Industrial control iot device security monitoring method and device and storage medium
By constructing a working condition safety baseline and based on the timing response data of functional program units, the problem of large detection workload and inability to detect anomalies in existing technologies has been solved, and an efficient monitoring method has been achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHENGDU ETHER NODE TECH CO LTD
- Filing Date
- 2023-06-15
- Publication Date
- 2026-05-01
AI Technical Summary
In existing technologies for industrial control IoT devices, monitoring is typically performed at the command level, which results in a large workload for detection and makes it impossible to detect anomalies in functional program units.
A working condition safety baseline is constructed. Based on the timing response data of all component safety factors during the operation of the functional program unit, fitted timing response data is generated. The working status of the equipment is judged by Euclidean distance, and anomalies are detected.
It reduces the workload of detection, makes it easier to discover anomalies in functional program units, and improves monitoring efficiency.
Smart Images
Figure CN116893652B_ABST
Abstract
Description
Industrial control IoT device security monitoring methods, devices and storage media Technical Field
[0001] This invention relates to the field of industrial control security, specifically to a method, device, and storage medium for security monitoring of industrial control IoT devices. Background Technology
[0002] With the development of industrial automation control technology and Internet of Things (IoT) technology, industrial control IoT devices are also beginning to develop towards digitalization, automation, intelligence and flexibility. They utilize a combination of electronic, electrical, mechanical and software technologies to achieve automated operations, making factory production and manufacturing processes more automated, efficient and precise, and controllable and visible.
[0003] The safe operation of industrial control IoT devices is of utmost importance. Existing safety assurance methods typically involve: collecting normal control commands and corresponding normal response data of the equipment as a safety baseline; then, during subsequent production, monitoring the equipment based on the safety baseline database; identifying the equipment control commands; locating the normal control commands within the safety baseline; locating the corresponding normal response data; and finally, comparing the actual generated response data with the located normal response data to detect faults and anomalies in a timely or early manner.
[0004] In actual industrial manufacturing scenarios, the processes that industrial IoT devices can perform are fixed for a considerable period of time. These devices typically integrate multiple functional program units consisting of several control commands in a fixed sequence, each responsible for a specific process. During production, these specific processes are achieved by calling the corresponding functional program units. However, current technologies usually monitor at the command level, checking whether each command matches its response data. This command monitoring is labor-intensive and cannot detect anomalies in the functional program units. Summary of the Invention
[0005] The purpose of this invention is to solve the above-mentioned problems of the prior art and to provide a method, device and storage medium for safety monitoring of industrial control IoT devices. Based on the time-series response data of all component safety factors during the operation of the functional program unit under normal conditions, a working condition safety baseline is constructed, which can effectively reduce the workload of detection and facilitate the detection of abnormalities in the functional program unit.
[0006] In a first aspect, the present invention provides a method for security monitoring of industrial control IoT devices, the method comprising:
[0007] S1, acquire functional program unit information and response component information of industrial control IoT devices, where the response components include electrical and / or mechanical parts;
[0008] S2, determine the component safety factors that affect the normal operation of industrial control IoT devices;
[0009] S3, in a safe and controlled environment, collect data on the operation program and component safety factors of industrial control IoT devices for at least one full operating cycle, forming several program operation data and component safety factor data; the program operation data includes functional program unit information, start time of operation, and end time of operation; the component safety factor data includes component safety factor information, collection time, and collection value.
[0010] S4. For a single program running data, extract the component safety trigger data collected at the start and end times of the single program running data, and generate the corresponding raw time-series response data.
[0011] S5. Extract program running data with the same functional program unit information to form functional control data, and extract the corresponding original time-series response data to generate fitted time-series response data. Then, mark the functional control data and the fitted time-series response data to form a working condition safety baseline library.
[0012] S6 performs safety monitoring of industrial control IoT devices based on the operating condition safety baseline library.
[0013] Preferably, the method for generating the original time-series response data in S4 includes: constructing a multi-dimensional space based on component safety factor information; for a single program running data, mapping all corresponding component safety factor data to several original data points in the multi-dimensional space based on the sampling time, and fusing and mapping component safety factor data at the same sampling time to a single original data point in the multi-dimensional space; and sorting all the original data points corresponding to a single program running data to form the original time-series response data based on the sampling time.
[0014] Preferably, in step S5, for each program running data with the same functional program unit information, the difference between the end time and the start time of the running is taken as its running time, and then the functional program unit information and the running time are extracted to form functional control data.
[0015] Preferably, the method for generating the fitted time-series response data in S5 includes: for a single functional control data, extracting the original data points with the same order from all the original time-series response data corresponding to it as a single original point combination; determining the center point of all original point combinations in multidimensional space, and using each center point as the fitted data point of the corresponding order; sorting all the fitted data points to form the fitted time-series response data, and setting an allowable deviation for the fitted time-series response data.
[0016] Preferably, an allowable deviation is set for each fitted data point of the fitted time-series response data. The allowable deviation of a single fitted data point is set as the fitting difference, which is the maximum value of the Euclidean distance between the fitted data point and all its corresponding original data points.
[0017] Preferably, the allowable deviation of a single fitted data point is set as the sum of the fitting difference and the nominal deviation.
[0018] Preferably, in step S6, data monitoring is performed on the operating program and component safety factors of the industrial control IoT device. When the functional program unit starts running, the functional control data in the working condition safety baseline library is located based on the functional program unit information, and then the corresponding fitted time-series response data is located. At the same time, during the running period of the functional program unit, the monitoring values of all component safety factors of all response components are extracted at each time and fused and mapped into the data points to be inspected in a multi-dimensional space. It is then determined whether the Euclidean distance between the data points to be inspected and the corresponding fitted data points in the fitted time-series response data is not greater than the allowable deviation. If yes, the industrial control IoT device is determined to be working normally; otherwise, the industrial control IoT device is determined to be working abnormally.
[0019] Secondly, the present invention provides a security monitoring system for industrial control IoT devices, comprising:
[0020] The data monitoring and acquisition module is used to collect data on the operating program and component safety factors of industrial control IoT devices for at least one full operating cycle in a safe and controlled environment, forming several program operation data including functional program unit information, operation start time, and operation end time, and component safety factor data including component safety factor information, acquisition time, and acquisition value; it is also used to monitor the data of the operating program and component safety factors of industrial control IoT devices in actual industrial control environments;
[0021] The data processing module is used to extract component safety causal data at the start and end times of a single program's execution data collection, and generate corresponding raw time-series response data; it also extracts program execution data with the same functional program unit information to form functional control data, and extracts the corresponding raw time-series response data to generate fitted time-series response data.
[0022] The working condition safety baseline module is used to identify the corresponding functional control data and the fitted time series response data to form a working condition safety baseline library.
[0023] The safety assessment module is used to determine the working status of industrial control IoT devices based on the working condition safety baseline library.
[0024] Thirdly, the present invention provides an electronic device, including a memory and a computer program and a processor stored thereon, wherein the processor executes the computer program to implement the above-mentioned industrial control IoT device security monitoring method.
[0025] Fourthly, the present invention provides a storage medium storing computer-executable instructions, which, when loaded and executed by a processor, realize the above-mentioned industrial control IoT device security monitoring method.
[0026] In summary, the present invention has the following beneficial effects: It constructs a working condition safety baseline based on the timing response data of all component safety factors during the normal operation of a functional program unit, transforming the matching and detection of multiple independent and dispersed control command-response data into the overall linkage of control functional program unit-timing response data matching and detection. On the one hand, it only requires monitoring the information of the functional program unit, without needing to refine it to each control command within it, thus reducing the workload of control detection. On the other hand, it uses timing response data to perform timing linkage response detection of safety factors of industrial control IoT device components, thereby discovering overall response anomalies and subsequently discovering anomalies in the functional program unit.
[0027] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0028] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0029] Figure 1 is a schematic diagram of the method flow of a specific embodiment of the present invention. Detailed Implementation
[0030] To make the objectives, technical solutions, and advantages disclosed in the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the embodiments of the present invention and are not intended to limit the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments in this application without creative effort are within the scope of protection of this application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout.
[0031] It should be noted that the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.
[0032] The existing security assurance methods for industrial control IoT devices are usually as follows: collect normal control commands and corresponding normal response data of industrial control IoT devices as a security baseline, and then conduct security monitoring of industrial control IoT devices based on the security baseline library during subsequent production. The control commands of industrial control IoT devices are identified, the normal control commands within the security baseline are located, and the corresponding normal response data is located. Then, the actual generated response data is compared with the located normal response data to detect faults and anomalies in a timely or early manner.
[0033] In actual industrial manufacturing scenarios, the processes that industrial IoT devices can perform are fixed for a considerable period of time. These devices typically integrate multiple functional program units consisting of several control commands in a fixed sequence, each responsible for a specific process. During production, these specific processes are achieved by calling the corresponding functional program units. However, current technologies usually monitor at the command level, checking whether each command matches its response data. This command monitoring is labor-intensive and cannot detect anomalies in the functional program units.
[0034] To address the aforementioned issues, this application provides a method for safety monitoring of industrial control IoT devices. This method constructs a working condition safety baseline based on the timing response data of all component safety factors during the operation of a functional program unit under normal conditions. This effectively reduces the workload of detection and facilitates the discovery of anomalies in the functional program unit.
[0035] As shown in Figure 1, the method of this embodiment includes S1, acquiring functional program unit information and response component information of industrial control IoT devices, wherein the response components include electrical and / or mechanical parts. The functional program unit information can be a unique call identifier for each functional program unit, and the response component information can be a unique identifier for each response component.
[0036] The method in this embodiment also includes S2, determining the component safety causal information that affects the normal operation of the industrial control IoT device due to the response component. In this step, the component safety causal information of the response component is determined as needed based on the component's characteristics. For example, the component safety causal information of electrical components may include current, voltage, etc., while the component safety causal information of mechanical components may include rotational speed, pressure, gripping force, speed, friction, etc. In this step, the component safety causal information can also serve as a unique identifier for each component safety causal information.
[0037] This embodiment further includes step S3, which involves collecting data on the operating procedures and component safety factors of the industrial control IoT device for at least one full operating cycle under a safe and controlled environment, forming several sets of program operation data and component safety factor data. The program operation data includes functional program unit information, start time, and end time; the component safety factor data includes component safety factor information, acquisition time, and acquired value. In this step, within one full operating cycle, all possible process operations of the industrial control IoT device, i.e., all functional program units, are executed at least once.
[0038] In this embodiment, the industrial control IoT device includes several functional program units, where the information of the k-th functional program unit is represented as FID. k The number of response components in industrial control IoT devices is denoted by m, and the information of the corresponding m response components is represented by numbers 1 to m. The number of component safety factors for the i-th | i∈(1,2,……,m) response component is denoted by n. i This indicates that, corresponding to n i The safety causation information for each component is represented as follows: The program execution data generated by a single execution of the kth functional program unit can be represented as follows: Where t s Indicates the start time of execution, t e This indicates the end time of the operation. The j-th |j∈(1,2,……,n) response component. i The individual component safety factor data corresponding to each component safety factor is represented as follows: Where t g Indicates the time of data collection. This indicates that the safety incentive of the j-th component in the i-th response component is in t. g The collected values at any given time.
[0039] The method in this embodiment also includes S4, which extracts component safety causation data at the time of collection within the start and end times of the execution of a single program running data, and generates corresponding original timing response data.
[0040] The method for generating the original time-series response data in S4 of this embodiment is as follows: A multi-dimensional space is constructed based on component safety causation information, and the number of dimensions of the multi-dimensional space is... For a single program execution data, all its corresponding component safety factor data are mapped to several raw data points in a multi-dimensional space based on the sampling time. The component safety factor data at the same sampling time are fused and mapped to a single raw data point in the multi-dimensional space. The coordinate values of each dimension of the single raw data point correspond one-to-one with the collected values of the component safety factor data at the corresponding single sampling time. Based on the sampling time, all raw data points corresponding to a single program execution data are sorted to form raw time-series response data.
[0041] For example, the k-th functional program unit starts running at time t1 and at time t... 10 The program terminates at any time, generating program execution data. The corresponding safety causation data for all components are mapped to 10 raw data points in multidimensional space, t g A single raw data point of the component safety causation data mapping at time |g∈(1,2,…,10) can be represented as: The original time-series response data, composed of 10 original data points sorted together, is represented as follows:
[0042] The method in this embodiment also includes S5, which extracts program running data with the same functional program unit information to form functional control data, extracts the corresponding original timing response data to generate fitted timing response data, and identifies the functional control data and fitted timing response data accordingly to form a working condition safety baseline library.
[0043] In this embodiment S5, for program execution data with identical functional program unit information, the difference between the execution end time and the execution start time is used as its execution duration. Then, the functional program unit information and the execution duration are extracted to form functional control data. For example, the program execution data formed by multiple executions of the j-th functional program unit are as follows: The corresponding function control data can be represented as FC. k =(FID) k ,9t0), where t0 represents the interval between adjacent sampling times.
[0044] In this embodiment S5, the method for generating the fitted time-series response data is as follows: for a single functional control data, extract the original data points with the same order from all the original time-series response data corresponding to it as a single original point combination; determine the center point of all original point combinations in the multi-dimensional space, and use each center point as the fitted data point of the corresponding order; sort all the fitted data points to form the fitted time-series response data, and set the allowable deviation for the fitted time-series response data.
[0045] For example, Function Control Data (FC) k=(FID) k The original timing response data corresponding to 9t0) includes The original point combinations corresponding to order 1 are respectively The combinations of original points corresponding to sequences 2-10 follow the same pattern.
[0046] For a single combination of original points, the coordinates of its center point in each dimension are the mean coordinates of all original data points in that combination in each dimension. For example, the center point of the original point combination corresponding to order 1, i.e., the fitted data point corresponding to order 1, is represented as... Its coordinates on the dimension of the safety cause of the i-th response component and the j-th component are The fitted response data, composed of all fitted data points sorted together, can be represented as follows: Its functional control data FC k =(FID) k ,9tx) corresponds to the identifier.
[0047] Furthermore, in this embodiment, an allowable deviation can be set for each fitted data point of the fitted time-series response data. The allowable deviation for a single fitted data point is set as the fitting difference, which is the maximum value of the Euclidean distance between the fitted data point and all its corresponding original data points. For example, for the fitted data point... In other words, its allowable deviation is its... Maximum Euclidean distance between three points
[0048] Furthermore, in this embodiment, the allowable deviation of a single fitted data point is set as the sum of the fitting difference and the nominal deviation, whereby the nominal deviation can be a pre-set Euclidean distance based on actual conditions.
[0049] The method in this embodiment also includes S6, which performs safety monitoring of industrial control IoT devices based on the operating condition safety baseline library.
[0050] Specifically, in S6, data monitoring is performed on the operating program and component safety factors of the industrial control IoT device. When the functional program unit starts running, the functional control data in the working condition safety baseline library is located based on the functional program unit information, and then the corresponding fitted time-series response data is located. At the same time, during the running period of the functional program unit, the monitoring values of all component safety factors of all response components are extracted at all times and fused and mapped into the data points to be inspected in the multi-dimensional space. It is then determined whether the Euclidean distance between the data points to be inspected and the corresponding fitted data points in the fitted time-series response data is not greater than the allowable deviation. If yes, the industrial control IoT device is determined to be working normally; otherwise, the industrial control IoT device is determined to be working abnormally.
[0051] For example, during actual production, at time t1, the Functional Program Unit Information (FID) is detected in the running program. k Locate the functional control data FC in the operating condition safety baseline library. k =(FID) k ,9t0), and then locate the corresponding fitted time series response data. Simultaneously extract time t1 The monitoring value of the safety factors of each component is mapped to a data point to be inspected in a multi-dimensional space. judge and Check if the Euclidean distance is greater than the allowable deviation. If not, determine that the industrial control IoT device is malfunctioning; if so, determine that the industrial control IoT device is functioning normally, and continue extracting time t2. The monitoring values of safety factors of each component are mapped to the data points to be inspected, and corresponding to... Perform Euclidean distance determination. Repeat the above steps until t. 10 The Euclidean distance determination of the data points to be inspected at any given time has been completed.
[0052] This application embodiment constructs a working condition safety baseline based on the timing response data of all component safety factors during the operation of the functional program unit under normal conditions. It transforms the matching and detection of multiple independent and scattered control command-response data into the matching and detection of the overall linkage control functional program unit-timing response data. On the one hand, it only needs to monitor the information of the functional program unit, without needing to be refined to each control command within it, thus reducing the workload of control detection. On the other hand, it uses timing response data to perform timing linkage response detection of safety factors of industrial control IoT device components, thereby discovering overall response anomalies and then discovering anomalies of the functional program unit.
[0053] This application also provides a method for security monitoring of industrial control IoT devices, including:
[0054] S1, acquire functional program unit information and response component information of industrial control IoT devices, where the response components include electrical and / or mechanical parts;
[0055] S2, determine the component safety factors that affect the normal operation of industrial control IoT devices;
[0056] S3, in a safe and controlled environment, collect data on the operation program and component safety factors of industrial control IoT devices for at least one full operating cycle, forming several program operation data and component safety factor data; the program operation data includes functional program unit information, start time of operation, and end time of operation; the component safety factor data includes component safety factor information, collection time, and collection value.
[0057] S4. For a single program running data, extract the component safety trigger data collected at the start and end times of the single program running data, and generate the corresponding raw time-series response data.
[0058] S5. Extract program running data with the same functional program unit information to form functional control data, and extract the corresponding original time-series response data to generate fitted time-series response data. Then, mark the functional control data and the fitted time-series response data to form a working condition safety baseline library.
[0059] S6 performs safety monitoring of industrial control IoT devices based on the operating condition safety baseline library.
[0060] The method for generating the raw timing response data in S4 is as follows: For all component safety causal data corresponding to a single program execution data, component safety causal data with the same component safety causal information are grouped into the same category. Then, based on the changes in sampling time and collected values, the single-category component safety causal data are fused into a single raw timing response data, thereby forming several raw timing response data corresponding to different component safety causal factors. For example, the k-th functional program unit starts running at time t1 and at time t... 10 The program will terminate at any time, and the program execution data will be processed. Among all the corresponding component safety cause data, the component safety cause data corresponding to the j-th component safety cause of the i-th response component. They are categorized into the same type. In other words, each program's runtime data corresponds to... One set of raw timing response data.
[0061] Specifically, a single raw time-series response data point is a raw curve reflecting the relationship between the collected values of a single component's safety causation and the sampling time. The generation method is as follows: Establish a coordinate system between runtime and collected values; based on the sampling time and collected values, map each component's safety causation data point in the single-component safety causation data to raw data points in the coordinate system; form a raw curve based on all the aforementioned raw data points, which can be achieved using existing point-fitting curve algorithms, or by connecting all raw data points; identify the raw curve as the raw time-series response data corresponding to the single program runtime data and the single component's safety causation. Single-component safety causation data. The resulting original curve can be represented as Its data during program execution Corresponding identifier.
[0062] Correspondingly, in this embodiment S5, the method for generating the fitted time-series response data is as follows: extracting program running data with the same functional program unit information to form functional control data, and extracting original curves corresponding to the same component safety factors from the original curves corresponding to the aforementioned program running data with the same functional program unit information, classifying them as the same type. For example, program running data... The original curves corresponding to the safety triggers of the j-th component for the i-th response component are shown below. They are grouped into the same category.
[0063] A fitted curve is generated by fitting similar original curves, which can be achieved using existing algorithms that fit multiple curves to a single curve. The fitted curve is then identified as the fitted time-series response data corresponding to a single functional control data point or a single component safety factor. Similar original curves The resulting fitted curve can be represented as MV k；i，j (t), which is related to the function control data FC k =(FID) k The corresponding identifier is 9t0). In other words, a single function control data corresponds to... Fitted time-series response data.
[0064] Correspondingly, in this embodiment S6, the operation program of the industrial control IoT device is monitored. When the k-th functional program unit starts running, the function is based on the functional program unit information FID. k Functional control data FC in the positioning condition safety baseline library k =(FID) k ,9t0), and then locate the corresponding A fitted curve. Simultaneously, during the runtime of the functional program unit, the safety triggers for each component are monitored. For the safety trigger of the j-th component of the i-th response component, firstly, in the aforementioned... Determine the individual fitted curve MV from the fitted curves. k；i，j (t), and then map the monitoring value of the component safety trigger at a certain moment to MV. k；i，j (t) is the data point to be inspected in the coordinate system, and the relationship between the data point to be inspected and MV is determined. k；i，j If the deviation of (t) is not greater than the set deviation, the industrial control IoT device is determined to be working normally; otherwise, the industrial control IoT device is determined to be working abnormally.
[0065] This application also provides an industrial control IoT device security monitoring system, including:
[0066] The data monitoring and acquisition module is used to collect data on the operating procedures and component safety factors of industrial control IoT devices for at least one full operating cycle in a safe and controlled environment. This generates several sets of program operation data, including functional program unit information, start time, and end time, as well as component safety factor data, including response component information, component safety factor information, acquisition time, and acquisition value. It is also used to monitor the operating procedures and component safety factors of industrial control IoT devices in actual industrial control environments.
[0067] The data processing module is used to extract component safety causal data at the start and end times of a single program's execution data collection, and generate corresponding raw time-series response data; it also extracts program execution data with the same functional program unit information to form functional control data, and extracts the corresponding raw time-series response data to generate fitted time-series response data.
[0068] The working condition safety baseline module is used to identify the corresponding functional control data and the fitted time series response data to form a working condition safety baseline library.
[0069] The safety assessment module is used to determine the working status of industrial control IoT devices based on the working condition safety baseline library.
[0070] This application also provides an electronic device, including a memory and a processor, which can be connected via a bus or other means. The memory can be used to store software programs, computer programs, and modules, such as the program / module corresponding to the above-described industrial control IoT device security monitoring method; the processor implements the above-described industrial control IoT device security monitoring method by executing the computer programs and modules in the memory.
[0071] The processor can be a central processing unit, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array, etc., and the memory can be a high-speed random access memory, a non-transitory memory, etc.
[0072] This application embodiment also provides a storage medium storing computer-executable instructions. When these computer-executable instructions are loaded and executed by a processor, the aforementioned industrial control IoT device security monitoring method is implemented. The storage medium may be one or more combinations of magnetic disks, optical disks, read-only memory, random access memory, flash memory, hard disks, etc.
[0073] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments, while other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims can be performed in a different order than that shown in the embodiments and still achieve the desired result. Additionally, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0074] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.
[0075] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware, or by a program instructing related hardware. The above descriptions are merely preferred embodiments of the present invention and are not intended to limit the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for security monitoring of industrial control IoT devices, characterized in that, The method includes the following steps: S1, acquiring functional program unit information and response component information of an industrial control IoT device, wherein the response components include electrical and / or mechanical parts; S2, determining component safety causal information that affects the normal operation of the industrial control IoT device; S3, collecting data on the operating program and component safety causal information of the industrial control IoT device under a safe and controlled environment for at least one full-condition cycle, forming several program operation data and component safety causal data; the program operation data includes functional program unit information, start time, and end time; the component safety causal data includes component safety causal information, acquisition time, and acquisition value; S4, for a single program operation data, extracting component safety causal data whose acquisition time is within the start and end times of the single program operation data, generating corresponding original time-series response data; the method for generating the original time-series response data in S4 includes: constructing a multi-dimensional space based on component safety causal information; targeting... For a single program execution data, all corresponding component safety causal data are mapped to several original data points in a multi-dimensional space based on the sampling time. Component safety causal data at the same sampling time are fused and mapped to a single original data point in the multi-dimensional space. Based on the sampling time, all original data points corresponding to a single program execution data are sorted to form original time-series response data. S5, program execution data with the same functional program unit information are extracted to form functional control data, and the corresponding original time-series response data is extracted to generate fitted time-series response data. The functional control data and fitted time-series response data are matched and identified to form a working condition safety baseline library. S6, safety monitoring of industrial control IoT devices is performed based on the working condition safety baseline library.
2. The industrial control IoT device security monitoring method according to claim 1, characterized in that, In step S5, for each program running data with the same functional program unit information, the difference between the end time and the start time of the run is taken as its running time, and then the functional program unit information and the running time are extracted to form functional control data.
3. The industrial control IoT device security monitoring method according to claim 1, characterized in that, The method for generating fitted time-series response data in S5 includes: for a single functional control data, extracting the original data points with the same order from all the original time-series response data corresponding to it as a single original point combination; determining the center point of all original point combinations in multidimensional space, and using each center point as the fitted data point of the corresponding order; sorting all the fitted data points to form fitted time-series response data, and setting an allowable deviation for the fitted time-series response data.
4. The industrial control IoT device security monitoring method according to claim 3, characterized in that, For each fitted data point of the time-series response data, an allowable deviation is set. The allowable deviation of a single fitted data point is set as the fitting difference, which is the maximum Euclidean distance between the fitted data point and all its corresponding original data points.
5. The industrial control IoT device security monitoring method according to claim 4, characterized in that, The allowable deviation of a single fitted data point is set as the sum of the fitting difference and the nominal deviation.
6. The industrial control IoT device security monitoring method according to any one of claims 3-5, characterized in that, In step S6, data monitoring is performed on the operating program and component safety factors of the industrial control IoT device. When the functional program unit starts running, the functional control data in the working condition safety baseline library is located based on the functional program unit information, and then the corresponding fitted time-series response data is located. At the same time, during the running period of the functional program unit, the monitoring values of all component safety factors of all response components are extracted at all times and fused and mapped into the data points to be inspected in the multi-dimensional space. It is then determined whether the Euclidean distance between the data points to be inspected and the corresponding fitted data points in the fitted time-series response data is not greater than the allowable deviation. If yes, the industrial control IoT device is determined to be working normally; otherwise, the industrial control IoT device is determined to be working abnormally.
7. An industrial control IoT device security monitoring system, characterized in that, include: The data monitoring and acquisition module is used to collect data on the operating program and component safety factors of industrial control IoT devices for at least one full operating cycle in a safe and controlled environment, forming several program operation data including functional program unit information, operation start time, and operation end time, and component safety factor data including component safety factor information, acquisition time, and acquisition value; it is also used to monitor the data of the operating program and component safety factors of industrial control IoT devices in actual industrial control environments; The data processing module is used to extract component safety causal data at the start and end times of a single program's execution, and generate corresponding raw time-series response data. The method for generating raw time-series response data includes: constructing a multi-dimensional space based on component safety causal information; for a single program execution data, mapping all corresponding component safety causal data to several raw data points in the multi-dimensional space based on the sampling time, and fusing component safety causal data at the same sampling time to a single raw data point in the multi-dimensional space; sorting all raw data points corresponding to a single program execution data based on the sampling time to form raw time-series response data; extracting program execution data with the same functional program unit information to form functional control data, and extracting the corresponding raw time-series response data to generate fitted time-series response data; a working condition safety baseline module, used to identify the functional control data and fitted time-series response data to form a working condition safety baseline library; and a safety determination module, used to determine the working status of industrial control IoT devices based on the working condition safety baseline library.
8. An electronic device, including a memory and a computer program and processor stored thereon, characterized in that, When the processor executes the computer program, it implements the industrial control IoT device security monitoring method as described in any one of claims 1-6.
9. A storage medium, characterized in that, The storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the industrial control IoT device security monitoring method as described in any one of claims 1-6.
Citation Information
Patent Citations
Method and system for detecting safety of industrial process control technological process
CN104460602A