A secure access method and system based on industrial Internet platform

Abstract

The present invention relates to the field of access control technology, specifically to a secure access method and system based on an industrial Internet platform, comprising the following steps: based on the user access timestamp of the industrial Internet platform, recording the user's access type and device usage frequency, analyzing the user access authorization and authentication data, and generating a user access data set. In the present invention, by adopting timestamp records on the industrial Internet platform, recording the user's access type and device usage frequency, identifying the regularity and changes of access data, further analyzing the user's access authorization mode and frequency, revealing potential risks and security vulnerabilities, and effectively distinguishing and processing authorization anomalies and frequency anomalies by identifying access behaviors that deviate from the normal and generating abnormal access sets, increasing the accuracy of handling security incidents, generating targeted security response measures, strengthening the ability to respond immediately, and continuously optimizing access control parameters to ensure synchronization with increasingly complex security needs.

Description

Technical Field

[0001] The present invention relates to the field of access control technology, and in particular to a secure access method and system based on an industrial Internet platform. Background Art

[0002] The field of access control technology is a key component of network security, focusing on protecting the security of network and system resources and preventing unauthorized access. It covers a series of policies, protocols and tools used to verify the identity of visitors and grant or deny access to specific resources based on predefined security policies. Permissions can be set based on roles, attributes or access control lists (ACLs), while encryption, two-factor authentication and biometrics are used to enhance security. It is not only used to protect the confidentiality and integrity of data, but also provides transparency to access activities through detailed auditing and monitoring. It is the cornerstone of maintaining security protection in network environments.

[0003] Among them, the secure access method involves implementing access control strategies and technologies in the environment of the Industrial Internet to ensure the security of data and systems. By combining industrial control systems with advanced information technology, especially in the fields of manufacturing, energy, and logistics, remote monitoring and management of industrial systems can be achieved to prevent unauthorized access, ensure the security of data transmission, and ensure the operational safety of critical infrastructure. Enterprises can protect critical data and systems while taking advantage of the high efficiency and intelligence of the Industrial Internet to promote production efficiency and technological innovation.

[0004] The access control technology of the existing industrial Internet platform provides multi-level security protection, from roles, attributes to the setting of access control lists (ACLs), combined with encryption, two-factor authentication, biometrics and other technical means. However, in actual operation, it focuses on static permission granting and access management. When faced with the rapidly changing industrial Internet environment, it is not flexible enough and cannot effectively respond to sudden security threats or abnormal behaviors. For example, for periodic access behaviors and device usage patterns, traditional access control methods cannot effectively identify and respond to unconventional but potentially legitimate access attempts, resulting in erroneous interception or delayed processing of legitimate access, affecting user experience and the processing efficiency of the industrial Internet platform. Existing technologies are not deep enough in recording and analyzing user behavior, and lack dynamic behavior analysis capabilities, resulting in insufficient timeliness or accuracy in identifying abnormal behaviors, which in turn affects the security situation awareness and emergency response capabilities of the entire network. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and to propose a secure access method and system based on an industrial Internet platform.

[0006] In order to achieve the above purpose, the present invention adopts the following technical solution, a secure access method based on an industrial Internet platform, comprising the following steps:

[0007] S1: Based on the user access timestamp of the industrial Internet platform, record the user's access type and device usage frequency, analyze the user access authorization and authentication data, and generate a user access data set;

[0008] S2: Based on the user access data set, identify the regularity and changes of the user access data of the industrial Internet platform, analyze the user's access authorization mode and access frequency, and obtain the periodic access mode;

[0009] S3: Based on the periodic access pattern, identify the access behavior of industrial Internet platform users that deviates from the normal state, mark abnormal access events, distinguish between authorization anomalies and access frequency anomalies, and obtain abnormal access sets;

[0010] S4: Based on the abnormal access set, evaluate the deviation from the normal access pattern, analyze the key attributes of the abnormal access pattern, and generate security response measures in combination with device security;

[0011] S5: Based on the security response measures, restrict abnormal user access to the industrial Internet platform, implement access interception and automatically trigger security protocols, send security alerts, record abnormal access applications, and obtain security event logs;

[0012] S6: Based on the security event log, analyze the effect of implementing the security protocol, optimize the access control mechanism by adjusting access control parameters, modifying security policies and updating user access rights, and obtain a policy adjustment plan.

[0013] As a further solution of the present invention, the user access data set includes user identification, access timestamp, access type, device usage frequency and access permission level, the periodic access pattern includes peak and trough periods of user access and access authorization pattern within a target time period, the abnormal access set includes unauthorized access and abnormal access, the security response measures include access interception, access rate limitation and temporary permission revocation, the security event log includes visitor identity, access time, access type and triggered security protocol, and the policy adjustment scheme includes revised security policy, updated user access rights and adjusted access control parameters.

[0014] As a further solution of the present invention, based on the user access timestamp of the industrial Internet platform, the user's access type and device usage frequency are recorded, and the user access authorization and authentication data are analyzed to generate the user access data set in the following steps:

[0015] S101: Based on the user access timestamp of the industrial Internet platform, analyze the user access type in the industrial Internet platform database, record and classify the user's login log and session monitoring record, and obtain an initialization access record set;

[0016] S102: Based on the initial access record set, the device usage frequency of each user session is recorded, including the startup and shutdown time of the device and the duration of the session activity, to obtain an extended access record set;

[0017] S103: Based on the extended access record set, the authorization and authentication status of each user's access is checked, and the user identity and access type are matched with the device usage to obtain a user access data set.

[0018] As a further solution of the present invention, based on the user access data set, the steps of identifying the regularity and changes of the user access data of the industrial Internet platform, analyzing the user's access authorization mode and access frequency, and obtaining the periodic access mode are specifically as follows:

[0019] S201: based on the user access data set, sorting the access records of each user by priority, analyzing the date and access time stamps of the access records, and obtaining time-sorted access records;

[0020] S202: Based on the time-sorted access records, daily and weekly access frequency statistics are performed on the access records to identify the access patterns of each user in differentiated time periods, and according to the statistical results, regular and abnormal access times are identified to obtain access frequency analysis results;

[0021] S203: Based on the access frequency analysis result, identify the peak and valley time periods of the access frequency, analyze and classify the access patterns on working days and non-working days, and obtain a periodic access pattern.

[0022] As a further solution of the present invention, based on the periodic access pattern, the access behavior of industrial Internet platform users that deviates from the normal state is identified, abnormal access events are marked, authorization anomalies and access frequency anomalies are distinguished, and the steps of obtaining abnormal access sets are specifically as follows:

[0023] S301: Based on the periodic access pattern, compare the access time point and access frequency data of each user, identify the access records that deviate from the periodic pattern, and generate a deviation pattern set;

[0024] S302: Based on the deviation pattern set, record the access records of abnormal authorization status and abnormal frequency of the industrial Internet platform users, mark the abnormal authorization events and abnormal frequency events of the users, and obtain an abnormal marking set;

[0025] S303: Based on the abnormal marking set, the priority of the abnormal marking is evaluated, and the access time, access type, authorization anomaly and frequency anomaly of the industrial Internet platform users are analyzed to obtain the abnormal access set.

[0026] As a further solution of the present invention, based on the abnormal access set, evaluating the deviation from the normal access mode, analyzing the key attributes of the abnormal access mode, and combining the device security, the steps of generating security response measures are specifically as follows:

[0027] S401: Based on the abnormal access set, evaluate the time and frequency deviation between each abnormal event and the normal access pattern, identify the deviated access event, and generate a deviation analysis result;

[0028] S402: Based on the deviation analysis results, iteratively analyze the access type and authorization status of abnormal access events, identify access and unauthorized access to industrial Internet platform resources, and generate a key abnormal attribute list;

[0029] S403: Based on the key abnormal attribute list, combined with the security configuration of the real-time device, predict abnormal access events in the future time period according to historical security events, and use access restrictions and identity authentication to obtain security response measures.

[0030] As a further solution of the present invention, based on the security response measures, the steps of restricting abnormal user access to the industrial Internet platform, implementing access interception and automatically triggering the security protocol, sending a security alert, recording abnormal access applications, and obtaining a security event log are specifically as follows:

[0031] S501: Based on the security response measures, activate the access interception mechanism preset by the industrial Internet platform, automatically intercept the identified abnormal user access request, and obtain the access interception record;

[0032] S502: Based on the access interception record, trigger the security protocol, send a real-time security alarm, optimize the abnormal access processing efficiency of the industrial Internet platform by notifying the administrator and the security team, and obtain the alarm sending record;

[0033] S503: Based on the alarm sending record, analyze and record the visitor identity, access time, access destination and triggered security protocol of the abnormal access, and generate a security event log by classifying and arranging the abnormal access events.

[0034] As a further solution of the present invention, based on the security event log, the effect of implementing the security protocol is analyzed, and the access control mechanism is optimized by adjusting the access control parameters, modifying the security policy and updating the user access rights. The steps of obtaining the policy adjustment solution are specifically as follows:

[0035] S601: Based on the security event log, an anomaly detection algorithm is used to analyze each recorded security event, and through the implementation of the security protocol, key abnormal events and abnormal access records that trigger security alarms are processed to obtain a security protocol effect evaluation result;

[0036] The formula of the anomaly detection algorithm is as follows:

[0037]

[0038] Among them, Z is the anomaly score of the calculated security event, X is the parameter value of the monitored security event, μ is the average value of the normal event parameter, σ is the standard deviation of the normal event parameter, C is the event complexity, T is the event trigger time, S is the credibility of the event source, and k 1 , k 2 and k 3 is the weight coefficient;

[0039] S602: Based on the security protocol effect evaluation result, adjust the access rights of the industrial Internet platform users, respond to and process security alarms in real time through intrusion detection and access denial thresholds, and obtain an access control parameter adjustment plan;

[0040] S603: Based on the access control parameter adjustment plan, update the access rights of the users of the industrial Internet platform, including the users who trigger the alarm, match the real-time changing user behavior and security requirements, and obtain a policy adjustment plan.

[0041] A secure access system based on an industrial Internet platform, the secure access system based on an industrial Internet platform is used to execute the secure access method based on the industrial Internet platform, the system comprising:

[0042] The access authorization audit module verifies the authorization status and identity authentication information of each access based on the user access timestamp of the industrial Internet platform, analyzes the user's access behavior and pattern, identifies regular and abnormal access behaviors, and generates access behavior analysis results;

[0043] The abnormal behavior identification module identifies access behaviors that deviate from the normal based on the access behavior analysis results, including access to sensitive resources during non-working hours, and generates an abnormal access set;

[0044] The security incident response module designs security measures for abnormal access based on the abnormal access records, blocks and restricts potential unsafe access through access restrictions and automatic security alarms, and generates response measures records;

[0045] The security alarm triggering module intercepts the identified abnormal user access request based on the response measure record, automatically triggers the security protocol, uses the security alarm to control the abnormal user's access request, and generates a security event log;

[0046] The policy evaluation module adjusts the access control policy and user authority settings based on the security event log and the access behaviors of multiple users, matches the changed access behaviors and security threats, and obtains a policy adjustment plan.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, by adopting the linkage processing of timestamp recording, behavior analysis and response strategy on the industrial Internet platform, comprehensive control and security supervision of user access is achieved. By recording the user's access type and device usage frequency, the regularity and changes of access data are identified, and the user's access authorization mode and frequency are further analyzed, which helps to reveal potential risks and security vulnerabilities. By identifying access behaviors that deviate from the normal and generating abnormal access sets, authorization anomalies and frequency anomalies can be effectively distinguished and processed, and the accuracy of handling security incidents can be increased. By integrating device security data and abnormal behavior analysis results, targeted security response measures such as access interception and security alarms are generated, which not only enhances the immediate response capability, but also optimizes the long-term security policy adjustment. By analyzing and adjusting the effectiveness of security responses, access control parameters are continuously optimized to ensure synchronization with increasingly complex security needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 It is a schematic diagram of the workflow of the present invention;

[0050] Figure 2 This is a detailed flow chart of S1 of the present invention;

[0051] Figure 3 This is a detailed flow chart of S2 of the present invention;

[0052] Figure 4 This is a detailed flow chart of S3 of the present invention;

[0053] Figure 5 This is a detailed flow chart of S4 of the present invention;

[0054] Figure 6 This is a detailed flow chart of S5 of the present invention;

[0055] Figure 7 This is a detailed flow chart of S6 of the present invention;

[0056] Figure 8 It is a system flow chart of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0058] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0059] Embodiment 1

[0060] See also Figure 1 The present invention provides a technical solution, a secure access method based on an industrial Internet platform, comprising the following steps:

[0061] S1: Based on the user access timestamp of the industrial Internet platform, classify the user's login log and session monitoring records, record the user's access type and device usage frequency, analyze the user access authorization and authentication data, and generate the user access data set;

[0062] S2: Based on the user access data set, identify the patterns and changes of user access data on the industrial Internet platform, prioritize according to the differentiated access records of each user, analyze the user's access authorization mode and access frequency, and obtain the periodic access pattern;

[0063] S3: Based on the periodic access pattern, identify the access behavior of industrial Internet platform users that deviates from the normal state, mark abnormal access events, distinguish between authorization anomalies and access frequency anomalies, identify abnormal user behavior, and obtain abnormal access sets;

[0064] S4: Based on the abnormal access set, evaluate the deviation from the normal access pattern, predict the access behavior in the future time period based on the historical access data, analyze the key attributes of the abnormal access pattern, and generate security response measures in combination with device security and user access permission control;

[0065] S5: Based on security response measures, restrict abnormal user access to the industrial Internet platform, implement access interception and automatically trigger security protocols, send security alerts, record abnormal access applications, and obtain security event logs;

[0066] S6: Based on the security event log, analyze the effect of implementing the security protocol, adjust the access control parameters, modify the security policy and update the user access rights, process the security alerts in real time, optimize the access control mechanism, and obtain the policy adjustment plan.

[0067] The user access data set includes user identification, access timestamp, access type, device usage frequency and access permission level. The periodic access pattern includes the peak and trough periods of user access and the access authorization pattern within the target time period. The abnormal access set includes unauthorized access and abnormal access. Security response measures include access interception, access rate limitation and temporary permission revocation. The security event log includes the visitor identity, access time, access type and triggered security protocol. The policy adjustment plan includes revised security policy, updated user access rights and adjusted access control parameters.

[0068] See also Figure 2 ,Based on the user access timestamp of the industrial Internet platform, the user's access type and device usage frequency are recorded, and the user access authorization and authentication data are analyzed. The specific steps to generate the user access data set are as follows:

[0069] S101: Based on the user access timestamp of the industrial Internet platform, analyze the user access type in the industrial Internet platform database, record and classify the user's login log and session monitoring record, and obtain the execution process of the initialization access record set as follows;

[0070] Sub-step S101 collects user access logs including timestamps, user IDs, and access types based on the user access timestamps of the industrial Internet platform, collected from various access points of the industrial Internet, and standardized through the log collection system. Perform preliminary sorting and analysis of the logs, remove invalid or damaged data items, such as records with incomplete timestamps or unclear user IDs, group access logs according to user IDs, and sort the access records of each user. For each type of access, calculate the total number and proportion of each type of access to identify common and abnormal access patterns. Combined with the user's behavior pattern, use the time series analysis method to calculate the periodicity and trend of user access, provide a basis for subsequent monitoring, and store the processed data in a dedicated database to form an initial access record set.

[0071] S102: Based on the initial access record set, the device usage frequency of each user session is recorded, including the device startup and shutdown time and the duration of the session activity, and the execution process of obtaining the extended access record set is as follows;

[0072] Based on the initialization access record set, sub-step S102 extracts detailed records of each user session, including the timestamps of the start and end of the session, as well as the corresponding user ID and device ID, calculates the time difference of the session records, obtains the duration of each session, and marks the startup and shutdown time of the device in the session. For each device, the frequency of use in different sessions is counted, including the number of startups and total running time, as well as the average running time after each startup. The statistical information helps to analyze the efficiency and maintenance needs of the device. Through statistical analysis of the session activity duration, the peak and trough periods of device use are identified, providing data support for resource allocation and optimization. Combine statistical data with user behavior patterns, analyze user work habits and device usage preferences, integrate the analysis results, and obtain an extended access record set.

[0073] S103: Based on the extended access record set, the authorization and authentication status of each user's access is checked, and the user identity and access type are matched with the device usage to obtain the user access data set. The execution process is as follows;

[0074] Based on the extended access record set, sub-step S103 conducts a detailed review of each user's access record, verifies the user's identity and authentication status, and uses the key management system to verify the user's login credentials to ensure that all access is initiated by legitimate users. For each access type, check whether the user's authorization level matches the access request to prevent unauthorized access. Audit the device usage records to ensure that the user's access type matches the device he uses, for example, advanced operations require high-authority user login. Introduce an access behavior analysis model to evaluate user access behavior, discover any abnormal or potential unauthorized access behavior through pattern recognition technology, improve the accuracy and response speed of security monitoring, and integrate the access records that have been authenticated and authorized to form a user access data set.

[0075] See also Figure 3 ,Based on the user access data set, we identify the rules and changes of the user access data of the industrial Internet platform, analyze the user's access authorization mode and access frequency, and obtain the steps of periodic access mode as follows:

[0076] S201: Based on the user access data set, sort the access records of each user by priority, analyze the date and access time stamps of the access records, and obtain the execution flow of the time-sorted access records as follows;

[0077] Sub-step S201 analyzes the access records of each user based on the user access data set, uses timestamp parsing, sorts the records by timestamp, ensures that they are arranged in the actual order of access, and sets different weights according to the user's activity priority, with user activities with high weights being prioritized. For example, if a user accesses during a critical period (such as during a promotion), the activity record should be given a higher weight to form a time-ordered access record. The formula is: V = [v1, v2, ..., vn], where V is the record data arranged in chronological order, n is the number of access records, and t is assumed. i is the timestamp of the i-th access record, and the merge sort method is used according to the timestamp t i Sort the access records.

[0078] S202: sort the access records based on time, perform daily and weekly access frequency statistics on the access records, identify the access patterns of each user in different time periods, identify regular and abnormal access times based on the statistical results, and obtain the access frequency analysis results. The execution process is as follows;

[0079] Sub-step S202 sorts the access records based on time, counts the daily and weekly access frequencies of the records, and sets a record array R d and R w , which are used to store the daily and weekly access frequency statistics respectively. For each record vi in ​​V, extract the date and week information di and wi, and update R respectively. d [d i ] and R w [w i ] count. After the statistics are completed, the average and standard deviation of the daily access frequency are compared to identify the regular and abnormal access times and generate the access frequency analysis results. The formula is: Among them, R d [d] is the statistics of daily access frequency, is the average daily access frequency, σ d is the standard deviation.

[0080] S203: Based on the access frequency analysis results, identify the peak and valley time periods of the access frequency, analyze and classify the access patterns of working days and non-working days, and obtain the execution process of the periodic access pattern as follows;

[0081] Substep S203 identifies the peak and valley time periods of access frequency based on the access frequency analysis results. The access data of working days and non-working days are processed separately to establish two independent frequency arrays F work and F rest , frequency statistics are performed for the access records on working days and non-working days. Simple moving average method is used to smooth the frequency data. By comparing S work and Srest The peak and valley of the traffic flow are analyzed, and a judgment standard is proposed to distinguish regular and irregular cycles. The judgment standard represents the peak time period of the working day and obtains the periodic access pattern. The formula is: Among them, S t is the smoothed access frequency at time t, k is the time window size, F i is the original access frequency on the i-th day.

[0082] See also Figure 4 ,Based on the periodic access pattern, we identify the access behavior of industrial Internet platform users that deviates from the normal state, mark abnormal access events, and distinguish between authorization anomalies and access frequency anomalies. The specific steps for obtaining the abnormal access set are:

[0083] S301: Based on the periodic access pattern, the access time point and access frequency data of each user are compared, and the access records that deviate from the periodic pattern are identified. The execution process of generating the deviation pattern set is as follows;

[0084] In step S301, the access time and frequency data of each user are analyzed based on the periodic access pattern. The established periodic access pattern data, such as the access peaks on weekdays and non-workdays, are used. work and S rest , as a benchmark. For each access record of each user, the access time point and frequency are extracted and compared with the benchmark pattern of the corresponding date. If the time point or frequency of a certain access record differs from the periodic pattern by more than the set threshold, the access is considered abnormal. Through detailed analysis of the periodic pattern, atypical access behaviors are further identified, such as high-frequency access during non-peak hours, to generate a deviation pattern set. The formula is: |fS(t)|>θ, where t is the access time point, f is the access frequency, and θ is the set threshold.

[0085] S302: Based on the deviation pattern set, record the access records of abnormal authorization status and abnormal frequency of the industrial Internet platform users, mark the abnormal authorization events and abnormal frequency events of the users, and obtain the execution process of the abnormal marking set as follows;

[0086] Based on the deviation pattern set, sub-step S302 further explores and records the abnormal authorization status and access frequency of industrial Internet platform users, and sets two subsets E auth and E freq To classify abnormal events, for each record, check the user's authorization status, such as whether the user has sufficient permissions at the time of access. If the access record shows that the user accessed at an unauthorized time point or under unauthorized conditions, it will be classified as an authorization abnormal event and recorded in E authIf the user's access frequency deviates significantly from the normal pattern, such as multiple consecutive accesses without following the normal access frequency, it will be recorded in the frequency anomaly subset E. freq , generating anomaly tag sets.

[0087] S303: Based on the abnormal tag set, the priority of the abnormal tag is evaluated, and the access time, access type, authorization anomaly and frequency anomaly of the industrial Internet platform user are analyzed to obtain the execution process of the abnormal access set as follows;

[0088] Sub-step S303 evaluates the priority of abnormal access records based on the abnormal tag set, and analyzes various data involved, such as user access time, access type, authorization exceptions, and frequency exceptions. Set a priority for each type of exception, and the priority is based on the severity of the exception and the impact it causes. For example, authorization exceptions involve operations with higher security risks and have a higher priority. Combined with the priority and frequency of each type of exception, analyze the main security risks and irregular operations on the Industrial Internet platform, and construct an abnormal access set.

[0089] See also Figure 5 ,Based on the abnormal access set, we evaluate the deviation from the normal access pattern, analyze the key attributes of the abnormal access pattern, and combine the device security to generate the security response measures.,Specific steps are:

[0090] S401: Based on the abnormal access set, evaluate the time and frequency deviation between each abnormal event and the normal access pattern, identify the access event with deviation, and generate the execution flow of the deviation analysis result as follows;

[0091] Substep S401 evaluates the time and frequency deviation from the normal access pattern based on the abnormal access set. For each abnormal event, the difference between the access time point and the standard access time of the corresponding time point in the periodic pattern, as well as the deviation of the access frequency from the normal frequency, is calculated. A threshold is set to determine whether there is a significant deviation from the normal pattern. Events with significant deviations are identified as key anomalies, and deviation analysis results are generated. The formula is: Δt = |tT norm | and Δf = |fF norm |, where Δt and Δf are time deviation and frequency deviation, t is the access time point, T norm is the standard access time, f is the access frequency, F norm is the normal frequency.

[0092] S402: Based on the deviation analysis results, the access type and authorization status of the abnormal access event are iteratively analyzed to identify the access and unauthorized access to the resources of the industrial Internet platform, and the execution process of generating a list of key abnormal attributes is as follows;

[0093] Based on the deviation analysis results, sub-step S402 conducts further iterative analysis on each identified abnormal event, focusing on the access type and authorization status. For each abnormal event, the access type is checked in detail, such as data reading, data modification, or system configuration change, and the authorization status of the user at the time of the access. This includes determining whether the access exceeds the user's normal authority and whether there are unauthorized access attempts. This is performed through data association and pattern matching technology to ensure that abnormal access and potential security vulnerabilities related to resources can be accurately identified, and a list of key abnormal attributes is generated.

[0094] S403: Based on the key abnormal attribute list, combined with the security configuration of the real-time device, the abnormal access events in the future time period are predicted according to the historical security events, and the execution process of the security response measures is obtained by using access restrictions and identity authentication as follows;

[0095] Substep S403 predicts future abnormal access events based on the key abnormal attribute list and the security configuration of the real-time device. Based on the data of historical security events, the statistical model is applied to predict potential security risks and abnormal access patterns. The prediction model considers various factors, such as the changing trend of access frequency, the evolution of access types, and the historical response to security vulnerabilities. The prediction results are used to formulate targeted security measures, such as enhanced access restrictions and multi-factor authentication. Adjustments are made based on the prediction results to ensure that future abnormal access can be effectively prevented, potential security threats can be reduced, and security response measures can be generated. The formula is: P e =γ·(αΔt+βΔf+δC), where, P e is the predicted probability of abnormal events, Δt and Δf are the deviations in time and frequency, C is the compliance of the authorization status, and α, β, and δ are the coefficients for adjusting the impact of each factor.

[0096] See also Figure 6 , based on security response measures, restrict abnormal user access to the industrial Internet platform, implement access interception and automatically trigger security protocols, send security alerts, record abnormal access applications, and obtain security event logs. The specific steps are:

[0097] S501: Based on the security response measures, the access interception mechanism preset by the industrial Internet platform is activated to automatically intercept the identified abnormal user access request, and the execution process of obtaining the access interception record is as follows;

[0098] Sub-step S501 activates the access interception mechanism preset by the industrial Internet platform based on security response measures, including rules set based on abnormal access patterns determined by previous analysis. The rules are defined by analyzing data in the abnormal access set, such as time and frequency deviations, and abnormal authorization status. When the system detects access requests that meet the rules, it automatically performs interception operations. Interception actions include interrupting requests, restricting account activities, and redirecting to the security audit page. Detailed information for each interception, including user ID, resources attempted to be accessed, timestamp, and interception reason, is obtained to obtain an access interception record. The formula is: I d =ω 1 ·Δf+ω 2 ·Δt+ω 3 C, where I d is the interception decision value calculated by the decision model, Δf and Δt are the frequency and time deviations respectively, C is the compliance of the authorization state, ω 1 ,ω 2 and ω 3 is the weight coefficient.

[0099] S502: Based on the access interception record, the security protocol is triggered, and a real-time security alarm is sent. By notifying the administrator and the security team, the efficiency of abnormal access processing on the industrial Internet platform is optimized. The execution process of obtaining the alarm sending record is as follows;

[0100] Based on the access interception record, sub-step S502 automatically triggers the security protocol of the industrial Internet platform, which includes sending real-time security alerts. The alerts are notified to administrators and security teams in real time via email, text messages, or platform notifications so that they can respond quickly and take necessary measures. This not only improves the response speed to abnormal access, but also optimizes the abnormal access processing efficiency of the entire platform, including the detailed content of the alert, the recipient, the sending time, and the priority of the alert, and generates an alert sending record.

[0101] S503: Based on the alarm sending record, analyze and record the visitor identity, access time, access destination and triggered security protocol of the abnormal access, and generate the security event log by classifying and arranging the abnormal access events. The execution process is as follows;

[0102] Based on the alarm sending record, sub-step S503 further analyzes and records the detailed information of each abnormal access event involved, including the identity of the visitor, the access time, the access destination and the triggered security protocol. The data will be used to classify and organize abnormal access events in order to better understand the nature and frequency patterns of security vulnerabilities. For example, by comparing data from different time periods and access destinations, potential security weaknesses or frequently attacked resources can be identified. All information will be summarized to generate a security event log.

[0103] See also Figure 7 ,Based on the security event log, analyze the effect of implementing the security protocol, optimize the access control mechanism by adjusting the access control parameters, modifying the security policy and updating the user access rights, and obtain the steps of the policy adjustment plan as follows:

[0104] S601: Based on the security event log, an anomaly detection algorithm is used to analyze each recorded security event, and through the implementation of the security protocol, key abnormal events and abnormal access records that trigger security alarms are processed to obtain the security protocol effect evaluation results. The execution process is as follows;

[0105] Sub-step S601 uses anomaly detection technology to conduct a detailed analysis of each recorded security event based on the security event log, and extracts key data elements in the security event log, such as event time, type, frequency deviation, time deviation, and authorization status. By applying statistical anomaly detection methods to the data, key abnormal events that deviate from the normal pattern are identified. Each identified event is classified and sorted according to severity and potential impact. According to the established security protocol, necessary security measures are implemented for key abnormal events, such as access restrictions, account suspension, or additional identity verification requirements, to obtain the security protocol effectiveness evaluation results.

[0106] The formula for the anomaly detection algorithm is as follows:

[0107]

[0108] Among them, Z is the anomaly score of the calculated security event, X is the parameter value of the monitored security event, μ is the average value of the normal event parameter, σ is the standard deviation of the normal event parameter, C is the event complexity, T is the event trigger time, S is the credibility of the event source, and k 1 , k 2 and k 3 is the weight coefficient;

[0109] The execution flow is as follows:

[0110] Analyze the security event log to obtain X, calculate the historical mean μ and standard deviation σ of the event type, determine the complexity C of the event, which is the number of components involved in the event or the number of users involved, calculate the trigger time T of the event, which is the time difference from the occurrence of the event to the time it is recorded, measure the credibility of the event source S, which is defined as the similarity score between the event source and the known trusted source, and adjust the weight coefficient k 1 , k 2 and k 3 ,The predictive ability of the optimization model is determined by the ,values ​​of the coefficients through regression analysis of historical data, and the ,improved anomaly score for each event is calculated using the ,improved formula.

[0111] S602: Based on the security protocol effect evaluation results, adjust the access rights of the industrial Internet platform users, respond to and process security alerts in real time through intrusion detection and access denial thresholds, and obtain the execution process of the access control parameter adjustment plan as follows;

[0112] Sub-step S602 adjusts the access rights of users on the industrial Internet platform based on the results of the security protocol effectiveness evaluation. By analyzing the triggering patterns of abnormal access records and security alarms, determine which users' behaviors indicate potential security risks. Combined with the intrusion detection system and the set access denial threshold, adjust the user's access rights in real time. This includes strengthening access restrictions on specific resources or implementing stricter monitoring measures for users who frequently trigger alarms. The adjustment is based not only on the user's past behavior, but also on the changing trend of behavior, ensuring the immediacy and appropriateness of the response measures, and obtaining the access control parameter adjustment plan.

[0113] S603: Based on the access control parameter adjustment plan, update the access rights of the industrial Internet platform users, including the users who triggered the alarm, match the real-time changing user behavior and security requirements, and obtain the execution process of the policy adjustment plan as follows;

[0114] Sub-step S603 updates the access rights of users on the industrial Internet platform based on the access control parameter adjustment plan, and makes necessary adjustments to the policy in consideration of the real-time changes in user behavior and the dynamic nature of security requirements. This includes implementing stricter or differentiated access control for users who frequently trigger alarms, and gradually restoring normal permissions for users who behave normally. Based on the latest security analysis results, regularly update security policies to ensure consistency with current security threats and business needs, and form a policy adjustment plan.

[0115] See also Figure 8 , a secure access system based on an industrial Internet platform, the secure access system based on an industrial Internet platform is used to execute the above-mentioned secure access method based on an industrial Internet platform, the system includes:

[0116] The access authorization audit module verifies the authorization status and identity authentication information of each access based on the user access timestamp of the industrial Internet platform, analyzes the user's access behavior and pattern, identifies regular and abnormal access behaviors, and generates access behavior analysis results;

[0117] The abnormal behavior identification module identifies access behaviors that deviate from the norm based on the access behavior analysis results, including access to sensitive resources during non-working hours, and generates abnormal access sets;

[0118] The security incident response module designs security measures for abnormal access based on abnormal access records, blocks and restricts potential unsafe access through access restrictions and automatic security alerts, and generates response measures records;

[0119] The security alarm trigger module intercepts and identifies abnormal user access requests based on the response measure records, automatically triggers the security protocol, uses security alarms to control abnormal user access requests, and generates security event logs;

[0120] The policy assessment module adjusts access control policies and user permission settings based on security event logs and the access behaviors of multiple users, matches changing access behaviors and security threats, and obtains policy adjustment plans.

[0121] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A secure access method based on an industrial Internet platform, characterized in that: The following steps are involved: Based on the user access timestamp of the Industrial Internet platform, record the user's access type and device usage frequency, analyze the user access authorization and authentication data, and generate a user access data set; Based on the user access data set, identify the regularity and changes of the user access data of the industrial Internet platform, analyze the user's access authorization mode and access frequency, and obtain the periodic access mode; Based on the periodic access pattern, identify the access behavior of industrial Internet platform users that deviates from the normal state, mark abnormal access events, distinguish between authorization anomalies and access frequency anomalies, and obtain abnormal access sets; Based on the abnormal access set, evaluate the deviation from the normal access pattern, analyze the key attributes of the abnormal access pattern, and generate security response measures in combination with device security; Based on the security response measures, restrict abnormal user access to the industrial Internet platform, implement access interception and automatically trigger security protocols, send security alerts, record abnormal access applications, and obtain security event logs; Based on the security event log, analyze the effect of implementing the security protocol, optimize the access control mechanism by adjusting access control parameters, modifying security policies and updating user access rights, and obtain a policy adjustment plan; Based on the user access data set, the steps of identifying the regularity and changes of the user access data of the industrial Internet platform, analyzing the user's access authorization mode and access frequency, and obtaining the periodic access mode are as follows: Based on the user access data set, sorting the access records of each user by priority, analyzing the date and access time stamps of the access records, and obtaining time-sorted access records; Based on the time-sorted access records, daily and weekly access frequency statistics are performed on the access records to identify the access patterns of each user in differentiated time periods, and according to the statistical results, regular and abnormal access times are identified to obtain access frequency analysis results; Based on the access frequency analysis results, the peak and trough time periods of the access frequency are identified, and the access patterns of working days and non-working days are analyzed and classified to obtain the periodic access pattern.

2. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: The user access data set includes user identification, access timestamp, access type, device usage frequency and access permission level; the periodic access pattern includes peak and trough periods of user access and access authorization patterns within a target time period; the abnormal access set includes unauthorized access and abnormal access; the security response measures include access interception, access rate limitation and temporary permission revocation; the security event log includes visitor identity, access time, access type and triggered security protocol; the policy adjustment plan includes revised security policies, updated user access permissions and adjusted access control parameters.

3. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: Based on the user access timestamp of the industrial Internet platform, the user's access type and device usage frequency are recorded, and the user access authorization and authentication data are analyzed. The specific steps to generate the user access data set are as follows: Based on the user access timestamp of the industrial Internet platform, analyze the user access type in the industrial Internet platform database, record and classify the user's login log and session monitoring record, and obtain the initial access record set; Based on the initial access record set, the device usage frequency of each user session is recorded, including the startup and shutdown time of the device and the duration of the session activity, to obtain an extended access record set; Based on the extended access record set, the authorization and authentication status of each user's access is checked, and the user identity and access type are matched with the device usage to obtain a user access data set.

4. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: Based on the periodic access pattern, the access behavior of industrial Internet platform users that deviates from the normal state is identified, abnormal access events are marked, and authorization anomalies and access frequency anomalies are distinguished. The specific steps for obtaining the abnormal access set are as follows: Based on the periodic access pattern, compare the access time point and access frequency data of each user, identify the access records that deviate from the periodic pattern, and generate a deviation pattern set; Based on the deviation pattern set, record the access records of abnormal authorization status and abnormal frequency of the industrial Internet platform users, mark the abnormal authorization events and abnormal frequency events of the users, and obtain the abnormal marking set; Based on the abnormal marking set, the priority of the abnormal marking is evaluated, and the access time, access type, authorization anomaly and frequency anomaly of the industrial Internet platform users are analyzed to obtain the abnormal access set.

5. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: Based on the abnormal access set, the deviation from the normal access pattern is evaluated, the key attributes of the abnormal access pattern are analyzed, and the steps of generating security response measures in combination with device security are as follows: Based on the abnormal access set, evaluating the time and frequency deviation between each abnormal event and the normal access pattern, identifying the deviated access events, and generating deviation analysis results; Based on the deviation analysis results, iteratively analyze the access type and authorization status of abnormal access events, identify access and unauthorized access to industrial Internet platform resources, and generate a list of key abnormal attributes; Based on the key abnormal attribute list, combined with the security configuration of the real-time device, abnormal access events in the future time period are predicted according to historical security events, and security response measures are obtained by using access restrictions and identity authentication.

6. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: Based on the security response measures, the steps of restricting abnormal user access to the industrial Internet platform, implementing access interception and automatically triggering security protocols, sending security alerts, recording abnormal access applications, and obtaining security event logs are as follows: Based on the security response measures, the access interception mechanism preset by the industrial Internet platform is activated to automatically intercept the identified abnormal user access requests and obtain the access interception record; Based on the access interception record, the security protocol is triggered, and a real-time security alert is sent. By notifying the administrator and the security team, the efficiency of abnormal access processing on the industrial Internet platform is optimized, and the alert sending record is obtained; Based on the alarm sending record, the identity of the visitor of the abnormal access, the access time, the access destination and the triggered security protocol are analyzed and recorded, and a security event log is generated by categorizing and organizing the events of the abnormal access.

7. The secure access method based on the industrial Internet platform according to claim 1 is characterized in that: Based on the security event log, the effect of implementing the security protocol is analyzed, and the steps of optimizing the access control mechanism by adjusting the access control parameters, modifying the security policy and updating the user access rights are specifically as follows: Based on the security event log, an anomaly detection algorithm is used to analyze each recorded security event, and through the implementation of the security protocol, key abnormal events and abnormal access records that trigger security alarms are processed to obtain security protocol effectiveness evaluation results; The formula of the anomaly detection algorithm is as follows: Among them, Z is the anomaly score of the calculated security event, X is the parameter value of the monitored security event, μ is the average value of the normal event parameter, σ is the standard deviation of the normal event parameter, C is the event complexity, T is the event trigger time, S is the credibility of the event source, k1, k2 and k3 are weight coefficients; Based on the security protocol effect evaluation results, the access rights of the industrial Internet platform users are adjusted, and the security alarms are responded to and processed in real time through intrusion detection and access denial thresholds to obtain access control parameter adjustment plans; Based on the access control parameter adjustment plan, the access rights of users of the industrial Internet platform are updated, including users who trigger alarms, to match real-time changing user behaviors and security requirements, and obtain a policy adjustment plan.

8. A secure access system based on an industrial Internet platform, characterized in that: According to the secure access method based on the industrial Internet platform according to claim 7, the system comprises: The access authorization audit module verifies the authorization status and identity authentication information of each access based on the user access timestamp of the industrial Internet platform, analyzes the user's access behavior and pattern, identifies regular and abnormal access behaviors, and generates access behavior analysis results; The abnormal behavior identification module identifies access behaviors that deviate from the normal based on the access behavior analysis results, including access to sensitive resources during non-working hours, and generates an abnormal access set; The security incident response module designs security measures for abnormal access based on the abnormal access records, blocks and restricts potential unsafe access through access restrictions and automatic security alarms, and generates response measures records; The security alarm triggering module intercepts the identified abnormal user access request based on the response measure record, automatically triggers the security protocol, uses the security alarm to control the abnormal user's access request, and generates a security event log; The policy evaluation module adjusts the access control policy and user authority settings based on the security event log and the access behaviors of multiple users, matches the changed access behaviors and security threats, and obtains a policy adjustment plan.

Images