative risk patterns related to potential process deviations. This comparison can be implemented using various techniques such as similarity calculation and classification algorithms.

[0095] Through the above technical solutions, this application can significantly improve the refinement and foresight of industrial internet network security situational awareness. Compared with solutions that rely solely on threshold judgments, this application can identify cumulative or evolving risks that do not immediately exceed security thresholds but have potential hazards, such as slow process parameter drift or minor disturbances caused by covert network attacks. This makes risk alerts more timely and accurate, helping to take countermeasures in the early stages of problems, preventing small issues from accumulating into major failures or serious security incidents, thereby effectively ensuring the continuity, stability, and security of industrial production and reducing potential economic losses and security risks.

[0096] If no risk pattern matching the above volatility pattern and the above cumulative trend can be found, then multi-dimensional feature extraction is performed on the above volatility pattern and the above cumulative trend. Contextual analysis of the above multi-dimensional features is performed by combining the material characteristics, equipment operating parameters, and environmental conditions of the current production batch. Determine whether the above fluctuation patterns and cumulative trends are related to the evolution of physical processes such as material fatigue, stress corrosion, or structural failure in the manufacture of aerospace components; If it exists, a risk warning will be generated.

[0097] Specifically, when the system fails to find a risk pattern in the preset risk pattern library that matches the currently identified volatility pattern and cumulative trend, it does not immediately give up. Instead, it further extracts multi-dimensional features from these volatility patterns and cumulative trends. Multi-dimensional feature extraction can be understood as extracting richer and deeper statistical, frequency domain, or time-frequency domain features from time series data. For example, these may include, but are not limited to, mean, variance, kurtosis, skewness, energy distribution, wavelet coefficients, and Fourier transform spectral features. The purpose is to more comprehensively characterize the intrinsic properties of abnormal patterns.

[0098] In performing contextual analysis on the aforementioned multi-dimensional features, the material characteristics, equipment operating parameters, and environmental conditions of the current production batch are considered. Material characteristics may include material composition, batch number, supplier information, and incoming inspection data; equipment operating parameters may include real-time or historical data such as equipment temperature, pressure, vibration, current, voltage, speed, and operating time; environmental conditions may include workshop temperature, humidity, and dust concentration. By fusing this contextual information with the extracted multi-dimensional features, the aim is to provide richer background information for abnormal patterns, thereby more accurately understanding their causes and potential impacts. For example, machine learning models or expert systems can be used to comprehensively evaluate these multi-dimensional features and contextual information to identify potential correlations between them.

[0099] In practical applications, determining whether the aforementioned fluctuation patterns and cumulative trends are related to the physical evolution of material fatigue, stress corrosion, or structural failure in aerospace component manufacturing can be understood as using domain knowledge and physical models to trace the underlying physical mechanisms of abnormal patterns. For example, simulation models based on principles such as finite element analysis, fracture mechanics, or corrosion kinetics can be established, using extracted multi-dimensional features and contextual correlation analysis results as input to simulate the response of materials or structures under specific operating conditions. If the simulation results show consistency or strong correlation with known material fatigue curves, stress corrosion rates, or structural failure modes, a correlation is considered to exist. The aim is to link abstract data anomalies with specific physical failure mechanisms, thereby achieving a fundamental identification of potential risks. If such a correlation is determined to exist, a risk warning is generated to prompt operators or management systems to take appropriate intervention measures.

[0100] Through the aforementioned technical solutions, this application significantly enhances the refinement and foresight of cybersecurity situational awareness in the industrial internet. Especially when a pre-defined risk pattern library cannot match known risk patterns, this application can deeply mine potential information from abnormal patterns through multi-dimensional feature extraction and contextual correlation analysis. More importantly, by associating this information with the evolutionary laws of specific physical processes (such as material fatigue, stress corrosion, or structural failure), this application can identify potential threats that are not explicit but carry a high risk and may indicate severe physical failure. This not only compensates for the shortcomings of traditional pattern-matching methods and avoids missed detections due to unknown risk patterns, but also enables a physical understanding of the profound impact of cyberattacks or system anomalies on production processes and product quality. Therefore, it provides a more comprehensive, accurate, and fundamental security situational awareness capability for high-value, high-risk industrial manufacturing sectors (such as aerospace component manufacturing), effectively preventing potential production accidents and quality problems.

[0101] In some preferred embodiments, a specific example is given below. Suppose that during the manufacturing process of an aero-engine blade, the industrial control system receives a seemingly normal instruction, but this instruction causes a critical processing parameter (e.g., grinding pressure or coolant flow rate) to experience a tiny, non-periodic fluctuation within a very short period of time, and this fluctuation has no directly matching record in a preset risk pattern library.

[0102] At this point, the analytical method of this application will initiate a further risk identification process. First, multi-dimensional features are extracted from the minute fluctuation and its cumulative trend, such as its high-frequency oscillation components, energy spectral density changes, and short-time Fourier transform features. Next, contextual correlation analysis is performed on these multi-dimensional features, taking into account the titanium alloy material characteristics of the current batch of blades (such as grain structure and impurity content), the real-time operating parameters of the grinding machine (such as spindle speed, tool wear, and motor current), and the workshop environmental conditions (such as temperature and humidity). The analysis reveals that although the fluctuation amplitude is small, its high-frequency oscillation characteristics are highly similar to the physical signals of the microcrack initiation process that may occur in a specific titanium alloy under high-temperature and high-pressure grinding. Furthermore, this fluctuation pattern, accumulated over a long period, is correlated with the acoustic emission signal pattern of the initial stage of fatigue crack propagation in known materials.

[0103] Furthermore, the system determines whether the fluctuation pattern and accumulation trend are related to the physical processes of material fatigue, stress corrosion, or structural failure in aerospace component manufacturing. For example, by inputting the extracted features into a pre-trained physics-based machine learning algorithm, the algorithm can identify combinations of features that indicate the blade surface may be experiencing the accumulation of microscopic fatigue damage. Once this correlation is confirmed, the system immediately generates a risk alarm, prompting operators to suspend production, perform non-destructive testing on the relevant blades, and adjust grinding parameters. This effectively avoids the potential risk of blade failure due to material fatigue, ensuring the quality of aerospace components and flight safety.

[0104] Traditional industrial internet network security situational awareness systems often rely on pre-defined, relatively fixed communication patterns to identify anomalies when faced with the continuously changing communication behavior generated by the real-time scheduling of Manufacturing Execution Systems (MES). This leads to a large number of false alarms and consequently, "alarm fatigue" among security operations personnel. Highly skilled attackers can leverage a deep understanding of the internal logic and production processes of MES systems to inject commands that appear legitimate at the network level but are potentially destructive at the process level. These commands can slowly erode product quality or operational integrity through minor parameter modifications or suboptimal path selection, often circumventing conventional quality checks and existing security detection mechanisms. If these problems are not addressed, industrial production processes will face continuous, hidden security risks, potentially leading to decreased product quality, reduced production efficiency, and even equipment damage.

[0105] Reference Figure 4 This invention provides an industrial internet network security situation awareness and analysis system, comprising: The detection end is used to acquire communication instructions between the manufacturing execution system and the industrial control system, and to parse the communication instructions to obtain operating parameters, source device identifier, target device identifier and instruction timestamp; The processing end is used to compare the operation parameters with the process rule base, obtain the operation procedures, material characteristics and product quality standards corresponding to the operation parameters, and obtain the process context of the communication command; based on the process context, the operation parameters and real-time production line status data, it obtains the simulation results of the communication command on the production indicators. The output terminal is used to compare the simulation results with a preset safety threshold. If the threshold is exceeded, a risk alarm is generated.

[0106] It should be noted that the industrial internet network security situation awareness and analysis system provided in this embodiment of the invention is used to execute all the process steps of the industrial internet network security situation awareness and analysis method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0107] This invention also provides a terminal device. The terminal device includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps described in the various embodiments of the industrial internet network security situation awareness and analysis methods, for example... Figure 1 Step S1 is shown. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in the above system embodiments.

[0108] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0109] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. An industrial internet network security situation awareness analysis method, characterized in that, The method comprises: obtaining a communication instruction between a manufacturing execution system and an industrial control system, and parsing the communication instruction to obtain an operation parameter, a source device identifier, a target device identifier, and an instruction timestamp; comparing the operation parameter with a process rule library to obtain an operation procedure, material characteristics, and product quality standards corresponding to the operation parameter, and obtaining a process context of the communication instruction; obtaining a simulation result of the communication instruction on a production index according to the process context, the operation parameter, and real-time production line state data; comparing the simulation result with a preset safety threshold, and if the simulation result exceeds the preset safety threshold, generating a risk warning. 2.The industrial internet network security situation awareness analysis method of claim 1, wherein, After the step of obtaining a simulation result of the communication instruction on a production index according to the process context, the operation parameter, and real-time production line state data, the method further comprises: obtaining actual physical measurement data on a production line; calculating an actual physical impact of the communication instruction on the production index according to the actual physical measurement data; comparing the actual physical impact with the simulation result; if there is a deviation between the actual physical impact and the simulation result, adjusting simulation model parameters used for simulation according to the deviation. 3.The industrial internet network security situation awareness analysis method of claim 1, wherein, The step of comparing the operation parameter with a process rule library to obtain an operation procedure, material characteristics, and product quality standards corresponding to the operation parameter, and obtaining a process context of the communication instruction comprises: obtaining real-time physical measurement data of a material to be processed; deducing real physical characteristic parameters of the material to be processed based on the real-time physical measurement data; comparing the real physical characteristic parameters with material characteristic data stored in the process rule library to obtain a deviation; if the deviation is greater than a preset threshold, using the real physical characteristic parameters to calibrate operation parameters in the manufacturing execution system instruction; downloading the calibrated operation parameters to the industrial control system; comparing the calibrated operation parameters with the process rule library to obtain the operation procedure, the material characteristics, and the product quality standards corresponding to the calibrated operation parameters, and obtaining a process context of the communication instruction. 4.The industrial internet network security situation awareness analysis method of claim 1, wherein, The step of obtaining a simulation result of the communication instruction on a production index according to the process context, the operation parameter, and real-time production line state data comprises: identifying a process association between multiple communication instructions; combining multiple operation instructions associated with the process association into a composite operation instruction; deducing a cumulative physical impact of the composite operation instruction on the production index based on the process context of the communication instruction, the composite operation instruction, and the real-time production line state data, and obtaining the simulation result. 5.The industrial internet network security situation awareness analysis method of claim 4, wherein, The step of deducing a cumulative physical impact of the composite operation instruction on the production index based on the process context of the communication instruction, the composite operation instruction, and the real-time production line state data, and obtaining the simulation result comprises: Before deducing the cumulative physical impact of the complex operation instruction on the production index, real-time running state data of a key execution component in the industrial control system is acquired, the real-time running state data including running time, running load and wear degree detected by a sensor of the component; According to the real-time running state data, a current performance attenuation degree of the key execution component is calculated; The performance attenuation degree is taken as input to adjust parameters related to the key execution component; According to the process context, the complex operation instruction and the real-time production line state data, the cumulative physical impact of the complex operation instruction on the production index is deduced to obtain the simulation result. 6.The industrial internet network security situation awareness analysis method of claim 5, wherein, The deducing the cumulative physical impact of the complex operation instruction on the production index according to the process context, the complex operation instruction and the real-time production line state data to obtain the simulation result comprises: Real-time measurement data of a key physical parameter under a current working condition is acquired; It is judged whether the current working condition belongs to an extreme working condition; If the current working condition belongs to an extreme working condition, a non-linear effect parameter related to the key physical parameter is dynamically adjusted according to the real-time measurement data; Based on the process context, the complex operation instruction, the non-linear effect parameter and the real-time production line state data, the cumulative physical impact of the complex operation instruction on the production index is deduced to obtain the simulation result. 7.The industrial internet network security situation awareness analysis method of claim 1, wherein, The comparing the simulation result with the preset safety threshold value, if exceeding, generating a risk warning comprises: Before comparing the simulation result with the preset safety threshold value, real-time production line state data is acquired, the real-time production line state data including equipment running state, material batch information and environmental parameters; The preset safety threshold value is dynamically calculated according to the real-time production line state data; The simulation result is compared with the dynamically calculated safety threshold value; If the simulation result exceeds the dynamically calculated safety threshold value, the risk warning is generated. 8.The industrial internet network security situation awareness analysis method of claim 7, wherein, The comparing the simulation result with the dynamically calculated safety threshold value comprises: Real-time deviation between the simulation result and the dynamically calculated safety threshold value is acquired; Time series analysis is performed on the real-time deviation to identify fluctuation mode and cumulative trend of the real-time deviation; The fluctuation mode and the cumulative trend are compared with a preset risk mode library to judge whether there is a cumulative risk mode of potential process deviation. 9.The industrial internet network security situation awareness analysis method of claim 8, wherein, The comparing the fluctuation mode and the cumulative trend with the preset risk mode library to judge whether there is a cumulative risk mode of potential process deviation further comprises: If no risk mode matching the fluctuation mode and the cumulative trend can be found, multi-dimensional feature extraction is performed on the fluctuation mode and the cumulative trend; Contextual correlation analysis is performed on the multi-dimensional features in combination with material characteristics, equipment running parameters and environmental conditions of a current production batch; It is judged whether the fluctuation mode and the cumulative trend are correlated with physical process evolution rules of material fatigue, stress corrosion or structural failure in aviation component manufacturing; If present, a risk alert is generated. 10.An industrial internet cyber-security situation awareness analysis system, characterized in that, The system comprises: a detection end configured to acquire a communication instruction between a manufacturing execution system and an industrial control system, and parse the communication instruction to obtain an operation parameter, a source device identifier, a target device identifier, and an instruction timestamp; a processing end configured to compare the operation parameter with a process rule library, acquire an operation procedure, material characteristics, and product quality standards corresponding to the operation parameter to obtain a process context of the communication instruction, and acquire a simulation result of the communication instruction on a production index according to the process context, the operation parameter, and real-time production line state data; an output end configured to compare the simulation result with a preset safety threshold, and generate a risk alert if the simulation result exceeds the preset safety threshold.

Images