Industrial data security protection method and system

Abstract

The present invention relates to the field of industrial data security protection technology, and discloses an industrial data security protection method and system, the system includes a data acquisition module and a security protection module. The protection method includes the following steps: step 1, the data acquisition module identifies security vulnerabilities to form vulnerability data sets and node data sets; step 2, the security protection module analyzes and generates isolation zones; step 3, the security protection module cuts off the original connection channels of network nodes; step 4, the long-short time neural network determines the attack mode, the security protection module obtains the original patches from different sources, and strictly manages the patch repair process with high security; step 5, the long-short time neural network matches and generates the corresponding patch data group; step 6, the long-short time neural network analyzes and generates an encryption shield, and the collaborative encryption system has good security protection capabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial data security protection, and in particular to an industrial data security protection method and system. Background Art

[0002] Industrial data mainly includes enterprise operation data, production line equipment interconnection data and enterprise external data. These data are generated at various stages of the product life cycle and are widely used to optimize the production process, improve operational efficiency and promote innovative decision-making. Enterprise operation data mainly comes from various information management systems within the enterprise, such as PLM, ERP, MES, SCM and CRM. The data generated by these systems include product information, process parameters, production plans, purchase orders, customer service records, etc. Through in-depth analysis of these structured data, enterprises can better understand their own operating conditions, find opportunities to improve production processes, and improve overall efficiency. Production line equipment interconnection data comes from physical equipment in the production process, such as sensors, PLCs and SCADA systems on the production line. These devices generate a large amount of time series data in real time, including equipment operating status, environmental parameters, working condition data, etc. These data are not only large in volume but also collected frequently, which is crucial for real-time monitoring and control of the production process. Enterprise external data covers user working condition data, operation data, maintenance service data after product delivery, as well as market information and environmental data obtained from external environments such as the Internet, supply chain, and online communities. This data is of great value to enterprises in understanding market demand, optimizing customer service, and formulating market strategies. Industrial data is an important asset of modern industrial enterprises, and its management and application level is directly related to the production efficiency and market competitiveness of enterprises. Through effective classification, grading and management, enterprises can better utilize this data to achieve digital transformation and high-quality development.

[0003] At present, in the face of existing security vulnerabilities, traditional industrial data security protection methods only rely on network patches for reactive patching. During the patching period, key data is also at risk of being stolen or destroyed. In addition, the source of network patches can be from within the system or from external suppliers and communities. Strict management of network patches distributed through unofficial channels is also key to preventing industrial data leaks. Poor patch management can easily lead to system instability and even introduce new security vulnerabilities. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the shortcomings of the prior art, the present invention provides an industrial data security protection method and system, which has the advantages of strict management of patch repair process with high security and good collaborative encryption system security protection capability. It solves the problem that traditional industrial data security protection methods rely solely on network patches to repair security vulnerabilities and have poor system security protection capability due to poor patch management.

[0006] (II) Technical solution

[0007] To achieve the above object, the present invention provides the following technical solution: an industrial data security protection method, comprising the following steps:

[0008] Step 1: The data collection module uses the OpenVAS vulnerability scanning tool to identify security vulnerabilities, obtain the exposed service port information and the prediction information of the simulated attack logic, and classify them into vulnerability data sets and node data sets before transmitting them to the security protection module;

[0009] Step 2: The security protection module is equipped with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets ;

[0010] Step 3: Safety protection module according to the isolation zone Cut off the original connection channels of network nodes to limit the exposure scope of industrial data;

[0011] Step 4: Long and Short Time Neural Network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources according to different attack modes and stores them with tags.

[0012] Step 5: The security protection module substitutes the original patch and node data set into the long-short time neural network , matching to generate the corresponding patch data group , patch the exposed service ports;

[0013] Step 6: Long and Short Time Neural Network Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports .

[0014] Preferably, in step 1, the vulnerability data set includes the location data of the exposed service ports and the time point when the exposure is discovered. The expression of the vulnerability data set is: , to The location data of each exposed service port and the time when the exposure was discovered are listed in turn. Indicates the time when the service port is found to be exposed. Indicates the location data of the exposed service port, numbered from 1 to Indicates that the exposed service ports are indivual.

[0015] Preferably, in step 1, the node data set includes all network nodes and attack sequences involved in the simulated attack logic prediction, and the expression of the node data set is: , to Corresponding to each network node involved in the prediction, the numbers are numbered from 1 to Indicates that the simulated attack logic is arranged in the order of attack from early to late network nodes.

[0016] Preferably, in step 2, the isolation zone The calculation formula is as follows:

[0017]

[0018] In the formula, Indicates isolation zone. Indicates that all network nodes involved in the simulated attack logic prediction are indivual, Represents the total number of network nodes involved in the simulated attack logic prediction in the node dataset, Indicates the first The network node is also the one currently under attack. exposed service ports, Indicates that the exposed service port information and the predicted information of the simulated attack logic are substituted into the long-short time neural network , analyze and generate isolation zones that isolate network nodes.

[0019] Preferably, in step 3, the isolation zone There is storage space inside, and the safety protection module is based on the isolation zone In the process of cutting off the original connection channel of the network node, the isolation zone Agree to all data input requests and reject all data output requests.

[0020] Preferably, in step 4, if the earliest exposed service port in the vulnerability data set is located in the edge area of ​​the system, it means that the attack is intruding from the outside to the inside, and the trust level of the network patch from the external source is low. The security protection module obtains the original patch from the inside of the system, which is recorded as .

[0021] Preferably, in step 4, if the earliest exposed service port in the vulnerability data set is located in the central area of ​​the system, it means that the attack is from the inside out, the trust level of the internal network patch is low, and the security protection module obtains the original patch from outside the system, which is recorded as .

[0022] Preferably, in step 5, the patch data set The calculation formula is as follows:

[0023]

[0024] In the formula, represents a patch data group, Represents long-short time neural network According to the predicted attack logic, all network nodes involved match the original patch inside the source system. Represents long-short time neural network All network nodes involved in the predicted attack logic are matched against the original patch external to the source system.

[0025] Preferably, in step six, encryption shield The calculation formula is as follows:

[0026]

[0027] In the formula, Indicates encryption shield, represents the encryption weight for the isolation zone, Indicates the first The encryption weight of the exposed service port, Indicates according to Weight and Weight, priority analysis to generate isolation zones The encryption shield is then analyzed to generate an encryption shield for the exposed service port.

[0028] An industrial data security protection system includes a data acquisition module and a security protection module;

[0029] The data collection module identifies security vulnerabilities through the OpenVAS vulnerability scanning tool, collects vulnerability data sets and node data sets, and transmits them to the security protection module;

[0030] The safety protection module is provided with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets Then cut off the original connection channel of the network node, long and short time neural network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources based on different attack modes and stores them with labels. The long and short time neural network Generate the corresponding patch data set based on the original patch and node data set matching , long short time neural network Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports .

[0031] Compared with the prior art, the present invention provides an industrial data security protection method and system, which has the following beneficial effects:

[0032] 1. The present invention connects the OpenVAS vulnerability scanning tool to identify security vulnerabilities through the data acquisition module. OpenVAS can scan open ports, misconfigurations and vulnerabilities in servers and network devices, and automatically generate reports, providing detailed information on each vulnerability, such as risk level, description, solution, etc., so as to help the data acquisition module obtain the exposed service port information and the prediction information of the simulated attack logic, and classify and form the vulnerability data set and node data set and transmit them to the security protection module. The security protection module is provided with a long-short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets , the safety protection module is based on the isolation zone Cut off the original connection channels of network nodes, limit the exposure scope of industrial data, effectively prevent new network attacks, slow down the attack speed, and gain a certain amount of processing time for subsequent patch downloads, patch repairs and data encryption. The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources according to different attack modes, and stores them after labeling. The patch repair process is strictly managed to ensure high security.

[0033] 2. The present invention substitutes the original patch and node data set into the long-short time neural network through the security protection module , matching to generate the corresponding patch data group , patch the exposed service ports and select patches that are highly compatible with the existing system, which not only ensures the stable operation of the system, but also reduces the exposure of the attack surface. Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports , the collaborative encryption system has good security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a step diagram of the method of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] In the face of existing security vulnerabilities, traditional industrial data security protection methods only rely on network patches for reactive patching. During the patching period, key data is also at risk of being stolen or destroyed. In addition, the source of network patches can be from within the system or from external suppliers and communities. Strict management of network patches distributed through unofficial channels is also the key to preventing industrial data leakage. Poor patch management can easily lead to system instability and even introduce new security vulnerabilities. Therefore, an industrial data security protection method and system are proposed. Please refer to Figure 1 , an industrial data security protection method, comprising the following steps:

[0037] Step 1: The data collection module identifies security vulnerabilities through the OpenVAS vulnerability scanning tool. OpenVAS can scan open ports, misconfigurations, and vulnerabilities in servers and network devices, and automatically generate reports that provide detailed information about each vulnerability, such as risk level, description, and solution, to help the data collection module obtain information about exposed service ports and prediction information of simulated attack logic, and classify them into vulnerability data sets and node data sets before transmitting them to the security protection module.

[0038] The vulnerability dataset includes the location data of the exposed service ports and the time point when the exposure was discovered. The expression of the vulnerability dataset is: , to The location data of each exposed service port and the time when the exposure was discovered are listed in turn. Indicates the time when the service port is exposed and records the time when the security vulnerability occurs, so as to facilitate the subsequent calculation of the attack trend in chronological order. Indicates the location data of the exposed service ports, which facilitates accurate positioning of the exposed service ports and makes subsequent patch repairs more timely and effective. The numbers are 1 to Indicates that the exposed service ports are indivual;

[0039] The node data set includes all network nodes and attack sequences involved in the simulated attack logic prediction. The expression of the node data set is: , to Corresponding to each network node involved in the prediction, the attack strategy is predicted from the perspective of the attacker, and the hidden risk points in the current system are fully revealed. The numbers are numbered from 1 to Indicates that the simulated attack logic is arranged in the order of attack from early to late A network node, a single network node includes but is not limited to a single or multiple service ports;

[0040] Step 2: The security protection module is equipped with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets , and its calculation formula is as follows:

[0041]

[0042] In the formula, Indicates isolation zone. Indicates that all network nodes involved in the simulated attack logic prediction are indivual, Represents the total number of network nodes involved in the simulated attack logic prediction in the node dataset, Indicates the first The network node is also the one currently under attack. exposed service ports, Indicates that the exposed service port information and the predicted information of the simulated attack logic are substituted into the long-short time neural network , analyze and generate isolation zones that isolate network nodes. Isolation zones can effectively prevent new network attacks, slow down the attack speed, and buy a certain amount of processing time for subsequent patch downloads, patch repairs, and data encryption;

[0043] Step 3: Safety protection module according to the isolation zone In the process of cutting off the original connection channel of the network node, the isolation zone There is storage space and isolation zone inside Approve all data input applications, reject all data output applications, limit the exposure scope of industrial data, and prevent external attacks from continuing to access the core key data of the system unless the attacker continues to break through the isolation zone Defense line, obtain sufficient permissions to carry out effective attacks;

[0044] Step 4: Long and Short Time Neural Network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources according to different attack modes and stores them with labels. If the earliest exposed service port in the vulnerability data set is located at the edge of the system, it means that the attack is intruding from the outside to the inside. The trust level of the network patch from the external source is low. The security protection module obtains the original patch from the system, which is recorded as If the earliest exposed service port in the vulnerability data set is located in the central area of ​​the system, it means that the attack is from the inside out, the trust level of the internal network patch is low, and the security protection module obtains the original patch from outside the system, which is recorded as , strictly manage the patch repair process and ensure high security;

[0045] Step 5: The security protection module substitutes the original patch and node data set into the long-short time neural network , matching to generate the corresponding patch data group , patch the exposed service ports, the calculation formula is as follows:

[0046]

[0047] In the formula, represents a patch data group, Represents long-short time neural network According to the predicted attack logic, all network nodes involved match the original patch inside the source system. Represents long-short time neural network Match the original patches outside the source system according to all network nodes involved in the predicted attack logic, and select patches that are highly compatible with the existing system, which not only ensures the stable operation of the system, but also reduces the exposure of the attack surface;

[0048] Step 6: Long and Short Time Neural Network Based on node data sets and isolation zones , analyze and generate encrypted shield , and its calculation formula is as follows:

[0049]

[0050] In the formula, Indicates encryption shield, represents the encryption weight for the isolation zone, Indicates the first The encryption weight of the exposed service port, Indicates according to Weight and Weight, priority analysis to generate isolation zones The encryption shield is then analyzed and generated for the exposed service ports, further limiting the scope of attack and strengthening the protection of key system data;

[0051] Safety protection modules are built first for isolation zones Encryption Shield , and then build an encryption shield for exposed service ports , the collaborative encryption system has good security protection capabilities.

[0052] The above industrial data security protection method is implemented based on an industrial data security protection system, which includes a data acquisition module and a security protection module;

[0053] The data collection module uses the OpenVAS vulnerability scanning tool to identify security vulnerabilities, collects vulnerability data sets and node data sets, and transmits them to the security protection module;

[0054] The safety protection module is equipped with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets Then cut off the original connection channel of the network node, cut off the feasible channel for continuing the attack, and the long and short time neural network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources according to different attack modes, and stores them with tags. The patch repair process is strictly managed with high security and long and short time neural networks. Generate the corresponding patch data set based on the original patch and node data set matching , long short time neural network Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports , the collaborative encryption system has good security protection capabilities.

[0055] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An industrial data security protection method, characterized in that: The following steps are involved: Step 1: The data collection module uses the OpenVAS vulnerability scanning tool to identify security vulnerabilities, obtain the exposed service port information and the prediction information of the simulated attack logic, and classify them into vulnerability data sets and node data sets before transmitting them to the security protection module; Step 2: The security protection module is equipped with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets ; Isolation belt The calculation formula is as follows: ； In the formula, Indicates isolation zone. Indicates that all network nodes involved in the simulated attack logic prediction are indivual, Represents the total number of network nodes involved in the simulated attack logic prediction in the node dataset, Indicates the first The network node is also the one currently under attack. exposed service ports, Indicates that the exposed service port information and the predicted information of the simulated attack logic are substituted into the long-short time neural network , analyze and generate isolation zones that isolate network nodes; Step 3: Safety protection module according to the isolation zone Cut off the original connection channels of network nodes to limit the exposure scope of industrial data; Step 4: Long and Short Time Neural Network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources according to different attack modes and stores them with tags. Step 5: The security protection module substitutes the original patch and node data set into the long-short time neural network , matching to generate the corresponding patch data group , patch the exposed service ports; Step 6: Long and Short Time Neural Network Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports .

2. The industrial data security protection method according to claim 1, characterized in that: In step 1, the vulnerability data set includes the location data of the exposed service ports and the time point when the exposure was discovered. The expression of the vulnerability data set is: , to The location data of each exposed service port and the time when the exposure was discovered are listed in turn. Indicates the time point when the service port is found to be exposed. Indicates the location data of the exposed service port, numbered from 1 to Indicates that the exposed service ports are indivual.

3. The industrial data security protection method according to claim 2, characterized in that: In step 1, the node data set includes all network nodes and attack sequences involved in the simulated attack logic prediction. The expression of the node data set is: , to Corresponding to each network node involved in the prediction, the numbers are numbered from 1 to Indicates that the simulated attack logic is arranged in the order of attack from early to late network nodes.

4. The industrial data security protection method according to claim 3 is characterized in that: In step 3, the isolation zone There is storage space inside, and the safety protection module is based on the isolation zone In the process of cutting off the original connection channel of the network node, the isolation zone Agree to all data input requests and reject all data output requests.

5. The industrial data security protection method according to claim 4, characterized in that: In step 4, if the earliest exposed service port in the vulnerability data set is located in the edge area of ​​the system, it means that the attack is intruding from the outside to the inside, and the trust level of the network patch from the external source is low. The security protection module obtains the original patch from the system, which is recorded as .

6. The industrial data security protection method according to claim 5, characterized in that: In step 4, if the earliest exposed service port in the vulnerability data set is located in the central area of ​​the system, it means that the attack is from the inside out, the trust level of the internal network patch is low, and the security protection module obtains the original patch from outside the system, which is recorded as .

7. An industrial data security protection method according to claim 6, characterized in that: In step 5, the patch data set The calculation formula is as follows: ； In the formula, represents a patch data group, Represents long-short time neural network According to the predicted attack logic, all network nodes involved match the original patch inside the source system. Represents long-short time neural network All network nodes involved in the predicted attack logic are matched against the original patch external to the source system.

8. The industrial data security protection method according to claim 7, characterized in that: Step 6: Encryption Shield The calculation formula is as follows: ； In the formula, Indicates encryption shield, represents the encryption weight for the isolation zone, Indicates the first The encryption weight of the exposed service port, Indicates according to Weight and Weight, priority analysis to generate isolation zones The encryption shield is then analyzed to generate an encryption shield for the exposed service port.

9. An industrial data security protection system, used in the industrial data security protection method according to any one of claims 1 to 8, characterized in that: Including data acquisition module and security protection module; The data collection module identifies security vulnerabilities through the OpenVAS vulnerability scanning tool, collects vulnerability data sets and node data sets, and transmits them to the security protection module; The safety protection module is provided with a long and short time neural network , long short time neural network Analyze and generate isolation zones based on vulnerability datasets and node datasets Then cut off the original connection channel of the network node, long and short time neural network The attack mode is determined based on the vulnerability data set. The security protection module obtains original patches from different sources based on different attack modes and stores them with labels. The long and short time neural network Generate the corresponding patch data set based on the original patch and node data set matching , long short time neural network Based on node data sets and isolation zones , analyze and generate encrypted shield , the safety protection module is built first for the isolation zone Encryption Shield , and then build an encryption shield for exposed service ports .

Images