Dangerous source safety emergency treatment method and device based on industrial Internet

Abstract

The present invention discloses a method and device for emergency handling of dangerous sources based on the industrial Internet. The method includes determining the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored to be running, and determining the abnormal propagation tree based on the risk attribute information and the abnormal propagation path. Then, the security risk information is determined based on the abnormal propagation tree. Finally, the security emergency strategy associated with the security risk information is matched, and the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy. The security emergency strategy is issued so that the industrial Internet device predicted to be attacked executes the security emergency strategy and performs device communication shielding and read-write shielding. In this way, while ensuring that the industrial Internet device attacked by the abnormal code is shielded by software, it can also ensure that other industrial Internet devices in the system can operate normally, reducing the security risks of the industrial Internet.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for emergency handling of hazardous sources based on industrial Internet. Background Art

[0002] The Industrial Internet is a new type of infrastructure, application model and industrial ecology that deeply integrates the new generation of information and communication technology with the industrial economy. It also takes the integration of industrial control and informatization as its core, and realizes the comprehensive interconnection and interoperability of internal and external informatization of enterprises through technical means such as the Internet and cloud computing. Since multiple industrial Internet devices are interconnected, once attacked, the entire system will be paralyzed or a large amount of internal data will be lost, causing huge losses to the enterprise.

[0003] Currently, when a system is found to be under attack, the physical network connection between the attacked industrial Internet device and other industrial Internet devices is usually disconnected. However, if there are many attacked industrial Internet devices, this emergency response solution may also cause the operation of the industrial Internet system to be paralyzed, and cause the internal data in the attacked industrial Internet devices to be leaked, thereby increasing security risks. Summary of the invention

[0004] In view of the above problems, the present invention is proposed to provide a method and device for safety emergency handling of major hazardous sources based on the industrial Internet that overcomes the above problems or at least partially solves the above problems.

[0005] According to a first aspect of the present invention, a method for emergency response to major hazardous sources based on the industrial Internet is provided, the method comprising:

[0006] When abnormal code is detected, the abnormal propagation path corresponding to the abnormal code is determined;

[0007] Query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path;

[0008] Determine the security risk information corresponding to the exception code according to the exception propagation tree;

[0009] Matching a security emergency strategy associated with the security risk information, wherein the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy;

[0010] The security emergency response strategy is issued so that the industrial interconnected device predicted to be attacked executes the security emergency response strategy to perform device communication shielding and read-write shielding.

[0011] According to a second aspect of the present invention, there is provided a major hazard source safety emergency processing device based on the industrial Internet, the device comprising:

[0012] A path confirmation module is used to determine the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored to be running;

[0013] A propagation tree determination module is used to query the risk attribute information of the industrial Internet and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path;

[0014] A risk information confirmation module, used to determine the security risk information corresponding to the abnormal code according to the abnormal propagation tree;

[0015] A policy matching module, used to match a security emergency policy associated with the security risk information, wherein the security emergency policy includes a communication shielding policy and a read-write shielding policy;

[0016] The strategy issuing module is used to issue the security emergency strategy so that the industrial interconnected device predicted to be attacked executes the security emergency strategy and performs device communication shielding and read-write shielding.

[0017] In the scheme of the present invention, the method includes first determining the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored to be running, then querying the risk attribute information of the industrial Internet, and determining the abnormal propagation tree based on the risk attribute information and the abnormal propagation path. Then, based on the abnormal propagation tree, determine the security risk information corresponding to the abnormal code. Finally, match the security emergency strategy associated with the security risk information, and the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy. And issue the security emergency strategy so that the industrial Internet device predicted to be attacked executes the security emergency strategy to perform device communication shielding and read-write shielding. Thus, when the system is detected to have abnormal code, the security risk information of the abnormal code for the system can be predicted, and the corresponding security emergency strategy can be determined based on the security risk information, so that the industrial Internet device attacked by the abnormal code can be shielded by software while ensuring that other industrial Internet devices in the system can operate normally, reducing the security risk of the industrial Internet.

[0018] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] By reading the detailed description of the preferred embodiment below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used for the purpose of illustrating the preferred embodiment and are not considered to be limitations of the present invention. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.

[0020] In the attached picture:

[0021] Figure 1 It is a flowchart of the steps of a method for emergency response to major hazardous sources based on the industrial Internet provided by an embodiment of the present invention;

[0022] Figure 2 It is a flowchart of another method for emergency response to major hazardous sources based on the industrial Internet provided by an embodiment of the present invention;

[0023] Figure 3 It is a structural schematic diagram of an abnormal propagation tree provided by an embodiment of the present invention;

[0024] Figure 4 This is a flowchart of another method for emergency response to major hazardous sources based on the industrial Internet provided by an embodiment of the present invention;

[0025] Figure 5 It is a block diagram of a major hazard source safety emergency response device based on the industrial Internet provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0027] Reference Figure 1 , shows a flowchart of a method for emergency response to a major hazardous source based on the industrial Internet provided by an embodiment of the present invention, which is applied to an industrial service end, and the method may include:

[0028] S101. When the operation of an abnormal code is monitored, determine an abnormal propagation path corresponding to the abnormal code.

[0029] In an embodiment of the present invention, the industrial service end can be loaded on an industrial server or an industrial cloud platform, which can monitor the current running processes of all industrial interconnected devices that form the industrial Internet, and when an abnormal process is monitored (i.e., there is abnormal code running), it is determined that the current abnormal code is an external code that conducts a network attack through a system vulnerability. Thus, the corresponding abnormal propagation path can be determined based on the abnormal code. Among them, the abnormal propagation path refers to the propagation link of the industrial interconnected device that is arranged in time sequence and is expected to cause the abnormal operation and the process module that causes the abnormal operation in the industrial interconnected device that is running abnormally.

[0030] S102. Query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path.

[0031] In an embodiment of the present invention, the risk attribute information is used to distinguish the degree to which each industrial interconnected device can bear security risks. For example, the risk attribute information may include device risk information and module risk information.

[0032] The abnormal propagation tree is used to characterize the risk association relationship between the abnormally running industrial interconnected devices and the abnormally running process modules, respectively, and the security risk information of the abnormal propagation path, which can be understood as a risk association map corresponding to the abnormal code. Therefore, when the abnormal propagation tree is determined, the security risk information of the abnormal propagation path can be used as the root node, the abnormally running industrial interconnected device can be used as the first child node subordinate to the root node, and the abnormally running process module in the abnormally running industrial interconnected device can be used as the second child node subordinate to the first child node. Correspondingly, the risk attribute information (device risk information) associated with the abnormally running industrial interconnected device is used as the edge attribute information of the first connection edge connecting the root node and the first child node. The risk attribute information (module risk information) associated with the abnormally running process module is used as the edge attribute information of the second connection edge connecting the first child node and the second child node, and so on, so as to obtain the abnormal propagation tree, and obtain the risk association relationship of all abnormal propagation paths based on the abnormal propagation tree.

[0033] S103: Determine the security risk information corresponding to the exception code according to the exception propagation tree.

[0034] In the embodiment of the present invention, since the abnormal propagation tree can characterize the risk association relationship of the abnormal code to the industrial Internet devices of the system after the abnormal code is run, the risk attribute information can be weighted and risk statistics can be performed from the second child node to the first child node, and then from the first child node to the root node, so that the security risk information corresponding to the abnormal code can be comprehensively determined. Among them, the security risk information can characterize the degree of impact of the abnormal code on the current operation security of the industrial Internet.

[0035] S104: Match a security emergency strategy associated with the security risk information, where the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy.

[0036] S105. Issue the security emergency response strategy so that the industrial Internet device predicted to be attacked executes the security emergency response strategy to perform device communication shielding and read-write shielding.

[0037] In an embodiment of the present invention, a policy match is performed according to the security risk information, and a security emergency policy associated with the security risk information is matched. Among them, the security emergency policy may include a communication shielding policy and a read-write shielding policy. Thereby, the security emergency policy is sent to the industrial Internet device predicted to be attacked by a network, or the security emergency policy is sent to all industrial Internet devices, so that the industrial Internet devices predicted to be attacked by a network can execute the security emergency policy and perform device communication shielding and read-write shielding. Therefore, while ensuring that the industrial Internet devices attacked by abnormal codes are shielded by software, it can also ensure that other industrial Internet devices in the system that are not affected by abnormal codes can operate normally, reducing the security risks of the industrial Internet and reducing the losses caused to manufacturers by system crashes.

[0038] In one example, the communication shielding strategy is executed on the industrial Internet device that is predicted to be attacked, which includes at least the following steps:

[0039] Based on the communication editing operation of the industrial Internet device predicted to be attacked, the communication between the abnormally operating industrial Internet device and the normally operating industrial Internet device is prohibited.

[0040] In another example, the industrial interconnected device that is predicted to be attacked executes a read-write blocking strategy, which includes at least the following steps:

[0041] It is predicted that the attacked industrial Internet device is prohibited from responding to the relevant instructions when receiving the relevant instructions containing address information.

[0042] In summary, an embodiment of the present invention provides a method for emergency handling of major hazardous sources based on the industrial Internet. The method includes first determining the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored, and then querying the risk attribute information of the industrial Internet, and determining the abnormal propagation tree based on the risk attribute information and the abnormal propagation path. Then, based on the abnormal propagation tree, the security risk information corresponding to the abnormal code is determined. Finally, the security emergency strategy associated with the security risk information is matched, and the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy. And the security emergency strategy is issued so that the industrial Internet device predicted to be attacked executes the security emergency strategy, and performs device communication shielding and read-write shielding. Thus, when an abnormal code is detected in the system, the security risk information of the abnormal code for the system can be predicted, and the corresponding security emergency strategy can be determined based on the security risk information, so that the industrial Internet device attacked by the abnormal code can be shielded by software while ensuring that other industrial Internet devices in the system can operate normally, reducing the security risk of the industrial Internet.

[0043] Reference Figure 2 , shows a flowchart of another method for emergency response to major hazardous sources based on the industrial Internet provided by an embodiment of the present invention, the method may include:

[0044] S201. When abnormal code operation is monitored, the abnormal code is used to match preset abnormal penetration rules to determine the industrial Internet device with abnormal operation caused by the abnormal code and the corresponding abnormal operation module in the industrial Internet device with abnormal operation.

[0045] In the embodiment of the present invention, the abnormal penetration rule may include a device penetration rule and a module penetration rule, wherein the device penetration rule may be understood as a preset device access format based on the division of the pre-collected attack code; the module penetration rule may be understood as a preset module control format based on the division of the pre-collected attack code, for example including but not limited to a data read instruction format, a data write instruction format, etc. Thus, the abnormal code may be used to fuzzy match the preset abnormal penetration rule, so that it may be determined that the abnormal code continues to run, which will lead to abnormal industrial Internet devices and the corresponding abnormal process modules in the abnormal industrial Internet devices.

[0046] S202: Determine an abnormal propagation path based on the abnormally operating industrial Internet device and the corresponding abnormal operating module.

[0047] S203. Query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path, wherein the risk attribute information includes the equipment risk level and the module risk level.

[0048] In an embodiment of the present invention, the risk attribute information is used to distinguish the degree of security risk that each industrial Internet device can withstand. For example, the risk attribute information may include a device risk level and a module risk level. The device risk level is used to characterize the level of security risk that each industrial Internet device can withstand, and the module risk level is used to characterize the level of security risk that different process modules in each industrial Internet device can withstand.

[0049] The abnormal propagation tree is used to characterize the risk association relationship between the abnormally operating industrial Internet devices and the abnormally operating process modules, and the security risk information of the abnormal propagation path, which can be understood as a risk association map corresponding to the abnormal code. Therefore, when the abnormal propagation tree is determined, the security risk information of the abnormal propagation path can be used as the root node, the abnormally operating industrial Internet device (or the device identifier corresponding to different industrial Internet devices) can be used as the first child node subordinate to the root node, and the abnormally operating process module in the abnormally operating industrial Internet device (or the module identifier corresponding to different abnormal modules) can be used as the second child node subordinate to the first child node.

[0050] Correspondingly, the device risk level associated with the abnormally running industrial interconnected device is used as the edge attribute information of the first connection edge between the root node and the first child node subordinate to the root node. The module risk level associated with the abnormally running process module is used as the edge attribute information of the second connection edge between the first child node and the second child node subordinate to the first child node, and so on, thereby obtaining an abnormal propagation tree, and based on the abnormal propagation tree, obtaining the risk association relationship of all abnormal propagation paths.

[0051] In an optional embodiment of the invention, the method further includes a step of configuring the risk attribute information, and the configuration step may include:

[0052] Provide a display page, and obtain the device identification of all industrial interconnected devices and the module identification of all running modules in each industrial interconnected device, and display the device identification and the module identification in the display page. Wherein, the display page includes a risk configuration control, which is triggered by the editing operation of the risk configuration control, generates a risk configuration instruction, and sends it to the server. The server configures the device risk information for the device identification and the module risk information for the module identification in response to the risk configuration instruction. The device risk information associated with the device identification and the module risk information associated with the corresponding module identification are determined as risk attribute information. In this way, the device risk information of different industrial interconnected devices and the module risk information of different process modules in each industrial interconnected device can be reconfigured in response to changes or adjustments in the architecture of the Industrial Internet.

[0053] S204: Determine the security risk level of the abnormal propagation path according to the device risk levels associated with all first child nodes in the abnormal propagation tree and the module risk levels associated with all second child nodes corresponding to each first child node.

[0054] In the embodiment of the present invention, since the abnormal propagation tree can characterize the risk association relationship of the abnormal code to the industrial Internet devices of the system after the abnormal code is run, the risk attribute information can be weighted and risk statistics can be performed from the second child node to the first child node, and then from the first child node to the root node, so that the security risk information corresponding to the abnormal code can be comprehensively determined. Among them, the security risk information can characterize the degree of impact of the abnormal code on the current operation security of the industrial Internet.

[0055] In one example, the device risk level may include two levels, high risk and low risk, and correspondingly, the module risk level may also include two levels, high risk and low risk. The higher the risk level, the greater the impact of the current industrial interconnection device, or a process module in the current industrial interconnection device, on the normal operation of the industrial interconnection system. On the contrary, the lower the risk level, the smaller the impact of the current industrial interconnection device, or a process module in the current industrial interconnection device, on the normal operation of the industrial interconnection system. For example, if the industrial interconnection device corresponding to the platform layer and the network layer has a large impact on the normal operation of the industrial interconnection system, the corresponding device risk level can be determined as high risk. By analogy, the number of nodes with a high risk module risk level from all second subnodes to the first subnode can be counted, and then the number of nodes with a high risk device risk level from all first subnodes to the root node can be counted, so that the security risk information corresponding to the abnormal code can be comprehensively determined. Among them, the security risk information can characterize the degree of impact of the abnormal code on the operational security of the current industrial Internet.

[0056] In one example, the security risk information may include a security risk level, and the security risk level of the abnormal propagation path may be determined according to the following formula (1).

[0057] Formula (1)

[0058] In the above formula (1), D refers to the security risk level; U S Refers to the total number of nodes with high risk level associated with all first child nodes; U1 refers to the total number of nodes with high risk level associated with the preset first child nodes; U m Refers to the total number of nodes with high risk level of modules associated with all second child nodes; U2 refers to the total number of nodes with high risk level of modules associated with the preset second child nodes; D1 refers to high risk; D2 refers to low risk. Among them, the total number of nodes with high risk level of equipment associated with the first child node U1 and the total number of nodes with high risk level of modules associated with the second child node U2 can be determined by technicians in this field according to actual conditions.

[0059] Based on the above formula (1), it can be determined that when the total number of nodes with high risk equipment associated with all first sub-nodes is greater than or equal to the total number of nodes with high risk equipment associated with the preset first sub-nodes, and the total number of nodes with high risk modules associated with all second sub-nodes is greater than or equal to the total number of nodes with high risk modules associated with the preset second sub-nodes, the security risk level is determined to be high risk, thereby determining that the abnormal code has a large impact on the operational safety of the current industrial Internet. Otherwise, the security risk level is determined to be low risk, thereby determining that the abnormal code has a small impact on the operational safety of the current industrial Internet.

[0060] For example, refer to Figure 3 As shown, when the first sub-node includes V1, V2 and V3, the corresponding first sub-node V1 includes two second sub-nodes V11 and V12, wherein the module risk levels associated with the second sub-nodes V11 and V1 are both D1, and the device risk level associated with the first sub-node V1 is D1; ​​the first sub-node V2 includes a second sub-node V21, the module risk level associated with the second sub-node V21 is D2, and the device risk level associated with the first sub-node V2 is D2;

[0061] The first subnode V3 includes two second subnodes V31 and V32. The risk level of the module associated with the second subnode V31 is D2, the risk level of the module associated with the second subnode V32 is D1, and the risk level of the module associated with the first subnode V3 is D1. If U1 is 3 and U2 is also 3, the corresponding security risk level is low risk.

[0062] S205: Match a security emergency strategy associated with the security risk level, wherein the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy.

[0063] S206. Issue the security emergency response strategy so that the industrial Internet device predicted to be attacked executes the security emergency response strategy to perform device communication shielding and read-write shielding.

[0064] In the embodiment of the present invention, a policy match is performed according to the security risk level to match a security emergency policy associated with the security risk level, wherein the security emergency policy may include a communication shielding policy and a read-write shielding policy.

[0065] The security emergency strategy is then sent to the industrial Internet devices predicted to be attacked by the network, or to all industrial Internet devices, so that the industrial Internet devices predicted to be attacked by the network can execute the security emergency strategy and perform device communication shielding and read-write shielding. Thus, while ensuring that the industrial Internet devices attacked by abnormal codes are shielded by software, other industrial Internet devices in the system that are not affected by abnormal codes can also be guaranteed to operate normally, reducing the security risks of the industrial Internet and reducing the losses caused by system crashes to manufacturers.

[0066] In one example, the security emergency strategy with a high security risk level may include a high-risk associated communication shielding strategy and a high-risk associated read-write shielding strategy. The high-risk associated communication shielding strategy at least includes: based on the communication editing operation of the industrial Internet device predicted to be attacked, prohibiting the communication between all industrial Internet devices that form a network connection with the currently abnormally operating industrial Internet device; the high-risk associated read-write shielding strategy at least includes: the industrial Internet device predicted to be attacked is prohibited from responding to any instructions when receiving instructions.

[0067] In another example, the security emergency strategy with the security risk level of low risk may include a communication shielding strategy associated with low risk and a read-write shielding strategy associated with low risk. The communication shielding strategy associated with low risk at least includes: based on the communication editing operation of the industrial interconnected device predicted to be attacked, prohibiting the communication between the abnormally operating industrial interconnected device and the normally operating industrial interconnected device; the read-write shielding strategy associated with low risk at least includes: when the industrial interconnected device predicted to be attacked receives the relevant instruction containing address information, prohibiting the response to the relevant instruction.

[0068] Reference Figure 4 , shows a flowchart of the steps of another method for emergency response to major hazardous sources based on the industrial Internet provided by an embodiment of the present invention, the method may include:

[0069] S401. When abnormal code operation is monitored, the abnormal code is used to match preset abnormal penetration rules to determine the industrial Internet device with abnormal operation caused by the abnormal code and the corresponding abnormal operation module in the industrial Internet device with abnormal operation.

[0070] S402: Determine an abnormal propagation path based on the abnormally operating industrial Internet device and the corresponding abnormally operating module.

[0071] In the embodiment of the present invention, the description of steps S401-S402 refers to the description of steps S201-S202.

[0072] S403. Query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path, wherein the risk attribute information includes the equipment risk value and the module risk value.

[0073] In an embodiment of the present invention, the risk attribute information is used to distinguish the degree to which each industrial Internet device can withstand security risks. For example, the risk attribute information may include a device risk value and a module risk value. The device risk value is used to characterize the degree to which each industrial Internet device can withstand security risks, and the module risk value is used to characterize the degree to which different process modules in each industrial Internet device can withstand security risks.

[0074] The abnormal propagation tree is used to characterize the risk association relationship between the abnormally operating industrial Internet devices and the abnormally operating process modules, and the security risk information of the abnormal propagation path, which can be understood as a risk association map corresponding to the abnormal code. Therefore, when the abnormal propagation tree is determined, the security risk information of the abnormal propagation path can be used as the root node, the abnormally operating industrial Internet device (or the device identifier corresponding to different industrial Internet devices) can be used as the first child node subordinate to the root node, and the abnormally operating process module in the abnormally operating industrial Internet device (or the module identifier corresponding to different abnormal modules) can be used as the second child node subordinate to the first child node.

[0075] Correspondingly, the device risk value associated with the abnormally running industrial interconnected device is used as the edge attribute information of the first connection edge between the root node and the first child node subordinate to the root node. The module risk value associated with the abnormally running process module is used as the edge attribute information of the second connection edge between the first child node and the second child node subordinate to the first child node, and so on, thereby obtaining an abnormal propagation tree, and based on the abnormal propagation tree, obtaining the risk association relationship of all abnormal propagation paths.

[0076] S404: Determine the security risk value of the abnormal propagation path according to the device risk values ​​associated with all the first sub-nodes in the abnormal propagation tree and the module risk values ​​associated with all the second sub-nodes corresponding to each first sub-node.

[0077] In the embodiment of the present invention, since the abnormal propagation tree can characterize the risk association relationship of the abnormal code to the industrial Internet devices of the system after the abnormal code is run, the risk attribute information can be weighted and risk statistics can be performed from the second child node to the first child node, and then from the first child node to the root node, so that the security risk information corresponding to the abnormal code can be comprehensively determined. Among them, the security risk information can characterize the degree of impact of the abnormal code on the current operation security of the industrial Internet.

[0078] In one example, the higher the risk value, the greater the impact of the current industrial Internet device, or a process module in the current industrial Internet device, on the normal operation of the industrial Internet system. On the contrary, the lower the risk value, the smaller the impact of the current industrial Internet device, or a process module in the current industrial Internet device, on the normal operation of the industrial Internet system. For example, the industrial Internet devices corresponding to the platform layer and the network layer have a greater impact on the normal operation of the industrial Internet system, and the corresponding device risk value is high. By analogy, the security risk information corresponding to the abnormal code can be comprehensively determined by comprehensively combining the risk values ​​distributed at different levels. Among them, the security risk information can characterize the impact of the abnormal code on the operational security of the current industrial Internet.

[0079] In one example, the security risk information may include a security risk value, and the security risk value of the abnormal propagation path may be determined according to the following formula (2).

[0080] Formula (2)

[0081] In the above formula (2), G refers to the security risk value; n refers to the total number of first child nodes in the anomaly propagation tree; i refers to the i-th first child node in the anomaly propagation tree; Z i Refers to the equipment risk value associated with the first child node of the ith node; m i refers to the total number of second child nodes corresponding to the i-th first child node; j refers to the j-th second child node associated with the first child node; Z ij Refers to the module risk value associated with the jth second child node associated with the ith first child node, where the module risk value is a weight coefficient distributed between 0 and 1. Therefore, for the ith first child node, the m i The module risk values ​​associated with the second sub-nodes are accumulated respectively, and then multiplied with the device risk value associated with the i-th first sub-node to obtain the weighted risk value corresponding to the i-th first sub-node, and then the weighted risk values ​​corresponding to the n first sub-nodes are accumulated to determine the safety risk value of the abnormal propagation path.

[0082] S405: Match a security emergency strategy associated with the security risk value, wherein the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy.

[0083] S406: Issue the security emergency response strategy so that the industrial Internet device predicted to be attacked executes the security emergency response strategy to perform device communication shielding and read-write shielding.

[0084] In an embodiment of the present invention, a policy is matched according to the security risk value, and a security emergency policy associated with the security risk information is matched. Among them, the security emergency policy may include a communication shielding policy and a read-write shielding policy. Thereby, the security emergency policy is sent to the industrial Internet device predicted to be attacked by the network, or the security emergency policy is sent to all industrial Internet devices, so that the industrial Internet devices predicted to be attacked by the network can execute the security emergency policy and perform device communication shielding and read-write shielding. Therefore, while ensuring that the industrial Internet devices attacked by abnormal codes are shielded by software, it can also ensure that other industrial Internet devices in the system that are not affected by abnormal codes can operate normally, reducing the security risks of the industrial Internet and reducing the losses caused to manufacturers by system crashes.

[0085] In one example, a person skilled in the art may preset a risk threshold, for example, when the security risk value is greater than or equal to the risk threshold, it is determined to be a high risk, and the corresponding security emergency strategy may refer to the security emergency strategy associated with the high risk described in the above embodiment. When the security risk value is less than the risk threshold, it is determined to be a low risk, and the corresponding security emergency strategy may refer to the security emergency strategy associated with the high risk described in the above embodiment. In other embodiments, the risk threshold may include a first risk threshold and a second risk threshold, etc. Thus, multiple security emergency strategies may be pre-set according to the distribution intervals of different security risk values ​​to ensure that when abnormal code operation is detected, risk assessment is performed in a timely manner, rather than directly disconnecting the network connection in the industrial Internet, so as to ensure that other industrial Internet devices in the system that are not affected by the abnormal code can operate normally, reduce the security risks of the industrial Internet, and reduce the losses caused to manufacturers by system crashes.

[0086] In summary, an embodiment of the present invention provides a method for emergency handling of major hazardous sources based on the industrial Internet. The method includes first determining the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored, and then querying the risk attribute information of the industrial Internet, and determining the abnormal propagation tree based on the risk attribute information and the abnormal propagation path. Then, based on the abnormal propagation tree, the security risk information corresponding to the abnormal code is determined. Finally, the security emergency strategy associated with the security risk information is matched, and the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy. And the security emergency strategy is issued so that the industrial Internet device predicted to be attacked executes the security emergency strategy, and performs device communication shielding and read-write shielding. Thus, when an abnormal code is detected in the system, the security risk information of the abnormal code for the system can be predicted, and the corresponding security emergency strategy can be determined based on the security risk information, so that the industrial Internet device attacked by the abnormal code can be shielded by software while ensuring that other industrial Internet devices in the system can operate normally, reducing the security risk of the industrial Internet.

[0087] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0088] Reference Figure 5 , shows a major hazard source safety emergency treatment device based on industrial Internet provided by an embodiment of the present invention, the device may include:

[0089] The path confirmation module 501 is used to determine the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored to be running.

[0090] The propagation tree determination module 502 is used to query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path.

[0091] The risk information confirmation module 503 is used to determine the security risk information corresponding to the abnormal code according to the abnormal propagation tree.

[0092] The policy matching module 504 is used to match the security emergency policy associated with the security risk information, wherein the security emergency policy includes a communication shielding policy and a read-write shielding policy.

[0093] The policy issuing module 505 is used to issue the security emergency policy so that the industrial interconnected device predicted to be attacked executes the security emergency policy and performs device communication shielding and read-write shielding.

[0094] In an optional embodiment of the invention, the path confirmation module 501 may include:

[0095] The abnormality determination submodule is used to adopt the abnormality code, match the preset abnormality penetration rules, determine the industrial Internet device with abnormal operation caused by the abnormality code, and the corresponding abnormal operation module in the industrial Internet device with abnormal operation.

[0096] The path confirmation submodule is used to determine the abnormal propagation path based on the abnormally operating industrial Internet device and the corresponding abnormal operation module.

[0097] In an optional embodiment of the invention, the device may further include a configuration module for the risk attribute information, and the configuration module may include:

[0098] The identification acquisition submodule is used to obtain the device identifications of all industrial interconnected devices and the module identifications of all running modules in each industrial interconnected device.

[0099] The risk information configuration submodule is used to configure device risk information for the device identifier and configure module risk information for the module identifier in response to the risk configuration instruction.

[0100] The attribute information determination submodule is used to determine the device risk information associated with the device identifier and the module risk information associated with the corresponding module identifier as risk attribute information.

[0101] In an optional embodiment of the invention, the propagation tree determination module 502 may include:

[0102] The first node determines the submodule, which is used to use the security risk information of the abnormal propagation path as the root node of the abnormal propagation tree, the device identifier corresponding to the industrial Internet device with the abnormal operation as the first child node of the abnormal propagation tree, and the device risk information associated with the device identifier as the edge attribute information corresponding to the first connection edge connecting the first child node and the root node.

[0103] The second node determines a submodule, which is used to use the module identifier corresponding to the abnormal operation module in each abnormally operating industrial Internet device as the second subnode corresponding to the first subnode, and the module risk information associated with the module identifier as the edge attribute information corresponding to the second connection edge connecting the second subnode and the first subnode, to obtain an abnormal propagation tree.

[0104] In an optional embodiment of the invention, the risk information confirmation module 503 may also be used to:

[0105] The security risk information of the abnormal propagation path is determined based on the device risk information associated with all the first sub-nodes in the abnormal propagation tree and the module risk information associated with all the second sub-nodes corresponding to each first sub-node.

[0106] In an optional embodiment of the invention, the device risk information includes a device risk level, the module risk information includes a module risk level, and the risk information confirmation module 503 may include:

[0107] The first risk confirmation submodule is used to determine the security risk level of the abnormal propagation path according to the device risk level associated with all the first subnodes in the abnormal propagation tree and the module risk level associated with all the second subnodes corresponding to each first subnode.

[0108] In an optional embodiment of the invention, the first risk confirmation submodule may also be used for:

[0109] According to the device risk levels associated with all first child nodes in the abnormal propagation tree and the module risk levels associated with all second child nodes corresponding to each first child node, the security risk level of the abnormal propagation path is determined according to the following formula;

[0110]

[0111] In the above formula, D refers to the security risk level; U S Refers to the total number of nodes with high risk level associated with all first child nodes; U1 refers to the total number of nodes with high risk level associated with the preset first child nodes; U m It refers to the total number of nodes with high risk level of modules associated with all second child nodes; U2 refers to the total number of nodes with high risk level of modules associated with the preset second child nodes; D1 refers to high risk; D2 refers to low risk.

[0112] In an optional embodiment of the invention, the device risk information includes a device risk value, the module risk information includes a module risk value, and the risk information confirmation module 503 may include:

[0113] The second risk confirmation submodule is used to determine the security risk value of the abnormal propagation path based on the device risk values ​​associated with all the first subnodes in the abnormal propagation tree and the module risk values ​​associated with all the second subnodes corresponding to each first subnode.

[0114] In an optional embodiment of the invention, the second risk confirmation submodule may also be used for:

[0115] Based on the device risk values ​​associated with all first child nodes in the abnormal propagation tree and the module risk values ​​associated with all second child nodes corresponding to each first child node, the security risk value of the abnormal propagation path is determined according to the following formula.

[0116]

[0117] In the above formula, G refers to the security risk value; n refers to the total number of first child nodes in the anomaly propagation tree; i refers to the i-th first child node in the anomaly propagation tree; Z i Refers to the equipment risk value associated with the first child node of the ith node; m i refers to the total number of second child nodes corresponding to the i-th first child node; j refers to the j-th second child node associated with the first child node; Z ij Refers to the module risk value associated with the jth second child node associated with the i-th first child node.

[0118] In summary, an embodiment of the present invention provides a major hazard source safety emergency processing device based on the industrial Internet. The device includes first determining the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored, and then querying the risk attribute information of the industrial Internet, and determining the abnormal propagation tree based on the risk attribute information and the abnormal propagation path. Then, based on the abnormal propagation tree, determine the security risk information corresponding to the abnormal code. Finally, match the security emergency strategy associated with the security risk information, and the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy. And issue the security emergency strategy so that the industrial Internet device predicted to be attacked executes the security emergency strategy to perform device communication shielding and read-write shielding. Therefore, when the system detects that an abnormal code appears, the security risk information of the abnormal code for the system can be predicted, and the corresponding security emergency strategy can be determined based on the security risk information, so that the industrial Internet device attacked by the abnormal code can be shielded by software while ensuring that other industrial Internet devices in the system can operate normally, reducing the security risk of the industrial Internet.

[0119] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0120] It is easy for a person skilled in the art to think that any combination of the above embodiments is feasible, so any combination of the above embodiments is an implementation scheme of the present invention. However, due to space limitations, this specification will not describe them in detail here.

[0121] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0122] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those expressly recited in each claim. Rather, as reflected in the claims, inventive aspects lie in less than all of the features of the individual embodiments previously disclosed. Therefore, the claims that follow the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present invention.

[0123] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and further may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device so disclosed may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0124] An electronic device, comprising:

[0125] one or more processors;

[0126] Memory;

[0127] One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method described in the above embodiment.

[0128] A computer-readable storage medium stores a computer program used in combination with an electronic device, wherein the computer program can be executed by a processor to implement the method described in the above embodiment.

[0129] It should be understood by those skilled in the art that the embodiments of the present invention can be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0130] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0133] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0134] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0135] The above is a detailed introduction to a major hazard source safety emergency response method based on the industrial Internet and a major hazard source safety emergency response device based on the industrial Internet provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for emergency response to hazardous sources based on the industrial Internet, characterized in that: The method comprises: When abnormal code is detected, the abnormal propagation path corresponding to the abnormal code is determined; Query the risk attribute information of the industrial Internet, and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path; Determining the security risk information corresponding to the exception code according to the exception propagation tree; Matching a security emergency strategy associated with the security risk information, wherein the security emergency strategy includes a communication shielding strategy and a read-write shielding strategy; The security emergency strategy is issued so that the industrial interconnected device predicted to be attacked executes the security emergency strategy to perform device communication shielding and read-write shielding. Wherein, determining the exception propagation path corresponding to the exception code includes: The abnormal code is used to match the preset abnormal penetration rule, and the industrial interconnected device with abnormal operation caused by the abnormal code and the corresponding abnormal operation module in the industrial interconnected device with abnormal operation are determined; According to the abnormally operating industrial interconnected device and the corresponding abnormal operating module, the abnormal propagation path is determined. Wherein, determining the abnormal propagation tree corresponding to the abnormal propagation path according to the risk attribute information and the abnormal propagation path includes: The security risk information of the abnormal propagation path is used as the root node of the abnormal propagation tree, the device identifier corresponding to the abnormally operating industrial interconnected device is used as the first child node of the abnormal propagation tree, and the device risk information associated with the device identifier is used as the edge attribute information corresponding to the first connection edge connecting the first child node and the root node; The module identifier corresponding to the abnormal operation module in each abnormally operating industrial interconnected device is used as the second child node corresponding to the first child node, and the module risk information associated with the module identifier is used as the edge attribute information corresponding to the second connection edge connecting the second child node and the first child node, to obtain an abnormal propagation tree. Wherein, determining the security risk information corresponding to the abnormal code according to the abnormal propagation tree includes: Determine the security risk information of the abnormal propagation path according to the device risk information associated with all the first child nodes in the abnormal propagation tree and the module risk information associated with all the second child nodes corresponding to each first child node, Wherein, the device risk information includes the device risk level, and the module risk information includes the module risk level; The determining of the security risk information of the abnormal propagation path according to the device risk information associated with all first child nodes in the abnormal propagation tree and the module risk information associated with all second child nodes corresponding to each first child node includes: The security risk level of the abnormal propagation path is determined according to the device risk level associated with all the first sub-nodes in the abnormal propagation tree and the module risk level associated with all the second sub-nodes corresponding to each first sub-node.

2. The method for emergency response to hazardous sources based on industrial Internet according to claim 1 is characterized in that: The method further comprises a step of configuring the risk attribute information, the step of configuring comprising: Obtain device identifications of all industrial interconnected devices and module identifications of all running modules in each industrial interconnected device; In response to the risk configuration instruction, configuring device risk information for the device identifier and configuring module risk information for the module identifier; The device risk information associated with the device identification and the module risk information associated with the corresponding module identification are determined as risk attribute information.

3. The method for emergency response to hazardous sources based on industrial Internet according to claim 1 is characterized in that: The device risk information includes a device risk value, and the module risk information includes a module risk value; The determining of the security risk information of the abnormal propagation path according to the device risk information associated with all first child nodes in the abnormal propagation tree and the module risk information associated with all second child nodes corresponding to each first child node includes: The security risk value of the abnormal propagation path is determined based on the device risk values ​​associated with all the first sub-nodes in the abnormal propagation tree and the module risk values ​​associated with all the second sub-nodes corresponding to each first sub-node.

4. The method for emergency response to hazardous sources based on industrial Internet according to claim 3 is characterized in that: The determining of the security risk value of the abnormal propagation path according to the device risk values ​​associated with all first child nodes in the abnormal propagation tree and the module risk values ​​associated with all second child nodes corresponding to each first child node includes: According to the device risk values ​​associated with all first child nodes in the abnormal propagation tree and the module risk values ​​associated with all second child nodes corresponding to each first child node, the security risk value of the abnormal propagation path is determined according to the following formula; In the above formula, G refers to the security risk value; n refers to the total number of first child nodes in the anomaly propagation tree; i refers to the i-th first child node in the anomaly propagation tree; Z i Refers to the equipment risk value associated with the first child node of the ith node; m i refers to the total number of second child nodes corresponding to the i-th first child node; j refers to the j-th second child node associated with the first child node; Z ij Refers to the module risk value associated with the jth second child node associated with the i-th first child node.

5. A hazardous source safety emergency processing device based on the industrial Internet, executing the hazardous source safety emergency processing method based on the industrial Internet according to any one of claims 1 to 4, characterized in that: The device comprises: A path confirmation module is used to determine the abnormal propagation path corresponding to the abnormal code when the abnormal code is monitored to be running; A propagation tree determination module is used to query the risk attribute information of the industrial Internet and determine the abnormal propagation tree based on the risk attribute information and the abnormal propagation path; A risk information confirmation module, used to determine the security risk information corresponding to the abnormal code according to the abnormal propagation tree; A policy matching module, used to match a security emergency policy associated with the security risk information, wherein the security emergency policy includes a communication shielding policy and a read-write shielding policy; The strategy issuing module is used to issue the security emergency strategy so that the industrial Internet device predicted to be attacked executes the security emergency strategy and performs device communication shielding and read-write shielding.

Images