Industrial safety control method, electronic equipment, and storage medium

Abstract

The present application provides an industrial safety control method, electronic device, and storage medium, the method comprising: recording the time interval between the first state and the second state in the target scope for multiple times; generating a time probability function for switching from the first state to the second state according to the multiple recorded time intervals; obtaining a probability baseline function for switching from the first state to the second state in the target scope during normal working hours; matching the time probability function with the probability baseline function, and performing a safety control operation if they do not match. Thus, there is no need to judge each industrial control flow, which can reduce the number of alarms and false alarms.

Description

Technical Field

[0001] The present application relates to the field of industrial safety technology, and in particular to an industrial safety control method, electronic equipment, and computer-readable storage medium. Background Art

[0002] With the continuous development of Internet technology and industrial control, safety control technology is increasingly being used in industrial production.

[0003] The existing technology learns various possible operations and parameters of different devices based on the traffic transmission between industrial control devices. After learning, it confirms that the corresponding industrial control security policy has been generated. According to the industrial control security policy, analysis, alarm and control are performed. In the existing technology, the main focus is on learning whether a single instruction is compliant. When an instruction is not compliant, an alarm is immediately issued. An overly strict policy may increase the number of alarms and make it difficult to maintain. Summary of the invention

[0004] The embodiment of the present application provides an industrial safety control method for reducing the number of alarms and reducing false alarms.

[0005] The present application provides an industrial safety control method, including:

[0006] Recording the time interval between the occurrence of the first state and the occurrence of the second state in the target scope multiple times;

[0007] generating a time probability function for transitioning from the first state to the second state according to the time intervals recorded multiple times;

[0008] Obtaining a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation;

[0009] The time probability function is matched with the probability baseline function, and if they do not match, a safety control operation is performed.

[0010] In one embodiment, generating a time probability function of transitioning from the first state to the second state according to the time intervals recorded multiple times includes:

[0011] Calculating the probability of the second state occurring at different time points after the first state according to the time intervals recorded multiple times;

[0012] The time probability function is generated according to the probabilities of the second state occurring at different time points after the first state.

[0013] In one embodiment, the second state includes sub-states of multiple dimensions, and the time interval refers to the time interval between the first state and the sub-states of multiple dimensions that appear simultaneously; and calculating the probability of the second state appearing at different time points after the first state according to the time intervals recorded multiple times includes:

[0014] According to the time intervals recorded multiple times, the probability of sub-states of multiple dimensions appearing simultaneously corresponding to different time points after the first state is calculated.

[0015] In one embodiment, the target scope includes any one of a connection control domain, an interface control domain, a device control domain, and a whole network control domain.

[0016] In one embodiment, the first state and the second state refer to different states; wherein different operations represent different states; or, different parameters of the same operation represent different states; or, different combinations of operations and parameters represent different states; or, different serialized operations represent different states.

[0017] In one embodiment, before obtaining the probability baseline function of transitioning from a first state to a second state within the target scope during normal operation, the method includes:

[0018] Recording multiple times the time interval between the occurrence of the first state and the occurrence of the second state during normal operation;

[0019] The probability baseline function is learned according to time intervals of multiple transitions from the first state to the second state during normal operation until a learning condition is met.

[0020] In one embodiment, the learning of the probability baseline function according to the time intervals of switching from the first state to the second state multiple times during normal operation until a learning condition is met includes:

[0021] generating the probability baseline function according to time intervals of transitioning from the first state to the second state multiple times during normal operation;

[0022] If the number of sampling times is greater than the first threshold, the expected deviation between the probability curve generated in the next time period and the probability curve generated in the previous time period is less than the second threshold, and the total sampling time is greater than the third threshold, the learning of the probability baseline function is stopped.

[0023] In one embodiment, matching the time probability function with the probability baseline function, and performing a safety control operation if they do not match, includes:

[0024] If the sampling duration of the time probability function exceeds the time threshold and the expected deviation between the time probability function and the probability baseline function is greater than the expected threshold, it is determined that there is a mismatch and a safety control operation is performed.

[0025] The present application provides an industrial safety control device, which includes:

[0026] A data acquisition module, used for repeatedly recording the time interval between the occurrence of the first state and the occurrence of the second state within the target scope;

[0027] A function generating module, used for generating a time probability function of transitioning from the first state to the second state according to the time intervals recorded multiple times;

[0028] A baseline acquisition module, used to acquire a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation;

[0029] The safety control module is used to match the time probability function with the probability baseline function, and if they do not match, perform a safety control operation.

[0030] An embodiment of the present application provides an electronic device, the electronic device comprising:

[0031] processor;

[0032] a memory for storing processor-executable instructions;

[0033] Wherein, the processor is configured to execute the above-mentioned industrial safety control method.

[0034] An embodiment of the present application provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to implement the above-mentioned industrial safety control method.

[0035] The technical solution provided by the above-mentioned embodiments of the present application generates a time probability function by recording the time interval for the first state to switch to the second state, and matches the time probability function with the probability baseline function by obtaining the probability baseline function for the switch from the first state to the second state during normal working. If there is a mismatch, a safety control operation is performed, thereby eliminating the need to make judgments for each industrial control flow, thereby reducing the number of alarms and false alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solution of the embodiments of the present application, the drawings required for use in the embodiments of the present application are briefly introduced below.

[0037] Figure 1 This is a schematic diagram of an application scenario of an industrial safety control method provided by an embodiment of the present application;

[0038] Figure 2 is a structural schematic diagram of an electronic device provided by an embodiment of the present application;

[0039] Figure 3 It is a flowchart of an industrial safety control method provided by an embodiment of the present application;

[0040] Figure 4 is a curve diagram of a time probability function provided by an embodiment of the present application;

[0041] Figure 5 yes Figure 3 Detailed flowchart of step S320 in the corresponding embodiment;

[0042] Figure 6 yes Figure 3 Schematic diagram of the generation process of the probability baseline function in the corresponding embodiment;

[0043] Figure 7 It is a detailed flowchart of the industrial safety control method provided by the embodiment of the present application;

[0044] Figure 8 It is a specific flow chart of the learning phase provided in the embodiment of the present application;

[0045] Fig. 9 A block diagram of an industrial safety control device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0047] Similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0048] Please refer to Figure 1, which is a schematic diagram of an application scenario of an industrial safety control method provided by an embodiment of the present application. The application scenario includes a first terminal 101, a second terminal 102 and an industrial device 103, and the second terminal 102 is connected to the first terminal 101 and the industrial device 103 respectively. The first terminal 101 can be an intelligent terminal such as a desktop computer or a laptop computer. The second terminal 102 can be an industrial control device. The first terminal 101 is used to send industrial operation instructions to the industrial device 103 through the second terminal 102. Thereby, when an abnormality occurs, the second terminal 102 can intercept the instruction in time. Among them, a sequence of one or several consecutive industrial operation instructions can represent a first state. Another instruction or another instruction sequence can represent a second state. The second terminal 102 can execute the method provided in the following embodiment of the present application, and record the time interval between the occurrence of the first state and the occurrence of the second state in the target scope for multiple times; generate a time probability function for transitioning from the first state to the second state based on the multiple recorded time intervals; obtain a probability baseline function for transitioning from the first state to the second state in the target scope during normal operation; match the time probability function with the probability baseline function, and if there is a mismatch, perform security control operations such as alarms or blocking, thereby reducing the number of alarms and false alarms.

[0049] Please refer to Figure 2 , which is a schematic diagram of the structure of an electronic device 200 provided in an embodiment of the present application, and the electronic device 200 can be used to execute the industrial safety control method provided in an embodiment of the present application. The electronic device 200 includes: at least one processor 203, at least one memory 202 and a bus 201, and the bus 201 is used to realize the connection and communication of these components. The electronic device 200 can be a host, a tablet computer, etc., and is used to execute the industrial safety control method.

[0050] In one embodiment, the memory 202 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, including but not limited to random access memory (RAM), read only memory (ROM), static random access memory (SRAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), and electrically erasable read-only memory (EEPROM).

[0051] In one embodiment, the processor 203 may be a general-purpose processor, including but not limited to a central processing unit (CPU), a network processor (NP), etc., and may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor 203 may also be any conventional processor, etc. The processor 203 is the control center of the electronic device 200, and uses various interfaces and lines to connect various parts of the entire electronic device 200. The processor 203 may implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application.

[0052] In one embodiment, Figure 2 Taking a processor 203 and a memory 202 as an example, the processor 203 and the memory 202 are connected via a bus 201, and the memory 202 stores instructions that can be executed by the processor 203. The instructions are executed by the processor 203 so that the electronic device 200 can execute all or part of the process of the method in the following embodiment to achieve control of industrial safety.

[0053] An embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and the computer program can be executed by a processor to implement the industrial safety control method provided in the following embodiment.

[0054] Please refer to Figure 3 , which is a flow chart of an industrial safety control method provided by an embodiment of the present application, the method can be Figure 1 The second terminal 102 shown executes the method including S310 - S340 .

[0055] Step S310: Record the time interval between the occurrence of the first state and the occurrence of the second state in the target scope multiple times.

[0056] The target scope refers to the collection scope of the first state and the second state. In one embodiment, the target scope includes any one of a connection control domain, an interface control domain, a device control domain, and a whole network control domain.

[0057] The connection control domain refers to the state set collected under the same network quintuple (source IP, destination IP, source port number, destination port number, protocol type). The interface control domain refers to the state set obtained by the same interface. The device control domain refers to the state set obtained by the same network control or collection device. The whole network control domain refers to the state set obtained by the company or group network as a whole.

[0058] The first state and the second state refer to different states. In one embodiment, different operations can represent different states; for example, the first state is "source address 1, destination address 2, operation" a; the second state is "source address 1, destination address 2, operation b". In one embodiment, different parameters of the same operation represent different states; for example, the first state is "source address 1, destination address 2, operation a, value x"; the second state is "source address 1, destination address 2, operation a, value k".

[0059] In one embodiment, different combinations of operations and parameters represent different states. For example, the first state is source address 1, destination address 2, (operation a, value x); the second state is source address 1, destination address 2, (operation b, value y).

[0060] In one embodiment, different serialized operations represent different states. That is, a state is a sequence of several operations. For example, the first state is "source address 1, destination address 2, operation a; source address 1, destination address 2, operation b"; the second state is "source address 1, destination address 2, operation p; source address 1, destination address 2, operation q".

[0061] The time interval refers to the interval between the occurrence time of the first state and the occurrence time of the second state. The current "state", such as state X; the subsequent state transition process is:

[0062] When state m appears, record the interval time with state X;

[0063] When state n appears, record the interval time with state X;

[0064] When state o appears, record the interval time with state X;

[0065] When state p appears, record the interval time with state X;

[0066] When state q appears, record the interval time with state X;

[0067] When state X appears again, the interval time of subsequent states will continue to be recorded;

[0068] When state X appears for the third time, continue to record the interval time of subsequent states;

[0069] Repeat the recording to form a set of state transition information records from state X to state Y. The first state is state X, and the second state can be any one of states m, n, o, p, and q. Assume that the second state is state p. If state p appears after each state X, the time interval between the two is recorded once, thereby obtaining multiple records.

[0070] Step S320: Generate a time probability function of transitioning from the first state to the second state according to the time intervals recorded multiple times.

[0071] Among them, the time probability function can be as follows Figure 4 The curve shown. The horizontal axis represents the time interval and the vertical axis represents the probability. Each point on the curve represents the probability of transitioning from the first state to the second state at a specified time point. For example, the point (1, P 1 ) represents the probability of conversion within 0-1 hours is P 1 ; Point (2,P 2 ) is the probability of conversion within 0-2 hours is P 2 , point (3,P 3 ) is the probability of conversion within 0-3 hours is P 3 , so as time goes by, the probability will become larger and larger, and closer and closer to 1. Therefore, the time probability function is used to characterize the probability distribution of transitioning from the first state to the second state at different time points.

[0072] In one embodiment, if Figure 5 As shown, the above step S320 specifically includes: step S321-step S322.

[0073] In step S321, the probability of the second state occurring at different time points after the first state may be calculated according to the time intervals recorded multiple times.

[0074] Assuming that the total number of transitions from the first state to the second state is 100 times, calculate the number of transitions from the first state to the second state within 0-1 hours after the first state, assuming it is 5 times, and the corresponding probability of time point 1 is 5%; calculate the number of transitions from the first state to the second state within 0-2 hours, assuming it is 15 times, and the corresponding probability of time point 2 is 15%; calculate the number of transitions from the first state to the second state within 0-3 hours, assuming it is 20 times, and the corresponding probability of time point 3 is 20%, and so on, calculate the number of transitions from the first state to the second state within 0-10 hours, assuming it is 100 times, and the corresponding probability of time point 10 is 100%. Therefore, the time point refers to a period of time after the first state.

[0075] Step S322: fitting and generating a time probability function according to the probability of the second state occurring at different time points after the first state.

[0076] Based on the above embodiment, multiple points (1, 5%), (2, 15%), (3, 20%), ... (10, 100%) can be obtained, and thus these points can be fitted to obtain the following: Figure 4 The curve of the time probability function is shown, and the time probability function can be recorded as f(t).

[0077] Step S330: Obtain a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation.

[0078] The probability baseline function is a time probability function generated based on the time interval from the first state to the second state collected during normal working, and is called a probability baseline function for distinction, which can be represented by g(t).

[0079] In one embodiment, the probability baseline function may be generated in advance, and in the embodiment of the present application, the generated probability baseline function is directly obtained. Figure 6 As shown, the probability baseline function can also be generated in the manner provided in the following embodiment.

[0080] Step S331: Record the time intervals between the first state and the second state during normal operation for multiple times.

[0081] Step S332: learning the probability baseline function according to the time intervals of switching from the first state to the second state multiple times during normal operation until a learning condition is met.

[0082] During the probability learning phase, information is continuously read to obtain comprehensive information, and the following results are continuously calculated: state X->state m, the probability distribution of the occurrence at a certain point in time, and the probability function is fitted; state X->state n, the probability distribution of the occurrence at a certain point in time, and the probability function is fitted.

[0083] The recording method can refer to the above step S310, which will not be described in detail here. According to the time intervals of multiple transitions from the first state to the second state during normal working, the method described in the above step S320 can be referred to to generate a similar Figure 4 The probability curve shown is called the probability baseline function for differentiation.

[0084] The learning conditions may include conditions such as the expected deviation is less than the expected threshold, the data samples are sufficient, the acquisition time is long enough, etc. In one embodiment, if the number of sampling times is greater than the first threshold (for example, the first state occurs N times), the expected deviation of the probability curve generated in the next time period from the probability curve generated in the previous time period is less than the second threshold, and the total sampling time is greater than the third threshold, then the learning of the probability baseline function is stopped. The learning of the above-mentioned probability baseline function can learn the cascade relationship between states, rather than learning for a single state.

[0085] The expected deviation between the probability curve generated in the next time period and the probability curve generated in the previous time period is less than the second threshold, which means that within a sufficiently long time, the probability curve is assumed to be the f(t) function.

[0086] In the next T time period, assuming that the probability curve generated in the next T time period is represented by g(t), the probability curve does not change significantly before and after, that is, the expected deviation does not exceed a certain threshold (that is, the second threshold mentioned above). The expected deviation calculation formula is as follows

[0087]

[0088] Among them, t(0,1,2...n) represents n time points in the time period T. The deviation of the probability value of each time point is calculated respectively, and then summed up to obtain the expected deviation.

[0089] Step S340: Match the time probability function with the probability baseline function. If they do not match, perform a safety control operation.

[0090] The security control operation includes alarm processing and / or blocking operations.

[0091] The probability baseline function can be considered as the probability function of the first state transitioning to the second state during normal operation. The time probability function can be considered as the probability function of the first state transitioning to the second state under the working environment to be tested. If the results of the two functions are consistent, it can be considered that they match and the device is working normally. Otherwise, it can be considered that the industrial control traffic is unsafe and needs to be alarmed or blocked.

[0092] In one embodiment, if the sampling duration of the time probability function exceeds a time threshold and an expected deviation between the time probability function and the probability baseline function is greater than an expected threshold, a mismatch is determined and a safety control operation is performed.

[0093] The sampling duration refers to the data collection duration used to generate the time probability function, so as to avoid the situation where the data collection time is too short and affects the accuracy of the time probability function. The calculation formula of the expected deviation can be found in the above formula (1). For each time point, the deviation between the value of the time probability function and the value of the probability baseline function is calculated. The expected deviation is obtained by accumulating the deviation at each time point. If the expected deviation is greater than the expected threshold, it is considered to be mismatched and an alarm or blocking is issued. If it is less than or equal to the expected threshold, it is considered to be matched and works normally.

[0094] The technical solution provided by the above-mentioned embodiments of the present application generates a time probability function by recording the time interval for the first state to switch to the second state, and matches the time probability function with the probability baseline function by obtaining the probability baseline function for the switch from the first state to the second state during normal working. If there is a mismatch, a safety control operation is performed, thereby eliminating the need to make judgments for each industrial control flow, thereby reducing the number of alarms and false alarms.

[0095] In one embodiment, the second state may include sub-states of multiple dimensions, and the time interval refers to the time interval between the first state and the sub-states of multiple dimensions appearing simultaneously. Therefore, the step S321 may specifically include: calculating the probability of the sub-states of multiple dimensions appearing simultaneously at different time points after the first state according to the time intervals recorded multiple times.

[0096] For example, the dimension of the substate can be two-dimensional, that is, the probability that state m will appear next time after each state x, and state n will also appear. The dimension of the substate can be three-dimensional, that is, the probability function that each time state x appears next, states o, p, and q will also appear. The recorded time interval is the time interval when multiple substates appear at the same time after the first state, so the time probability function can represent the probability value of multiple substates appearing at the same time at each time point after the first state.

[0097] Similarly, the probability baseline function can be the probability value of multiple sub-states occurring simultaneously at each time point after the first state collected during normal operation, so as to match the time probability function with the probability baseline function, and issue an alarm or block when there is a mismatch.

[0098] Figure 7 Detailed flow chart of the industrial safety control method provided by the embodiment of the present application. Figure 7 As shown, the method includes: a learning stage and an alarm protection stage.

[0099] The learning phase mainly involves traffic analysis, probability learning, judgment of learning completion, and probability rule generation for industrial control traffic during normal working hours.

[0100] The alarm stage mainly analyzes the industrial control traffic in the test environment, generates a time probability function and matches it with the learned probability baseline function. If the match is successful, other processing is performed; if the match is unsuccessful, an alarm is processed.

[0101] like Figure 8 As shown in the figure, the specific process of the learning phase includes: (1) Traffic enters the industrial control equipment, and the industrial control equipment parses the industrial control traffic to obtain the source address, destination address, operation, parameters, etc. (2) Cache the parsing results and record the time interval from the first state to the second state; (3) Calculate the conversion probability at each time point and generate a probability baseline function (i.e., rule generation). (4) Determine whether the three conditions (acquisition state data is achieved, acquisition state time is achieved, and expected deviation meets the requirements) are all met. If so, the learning is completed.

[0102] When prompts, alarms, and blocking information need to be manually verified by the customer, this strategy needs to be added to the "industrial control whitelist"; for this scenario, an editing scheme for the probability conversion strategy can be added to integrate the existing current probability function with the previous probability function. For example, the arithmetic mean method can be simply used to calculate a new probability function and use it as the probability baseline function.

[0103]

[0104] There are two scenarios for optimizing the probability conversion dimension:

[0105] Dimensionality reduction control: The user wants to change the high-dimensional probability control to low-dimensional probability control. For example, if the user changes the 3-dimensional control dimension to the 2-dimensional control dimension, the 3-dimensional probability conversion information can be deleted.

[0106] Dimensional control: Users want to change low-dimensional probability control to high-dimensional conversion probability control. For example, users change the 2-dimensional control dimension to a 3-dimensional control dimension with stronger control capability. This requires expanding and optimizing the database to store data from the learning stage and the appending stage, and to store all state information.

[0107] That is, the database stores all the original state information from the beginning to the end of learning. When the dimension increases, it is necessary to re-analyze the conversion probability from the original state data. The larger the data volume and the higher the dimension, the longer the generation time of this part. Therefore, this part of the function defines different dimension limits and decides whether to enable it according to the computing and storage capabilities of different devices.

[0108] The solution provided in the embodiments of the present application enhances the following capabilities based on the traditional analysis and control capabilities based on equipment, operations, and parameters: (1) learning the industrial control operation process, taking the operations and parameters parsed from the traffic as states, and analyzing the state transition probabilities between them; (2) learning from them to complete the generation of a probability baseline function; (3) enabling a state transition probability security control strategy for control, or enabling a big data product state transition probability analysis capability system; (4) parsing industrial network data packets to obtain a time probability function and a probability baseline function for comparison, and issuing alarms or other controls according to policy actions.

[0109] The following is an embodiment of the device of the present application, which can be used to execute the above-mentioned industrial safety control method embodiment of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the industrial safety control method of the present application.

[0110] Fig. 9 FIG. 1 is a block diagram of an industrial safety control device according to an embodiment of the present application. Fig. 9 As shown, the device includes: a data acquisition module 910, a function generation module 920, a baseline acquisition module 930 and a safety control module 940.

[0111] A data collection module 910 is used to record the time interval between the first state and the second state in the target scope for multiple times;

[0112] A function generating module 920, configured to generate a time probability function of transitioning from the first state to the second state according to the time intervals recorded multiple times;

[0113] A baseline acquisition module 930, for acquiring a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation;

[0114] The safety control module 940 is used to match the time probability function with the probability baseline function, and if they do not match, perform a safety control operation.

[0115] The implementation process of the functions and effects of each module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned industrial safety control method, and will not be repeated here.

[0116] In several embodiments provided in the present application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are merely schematic, for example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to the multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram may represent a module, a program segment or a part of a code, and a module, a program segment or a part of a code contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of boxes in the block diagram and / or the flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0117] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0118] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

Claims

1. A method for controlling industrial safety, characterized in that: include: Recording the time interval between the occurrence of the first state and the occurrence of the second state in the target scope multiple times; Generate a time probability function for transitioning from the first state to the second state according to the time intervals recorded multiple times; the time probability function is used to characterize the probability distribution of transitioning from the first state to the second state at different time points; Obtaining a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation; The time probability function is matched with the probability baseline function, and if they do not match, a safety control operation is performed.

2. The method according to claim 1, characterized in that The step of generating a time probability function for transitioning from the first state to the second state according to the time intervals recorded multiple times comprises: Calculating the probability of the second state occurring at different time points after the first state according to the time intervals recorded multiple times; The time probability function is generated according to the probabilities of the second state occurring at different time points after the first state.

3. The method according to claim 2, characterized in that The second state includes sub-states of multiple dimensions, and the time interval refers to the time interval between the first state and the sub-states of multiple dimensions that appear simultaneously; and calculating the probability of the second state appearing at different time points after the first state according to the time intervals recorded multiple times, includes: According to the time intervals recorded multiple times, the probability of sub-states of multiple dimensions appearing simultaneously corresponding to different time points after the first state is calculated.

4. The method according to claim 1, characterized in that: The target scope includes any one of a connection control domain, an interface control domain, a device control domain and a whole network control domain.

5. The method according to claim 1, characterized in that The first state and the second state refer to different states; wherein different operations represent different states; or, different parameters of the same operation represent different states; or, different combinations of operations and parameters represent different states; or, different serialized operations represent different states.

6. The method according to claim 1, characterized in that Prior to acquiring a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation, the method includes: Recording multiple times the time interval between the occurrence of the first state and the occurrence of the second state during normal operation; The probability baseline function is learned according to time intervals of multiple transitions from the first state to the second state during normal operation until a learning condition is met.

7. The method according to claim 6, characterized in that The learning of the probability baseline function according to the time intervals of switching from the first state to the second state multiple times during normal operation until a learning condition is met includes: generating the probability baseline function according to time intervals of transitioning from the first state to the second state multiple times during normal operation; If the number of sampling times is greater than the first threshold, the expected deviation between the probability curve generated in the next time period and the probability curve generated in the previous time period is less than the second threshold, and the total sampling time is greater than the third threshold, the learning of the probability baseline function is stopped.

8. The method according to claim 1, characterized in that The matching of the time probability function with the probability baseline function and, if they do not match, performing a safety control operation includes: If the sampling duration of the time probability function exceeds the time threshold and the expected deviation between the time probability function and the probability baseline function is greater than the expected threshold, it is determined that there is a mismatch and a safety control operation is performed.

9. An industrial safety control device, characterized in that: include: A data acquisition module, used for repeatedly recording the time interval between the occurrence of the first state and the occurrence of the second state within the target scope; A function generation module, used to generate a time probability function of transitioning from the first state to the second state according to the time intervals recorded multiple times; the time probability function is used to characterize the probability distribution of transitioning from the first state to the second state at different time points; A baseline acquisition module, used to acquire a probability baseline function of transitioning from a first state to a second state within the target scope during normal operation; The safety control module is used to match the time probability function with the probability baseline function, and if they do not match, perform a safety control operation.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to execute the industrial safety control method described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program can be executed by a processor to implement the industrial safety control method according to any one of claims 1 to 8.

Images