An information security monitoring method and system based on industrial Internet

Abstract

The present invention discloses an information security monitoring system based on the industrial Internet, the system includes: a network protection strategy formulation system, an information collection system (network information collector), an information transmission and protection system (SDN switch), and an Internet big data platform (information classification system, information storage system, information analysis system, and abnormal supervision system). The present invention analyzes a large amount of network traffic data, log information, and user behavior data through big data and machine learning algorithms, extracts the behavioral characteristics and strategy patterns of attackers and defenders, and then uses game theory models to model and analyze these data, predict the possible actions of attackers and the best response strategies of defenders, and then trains intelligent agents through reinforcement learning to dynamically adjust protection strategies based on real-time network traffic, system status, security events, and other information of the industrial Internet.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial Internet information security monitoring, and specifically to an industrial Internet-based information security monitoring method and system. Background Art

[0002] The so-called "Industrial Internet" is to use new network technology and industrial systems to establish and integrate to form a new industrial ecological structure. As a product of the deep integration of new-generation information technology and industrial economy, the Industrial Internet has brought unprecedented intelligent and automated changes to industrial production. With the development of computer and network technology, especially the deep integration of informatization and industrialization and the rapid development of the Internet of Things, industrial control system products are increasingly using general protocols, general hardware and general software, and connecting to public networks such as the Internet in various ways. Threats such as viruses and Trojans are spreading to industrial control systems, and the information security issues of industrial control systems are becoming increasingly prominent. In order to ensure the information security and stable operation of the Industrial Internet, a complete set of information security monitoring methods and systems must be built to ensure the security of data, equipment and communications in the Industrial Internet environment. However, the existing information security monitoring methods and systems of the Industrial Internet are unable to dynamically adjust the protection strategy according to the real-time monitoring results, which reduces the protection effect and affects the safe and stable operation of the Industrial Internet. Summary of the invention

[0003] The purpose of the present invention is to provide an information security monitoring method and system based on industrial Internet to solve the problems raised in the above background technology.

[0004] To achieve the above purpose, the present invention provides the following technical solutions: an information security monitoring system based on the industrial Internet, the system includes: a network protection strategy formulation system, an information collection system (network information collector), an information transmission and protection system (SDN switch), an Internet big data platform (information classification system, information storage system, information analysis system, abnormal supervision system), wherein:

[0005] S1, information collection and preprocessing system, using network information collector to collect data from various nodes and devices of the industrial Internet;

[0006] S2, information transmission and protection system, using SDN switches to communicate and manage through network controllers, deploying network security devices such as firewalls and intrusion detection systems on SDN switches, and taking security measures such as encrypted communication and access control;

[0007] S3, network protection strategy formulation system, which uses reinforcement learning algorithm (Q-learning) to interact with the environment to learn the optimal decision-making strategy and automatically execute a series of predefined response measures, including isolating affected systems, blocking malicious traffic, and restoring data;

[0008] S4. Internet big data platform: The Internet big data platform is a comprehensive information technology platform with big data as the core, integrating information classification system, information storage system, information analysis system, abnormal supervision system and other functions.

[0009] The information analysis system uses big data analysis and machine learning algorithms to process and analyze the collected information in real time, learn and analyze data such as network traffic, user behavior, and system logs, extract key features from them, classify and identify information based on the extracted information features, and discover hidden attack behaviors;

[0010] Information classification system, which classifies data and stores it in the data storage system by training the support vector machine (SVM) model;

[0011] Information storage system, using distributed file system such as Hadoop Distributed File System (HDFS), to store data in multiple nodes;

[0012] The abnormal supervision system uses game theory algorithms to deeply analyze the strategic interactions and dynamic changes between attackers and defenders. The game decision algorithm includes behavior difference and behavior closeness:

[0013] The behavior difference is expressed using the Minkowski distance, and the specific formula is as follows:

[0014] The formula for Minkowski Distance is:

[0015]

[0016] Among them, X and Y are two points, each point has n-dimensional features, x i ,y i are the coordinates of X and Y in the i-th dimension respectively. The parameter p is a variable parameter that determines the specific form of the Minkowski distance;

[0017] When p takes different values, the Minkowski distance can represent different types of distances:

[0018] When p = 1, the Minkowski distance becomes the Manhattan distance, which represents the sum of the absolute wheelbases of two points in the standard coordinate system.

[0019] When p = 2, the Minkowski distance becomes the Euclidean distance, which is the straight-line distance between two points.

[0020] When p tends to infinity, the Minkowski distance becomes the Chebyshev distance.

[0021] The calculation of closeness can be based on the concepts of fuzzy inner product and fuzzy outer product. Fuzzy inner product and outer product are important tools for describing the relationship between fuzzy vectors. Suppose there are two fuzzy vectors a and b. The fuzzy inner product a°b is usually defined as the maximum value among the minimum values ​​corresponding to each component, that is, a°b=∨{(ak∧bk)|1≤k≤n}; while the fuzzy outer product a⊙b is defined as the minimum value among the maximum values ​​corresponding to each component, that is, a⊙b=∧{(ak∨bk)|1≤k≤n}.

[0022] When using fuzzy inner and outer products to represent behavioral closeness, a specific formula or model can be constructed, using the fuzzy inner and outer products as components or weight factors of closeness, and the behavioral closeness is obtained by comprehensively considering the inner and outer product characteristics of the fuzzy vector.

[0023] An information security monitoring method based on industrial Internet, the method comprising:

[0024] T1. Collect data from various nodes and devices of the industrial Internet through network information collectors, collect data such as network traffic, device status and user behavior, use data cleaning tools (Python, VBA, PyCharm) to clean and preprocess the information, remove redundant, erroneous or irrelevant data, and transmit the preprocessed information to the Internet big data platform through SDN switches. SDN switches use centralized controllers to monitor and manage network traffic;

[0025] T2. Information analysis system deploys big data analysis and machine learning algorithms on the Internet big data platform. Big data analysis uses stream processing technology Apache Storm to efficiently process collected data. Stream processing technology can process continuously arriving data streams and can analyze and process data as it arrives, meeting real-time requirements.

[0026] Machine learning uses a trained convolutional neural network (CNN) model to learn and analyze data such as network traffic, user behavior, and system logs, extract key features, classify and identify data based on the extracted data features, and discover hidden attack behaviors. The machine learning model uses regression algorithms to predict future trends and results;

[0027] Stream processing technology combined with the convolutional neural network (CNN) model can achieve real-time monitoring and early warning of information, and timely discover abnormal patterns in data. The machine learning model uses regression algorithms to predict potential risks and uses intelligent agents to dynamically adjust protection strategies based on real-time network traffic, system status, security events and other information;

[0028] T3. The network protection strategy formulation system applies reinforcement learning to network security. The reinforcement learning algorithm uses the Q-learning algorithm to train the intelligent agent to detect and identify malicious traffic patterns. The Q-learning algorithm formula is:

[0029] Q(s,a)=(1-α)Q(s,a)+α(r+γmax(Q(s',a')))

[0030] Where Q(s,a) represents the value function of executing action a in state s, α is the learning rate (0<α≤1), r is the immediate reward after executing action a, γ is the discount factor (0<γ≤1), s' is the next state transferred to after executing action a, and a' is the optimal action selected in state s';

[0031] The optimal strategy is learned by iteratively updating the Q-value table. During the learning process, the agent selects actions based on the current Q-value table, usually the action with the highest Q-value (called a greedy strategy, although in practice an ε-greedy strategy is often used to balance exploration and exploitation). Over time, by constantly interacting with the environment and updating the Q-value table, the agent is able to learn the expected return of each state-action pair, thereby finding the optimal decision-making strategy;

[0032] Reinforcement learning algorithms combined with deep learning techniques form a powerful machine learning paradigm called Deep Reinforcement Learning, which enables intelligent agents to handle complex network environments and large-scale data sets.

[0033] T4. The information classification system classifies the data and stores it in the data storage system by training the support vector machine (SVM) model. The steps of training the support vector machine (SVM) model are as follows:

[0034] (1) Prepare the data set: Use data cleaning tools (Python, VBA, PyCharm) to clean and preprocess the data to remove redundant, erroneous or irrelevant data. Use the make_blobs function to create a dataset with two categories from the collected data. Then, the function divides the dataset into a training set and a test set.

[0035] (2) Model training: Use the training data set to train the SVM model. During the training process, the SVM will try to find an optimal hyperplane that minimizes the classification error on the training data set and maximizes the margin.

[0036] (3) Testing model: Use the test data set to evaluate the performance of the trained SVM model. The evaluation indicators include accuracy, precision, recall, and F1 value.

[0037] (4) Adjustment and optimization: According to the performance of the model on the test set, some parameters in the SVM need to be tuned, such as the selection of kernel functions and the setting of regularization parameters;

[0038] The data samples are labeled and classified using the support vector machine (SVM) model. The support vector machine (SVM) model can learn the data classification pattern, so as to accurately detect and classify new data when it is generated. The support vector machine (SVM) decision classification function can be expressed as:

[0039]

[0040] Among them, ai is the Lagrange multiplier, yi is the label of the sample, xi is the feature of the sample, and b is the bias top;

[0041] T5. The information storage system uses a distributed file system to store classified data in multiple nodes. The distributed storage mechanism uses a data partitioning algorithm to calculate data. The data partitioning algorithm uses a consistent hashing algorithm to determine which node the data object should be stored on, ensuring that data consistency is maintained when the number of nodes changes, thereby avoiding data migration and redistribution;

[0042] The consistent hashing algorithm uses the following mathematical model formula to calculate the hash value: Hash value = hash function (data key) mod number of nodes,

[0043] Wherein, the hash function is a random hash function, the data key is the key of the data on the storage node, and the number of nodes is the number of nodes on the storage node;

[0044] Consistent hashing maps each node to one or more virtual nodes. The virtual nodes are evenly distributed on the hash ring. When data needs to be searched or stored, the corresponding virtual node is found through the hash algorithm and then mapped to the real node, thereby achieving stable storage and efficient search of data.

[0045] The hit rate calculation formula of the consistent hashing algorithm is: (1-g / (g+m))*100%, where g represents the number of servers and m represents the number of variable servers. When the number of server samples is large enough, the larger the number of variable servers, the smaller the hit rate will be, and the smaller the impact will be.

[0046] T6. The abnormal supervision system uses game theory algorithms to analyze the adversarial relationship between network attackers and defenders. Network attackers usually choose the weakest link of the target, and network defenders need to take corresponding measures to protect network security. Through game theory analysis, defenders can predict the attacker's strategy choices and take corresponding defense measures in advance to reduce network security risks.

[0047] Preferably, in S4, the functions in sklearn.metrics are used to calculate the accuracy, precision, recall and F1 score, and average = 'macro' is specified to calculate the indicators of each category and then take the average;

[0048] Accuracy: It is the most intuitive evaluation indicator, indicating the proportion of samples correctly classified by the model to the total number of samples. The formula is: Accuracy = (number of correctly classified samples / total number of samples) × 100%;

[0049] Precision: refers to the proportion of instances predicted by the model as positive samples that are actually positive samples. The formula is: Precision = (True Positive Samples / Predicted Positive Samples) × 100%;

[0050] Recall: refers to the proportion of all positive samples that are correctly predicted as positive samples. The formula is: Recall = (true positive samples / actual positive samples) × 100%;

[0051] F1 value (F1 Score): It is the harmonic mean of precision and recall, which is used to comprehensively consider the two. The formula is: F1Score = 2×(Precision×Recall) / (Precision+Recall).

[0052] Compared with the prior art, the invention has the following beneficial effects: by analyzing a large amount of network traffic data, log information, user behavior data, etc. through big data and machine learning algorithms, the behavioral characteristics and strategy patterns of attackers and defenders are extracted, and then, the game theory model is used to model and analyze these data, predict the possible actions of attackers and the best response strategies of defenders, and the intelligent agent is trained through reinforcement learning to dynamically adjust the protection strategy according to real-time network traffic, system status, security events and other information;

[0053] Through reinforcement learning algorithms, protection strategies can be continuously optimized based on historical data and real-time feedback, so that they can adapt to new threats and attack patterns. Through continuous learning and adjustment, adaptive security systems can respond to network attacks more flexibly and improve overall security protection capabilities to ensure the safe and stable operation of the industrial Internet. In addition, through the combination of reinforcement learning algorithms and deep learning technology, a powerful machine learning paradigm has been formed, known as deep reinforcement learning, which enables intelligent agents to handle complex network environments and large-scale data sets, thereby further improving the performance and accuracy of security systems. Deep reinforcement learning combines the advantages of deep learning and reinforcement learning, enabling intelligent agents to make optimal decisions and dynamically adjust protection strategies in more complex and uncertain environments.

[0054] Stream processing technology combined with the convolutional neural network (CNN) model can achieve real-time monitoring and early warning of information, and promptly discover abnormal patterns in the data. The machine learning model uses regression algorithms to predict potential risks. Based on this, the network protection strategy formulation system uses intelligent agents to dynamically adjust protection strategies based on real-time network traffic, system status, security events and other information. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 is a system architecture diagram of the present invention;

[0056] Figure 2 is a flow chart of the method of the present invention;

[0057] Figure 3 The flowchart of the training convolutional neural network (CNN) model of the present invention;

[0058] Figure 4 It is a flow chart of the training regression model of the present invention;

[0059] Figure 5 The flowchart of the training deep neural network (DNN) model of the present invention;

[0060] Figure 6 This is a flow chart of the training support vector machine (SVM) model of the present invention. DETAILED DESCRIPTION

[0061] The technical solution of the present invention is described in detail below through specific embodiments.

[0062] See also Figure 1-6 The present invention provides an information security monitoring system based on the industrial Internet. The system includes: a network protection strategy formulation system, an information collection system (network information collector), an information transmission and protection system (SDN switch), and an Internet big data platform (information classification system, information storage system, information analysis system, and abnormal supervision system), wherein:

[0063] S1, information collection and preprocessing system, using network information collectors to collect data from various nodes and devices of the industrial Internet, and using data cleaning tools (Python, VBA, PyCharm) to clean and preprocess the data;

[0064] S2, information transmission and protection system, using SDN switches to communicate and manage through network controllers, deploying network security devices such as firewalls and intrusion detection systems on SDN switches, and taking security measures such as encrypted communication and access control;

[0065] Firewalls can prevent unauthorized access and malicious attacks. At the same time, the logging function of the firewall is enabled to monitor and analyze the logs regularly to detect abnormal activities in a timely manner.

[0066] Intrusion Detection System (IDS): IDS can be deployed on the core switch to comprehensively monitor the entire network traffic. In addition, IDS should adopt a combination of active and passive monitoring to detect known and unknown attacks, and be able to monitor network traffic in real time and discover network intrusions by analyzing abnormal behaviors in traffic.

[0067] Encrypted communication, using SSL / TLS protocol, IPsec protocol and SSH protocol, etc., by using public key encryption and private key decryption to encrypt and verify the integrity of transmission security information, so that data will not be stolen or tampered with during transmission, ensuring the network security of the industrial Internet system;

[0068] Access control: Establish a strict access control mechanism to ensure that only authorized users can access the system and data;

[0069] (1) Identity-based access control strategy: Determine access rights by verifying the identity of the user or device, using authentication technologies such as username and password, digital certificates, and biometrics;

[0070] The establishment method is: divide users into different roles and assign corresponding permissions to each role. By managing the permissions of the roles, the user's access rights can be easily adjusted;

[0071] (2) Rule-based access control policy: determines which users or devices have access to which resources based on predefined rules, which are formulated based on multiple factors such as user role, device identity, time, and location;

[0072] The establishment method is: maintain an access control list for each resource or operation, listing all users or devices with access rights. When an access request occurs, the built-in inspection system of the Internet big data platform checks the ACL to determine whether the requester has the corresponding permission;

[0073] (3) Behavior-based access control strategy: dynamically adjust the access rights of users or devices by analyzing their historical behavior patterns;

[0074] The establishment method is: restricting the access rights of users or devices by implementing mandatory access control policies;

[0075] S3, network protection strategy formulation system, which uses reinforcement learning algorithm (Q-learning) to interact with the environment to learn the optimal decision-making strategy and automatically execute a series of predefined response measures, including isolating affected systems, blocking malicious traffic, and restoring data;

[0076] S4. Internet big data platform: The Internet big data platform is a comprehensive information technology platform with big data as the core, integrating functions such as information classification system, information storage system, information analysis system, and abnormal supervision system;

[0077] The information analysis system uses big data analysis and machine learning algorithms to process and analyze the collected information in real time, learn and analyze network traffic, user behavior, system logs and other data, extract key features from them, classify and identify information based on the extracted information features, and discover hidden attack behaviors;

[0078] Information classification system, which classifies data and stores it in the data storage system by training the support vector machine (SVM) model;

[0079] Information storage system, using distributed file system such as Hadoop Distributed File System (HDFS), to store data in multiple nodes;

[0080] The abnormal supervision system uses game theory algorithms to deeply analyze the strategic interactions and dynamic changes between attackers and defenders. The game decision algorithm includes behavior difference and behavior closeness:

[0081] The behavior difference is expressed using the Minkowski distance, and the specific formula is as follows:

[0082] The formula for Minkowski distance is:

[0083]

[0084] Among them, X and Y are two points, each point has n-dimensional features, x i ,y i are the coordinates of X and Y in the i-th dimension respectively. The parameter p is a variable parameter that determines the specific form of the Minkowski distance;

[0085] When p takes different values, the Minkowski distance can represent different types of distances:

[0086] When p = 1, the Minkowski distance becomes the Manhattan distance, which represents the sum of the absolute wheelbases of two points in the standard coordinate system.

[0087] When p = 2, the Minkowski distance becomes the Euclidean distance, which is the straight-line distance between two points.

[0088] When p tends to infinity, the Minkowski distance becomes the Chebyshev distance.

[0089] The calculation of closeness can be based on the concepts of fuzzy inner product and fuzzy outer product. Fuzzy inner product and outer product are important tools to describe the relationship between fuzzy vectors. Suppose there are two fuzzy vectors a and b. The fuzzy inner product a°b is usually defined as the maximum value among the minimum values ​​corresponding to each component, that is, a°b=∨{(ak∧bk)|1≤k≤n}; and the fuzzy outer product a⊙b is defined as the minimum value among the maximum values ​​corresponding to each component, that is, a⊙b=∧{(ak∨bk)|1≤k≤n}.

[0090] When using fuzzy inner and outer products to represent behavioral closeness, a specific formula or model can be constructed, using the fuzzy inner and outer products as components or weight factors of closeness, and the behavioral closeness is obtained by comprehensively considering the inner and outer product characteristics of the fuzzy vector.

[0091] An information security monitoring method based on industrial Internet, the method comprising:

[0092] T1. Collect data from various nodes and devices of the industrial Internet through network information collectors, collect data such as network traffic, device status and user behavior, use data cleaning tools (Python, VBA, PyCharm) to clean and preprocess the information, remove redundant, erroneous or irrelevant data for subsequent analysis and identification, and transmit the preprocessed information to the Internet big data platform through the SDN switch. The SDN switch uses a centralized controller to monitor and manage network traffic, and through the centralized management protection strategy, better protect the network from malicious attacks and unauthorized access;

[0093] T2. Information analysis system deploys big data analysis and machine learning algorithms on the Internet big data platform. Big data analysis uses stream processing technology Apache Storm to efficiently process collected data. Stream processing technology can process continuously arriving data streams and can analyze and process data as it arrives, meeting real-time requirements.

[0094] Apache Storm, a stream processing technology, performs the following steps to efficiently process the collected data:

[0095] (1) Designing a data flow graph: In Apache Storm, data processing is implemented through a graph structure called "topology", which requires defining Spout, Bolt, and the data flow between them. Spout is responsible for reading data from external sources and emitting it as a stream. Bolt receives and processes the emitted stream, and then emits a new stream for other Bolts to use.

[0096] (2) Implement Spout and Bolt: Write Spout to read data from data sources (such as Kafka, HDFS, database, etc.); implement Bolt to perform data processing logic, such as filtering, aggregation, conversion, etc.; as needed, multiple Bolts can be chained to build complex data processing pipelines;

[0097] (3) Optimizing parallelism: Improving system throughput and performance by increasing the parallelism of spouts and bolts, which involves configuring more worker threads (executors) and tasks; adjusting the parallelism appropriately according to the characteristics of the data and the processing logic to achieve optimal resource utilization and performance;

[0098] (4) Ensure data reliability: Apache Storm provides "at-least-once" processing semantics, each message will be processed at least once; Storm's acker mechanism is used to ensure that messages are correctly processed and confirmed;

[0099] (5) Monitoring and tuning: Use Storm's built-in monitoring tools and metrics to track the performance and status of the topology. Based on the monitoring data, tune the topology, such as adjusting the degree of parallelism, optimizing data processing logic, and adjusting garbage collection parameters.

[0100] The core architecture of Storm is very simple, mainly consisting of four components: Spout, Bolt, Topology, and Stream;

[0101] Machine learning uses a trained convolutional neural network (CNN) model to learn and analyze data such as network traffic, user behavior, and system logs of the industrial Internet, extract key features from them, classify and identify data based on the extracted data features, and discover hidden attack behaviors. The specific steps of training a convolutional neural network (CNN) model are as follows;

[0102] (1) Prepare the data set: Use the train_test_split function to divide the data set collected in the Industrial Internet into a training set and a prediction set;

[0103] (2) Training model: Use the training set to iteratively train the model. The specific steps are as follows:

[0104] 1) Forward propagation: First, the input data is forward propagated through the network to obtain the model's predicted output;

[0105] 2) Calculate the loss: Use the loss function to calculate the difference between the predicted output and the actual label; the gradient of the loss function is calculated as: Mean Squared Error (MSE) Loss Function: For a single parameter θ, its gradient is calculated by the following formula:

[0106]

[0107] Where n is the number of samples, yi is the true value, and y^i is the predicted value of the model. is the gradient of the predicted value with respect to the parameter θ;

[0108] Initialize gradient: Initialize the gradient of the loss function with respect to each parameter to 0;

[0109] 3) Back propagation: Starting from the output layer, the gradient of the loss function with respect to each parameter is calculated layer by layer. For each parameter, its gradient is calculated using the chain rule and accumulated to the previously initialized gradient.

[0110] 4) Gradient update: Use an optimizer (such as Adam, SGD, etc.) to update the network weights according to the calculated gradient;

[0111] (3) Model prediction: Use the prediction set to make predictions for the trained model and evaluate the model performance;

[0112] Traverse the prediction set and perform forward propagation on each batch of data to obtain the prediction value; use the functions in sklearn.metrics to calculate the mean square error and mean absolute error, and specify average = 'macro' to calculate the indicators for each category and then take the average;

[0113] The ability to automatically extract and learn features of industrial Internet information through trained convolutional neural networks (CNNs). For network traffic data, CNNs can be used to extract local patterns and spatial correlations by converting traffic data into time series images or spectrum images. For system log analysis, CNNs can be used to identify patterns, especially when log data has a certain structure or pattern. In threat detection, CNNs can automatically identify malicious traffic and attack behaviors by learning the characteristics of network traffic data.

[0114] Machine learning uses regression algorithms to predict future trends and results. The specific steps are as follows:

[0115] (1) Feature selection: Select features that are highly correlated with the target variable, and use correlation analysis, feature importance assessment and other methods to assist feature selection;

[0116] (2) Model selection: Select an appropriate regression algorithm, such as linear regression. The general form of a linear regression model is: [y = \beta_0 + \beta_1x_1 + \beta_2x_2 + \ldots + \beta_nx_n] where: (y) is the dependent variable (target variable), (x_1, x_2, \ldots, x_n) are independent variables (features), (\beta_0, \beta_1, \ldots, \beta_n) are model parameters, also called regression coefficients;

[0117] (3) Model training: Divide the collected data into training sets and test sets, use the training set to train the regression model, and use optimization algorithms such as gradient descent to minimize the loss function, such as mean square error, to fit the relationship between features and target variables;

[0118] (4) Model evaluation: Use the test set to evaluate the trained model and calculate the prediction error or performance indicators, such as mean square error, root mean square error, and R-square value;

[0119] Mean Squared Error (MSE): It is the mean of the squares of the differences between the predicted value and the true value. It is used to measure the prediction performance of the regression model. The formula is: MSE = (1 / n) × Σ (predicted value - true value) 2 ;

[0120] Root Mean Squared Error (RMSE) is a commonly used performance indicator in regression analysis, which is used to measure the deviation between the model prediction value and the true value. The formula is:

[0121]

[0122] Where: n is the number of samples, y isi is the true value of the i-th sample, is the model's predicted value for the i-th sample, is the sum of squares of all sample prediction errors;

[0123] R-squared (also known as the coefficient of determination) is a statistic used in regression analysis. It indicates the proportion of the response variable changes explained by the model. The R-squared value measures how well the model fits the data. Its value is between 0 and 1. The calculation formula of the R-squared value is as follows:

[0124]

[0125] Where: n is the number of samples, y is i is the true value of the i-th sample, is the model's predicted value for the i-th sample, is the mean of the true values ​​(i.e. ), molecular part It is the residual sum of squares between the model prediction and the true value, measuring the changes that the model cannot explain, the denominator It is the total sum of squares between the true value and the mean, which represents all changes in the response variable. The parameters of the model are adjusted according to the evaluation results.

[0126] (5) Future prediction: After model training is completed, the model is used to predict network threat data. Through reasoning with the trained model, the trend and pattern of network attacks are analyzed to predict future threats. The attacker's behavior patterns, goals, and possible attack methods are predicted and identified. Based on this, the network protection strategy formulation system uses intelligent agents to dynamically adjust the protection strategy based on real-time network traffic, system status, security events and other information.

[0127] T3. The network protection strategy formulation system applies reinforcement learning to network security. The reinforcement learning algorithm uses the Q-learning algorithm to train the intelligent agent to detect and identify malicious traffic patterns. The Q-learning algorithm formula is: Q(s,a)=(1-α)Q(s,a)+α(r+γmax(Q(s',a')))

[0128] Where Q(s,a) represents the value function of executing action a in state s, α is the learning rate (0<α≤1), r is the immediate reward after executing action a, γ is the discount factor (0<γ≤1), s' is the next state transferred to after executing action a, and a' is the optimal action selected in state s';

[0129] The optimal strategy is learned by iteratively updating the Q-value table. During the learning process, the agent selects actions based on the current Q-value table, usually the action with the highest Q-value (called a greedy strategy, although in practice an ε-greedy strategy is often used to balance exploration and exploitation). Over time, by constantly interacting with the environment and updating the Q-value table, the agent is able to learn the expected return of each state-action pair, thereby finding the optimal decision-making strategy;

[0130] In deep reinforcement learning, deep learning networks, especially deep neural networks (DNNs), are used as function approximators to learn the mapping relationship from environmental states to actions. This means that the agent can understand and parse the state of the environment through deep neural networks and make decisions based on these understandings. The protection strategy is continuously optimized based on historical data and real-time feedback by training the deep neural network (DNN) model. The specific steps for training a deep neural network (DNN) are as follows:

[0131] (1) Build a network model: Use the API provided by the deep learning framework to build a network model;

[0132] (2) Prepare the training data set: Use the make_blobs function to create a data set for the historical data of network attacks. Use the train_test_split function to divide the data set into a training set, a validation set, and a test set. Perform necessary preprocessing on the data, such as normalization or standardization.

[0133] (3) Forward propagation and back propagation: The training data is fed into the network in batches, and forward calculations are performed layer by layer until the output layer. The current network output is compared with the true label, and the loss is calculated using a loss function (such as mean square error loss MSE or cross entropy loss). The back propagation algorithm is used to adjust the network parameters according to the loss to minimize the loss.

[0134] (4) Training model: Use optimization algorithms (such as gradient descent, Adam, etc.) to update network parameters; repeat the process of forward propagation, loss calculation, back propagation and parameter update until the model converges or reaches the preset number of training rounds;

[0135] (5) Evaluation and tuning: Use the validation set to evaluate the performance of the model, such as accuracy, loss, etc., and perform necessary model tuning based on the evaluation results, such as adjusting the learning rate, modifying the network structure, or trying different optimization algorithms;

[0136] (6) Testing the model: Use the test set to evaluate the performance of the final model to ensure that the model has good generalization ability;

[0137] Reinforcement learning algorithms can continuously optimize protection strategies based on historical data and real-time feedback, so that they can adapt to new threats and attack patterns. Reinforcement learning algorithms combined with deep learning technology form a powerful machine learning paradigm called Deep Reinforcement Learning. This combination enables intelligent agents to handle complex network environments and large-scale data sets, thereby further improving the performance and accuracy of security systems.

[0138] T4. The information classification system classifies the data and stores it in the data storage system by training the support vector machine (SVM) model. The steps of training the support vector machine (SVM) model are as follows:

[0139] (1) Prepare the data set: Use data cleaning tools (Python, VBA, PyCharm) to clean and preprocess the data to remove redundant, erroneous or irrelevant data. Use the make_blobs function to create a dataset with two categories from the collected data. Then, the function divides the dataset into a training set and a test set.

[0140] (2) Model training: Use the training data set to train the SVM model. During the training process, the SVM will try to find an optimal hyperplane that minimizes the classification error on the training data set and maximizes the margin.

[0141] (3) Testing model: Use the test data set to evaluate the performance of the trained SVM model. The evaluation indicators include accuracy, precision, recall, and F1 value.

[0142] The functions in sklearn.metrics are used to calculate accuracy, precision, recall, and F1 score, and average = 'macro' is specified to calculate the indicators for each category and then take the average;

[0143] Accuracy: It is the most intuitive evaluation indicator, indicating the proportion of samples correctly classified by the model to the total number of samples. The formula is: Accuracy = (number of correctly classified samples / total number of samples) × 100%;

[0144] Precision: refers to the proportion of instances predicted by the model as positive samples that are actually positive samples. The formula is: Precision = (True Positive Samples / Predicted Positive Samples) × 100%;

[0145] Recall: refers to the proportion of all positive samples that are correctly predicted as positive samples. The formula is: Recall = (true positive samples / actual positive samples) × 100%;

[0146] F1 Score: It is the harmonic mean of precision and recall, which is used to comprehensively consider the two. The formula is: F1Score = 2×(Precision×Recall) / (Precision+Recall)

[0147] (4) Adjustment and optimization: According to the performance of the model on the test set, some parameters in the SVM need to be tuned, such as the selection of kernel functions and the setting of regularization parameters;

[0148] The data samples are labeled and classified using the support vector machine (SVM) model. The support vector machine (SVM) model can learn the data classification pattern, so as to accurately detect and classify new data when it is generated. The support vector machine (SVM) decision classification function can be expressed as:

[0149]

[0150] Among them, ai is the Lagrange multiplier, yi is the label of the sample, xi is the feature of the sample, and b is the bias top;

[0151] T5. The information storage system uses a distributed file system to store the classified data in multiple nodes.

[0152] The distributed storage mechanism uses a data partitioning algorithm to calculate data. The data partitioning algorithm uses a consistent hashing algorithm to determine which node the data object should be stored on, ensuring data consistency when the number of nodes changes, thereby avoiding data migration and redistribution;

[0153] The consistent hashing algorithm uses the following mathematical model formula to calculate the hash value: Hash value = hash function (data key) mod number of nodes;

[0154] Wherein, the hash function is a random hash function, the data key is the key of the data on the storage node, and the number of nodes is the number of nodes on the storage node;

[0155] Consistent hashing maps each node to one or more virtual nodes. The virtual nodes are evenly distributed on the hash ring. When data needs to be searched or stored, the corresponding virtual node is found through the hash algorithm and then mapped to the real node, thereby achieving stable storage and efficient search of data.

[0156] The hit rate calculation formula of the consistent hashing algorithm is: (1-g / (g+m))*100%, where g represents the number of servers and m represents the number of variable servers. When the number of server samples is large enough, the larger the number of variable servers, the smaller the hit rate will be, and the smaller the impact will be.

[0157] The distributed storage mechanism has the performance of data partitioning, redundant storage, data consistency, load balancing, fault tolerance mechanism, and scalability;

[0158] Data partitioning: Divide large-scale data into multiple smaller data blocks and store these data blocks in multiple storage nodes. This can improve the data read and write performance and storage efficiency. Data partition calculation formula: Assuming there are N data objects, they need to be distributed to M storage nodes. The number of data objects stored in each node can be calculated by the following formula:

[0159] (\text{Number of objects stored in each node}=\lceil\frac{N}{M}\rceil)

[0160] Where (\lceil x\rceil) represents the smallest integer not less than x (rounded up). This formula is used to evenly distribute N data objects to M storage nodes.

[0161] Redundant storage: To ensure data reliability, distributed storage usually adopts a multi-copy strategy, that is, multiple copies of data are stored on different storage nodes. When a storage node fails, the data can be restored through other copies.

[0162] Data consistency: To ensure data consistency among multiple replicas, distributed storage usually uses distributed protocols, such as PAXOS and RAFT, to ensure data synchronization among replicas.

[0163] Load balancing: By distributing data across multiple storage nodes, load balancing can be achieved to avoid overloading a single storage node;

[0164] Fault-tolerant mechanism: Distributed storage systems usually use fault-tolerant mechanisms, such as data backup, data recovery, and node fault tolerance, to ensure system reliability and availability;

[0165] Scalability: Distributed storage systems can increase storage capacity and performance by adding storage nodes, and have good scalability;

[0166] T6. The abnormal supervision system uses game theory algorithms to analyze the confrontational relationship between network attackers and defenders. Network attackers usually choose the weakest link of the target, and network defenders need to take corresponding measures to protect network security. Through game theory analysis, defenders can predict the attacker's strategy selection, so as to take corresponding defense measures in advance and reduce network security risks.

[0167] Through the analysis of game theory, more secure cryptographic algorithms and protocols can be designed; the accuracy and efficiency of intrusion detection can be improved; and theoretical support can be provided for the formulation of network protection strategies to ensure their effectiveness and feasibility.

[0168] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. An information security monitoring system based on industrial Internet, characterized by: The system includes: a network protection strategy formulation system, an information collection system, an information transmission and protection system, and an Internet big data platform, among which: S1, information collection system, uses network information collectors to collect data from various nodes and devices in the industrial Internet; S2, information transmission and protection system, using SDN switches to communicate and manage through network controllers, deploying firewalls, intrusion detection system network security devices on SDN switches, and taking encrypted communication and access control security measures; S3, network protection strategy formulation system, uses the reinforcement learning algorithm Q-learning to interact with the environment to learn the optimal decision-making strategy and automatically execute a series of predefined response measures, including isolating affected systems, blocking malicious traffic, and restoring data; S4. Internet big data platform: The Internet big data platform is a comprehensive information technology platform that integrates the functions of information classification system, information storage system, information analysis system, and abnormal supervision system. The information analysis system uses big data analysis and machine learning algorithms to process and analyze the collected information in real time, learn and analyze network traffic, user behavior and system log data, extract key features from them, classify and identify information based on the extracted information features, and discover hidden attack behaviors; Information classification system, which classifies data and stores it in the data storage system by training the support vector machine (SVM) model; The information storage system uses the distributed file system HDFS to store data in multiple nodes; The abnormal supervision system uses game theory algorithms to deeply analyze the strategic interactions and dynamic changes between attackers and defenders. The game decision algorithm includes behavior difference and behavior closeness: The behavior difference is expressed using the Minkowski distance, and the specific formula is as follows: The formula of Minkowski Distance is: Among them, X and Y are two points, each point has n-dimensional features, x i ,y i are the coordinates of X and Y in the i-th dimension respectively. The parameter p is a variable parameter that determines the specific form of the Minkowski distance; When p takes different values, the Minkowski distance represents different types of distances: When p = 1, the Minkowski distance becomes the Manhattan distance, which represents the sum of the absolute wheelbases of two points in the standard coordinate system. When p = 2, the Minkowski distance becomes the Euclidean distance, which is the straight-line distance between two points. When p tends to infinity, the Minkowski distance becomes the Chebyshev distance. Behavior closeness is based on the concepts of fuzzy inner product and fuzzy outer product. Fuzzy inner product and outer product are important tools to describe the relationship between fuzzy vectors. Suppose there are two fuzzy vectors a and b, the fuzzy inner product a°b is defined as the maximum value among the minimum values ​​corresponding to each component, that is, a°b=∨{(ak∧bk)|1≤k≤n}; and the fuzzy outer product a⊙b is defined as the minimum value among the maximum values ​​corresponding to each component, that is, a⊙b=∧{(ak∨bk)|1≤k≤n}; When the fuzzy inner product and outer product are used to represent the behavior closeness, a specific formula or model is constructed, and the fuzzy inner product and outer product are used as components or weight factors of the closeness. The behavior closeness is obtained by comprehensively considering the inner product and outer product characteristics of the fuzzy vector; Methods of information security monitoring system: T1. Collect data from various nodes and devices of the industrial Internet through network information collectors, collect network traffic, device status and user behavior data, and use data cleaning tools such as Python, VBA and PyCharm to clean and preprocess the information to remove redundant, erroneous or irrelevant data. The preprocessed information is transmitted to the Internet big data platform through the SDN switch. The SDN switch uses a centralized controller to monitor and manage network traffic. T2. Information analysis system deploys big data analysis and machine learning algorithms on the Internet big data platform. Big data analysis uses stream processing technology Apache Storm to efficiently process collected data. Stream processing technology processes continuously arriving data streams and can analyze and process data as it arrives, meeting real-time requirements. Machine learning uses a trained convolutional neural network (CNN) model to learn and analyze network traffic, user behavior, and system log data, extract key features, classify and identify data based on the extracted data features, and discover hidden attack behaviors. The machine learning model uses regression algorithms to predict future trends and results. Stream processing technology combined with the convolutional neural network (CNN) model enables real-time monitoring and early warning of information, and timely detection of abnormal patterns in data. The machine learning model uses regression algorithms to predict potential risks and uses intelligent agents to dynamically adjust protection strategies based on real-time network traffic, system status, and security event information. T3. The network protection strategy formulation system applies reinforcement learning to network security. The reinforcement learning algorithm uses the Q-learning algorithm to train the intelligent agent to detect and identify malicious traffic patterns. The Q-learning algorithm formula is: Q(s,a)=(1-α)Q(s,a)+α(r+γmax(Q(s',a'))) Where Q(s,a) represents the value function of executing action a in state s, α is the learning rate (0<α≤1), r is the immediate reward after executing action a, γ is the discount factor (0<γ≤1), s' is the next state transferred to after executing action a, and a' is the optimal action selected in state s'; The optimal strategy is learned by iteratively updating the Q-value table. During the learning process, the agent selects actions based on the current Q-value table and selects the action with the highest Q-value. By continuously interacting with the environment and updating the Q-value table, the agent can learn the expected return of each state-action pair, thereby finding the optimal decision-making strategy. Reinforcement learning algorithms combined with deep learning techniques form a powerful machine learning paradigm called Deep Reinforcement Learning, which enables intelligent agents to handle complex network environments and large-scale data sets; T4. The information classification system classifies the data and stores it in the data storage system by training the support vector machine SVM model. The steps of training the support vector machine SVM model are as follows: Prepare the data set: Use Python, VBA, and PyCharm to clean and preprocess the data, remove redundant, erroneous, or irrelevant data, and use the make_blobs function to create a dataset with two categories from the collected data. Then, the function divides the dataset into a training set and a test set. Model training: Use the training data set to train the SVM model. During the training process, SVM tries to find an optimal hyperplane to minimize the classification error on the training data set and maximize the interval; Test model: Use the test data set to evaluate the performance of the trained SVM model. The evaluation indicators include accuracy, precision, recall, and F1 value. Adjustment and optimization: According to the performance of the model on the test set, the parameters in the SVM are changed, the kernel function is selected, and the regularization parameters are set; Use the support vector machine (SVM) model to label and classify data samples. The support vector machine (SVM) model learns the data classification pattern, so as to accurately detect and classify new data when it is generated. T5. The information storage system uses a distributed file system to store classified data in multiple nodes. The distributed storage mechanism uses a data partitioning algorithm to calculate data. The data partitioning algorithm uses a consistent hashing algorithm to determine which node the data object should be stored on, ensuring that data consistency is maintained when the number of nodes changes, thereby avoiding data migration and redistribution; The consistent hashing algorithm uses the following mathematical model formula to calculate the hash value: Hash value = hash function mod number of nodes, Wherein, the hash function is a random hash function, and the number of nodes is the number of nodes on the storage node; Consistent hashing maps each node to one or more virtual nodes. The virtual nodes are evenly distributed on the hash ring. When data needs to be searched or stored, the corresponding virtual node is found through the hash algorithm and then mapped to the real node, thereby achieving stable storage and efficient search of data. The hit rate calculation formula of the consistent hashing algorithm is: (1-g / (g+m))*100%, where g represents the number of servers and m represents the number of variable servers. The larger the number of variable servers, the smaller the hit rate will be and the smaller the impact will be. T6. The abnormal supervision system uses game theory algorithms to analyze the adversarial relationship between network attackers and defenders. Network attackers choose the weakest link of the target, and network defenders need to take corresponding measures to protect network security. Through game theory analysis, defenders predict the attacker's strategic choices and take corresponding defense measures in advance to reduce network security risks.

2. According to claim 1, an information security monitoring system based on industrial Internet is characterized in that: In T4, the functions in sklearn.metrics are used to calculate accuracy, precision, recall, and F1 score, and average = 'macro' is specified to calculate the indicators for each category and then take the average; Accuracy: It is the most intuitive evaluation indicator, indicating the proportion of samples correctly classified by the model to the total number of samples. The formula is: Accuracy = (number of correctly classified samples / total number of samples) × 100%; Precision: refers to the proportion of instances predicted by the model as positive samples that are actually positive samples. The formula is: Precision = (True Positive Samples / Predicted Positive Samples) × 100%; Recall: refers to the proportion of all positive samples that are correctly predicted as positive samples. The formula is: Recall = (true positive examples / actual positive examples) × 100%; F1 Score: It is the harmonic mean of precision and recall, which is used to comprehensively consider the two. The formula is: F1 Score=2×(Precision×Recall) / (Precision+Recall).

Images