Data security management method, device, system and medium based on industrial internet

Abstract

The application provides a data security management method, device and system based on an industrial internet and a medium. The method receives first industrial control data corresponding to a first industrial control device through a first data interface in a data interface cluster. Then, a security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, and sends the first industrial control data to a first controlled device when the first security level meets a preset security level condition. Thus, the security control layer realizes security verification of the industrial control data, and effectively improves the system security of an industrial control data management system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to a data security management method, device and system based on industrial internet and a medium. BACKGROUND

[0002] Industrial internet is a complex ecosystem integrating information technology, operation technology and communication technology, aiming to realize seamless connection and interaction of people, machines, data and various industrial control devices through advanced network technology and intelligent analysis.

[0003] Since industrial internet involves the security of enterprise core production data and key infrastructure, a strict security protection system must be established to ensure the security and reliability of data transmission and storage, and to prevent potential network security threats. In order to increase the scalability of industrial control systems, the existing industrial internet has gradually developed from internal local area networks to open networks, for example, external devices can control related industrial control devices in the system, and such industrial control instructions need a data security management method that can realize automatic security verification. SUMMARY

[0004] The present application provides a data security management method, device, system and medium based on industrial internet, which realizes the security verification of industrial control data and effectively improves the system security of industrial control data management system.

[0005] In a first aspect, the present application provides a data security management method based on industrial internet, applied to an industrial control data management system, the industrial control data management system comprising a security control layer, a data interface cluster and a to-be-controlled device cluster, each data interface in the data interface cluster being connected with the security control layer, the security control layer being in communication connection with each to-be-controlled device in the to-be-controlled device cluster, and the data interface being used for data connection with external industrial control devices; the method comprises:

[0006] receiving first industrial control data corresponding to a first industrial control device through a first data interface in the data interface cluster, the first industrial control data comprising a first control parameter for instructing a first to-be-controlled device in the to-be-controlled device cluster to perform a first operation, the first control parameter being a control parameter generated based on a first control protocol;

[0007] determining a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, wherein the preset industrial control data management model is an industrial control data classification model obtained by training a preset decision model using a preset industrial control data sample set;

[0008] If the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device.

[0009] Optionally, if the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device, including:

[0010] If the first security level is higher than a preset security level, the security control layer sends the first industrial control data to the first to-be-controlled device.

[0011] Correspondingly, the method further includes:

[0012] If the first security level is lower than the preset security level, the security control layer sends the first industrial control data to a monitoring device, and the industrial control data management system further includes the monitoring device, which is in communication connection with the security control layer.

[0013] The monitoring device converts the first industrial control data into first security data in response to a security confirmation instruction, and sends the first security data to the security control layer, so that the security control layer sends the first security data to the first to-be-controlled device, wherein the first security data is control data generated based on a second control protocol, and the second control protocol is a preset security control protocol in the security control layer; or

[0014] The monitoring device responds to a security rejection instruction, so that the security control layer sends a first industrial control rejection instruction to the first to-be-controlled device through the first data interface.

[0015] Optionally, the preset decision model includes a classification and regression tree; before the security control layer determines the first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, the method further includes:

[0016] Generating a set of original training data according to first original training data and second original training data, the first original training data being a set of training data composed of industrial control data with a security level higher than a preset security level, and the second original training data being a set of training data composed of industrial control data with a security level lower than the preset security level;

[0017] Training the classification and regression tree according to the set of original training data by using Formula 1, to determine the preset decision model, wherein the Formula 1 is:

[0018] C(S) = ^Ln(S) + a|S|

[0019] wherein S is a set of leaf nodes of the classification and regression tree, C(S) is a cost complexity of S, a is a constant, |S| is a cardinality of S, ^Ln(S) is an empirical risk using S.

[0020] Optionally, the training of the classification and regression tree according to the original training data set to determine the preset decision model comprises:

[0021] A search parameter space of the set of leaf nodes S is determined by using Formula 2, the search parameter space being used to determine a next leaf node X ij (t+1) from a current leaf node X ij (t) in the set of leaf nodes S, the Formula 2 being:

[0022]

[0023] wherein R1 is a preset first initial value, R2 is a preset second initial value, R3 is a preset third initial value, R4 is a preset fourth initial value, R5 is a preset fifth initial value, R6 is a preset sixth initial value, 0 < R3+R4≤2, R5-R6≥1, X ij (t) is a search speed at the current node, V ij (t+1) is a search speed from the current leaf node X ij (t) to the next leaf node X ij (t+1), V ij (t) is a search speed from the next leaf node to the current leaf node X ij (t), P ij (t) is a preset minimum search speed, ω s is an initial inertial weight, ω e is a preset acceptable minimum weight, t is a current iteration number, T max is a preset maximum number of allowed iterations.

[0024] Optionally, the preset decision model comprises a support vector machine; before the safety control layer determines the first safety level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, the method further comprises:

[0025] generating, by the support vector machine, a safety level decision boundary condition for first original training data and second original training data, the first original training data being a training data set composed of industrial control data with a safety level higher than a preset safety level, the second original training data being a training data set composed of industrial control data with a safety level lower than the preset safety level, a data amount in the first original training data being greater than a data amount in the second original training data;

[0026] determining distances between each of the training data in the first original training data and the safety level decision boundary condition, and deleting training data corresponding to distances greater than a preset distance threshold from the first original training data to form first updated training data;

[0027] generating the preset industrial control data sample set according to the first updated training data and the second original training data.

[0028] Optionally, after the generating of the preset industrial control data sample set according to the first updated training data and the second original training data, the method further comprises:

[0029] performing clustering processing on the second original training data by using a preset clustering algorithm to generate a second data cluster set;

[0030] determining distances between clustering centers of each of the data clusters in the second data cluster set and the safety level decision boundary condition;

[0031] determining a first data boundary condition and a second data boundary condition according to the distances between the clustering centers of each of the data clusters in the second data cluster set and the safety level decision boundary condition;

[0032] dividing the second original training data into a first data set, a second data set and a third data set according to the first data boundary condition and the second data boundary condition, wherein the first data set is a data set composed of training data with distances less than the second data boundary condition from the safety level decision boundary condition, the second data set is a data set composed of training data with distances greater than or equal to the second data boundary condition and less than the first data boundary condition from the safety level decision boundary condition, and the third data set is a data set composed of training data with distances greater than the second data boundary condition from the safety level decision boundary condition;

[0033] generating a first extended data set according to the first data set and a preset random data generation algorithm, and generating a second extended data set according to the second data set and the preset random data generation algorithm, wherein a data amount difference between the first extended data set and the first data set is greater than a data amount difference between the second extended data set and the second data set;

[0034] generating second updated training data according to the first extended data set, the second extended data set and the third data set;

[0035] updating the preset industrial control data sample set according to the first updated training data and the second updated training data.

[0036] Optionally, the security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, and the method comprises:

[0037] a discriminant result f(x) of the first industrial control data is determined according to the first industrial control data x by using a formula 3, and the formula 3 is as follows:

[0038]

[0039] sgn is a discriminant function, K(x, x i ) is a kernel function of the support vector machine, x i is a feature vector corresponding to an i-th sample in the preset industrial control data sample set, n is a total number of samples in the preset industrial control data sample set, is a Lagrange operator for obtaining an optimal solution, b * is a bias term of the support vector machine, ω is a weight vector, ξ i is a relaxation vector, and b is a preset constant;

[0040] The first security level is determined according to the discriminant result f(x) and a preset discriminant result mapping table.

[0041] In a second aspect, the present application provides an industrial control data management system, which comprises a security control layer, a data interface cluster and a to-be-controlled device cluster, each data interface in the data interface cluster is connected with the security control layer, the security control layer is in communication connection with each to-be-controlled device in the to-be-controlled device cluster, and the data interface is used for data connection with an external industrial control device.

[0042] First industrial control data corresponding to a first industrial control device is received through a first data interface in the data interface cluster, the first industrial control data comprises a first control parameter used for instructing a first to-be-controlled device in the to-be-controlled device cluster to perform a first operation, and the first control parameter is a control parameter generated based on a first control protocol;

[0043] The security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, wherein the preset industrial control data management model is an industrial control data classification model obtained by training a support vector machine by using a preset industrial control data sample set;

[0044] If the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device.

[0045] Optionally, if the first security level is higher than the preset security level, the security control layer sends the first industrial control data to the first to-be-controlled device;

[0046] If the first security level is lower than the preset security level, the security control layer sends the first industrial control data to a monitoring device, the industrial control data management system further comprises the monitoring device, and the monitoring device is in communication connection with the security control layer;

[0047] The monitoring device converts the first industrial control data into first security data in response to a security confirmation instruction, and sends the first security data to the security control layer, so that the security control layer sends the first security data to the first to-be-controlled device, wherein the first security data is control data generated based on a second control protocol, and the second control protocol is a preset security control protocol in the security control layer; or,

[0048] The monitoring device responds to a security rejection instruction, so that the security control layer sends a first industrial control rejection instruction to the first to-be-controlled device through the first data interface.

[0049] Optionally, the preset decision model comprises a classification and regression tree;

[0050] According to the first original training data and the second original training data, an original training data set is generated, the first original training data is a training data set composed of industrial control data with a security level higher than a preset security level, and the second original training data is a training data set composed of industrial control data with a security level lower than the preset security level;

[0051] According to the original training data set, the classification and regression tree is trained by using formula 1 to determine the preset decision model, wherein the formula 1 is:

[0052] C(S) = ^Ln(S) + a|S|

[0053] Wherein, S is a leaf node set of the classification and regression tree, C(S) is the cost complexity of S, a is a constant, |S| is the cardinality of S, ^Ln(S) is the empirical risk using S.

[0054] Optionally, the search parameter space of the leaf node set S is determined by using formula 2, and the search parameter space is used to determine the next leaf node X ij (t+1) from the current leaf node X ij (t) of the leaf node set S, and the formula 2 is:

[0055]

[0056] wherein, R1 is a preset first initial value, R2 is a preset second initial value, R3 is a preset third initial value, R4 is a preset fourth initial value, R5 is a preset fifth initial value, R6 is a preset sixth initial value, 0 < R3 + R4 ≤ 2, R5 - R6 ≥ 1, X ij (t) is a search speed at the current node, V ij (t+1) is a current leaf node X ij (t) to a next leaf node X ij (t+1) is a search speed, V ij (t) is a next leaf node to a current leaf node X ij (t) is a search speed, P ij (t) is a preset minimum search speed, ω s is an initial inertia weight, ω e is a preset acceptable minimum weight, t is a current iteration number, T max is a preset maximum number of iterations allowed.

[0057] Optionally, the preset decision model comprises a support vector machine.

[0058] A safety level decision boundary condition is generated by the support vector machine for first original training data and second original training data, the first original training data being a training data set composed of industrial control data with a safety level higher than a preset safety level, the second original training data being a training data set composed of industrial control data with a safety level lower than the preset safety level, a data quantity in the first original training data being greater than a data quantity in the second original training data.

[0059] Distances between each training data in the first original training data and the safety level decision boundary condition are determined, and training data corresponding to distances greater than a preset distance threshold are deleted from the first original training data to form first updated training data.

[0060] The preset industrial control data sample set is generated according to the first updated training data and the second original training data.

[0061] Optionally, a preset clustering algorithm is used to perform clustering processing on the second original training data to generate a second data cluster set.

[0062] Distances between clustering centers of each data cluster in the second data cluster set and the safety level decision boundary condition are determined.

[0063] First data boundary conditions and second data boundary conditions are determined according to the distances between the clustering centers of each data cluster in the second data cluster set and the safety level decision boundary condition.

[0064] dividing the second original training data into a first data set, a second data set and a third data set according to the first data boundary condition and the second data boundary condition, wherein the first data set is a data set composed of training data with a distance to the safety level decision boundary condition less than the second data boundary condition, the second data set is a data set composed of training data with a distance to the safety level decision boundary condition greater than or equal to the second data boundary condition and less than the first data boundary condition, and the third data set is a data set composed of training data with a distance to the safety level decision boundary condition greater than the second data boundary condition;

[0065] generating a first extended data set according to the first data set and a preset random data generation algorithm, and generating a second extended data set according to the second data set and the preset random data generation algorithm, wherein a data amount difference between the first extended data set and the first data set is greater than a data amount difference between the second extended data set and the second data set;

[0066] generating second updated training data according to the first extended data set, the second extended data set and the third data set;

[0067] updating the preset industrial control data sample set according to the first updated training data and the second updated training data.

[0068] Optionally, a formula 3 is used, and a discrimination result f(x) of the first industrial control data is determined according to the first industrial control data x, the formula 3 being:

[0069]

[0070] sgn is a discrimination function, K(x, x i ) is a kernel function of the support vector machine, x i is a feature vector corresponding to an i th sample in the preset industrial control data sample set, n is a total number of samples in the preset industrial control data sample set, is a Lagrange operator for obtaining an optimal solution, b * is a bias term of the support vector machine, ω is a weight vector, ξ i is a relaxation vector, and b is a preset constant;

[0071] the first safety level is determined according to the discrimination result f(x) and a preset discrimination result mapping table.

[0072] In a third aspect, the present application provides an electronic device, comprising:

[0073] a processor; and

[0074] a memory for storing executable instructions of the processor;

[0075] The processor is configured to execute any one of the possible methods described in the first aspect by executing the executable instructions.

[0076] In a fourth aspect, the present application provides a computer readable storage medium, which stores computer execution instructions, and the computer execution instructions are executed by a processor to implement any one of the possible methods described in the first aspect.

[0077] The data security management method, device, system and medium based on industrial internet provided by the present application receive first industrial control data corresponding to a first industrial control device through a first data interface in a data interface cluster, then the security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, and sends the first industrial control data to a first controlled device when the first security level meets a preset security level condition, so that the security control layer realizes security verification of the industrial control data, and effectively improves the system security of the industrial control data management system. BRIEF DESCRIPTION OF DRAWINGS

[0078] The accompanying drawings, which are incorporated herein and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0079] Figure 1 is a flowchart of the data security management method based on industrial internet according to an example embodiment of the present application;

[0080] Figure 2 is a flowchart of the data security management method based on industrial internet according to another example embodiment of the present application;

[0081] Figure 3 is a structural diagram of the industrial control data management system according to an example embodiment of the present application;

[0082] Figure 4 is a structural diagram of the electronic device according to an example embodiment of the present application.

[0083] Through the above drawings, the specific embodiments of the present application have been shown, and will be described in more detail hereinafter. These drawings and textual descriptions are not intended to limit the scope of the concept of the present application by any means, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0084] The exemplary embodiments will be described in detail below with reference to the drawings. The following description is only exemplary and is not intended to represent all the embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with some aspects of the present application as detailed in the appended claims.

[0085] Figure 1 is a flowchart of a data security management method based on industrial internet according to an exemplary embodiment of the present application. As shown in Figure 1 , the data security management method based on industrial internet provided by the present embodiment includes:

[0086] S101, receiving first industrial control data corresponding to a first industrial control device through a first data interface in a data interface cluster.

[0087] The method provided by the present embodiment can be applied to an industrial control data management system, which can include a security control layer, a data interface cluster, and a cluster of controlled devices. Each data interface in the data interface cluster is connected to the security control layer, and the security control layer is in communication connection with each controlled device in the cluster of controlled devices. The data interface is used to connect data with external industrial control devices. The security control layer can be an industrial firewall, or a next-level security system built on the basis of a basic industrial firewall.

[0088] In this step, the first industrial control data corresponding to the first industrial control device can be received through the first data interface in the data interface cluster. The first industrial control data includes a first control parameter for instructing a first controlled device in the cluster of controlled devices to perform a first operation. The first control parameter is a control parameter generated based on a first control protocol.

[0089] S102, the security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model.

[0090] In this step, the security control layer can determine the first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model. The preset industrial control data management model is an industrial control data classification model obtained by training a preset decision model using a preset industrial control data sample set. The preset industrial control data sample set can be a sample set manually labeled with industrial control data classification labels. The preset decision model can be based on decision tree, neural network, support vector machine, deep learning model, naive Bayes algorithm, etc.

[0091] Optionally, the preset decision model can include a classification and regression tree. Before the safety control layer determines the first safety level of the first industrial control data according to the first industrial control data and the preset industrial control data management model, the method can further include:

[0092] generating a set of original training data according to the first original training data and the second original training data, the first original training data being a set of training data composed of industrial control data with a safety level higher than a preset safety level, and the second original training data being a set of training data composed of industrial control data with a safety level lower than the preset safety level;

[0093] training the classification and regression tree according to the set of original training data to determine the preset decision model, by using Formula 1, wherein Formula 1 is:

[0094] C(S) = ^Ln(S) + a|S|

[0095] wherein S is a set of leaf nodes of the classification and regression tree, C(S) is a cost complexity of S, a is a constant, |S| is a cardinality of S, and ^Ln(S) is an empirical risk using S.

[0096] In addition, the training of the classification and regression tree according to the set of original training data to determine the preset decision model can include: determining a search parameter space of the set of leaf nodes S by using Formula 2, the search parameter space being used to search for a next leaf node X ij (t+1) from a current leaf node X ij (t) of the set of leaf nodes S.

[0097]

[0098] wherein R1 is a preset first initial value, R2 is a preset second initial value, R3 is a preset third initial value, R4 is a preset fourth initial value, R5 is a preset fifth initial value, R6 is a preset sixth initial value, 0 < R3 + R4 ≤ 2, R5 - R6 ≥ 1, V ij (t) is a search speed at the current node, V ij (t+1) is a search speed from the current leaf node X ij (t) to the next leaf node X ij (t+1), V ij (t) is a search speed from the next leaf node to the current leaf node X ij (t), P ij (t) is a preset minimum search speed, ω s is an initial inertia weight, ω e is a preset acceptable minimum weight, t is a current iteration number, T max is a preset maximum number of allowed iterations.

[0099] Through the above steps, a hybrid algorithm can be formed, the algorithm corresponding to formula 2 serving as a parameter operator of space search. When the classification decision falls into a local optimal solution, the iteration parameter can be mutated by the above algorithm, so as to jump out of the local optimal solution, enhance the classification decision ability, and further improve the classification decision accuracy of the model.

[0100] S103, if the first security level meets the preset security level condition, the safety control layer sends the first industrial control data to the first to-be-controlled device.

[0101] If the first security level meets the preset security level condition, the safety control layer sends the first industrial control data to the first to-be-controlled device. If the first security level is higher than the preset security level, the safety control layer sends the first industrial control data to the first to-be-controlled device.

[0102] In addition, if the first security level is lower than the preset security level, the safety control layer sends the first industrial control data to the monitoring device. The industrial control data management system further comprises a monitoring device, which is in communication connection with the safety control layer. The monitoring device converts the first industrial control data into first security data in response to a safety confirmation instruction, and sends the first security data to the safety control layer, so that the safety control layer sends the first security data to the first to-be-controlled device. The first security data is control data generated based on a second control protocol, and the second control protocol is a preset security control protocol in the safety control layer. Through the above steps, the industrial control data determined to be of low security level can be subjected to secondary verification, so as to avoid misjudgment of data classification due to differences in control protocols. It should be noted that, in order to further improve the classification decision ability of the model, the misjudged industrial control data can also be added to the preset industrial control data sample set for subsequent model iteration update. In addition, in order to further improve the recognition efficiency of non-security industrial control data, a preset lower limit of security level can also be set. When the recognition result is the first preset lower limit of security level, the safety control layer directly sends a first industrial control rejection instruction to the first to-be-controlled device through the first data interface without sending it to the monitoring device for confirmation.

[0103] In addition, after the safety control layer sends the first industrial control data to the monitoring device, the monitoring device responds to a safety rejection instruction, so that the safety control layer sends a first industrial control rejection instruction to the first to-be-controlled device through the first data interface.

[0104] In this embodiment, the first industrial control data corresponding to the first industrial control device is received through the first data interface in the data interface cluster, then the first security level of the first industrial control data is determined according to the first industrial control data and the preset industrial control data management model by the security control layer, and the first industrial control data is sent to the first controlled device when the first security level meets the preset security level condition, so that the security verification of the industrial control data is realized through the security control layer, and the system security of the industrial control data management system is effectively improved.

[0105] Figure 2 is a flowchart of an industrial internet-based data security management method according to another example embodiment of the present application. As shown in Figure 2 the data security management method for industrial internet provided in this embodiment includes:

[0106] S201, receiving first industrial control data corresponding to a first industrial control device through a first data interface in a data interface cluster.

[0107] The method provided in this embodiment can be applied to an industrial control data management system, which can include a security control layer, a data interface cluster, and a controlled device cluster. Each data interface in the data interface cluster is connected to the security control layer, and the security control layer is in communication connection with each controlled device in the controlled device cluster. The data interface is used for data connection with an external industrial control device. The security control layer can be an industrial firewall, or a next-level security system built on the basis of a basic industrial firewall.

[0108] In this step, the first industrial control data corresponding to the first industrial control device can be received through the first data interface in the data interface cluster. The first industrial control data includes a first control parameter for instructing the first controlled device in the controlled device cluster to perform a first operation. The first control parameter is a control parameter generated based on a first control protocol.

[0109] S202, determining a preset industrial control data sample set.

[0110] In this step, in order to be able to iteratively update the preset industrial control data management model. When the preset decision model includes a support vector machine, the support vector machine can be used to generate a security level decision boundary condition for the first original training data and the second original training data. The first original training data is a training data set composed of industrial control data with a security level higher than a preset security level. The second original training data is a training data set composed of industrial control data with a security level lower than the preset security level. The data amount in the first original training data is greater than the data amount in the second original training data.

[0111] The distance between each training data point in the first original training data and the safety level decision boundary conditions is determined, and training data points with distances greater than a preset distance threshold are deleted from the first original training data to form the first updated training data. A preset industrial control data sample set is generated based on the first updated training data and the second original training data.

[0112] Specifically, it can be based on the first original training data P = {p1, p2, ..., p...} i ,…,p n} and the second original training data Q={q1,q2,…,q j ,…,q m Generate the security level decision boundary S: a·x + b = 0, where n is the first data volume, m is the second data volume, and p i Let q be the i-th training data in the first original training data P. j Let be the j-th training data in the second original training data Q, where a is the normal vector, b is the intercept, and x is the feature vector of the industrial control data after being processed by a preset vector machine.

[0113] Using Formula 4, and based on the first original training data P = {p1, p2, ..., p...} i ,…,p n The first original training distance set D = {d1, d2, ..., d} is determined by the security level decision boundary S. i ,…,d n}, where d i For p i The distance to the sample decision boundary S is given by Formula 4:

[0114]

[0115] Select the first original training distance set D = {d1, d2, ..., d i ,…,d n The distance is less than the preset threshold. The distance is used to form the first updated training data.

[0116] In addition, after generating a preset industrial control data sample set based on the first updated training data and the second original training data, a preset clustering algorithm can be used to cluster the second original training data to generate a second data cluster.

[0117] Specifically, it can be based on a preset clustering algorithm on the second original training data Q = {q1,q2,…,q} j ,…,q m Clustering is performed to generate a second original data cluster set V = {v1, v2, ..., v}. f ,…,v gwherein g is the number of data clusters in the second original data cluster set V, v f is the fth data cluster in the second original data cluster set V.

[0118] The distance between the cluster center of each data cluster in the second data cluster set and the security level decision boundary condition is determined.

[0119] Specifically, formula 5 can be used, and the second original data cluster distance set L = {l1, l2, …, l f ,…,l g} is determined according to the second original data cluster set V = {v1, v2, …, v f ,…,v g} and the sample decision boundary S, wherein l f is the distance from v f to the security level decision boundary S, and formula 5 is as follows:

[0120]

[0121] wherein is the cluster center of l f .

[0122] The first data boundary condition and the second data boundary condition are determined according to the distance between the cluster center of each data cluster in the second data cluster set and the security level decision boundary condition.

[0123] Specifically, formula 6 can be used, and the first data distance boundary t1 and the second data distance boundary t2 are determined according to the second original data cluster distance set L = {l1, l2, …, l f ,…,l g}, and formula 6 is as follows:

[0124]

[0125] The second original training data is divided into a first data set, a second data set and a third data set according to the first data boundary condition and the second data boundary condition, wherein the first data set is a data set composed of training data whose distance from the security level decision boundary condition is less than the second data boundary condition, the second data set is a data set composed of training data whose distance from the security level decision boundary condition is greater than or equal to the second data boundary condition and less than the first data boundary condition, and the third data set is a data set composed of training data whose distance from the security level decision boundary condition is greater than the second data boundary condition.

[0126] The first extended data set is generated according to the first data set and a preset random data generation algorithm, and the second extended data set is generated according to the second data set and the preset random data generation algorithm, wherein a difference in data quantity between the first extended data set and the first data set is greater than a difference in data quantity between the second extended data set and the second data set. The random data generation algorithm can be a uniform distribution random number generator, a normal distribution (Gaussian distribution) random number generator, a Poisson distribution random number generator, a polynomial distribution random number generator, or joint distribution random sampling.

[0127] The second updated training data is generated according to the first extended data set, the second extended data set, and the third data set. The preset industrial control data sample set is updated according to the first updated training data and the second updated training data. Through the above data expansion method, the first extended data set and the second extended data set close to the sample decision boundary are expanded, and the third extended data set far away from the sample decision boundary is not expanded, so that the data quantity of the normal use data and the abnormal use data in the generated second updated training data is close, and the phenomenon that the classification result of the trained model deviates to the majority class sample is avoided.

[0128] It is worth noting that the method for determining the preset industrial control data sample set can also be applied to Figure 1 The embodiments shown in the drawings form a hybrid model. In addition, the preset industrial control data sample set generated and iterated by the above steps can also be applied to the training of decision trees, neural networks, support vector machines, deep learning models, naive Bayes algorithms, etc. The generated and iterated preset industrial control data sample set is universal and does not depend on the type of the preset decision model, thereby providing better compatibility for subsequent upgrade of the preset decision model.

[0129] S203, the security control layer determines the first security level of the first industrial control data according to the first industrial control data and the preset industrial control data management model.

[0130] In one possible implementation, the discriminant result f(x) of the first industrial control data can be determined by using formula 3 and the first industrial control data x, and formula 3 is as follows:

[0131]

[0132] sgn is a discriminant function, K(x, x i ) is a kernel function of a support vector machine, x i is a feature vector corresponding to the i th sample in the preset industrial control data sample set, n is the total number of samples in the preset industrial control data sample set, is a Lagrange operator for obtaining an optimal solution, and b *is a bias term of the support vector machine, ω is a weight vector, and ξ i is a relaxation vector, and b is a preset constant.

[0133] The first security level is determined according to the discrimination result f(x) and a preset discrimination result mapping table.

[0134] S204, if the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device.

[0135] If the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device. If the first security level is higher than the preset security level, the security control layer sends the first industrial control data to the first to-be-controlled device.

[0136] In addition, if the first security level is lower than the preset security level, the security control layer sends the first industrial control data to the monitoring device. The industrial control data management system further includes a monitoring device, which is in communication connection with the security control layer. The monitoring device, in response to a security confirmation instruction, converts the first industrial control data into first security data and sends the first security data to the security control layer, so that the security control layer sends the first security data to the first to-be-controlled device. The first security data is control data generated based on a second control protocol, and the second control protocol is a preset security control protocol in the security control layer. Through the above steps, the industrial control data determined to be of a low security level can be subjected to secondary verification, thereby avoiding misjudgment of data classification due to differences in control protocols. It should be noted that, in order to further improve the classification decision-making ability of the model, the misjudged industrial control data can also be added to the preset industrial control data sample set for subsequent model iteration and update. In addition, in order to further improve the recognition efficiency of non-security industrial control data, a preset security level lower limit can also be set. When the recognition result is the first preset security level lower limit, the security control layer directly sends a first industrial control rejection instruction to the first to-be-controlled device through the first data interface without sending it to the monitoring device for confirmation.

[0137] In addition, after the security control layer sends the first industrial control data to the monitoring device, the monitoring device, in response to a security rejection instruction, causes the security control layer to send a first industrial control rejection instruction to the first to-be-controlled device through the first data interface.

[0138] Figure 3 is a structure diagram of an industrial control data management system according to an example embodiment of the present application. As shown in Figure 3As shown, the industrial data management system 300 provided by the embodiment includes a security control layer 310, a data interface cluster 320, and a controlled device cluster 330. Each data interface in the data interface cluster 320 is connected with the security control layer 310. The security control layer 310 is in communication connection with each controlled device in the controlled device cluster 330. The data interface is used to perform data connection with an external industrial control device.

[0139] A first industrial data corresponding to a first industrial control device is received through a first data interface in the data interface cluster 320. The first industrial data includes a first control parameter used to instruct a first controlled device in the controlled device cluster 330 to perform a first operation. The first control parameter is a control parameter generated based on a first control protocol.

[0140] The security control layer 310 determines a first security level of the first industrial data according to the first industrial data and a preset industrial data management model. The preset industrial data management model is an industrial data classification model obtained by training a support vector machine using a preset industrial data sample set.

[0141] If the first security level satisfies a preset security level condition, the security control layer 310 sends the first industrial data to the first controlled device.

[0142] Optionally, if the first security level is higher than a preset security level, the security control layer 310 sends the first industrial data to the first controlled device.

[0143] If the first security level is lower than the preset security level, the security control layer 310 sends the first industrial data to a monitoring device. The industrial data management system further includes the monitoring device. The monitoring device is in communication connection with the security control layer 310.

[0144] The monitoring device converts the first industrial data into first security data in response to a security confirmation instruction and sends the first security data to the security control layer 310, so that the security control layer 310 sends the first security data to the first controlled device. The first security data is control data generated based on a second control protocol. The second control protocol is a preset security control protocol in the security control layer 310. Alternatively,

[0145] The monitoring device responds to a security rejection instruction, so that the security control layer 310 sends a first industrial rejection instruction to the first controlled device through the first data interface.

[0146] Optionally, the preset decision model includes a classification and regression tree.

[0147] generate a set of original training data according to first original training data and second original training data, the first original training data being a set of training data composed of industrial control data with a security level higher than a preset security level, and the second original training data being a set of training data composed of industrial control data with a security level lower than the preset security level;

[0148] train the classification and regression tree according to the set of original training data, to determine the preset decision model, wherein the formula 1 is:

[0149] C(S) = ^Ln(S) + a|S|

[0150] wherein S is a set of leaf nodes of the classification and regression tree, C(S) is a cost complexity of S, a is a constant, |S| is a cardinality of S, and ^Ln(S) is an empirical risk using S.

[0151] Optionally, a search parameter space of the set of leaf nodes S is determined according to formula 2, the search parameter space being used to determine a next leaf node X ij (t+1) from a current leaf node X ij (t), and the formula 2 is:

[0152]

[0153] wherein R1 is a preset first initial value, R2 is a preset second initial value, R3 is a preset third initial value, R4 is a preset fourth initial value, R5 is a preset fifth initial value, R6 is a preset sixth initial value, 0 < R3 + R4 ≤ 2, R5 - R6 ≥ 1, X ij (t) is a search speed at the current node, V ij (t+1) is a search speed of the current leaf node X ij (t) to the next leaf node X ij (t+1), V ij (t) is a search speed of the next leaf node to the current leaf node X ij (t), P ij (t) is a preset minimum search speed, ω s is an initial inertia weight, ω e is a preset acceptable minimum weight, t is a current iteration number, T max is a preset maximum number of allowed iterations.

[0154] Optionally, the preset decision model comprises a support vector machine.

[0155] generate a safety level decision boundary condition by the support vector machine, the first original training data being a training data set composed of the industrial control data with a safety level higher than a preset safety level, the second original training data being a training data set composed of the industrial control data with a safety level lower than the preset safety level, and a data amount in the first original training data being greater than a data amount in the second original training data;

[0156] determine distances between each training data in the first original training data and the safety level decision boundary condition, and delete the training data corresponding to a distance greater than a preset distance threshold from the first original training data to form first updated training data;

[0157] generate the preset industrial control data sample set according to the first updated training data and the second original training data.

[0158] Optionally, a preset clustering algorithm is used to perform clustering processing on the second original training data to generate a second data cluster set;

[0159] determine distances between a clustering center of each data cluster in the second data cluster set and the safety level decision boundary condition;

[0160] determine a first data boundary condition and a second data boundary condition according to the distances between the clustering center of each data cluster in the second data cluster set and the safety level decision boundary condition;

[0161] divide the second original training data into a first data set, a second data set and a third data set according to the first data boundary condition and the second data boundary condition, wherein the first data set is a data set composed of the training data with a distance less than the second data boundary condition from the safety level decision boundary condition, the second data set is a data set composed of the training data with a distance greater than or equal to the second data boundary condition and less than the first data boundary condition from the safety level decision boundary condition, and the third data set is a data set composed of the training data with a distance greater than the second data boundary condition from the safety level decision boundary condition;

[0162] generate a first extended data set according to the first data set and a preset random data generation algorithm, and generate a second extended data set according to the second data set and the preset random data generation algorithm, wherein a data amount difference between the first extended data set and the first data set is greater than a data amount difference between the second extended data set and the second data set;

[0163] generate second update training data according to the first extended data set, the second extended data set and the third data set;

[0164] update the preset industrial control data sample set according to the first update training data and the second update training data.

[0165] Optionally, a formula 3 is used, and the discrimination result f(x) of the first industrial control data is determined according to the first industrial control data x, the formula 3 is as follows:

[0166]

[0167] sgn is a discrimination function, K(x, x i ) is a kernel function of the support vector machine, x i is a feature vector corresponding to the i th sample in the preset industrial control data sample set, n is a total number of samples in the preset industrial control data sample set, is a Lagrange operator for obtaining an optimal solution, b * is a bias term of the support vector machine, ω is a weight vector, ξ i is a relaxation vector, and b is a preset constant.

[0168] determine the first security level according to the discrimination result f(x) and a preset discrimination result mapping table.

[0169] Figure 4 is a structural schematic diagram of an electronic device according to an example embodiment. As shown in the figure, an electronic device 400 provided by the embodiment includes a processor 401 and a memory 402; wherein: Figure 4

[0170] The memory 402 is used for storing a computer program, and the memory can also be a flash (flash memory).

[0171] The processor 401 is used for executing an execution instruction stored in the memory to realize each step in the above method. For details, please refer to the related description in the method embodiment.

[0172] Optionally, the memory 402 can be independent or integrated with the processor 401.

[0173] When the memory 402 is a device independent of the processor 401, the electronic device 400 can further include:

[0174] A bus 403 is used for connecting the memory 402 and the processor 401.

[0175] ​The embodiment also provides a readable storage medium, and the readable storage medium stores a computer program. When at least one processor of an electronic device executes the computer program, the electronic device executes the method provided by various embodiments.

[0176] The embodiment also provides a program product, and the program product includes a computer program stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to enable the electronic device to implement the method provided by various embodiments.

[0177] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0178] It will be understood that the application is not limited to the precise structures hereinbefore described and illustrated in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the application is indicated by the appended claims, only.

Claims

1. A data security management method based on an industrial internet, characterized in that, The application is applied to an industrial control data management system, the industrial control data management system comprises a safety control layer, a data interface cluster and a to-be-controlled device cluster, each data interface in the data interface cluster is connected with the safety control layer, the safety control layer is in communication connection with each to-be-controlled device in the to-be-controlled device cluster, and the data interface is used for data connection with an external industrial control device; the method comprises the following steps: receiving first industrial control data corresponding to a first industrial control device through a first data interface in the data interface cluster, wherein the first industrial control data comprises first control parameters used for instructing a first to-be-controlled device in the to-be-controlled device cluster to perform a first operation, and the first control parameters are control parameters generated based on a first control protocol; determining a first safety level of the first industrial control data according to the first industrial control data and a preset industrial control data management model by the safety control layer, wherein the preset industrial control data management model is an industrial control data classification model obtained by training a preset decision model by using a preset industrial control data sample set; if the first safety level meets a preset safety level condition, the safety control layer sends the first industrial control data to the first to-be-controlled device; the preset decision model comprises a support vector machine; before the safety control layer determines the first safety level of the first industrial control data according to the first industrial control data and the preset industrial control data management model, the method further comprises the following steps: generating a safety level decision boundary condition by the support vector machine for first original training data and second original training data, wherein the first original training data is a training data set composed of industrial control data with a safety level higher than the preset safety level, the second original training data is a training data set composed of industrial control data with a safety level lower than the preset safety level, and the data amount in the first original training data is greater than the data amount in the second original training data; determining the distance between each training data in the first original training data and the safety level decision boundary condition, and deleting the training data corresponding to a distance greater than a preset distance threshold from the first original training data to form first updated training data; generating the preset industrial control data sample set according to the first updated training data and the second original training data; performing clustering processing on the second original training data by using a preset clustering algorithm to generate a second data cluster cluster; determining the distance between the clustering center of each data cluster in the second data cluster cluster and the safety level decision boundary condition; determining a first data boundary condition and a second data boundary condition according to the distance between the clustering center of each data cluster in the second data cluster cluster and the safety level decision boundary condition; According to the first data boundary condition and the second data boundary condition, the second original training data is divided into a first data set, a second data set and a third data set, wherein the first data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition less than the first data boundary condition, the second data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition greater than or equal to the second data boundary condition and less than the first data boundary condition, and the third data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition greater than the second data boundary condition; According to the first data set and a preset random data generation algorithm, a first extended data set is generated, and according to the second data set and the preset random data generation algorithm, a second extended data set is generated, wherein the difference in data quantity between the first extended data set and the first data set is greater than the difference in data quantity between the second extended data set and the second data set; According to the first extended data set, the second extended data set and the third data set, second update training data is generated; According to the first update training data and the second update training data, the preset industrial control data sample set is updated, so that the trained preset decision model avoids the phenomenon of classification result shifting to majority class sample. 2.The industrial internet of things based data security management method according to claim 1, wherein, If the first safety level meets the preset safety level condition, the safety control layer sends the first industrial control data to the first controlled device, including: If the first safety level is higher than the preset safety level, the safety control layer sends the first industrial control data to the first controlled device; Correspondingly, the method further comprises: If the first safety level is lower than the preset safety level, the safety control layer sends the first industrial control data to a monitoring device, and the industrial control data management system further comprises the monitoring device, and the monitoring device is in communication connection with the safety control layer; The monitoring device responds to a safety confirmation instruction, converts the first industrial control data into first safety data, and sends the first safety data to the safety control layer, so that the safety control layer sends the first safety data to the first controlled device, wherein the first safety data is control data generated based on a second control protocol, and the second control protocol is a preset safety control protocol in the safety control layer; or The monitoring device responds to a safety rejection instruction, so that the safety control layer sends a first industrial control rejection instruction to the first controlled device through the first data interface. 3.The industrial internet-based data security management method of claim 1, wherein, The safety control layer determines the first safety level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, including: Using formula 3, and determining the discriminant result f(x) of the first industrial control data according to the first industrial control data x, the formula 3 is: sgn is a decision function, K(x, x i ) is a kernel function of the support vector machine, x i is a feature vector corresponding to an i-th sample in the preset industrial control data sample set, n is a total number of samples in the preset industrial control data sample set, is a Lagrange operator for obtaining an optimal solution, b * is a bias term of the support vector machine, ω is a weight vector, ξ i is a relaxation vector, and b is a preset constant; Determine the first security level according to the discrimination result f(x) and a preset discrimination result mapping table.

4. An industrial data management system, characterized by Comprise: A security control layer, a data interface cluster, and a to-be-controlled device cluster, each data interface in the data interface cluster is connected with the security control layer, the security control layer is in communication connection with each to-be-controlled device in the to-be-controlled device cluster, and the data interface is used for data connection with an external industrial control device; Receive first industrial control data corresponding to a first industrial control device through a first data interface in the data interface cluster, the first industrial control data comprises a first control parameter used for instructing a first to-be-controlled device in the to-be-controlled device cluster to perform a first operation, and the first control parameter is a control parameter generated based on a first control protocol; The security control layer determines a first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, wherein the preset industrial control data management model is an industrial control data classification model obtained by training a preset decision model using a preset industrial control data sample set; If the first security level meets a preset security level condition, the security control layer sends the first industrial control data to the first to-be-controlled device; The preset decision model comprises a support vector machine; before the security control layer determines the first security level of the first industrial control data according to the first industrial control data and a preset industrial control data management model, it further comprises: Generate a security level decision boundary condition through the support vector machine for first original training data and second original training data, the first original training data is a training data set composed of industrial control data with a security level higher than the preset security level, the second original training data is a training data set composed of industrial control data with a security level lower than the preset security level, and the data amount in the first original training data is greater than that in the second original training data; Determine the distance between each training data in the first original training data and the security level decision boundary condition, and delete the training data corresponding to the distance greater than a preset distance threshold from the first original training data to form first updated training data; Generate the preset industrial control data sample set according to the first updated training data and the second original training data; Use a preset clustering algorithm to perform clustering processing on the second original training data to generate a second data cluster cluster; Determine the distance between the clustering center of each data cluster in the second data cluster cluster and the security level decision boundary condition; Determine a first data boundary condition and a second data boundary condition according to the distance between the clustering center of each data cluster in the second data cluster cluster and the security level decision boundary condition; According to the first data boundary condition and the second data boundary condition, the second original training data is divided into a first data set, a second data set and a third data set, wherein the first data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition less than the first data boundary condition, the second data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition greater than or equal to the second data boundary condition and less than the first data boundary condition, and the third data set is a data set composed of training data with a distance between the safety level decision boundary condition and the second data boundary condition greater than the second data boundary condition; According to the first data set and a preset random data generation algorithm, a first extended data set is generated, and according to the second data set and the preset random data generation algorithm, a second extended data set is generated, wherein a data amount difference between the first extended data set and the first data set is greater than a data amount difference between the second extended data set and the second data set; According to the first extended data set, the second extended data set and the third data set, second update training data is generated; According to the first update training data and the second update training data, the preset industrial control data sample set is updated, so that the trained preset decision model avoids the phenomenon of classification result shifting to majority class samples.

5. An electronic device, comprising: Comprise: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the method of any one of claims 1 to 3 by executing the executable instructions.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method of any one of claims 1 to 3.

Images