A logistics warehouse network security early warning method based on application data

Abstract

The present invention discloses a network security early warning method for a logistics warehouse based on application data, which relates to the field of logistics information technology. The method comprises: collecting public network data of logistics warehouse scheduling equipment, regional network data of storage management equipment and operator operation data. Based on historical public network, regional network and operation data and security records, correlation analysis is performed to obtain respective correlation parameters. Data scarcity and frequency abnormality parameters are analyzed based on historical data. Network security analysis is performed on historical public network, regional network and operation data to obtain public network, regional network and operation network security parameters. Network security parameters are adjusted according to data scarcity and frequency abnormality parameters. Risk identification and early warning are performed in combination with network security parameters processed by integrating the adjusted parameters with the associated parameters. The technical problem of low accuracy in the existing network security early warning analysis process of logistics warehouses is solved, and the technical effect of improving the accuracy of network security early warning of logistics warehouses is achieved.

Description

Technical Field

[0001] The present application relates to the field of logistics information technology, and in particular to a logistics warehouse network security early warning method based on application data. Background Art

[0002] In the logistics warehouse network security management scenario, as logistics business relies more and more on the network, network security risks are becoming increasingly prominent. Efficient and accurate network security warning has become a crucial link in ensuring the safety of logistics warehouses. Traditional logistics warehouse network security warning has low data relevance, only focuses on a single type of data, and ignores the connection between different data; it does not take into account the characteristics of the data itself, and does not deeply analyze the impact of factors such as data scarcity and frequency anomalies on network security; it has low accuracy, making it difficult to accurately assess network security risk conditions, and cannot issue warning signals in a timely and effective manner, and cannot cope well with the increasingly complex logistics warehouse network security situation.

[0003] At the current stage, relevant technologies have technical problems such as low data correlation, insufficient consideration of data characteristics, and low accuracy in the process of network security early warning analysis in logistics warehouses. Summary of the invention

[0004] The present application provides a network security early warning method for logistics warehouses based on application data, which collects public network data of dispatching equipment, regional network data of storage management equipment and operator operation data in logistics warehouses. Based on historical public network, regional network and operation data and security records, correlation analysis is performed to obtain respective correlation parameters. Data scarcity and frequency abnormality parameters are analyzed based on historical data. Network security analysis is performed on historical public network, regional network and operation data to obtain public network, regional network and operation network security parameters. Network security parameters are adjusted according to data scarcity and frequency abnormality parameters. Risk identification and early warning are performed in combination with network security parameters processed by fusion of adjusted parameters and associated parameters, which realizes parameter adjustment and fusion processing by collecting multiple data, performing correlation analysis and considering data characteristics.

[0005] The present application provides a logistics warehouse network security early warning method based on application data, including:

[0006] Collect the public network application data of the dispatching equipment connected to the public network in the logistics warehouse, the local area network application data of the storage management equipment connected to the internal local area network, and the operation data of the operator; perform correlation analysis based on the historical public network application data, historical local area network application data, historical operation data and historical warehouse network security record data of the logistics warehouse to obtain public network correlation parameters, local area network correlation parameters and operation correlation parameters; analyze the data scarcity parameters and frequency abnormality parameters of the public network application data, local area network application data and operation data based on the historical data; perform network security analysis on the public network application data, local area network application data and operation data to obtain public network network security parameters, local area network network security parameters and operation network security parameters; perform compensation adjustment on the public network network security parameters, local area network network security parameters and operation network security parameters according to the data scarcity parameters and frequency abnormality parameters to obtain adjusted public network network security parameters, adjusted local area network network security parameters and adjusted operation network security parameters; perform fusion processing based on the adjusted public network network security parameters, adjusted local area network network security parameters and adjusted operation network security parameters, combined with the public network correlation parameters, local area network correlation parameters and operation correlation parameters to obtain network security parameters for risk identification and early warning.

[0007] The network security early warning method for logistics warehouses based on application data proposed in this application first collects the dispatching equipment data connected to the public network, the storage management equipment data connected to the internal regional network, and the operator's operation data in the logistics warehouse. Then, based on the historical public network, regional network and operation data and security records, correlation analysis is performed to obtain the respective correlation parameters. Next, the data scarcity and frequency abnormality parameters are analyzed, and network security analysis is performed on these data to obtain the corresponding network security parameters. Compensation and adjustment are performed based on these parameters, and finally various correlation parameters are combined and fused to generate network security parameters for risk identification and early warning, thereby achieving the technical effect of improving the accuracy of network security early warning for logistics warehouses and providing reliable protection for network security of logistics warehouses. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0009] Figure 1 A flow chart of a logistics warehouse network security early warning method based on application data provided in an embodiment of the present application;

[0010] Figure 2 A schematic diagram of the correlation analysis process of a logistics warehouse network security early warning method based on application data provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0012] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0013] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0014] The present application embodiment provides a logistics warehouse network security early warning method based on application data, such as Figure 1 As shown, the method includes:

[0015] Step S100, collect the public network application data of the dispatching equipment connected to the public network in the logistics warehouse, the regional network application data of the warehouse management equipment connected to the internal regional network, and the operation data of the operator. Specifically, in the network security early warning of the logistics warehouse, first collect relevant data, including the public network application data of the dispatching equipment connected to the public network, such as the dispatching time and content, which can understand the interaction between the logistics warehouse and the outside and the potential network security risks; the regional network application data of the warehouse management equipment connected to the internal regional network, covering the management time and content, which is helpful for analyzing the internal network security status; and the operator's operation data, including the operation time and content, which can monitor the operator's behavior to reduce network security risks. By installing data collection software or sensors on the equipment, and using the operation log recording system or monitoring cameras, etc. to collect these data, and verify and verify them to ensure accuracy and completeness, it provides strong support for subsequent analysis and early warning, and improves the network security level of the logistics warehouse.

[0016] In a possible implementation, the public network application data of the dispatching device connected to the public network in the logistics warehouse, the regional network application data of the storage management device connected to the internal regional network, and the operation data of the operator are collected. Step S100 further includes step S110, collecting the dispatching time data and dispatching content data of the dispatching device connected to the public network in the logistics warehouse as the public network application data. Specifically, in the logistics warehouse, the dispatching device connected to the public network plays a key role. The collection of dispatching time data can accurately record the specific time when the cargo dispatch occurs. By analyzing the law of dispatching time, potential abnormal situations can be found. For example, if there are frequent dispatching operations during non-working hours, it means that there is a risk of unauthorized access or system attack. The dispatching content data includes detailed information such as the type, quantity, and destination of the dispatched cargo. The data not only reflects the business activities of the logistics warehouse, but is also closely related to network security. If there are abnormal changes in the dispatching content, such as a sudden large-scale dispatch of sensitive cargo or a dispatching instruction with an unknown destination, it may be a sign of a network attack. The attacker may destroy the normal operation of the logistics warehouse by tampering with the dispatching content.

[0017] Step S120, collect management time data and management content data of the warehouse management equipment connected to the internal area network in the logistics warehouse as the area network application data. Specifically, for the warehouse management equipment connected to the internal area network, the collection of management time data helps to understand the time distribution of management activities inside the warehouse. If there is an abnormal fluctuation in management time, such as frequent management operations in the middle of the night or during non-working hours, it may indicate that there is a security problem in the internal network. The attacker may try to obtain the goods information in the warehouse or destroy the inventory management system by manipulating the warehouse management equipment. The management content data includes information such as the warehousing, delivery, inventory counting, and warehouse location adjustment of the goods. The data reflects the logistics operation status inside the warehouse. By analyzing the management content data, abnormal operation modes can be found. For example, frequent warehouse location adjustments or unreasonable warehousing and delivery operations may be abnormal system behaviors caused by network attacks.

[0018] Step S130, collecting the operator's operation time and operation content data as operation data. Specifically, the collection of operation time data can help monitor the distribution of the operator's working hours. If the operator performs a large number of operations during abnormal working hours, there may be security risks. For example, the operator's account may be stolen by an attacker and used for malicious operations. The operation content data includes information about the operator's specific operations such as moving goods. By analyzing the operation content data, abnormal operation behaviors can be found. For example, the operator frequently operates specific goods or performs operations that do not comply with business processes. This may be affected by network attacks or the operator himself has improper behavior. In summary, by respectively collecting the scheduling time data and scheduling content data of the scheduling equipment connected to the public network, the management time data and management content data of the storage management equipment connected to the internal area network, and the operator's operation time and operation content data, the operation status of the logistics warehouse and the potential network security risks can be fully understood, providing an important data basis for subsequent network security warning and analysis.

[0019] Step S200, performing correlation analysis based on the historical public network application data, historical local network application data, historical operation data and historical warehouse network security record data of the logistics warehouse to obtain public network correlation parameters, local network correlation parameters and operation correlation parameters. Specifically, in the network security early warning of logistics warehouses, correlation analysis is performed based on the historical public network application data, historical regional network application data, historical operation data and historical warehouse network security record data of the logistics warehouse. The grey correlation analysis method is adopted, with the historical warehouse network security record data as the reference series, and the public network application data, regional network application data and operation data as the comparison series respectively. By calculating the grey correlation between each series and the reference series, the public network correlation parameters, regional network correlation parameters and operation correlation parameters are obtained. The parameters reflect the degree of correlation between the public network application, regional network application and operator operation and the warehouse network security, and can be used as key indicators for network security early warning. For example, parameter changes can indicate corresponding risks. For example, an increase in public network correlation parameters may mean that the public network dispatching equipment is at risk of being attacked, a change in regional network correlation parameters may indicate that there is a security vulnerability in the internal warehouse management system, and an abnormal operation correlation parameter may indicate that the operator has a problem with the behavior, thereby providing strong support for improving the network security level of logistics warehouses.

[0020] In one possible implementation, Figure 2 As shown, according to the historical public network application data, historical regional network application data, historical operation data and historical warehouse network security record data of the logistics warehouse, correlation analysis is performed to obtain public network correlation parameters, regional network correlation parameters and operation correlation parameters. Step S200 further includes step S210, collecting the historical public network application data sequence, historical regional network application data sequence and historical operation data sequence of the dispatching equipment, warehouse management equipment and operators. Specifically, the historical public network application data sequence, historical regional network application data sequence and historical operation data sequence of the dispatching equipment, warehouse management equipment and operators are collected. The historical data sequence covers various activity records of the logistics warehouse in the past period of time. For the dispatching equipment, the historical public network application data sequence includes a series of data for connecting to the public network for cargo dispatching in the past; for the warehouse management equipment, the historical regional network application data sequence records the warehouse management activities under the internal regional network environment; for the operator, the historical operation data sequence reflects his past operation behavior.

[0021] Step S220, the historical public network application data sequence, the historical regional network application data sequence, and the historical operation data sequence are divided into time data and content data, and the content data is digitally annotated to obtain the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, and the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence. Specifically, the collected historical public network application data sequence, the historical regional network application data sequence, and the historical operation data sequence are divided into time data and content data. The time data records the specific time when each activity occurs, and the content data contains the specific content of the activity. For example, for the historical public network application data of the dispatching device, the time data may be the time point when a certain dispatch occurs, and the content data may be information such as the type and quantity of the dispatched goods. The content data is digitally annotated, such as marking different content data as different digital codes to complete the digitization of the content data, which can make the content data easier to analyze and process. For example, "a certain amount of a certain type of goods" is defined as a specific digital code such as "10215". In this way, the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, as well as the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence are obtained.

[0022] Step S230, according to the historical network security data records of the logistics warehouse in the historical time, digital annotation is performed to obtain the historical warehouse network security data sequence. Specifically, according to the historical network security data records of the logistics warehouse in the historical time, digital annotation is performed. The historical network security data records various network security events experienced by the logistics warehouse in the past, such as the time, type, and impact of the attack. After digital annotation, the historical warehouse network security data sequence is obtained.

[0023] Step S240, the historical warehouse network security data sequence is combined with the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence to perform correlation analysis, and obtain public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters, as well as public network content correlation parameters, regional network content correlation parameters, and operation content correlation parameters. Specifically, the historical warehouse network security data sequence is combined with the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence to perform correlation analysis. For the correlation analysis of time data, the historical warehouse network security data sequence is used as a reference to analyze the historical public network time data sequence, the historical regional network time data sequence, and the historical operation time data sequence. For example, if network security events occur frequently in certain time periods and are close to the public network application time of the dispatching equipment, the regional network application time of the storage management equipment, or the operation time of the operator, then there may be a temporal correlation. Through this analysis, public network time correlation parameters, regional network time correlation parameters and operation time correlation parameters can be obtained. For the correlation analysis of content data, the historical warehouse network security data sequence is also used as a reference, and the historical public network content data sequence, historical regional network content data sequence, and historical operation content data sequence are analyzed respectively. If certain specific content data are associated with network security events, such as a certain type of cargo scheduling, specific warehouse management operations, or specific behaviors of operators occurring at the same time as network security events, then the content association can be determined. Through analysis, public network content correlation parameters, regional network content correlation parameters and operation content correlation parameters can be obtained.

[0024] Step S250, according to the public network time associated parameter, the regional network time associated parameter and the operation time associated parameter, as well as the public network content associated parameter, the regional network content associated parameter and the operation content associated parameter, calculate and obtain the public network associated parameter, the regional network associated parameter and the operation associated parameter. Specifically, according to the public network time associated parameter, the regional network time associated parameter and the operation time associated parameter, as well as the public network content associated parameter, the regional network content associated parameter and the operation content associated parameter, perform comprehensive calculation to obtain the public network associated parameter, the regional network associated parameter and the operation associated parameter, and adopt a weighted method to integrate the associated parameters of the two aspects of time and content. For example, the time associated parameter weight is set to 0.4, the content associated parameter weight is set to 0.6, the public network time associated parameter is multiplied by 0.4 and the public network content associated parameter is multiplied by 0.6 to obtain the final public network associated parameter. The same method is applicable to calculating the regional network associated parameter and the operation associated parameter. According to different time and content associated parameters, the set weight is used to calculate to obtain the public network associated parameter, the regional network associated parameter and the operation associated parameter, which provides an important basis for the subsequent network security early warning of the logistics warehouse.

[0025] In a possible implementation, the historical warehouse network security data sequence is combined with the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence to perform correlation analysis to obtain public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters, as well as public network content correlation parameters, regional network content correlation parameters, and operation content correlation parameters. Step S240 further includes step S241, taking the historical warehouse network security data sequence as a passive sequence, and taking the historical public network time data sequence, the historical regional network time data sequence, and the historical operation time data sequence as active sequences, and based on grey correlation analysis, processing to obtain public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters. Specifically, it is clear that the historical warehouse network security data sequence is a passive sequence. The historical warehouse network security data sequence records various network security events experienced by the logistics warehouse in the past period of time, including the time, type, impact degree and other information of the event. The sequence is in a passive position in the analysis, that is, as a reference object, the historical public network time data sequence, the historical regional network time data sequence, and the historical operation time data sequence are respectively used as active sequences. The historical public network time data sequence records the time information of the dispatching equipment connected to the public network for cargo dispatching; the historical regional network time data sequence records the time information of the storage management equipment connected to the internal regional network for management activities; the historical operation time data sequence records the time information of the operator's operation. The time data sequence is in an active position in the analysis and is used for comparative analysis with the passive sequence. Based on the grey relationship Grey correlation analysis is used for processing. Grey correlation analysis is a multi-factor statistical analysis method. It judges the correlation relationship between factors by determining the similarity between a reference series and several comparison series. The historical warehouse network security data series is used as a reference series, and the historical public network time data series, the historical regional network time data series, and the historical operation time data series are used as comparison series respectively. By calculating the grey correlation between these series, the similarity and correlation between them can be measured. The public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters are obtained. The parameters reflect the correlation between the public network application time, the regional network application time, and the operator operation time and the warehouse network security. For example, if the public network time correlation parameter is high, it means that there is a strong correlation between the dispatching time of the dispatching equipment connected to the public network and the warehouse network security incident.

[0026] Step S242, taking the historical warehouse network security data sequence as a passive sequence, taking the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence as active sequences, based on the grey correlation analysis, processing to obtain public network content association parameters, regional network content association parameters, and operation content association parameters. Specifically, taking the historical warehouse network security data sequence as a passive sequence, the sequence is still used as a reference object in the association analysis based on content data, and taking the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence as active sequences. The historical public network content data sequence records the specific content information of cargo dispatching by dispatching equipment connected to the public network, such as the type, quantity, destination, etc. of the dispatched cargo; the historical regional network content data sequence records the specific content information of management activities performed by warehouse management equipment connected to the internal regional network, such as the content of operations such as warehousing, outbound storage, and inventory counting; the historical operation content data sequence records the specific content information of the operator's operation, such as the location of cargo movement, the type of operation, etc., and is processed based on grey correlation analysis. Similar to the analysis based on time data, the historical warehouse network security data sequence is used as a reference series, and the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence are used as comparison series respectively. By calculating the grey correlation between these series, the similarity and correlation between them can be measured, and the public network content correlation parameters and regional network content correlation parameters can be obtained through processing. The parameters reflect the degree of association between the public network application content, the regional network application content and the operator operation content and the warehouse network security. For example, if the public network content association parameter is high, it means that there is a strong association between the dispatching content of the dispatching equipment and the warehouse network security events. In summary, by taking the historical warehouse network security data sequence as the passive sequence, and taking the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, and the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence as the active sequence, based on the grey correlation analysis, we can obtain the parameters reflecting the degree of association between the public network application time, the regional network application time, the operator operation time, the public network application content, the regional network application content, the operator operation content and the warehouse network security, which provides an important basis for the network security early warning of the logistics warehouse.

[0027] Step S300, based on historical data, analyze the data scarcity parameters and frequency abnormality parameters of the public network application data, regional network application data and operation data. Specifically, it is of great significance to analyze the data scarcity parameters and frequency abnormality parameters of the public network application data, regional network application data and operation data based on historical data. First, the historical data is clustered to calculate the average occurrence rate of the public network, regional network and operation data, and then the occurrence rate is calculated based on the clustering of similar data in the historical data of the current data and the average occurrence rate to determine the scarcity parameter. At the same time, the average occurrence frequency is calculated by clustering similar data and detecting the occurrence frequency in the historical data, and then the real-time occurrence frequency is calculated by combining the last occurrence time of similar data of the current data and the current time, thereby determining the frequency abnormality parameter. These parameters provide important indicators for network security early warning of logistics warehouses, which can help identify potential abnormal situations and timely discover network security risks.

[0028] In a possible implementation, based on historical data, the data scarcity parameters and frequency anomaly parameters of the public network application data, regional network application data and operation data are analyzed, and step S300 further includes step S310, obtaining the historical public network application data, historical regional network application data and historical operation data of the logistics warehouse. Specifically, the historical public network application data, historical regional network application data and historical operation data of the logistics warehouse are obtained. The historical data includes the activity records of the dispatching equipment connected to the public network, the activity records of the storage management equipment connected to the internal regional network and the operation records of the operators of the logistics warehouse in the past period of time. The data are crucial for analyzing the scarcity and frequency anomaly of the data because they provide a reference framework for comparison with the current data.

[0029] Step S320, data clustering is performed on the historical public network application data, historical regional network application data, and historical operation data to obtain multiple public network application data clustering results, multiple regional network application data clustering results, and multiple operation data clustering results, and the average occurrence rate of the public network data, the average occurrence rate of the regional network data, and the average occurrence rate of the operation data are calculated. Specifically, data clustering is performed on the obtained historical public network application data, historical regional network application data, and historical operation data. For example, for the public network application data, data with content data within a certain range (such as similar dispatched goods types, similar dispatched quantities, etc.) and time data within a certain range (such as similar dispatched time intervals, etc.) can be classified into one category, and similar clustering operations are performed on the regional network application data and the operation data, so as to obtain multiple public network application data clustering results, multiple regional network application data clustering results, and multiple operation data clustering results, and the average occurrence rate of the public network data, the average occurrence rate of the regional network data, and the average occurrence rate of the operation data are calculated. By performing statistics on the data in each clustering result, the occurrence frequency of each type of data in the historical data is determined, and then these frequencies are averaged to obtain the average occurrence rate. This average occurrence rate reflects the overall occurrence level of various types of data in historical data.

[0030] Step S330, based on the public network application data, regional network application data and operation data, similar data clustering and occurrence rate calculation are performed in the historical public network application data, historical regional network application data and historical operation data to obtain the public network data occurrence rate, regional network data occurrence rate and operation data occurrence rate, and the public network data scarcity parameter, regional network data scarcity parameter and operation data scarcity parameter are calculated by combining the public network data average occurrence rate, regional network data average occurrence rate and operation data average occurrence rate. Specifically, based on the current public network application data, regional network application data and operation data, similar data clustering and occurrence rate calculation are performed in the historical public network application data, historical regional network application data and historical operation data. Similar to the previous data clustering, the current data is compared with the historical data to find similar data and calculate its occurrence rate. For example, for the public network application data, the occurrence frequency of data with similar content and time in the current scheduling activity and the historical scheduling activity is determined to obtain the public network data occurrence rate. Similarly, the regional network data occurrence rate and the operation data occurrence rate are calculated, and the public network data scarcity parameter, regional network data scarcity parameter and operation data scarcity parameter are calculated by combining the previously calculated average occurrence rate of public network data, average occurrence rate of regional network data and average occurrence rate of operation data. For example, the inverse of the ratio of the occurrence rate and the average occurrence rate can be calculated as the scarcity parameter. If the occurrence rate is smaller, the inverse of the ratio is larger, and the data scarcity parameter is larger. This means that this type of data is relatively scarce under the current circumstances.

[0031] Step S340, according to the historical public network application data, historical regional network application data, and historical operation data, analyze and obtain the frequency anomaly parameters of the public network application data, regional network application data, and operation data. Specifically, according to the historical public network application data, historical regional network application data, and historical operation data, analyze and obtain the frequency anomaly parameters of the public network application data, regional network application data, and operation data. A variety of methods can be used for analysis, such as comparing the difference between the frequency of occurrence of current data and the average frequency of occurrence of historical data. If the frequency of occurrence of current data obviously deviates from the historical average frequency of occurrence, then it can be considered that such data has frequency anomaly. By obtaining historical data, clustering data, calculating the average occurrence rate, determining scarcity parameters, and analyzing frequency anomaly parameters, the characteristics of the public network application data, regional network application data, and operation data can be fully understood, providing an important basis for network security early warning of logistics warehouses.

[0032] In a possible implementation, based on the historical public network application data, historical regional network application data, and historical operation data, frequency abnormality parameters of the public network application data, regional network application data, and operation data are analyzed, and step S340 further includes step S341, based on the public network application data, regional network application data, and operation data, similar data clustering and occurrence frequency detection are performed within the historical public network application data, historical regional network application data, and historical operation data to obtain average public network data occurrence frequency, average regional network data occurrence frequency, and average operation data occurrence frequency. Specifically, based on the public network application data, regional network application data and operation data, similar data are clustered in the historical public network application data, historical regional network application data and historical operation data, and data with similar characteristics are classified into one category according to certain standards. For example, for the public network application data, similar data can be clustered according to characteristics such as the type of dispatched goods and the dispatching time range, and the frequency of occurrence can be detected. The data in each cluster is counted to determine the frequency of occurrence of similar data in the historical data. By averaging the frequency of occurrence of all clusters, the average frequency of occurrence of public network data, the average frequency of occurrence of regional network data and the average frequency of occurrence of operation data are obtained. The average frequency of occurrence reflects the overall level and regularity of each type of data in the historical data.

[0033] Step S342, based on the last appearance time of similar data of the public network application data, regional network application data and operation data combined with the current time, calculate the real-time public network data appearance frequency, real-time regional network data appearance frequency and real-time operation data appearance frequency, and combine the average public network data appearance frequency, average regional network data appearance frequency and average operation data appearance frequency to calculate the public network frequency abnormality parameter, regional network frequency abnormality parameter and operation frequency abnormality parameter. Specifically, based on the last appearance time of similar data of the public network application data, regional network application data and operation data combined with the current time, calculate the real-time public network data appearance frequency, real-time regional network data appearance frequency and real-time operation data appearance frequency. Specifically, for each type of data, find the time point of the last appearance of its similar data, and then calculate the real-time appearance frequency based on the interval between the current time and the last appearance time. For example, if similar data of a certain type of public network application data frequently appears in a short period of time, then the real-time public network data appearance frequency will be higher. Combined with the average public network data appearance frequency, average regional network data appearance frequency and average operation data appearance frequency calculated previously, calculate the public network frequency abnormality parameter, regional network frequency abnormality parameter and operation frequency abnormality parameter. The domain network frequency anomaly parameters and operation frequency anomaly parameters can be calculated by the ratio of the deviation value between the real-time occurrence frequency and the average occurrence frequency to the average occurrence frequency. If the deviation is larger, the difference between the real-time occurrence frequency and the average occurrence frequency is larger, and the frequency anomaly parameter is also larger, indicating that the occurrence frequency of this type of data has undergone a large abnormal change compared with the historical law. The average occurrence frequency is calculated by clustering similar data and detecting the occurrence frequency in the historical data, and the real-time occurrence frequency is calculated in combination with the last occurrence time of similar data and the current time, and the frequency anomaly parameters are finally determined. This can effectively analyze the frequency characteristics of public network application data, regional network application data and operation data, and provide an important basis for network security early warning of logistics warehouses.

[0034] Step S400, network security analysis is performed on the public network application data, the regional network application data and the operation data to obtain public network network security parameters, regional network network security parameters and operation network security parameters. Specifically, the public network application data, regional network application data and operation data are the basis for network security analysis of logistics warehouses. By establishing an analysis model, the probability of network risk events in warehouses is analyzed based on these three types of data, thereby obtaining public network network security parameters, regional network network security parameters and operation network security parameters. The parameters represent the probability of network risk events occurring in logistics warehouses under different scenarios, providing quantitative indicators for network security early warning. Monitoring parameter changes can timely discover network security risks in different aspects, so as to take corresponding measures to prevent and deal with them, provide strong support for network security management of logistics warehouses, and improve network security levels.

[0035] In one possible implementation, network security analysis is performed on public network application data, regional network application data, and operation data to obtain public network network security parameters, regional network network security parameters, and operation network security parameters. Step S400 further includes step S410, collecting a sample public network application data set, a sample regional network application data set, and a sample operation data set, and annotating the probability of logistics warehouse network risk events under different sample public network application data, different sample regional network application data, and different sample operation data to obtain a sample public network network security parameter set, a sample regional network network security parameter set, and a sample operation network security parameter set. Specifically, sample public network application data sets, sample regional network application data sets and sample operation data sets are collected. The sample data cover the activity data of scheduling equipment connected to the public network in the logistics warehouse under different situations, the activity data of warehouse management equipment connected to the internal regional network, and the operation data of operators. The probabilities of network risk events in the logistics warehouse under different sample public network application data, different sample regional network application data and different sample operation data are annotated. By analyzing a large amount of sample data, the possibility of network risk events in the logistics warehouse under specific public network applications, regional network applications and operation conditions is determined, and the sample public network network security parameter set, sample regional network network security parameter set and sample operation network security parameter set are obtained. The parameters in the set reflect the network security status corresponding to different sample data.

[0036] Step S420, respectively use the sample public network application data set and the sample public network network security parameter set, the sample regional network application data set and the sample regional network network security parameter set, the sample operation data set and the sample operation network security parameter set to train the public network security analysis branch, the regional network security analysis branch and the operation security analysis branch to obtain a network security analyzer. Specifically, a sample public network application data set and a sample public network network security parameter set, a sample regional network application data set and a sample regional network network security parameter set, a sample operation data set and a sample operation network security parameter set are used to train the public network security analysis branch, the regional network security analysis branch and the operation security analysis branch. For the public network security analysis branch, the sample public network application data set and the corresponding sample public network network security parameter set are used for training. By continuously adjusting the parameters of the model, the model can accurately predict the probability of network risk events in the logistics warehouse based on the public network application data. For the regional network security analysis branch and the operation security analysis branch, the sample regional network application data set and the sample regional network network security parameter set, the sample operation data set and the sample operation network security parameter set are used for training, so that the branch can perform accurate network security analysis on the regional network application data and the operation data respectively. After training, security analysis branches that can independently analyze the public network, regional network and operation data are obtained, and these branches together constitute a network security analyzer.

[0037] Step S430, using the network security analyzer, the public network application data, the regional network application data and the operation data are subjected to network security analysis to obtain public network network security parameters, regional network network security parameters and operation network security parameters. Specifically, the trained network security analyzer is used to perform network security analysis on new public network application data, regional network application data and operation data. The public network security analysis branch in the network security analyzer analyzes the input public network application data to predict the probability of network risk events occurring in the logistics warehouse under the current public network application situation, thereby obtaining public network network security parameters. The regional network security analysis branch analyzes the regional network application data to obtain regional network network security parameters, reflecting the network security status under the regional network application scenario. The operation security analysis branch analyzes the operation data to obtain operation network security parameters, reflecting the impact of the operator's operation on network security. In summary, by collecting sample data and annotating it, training the security analysis branch to obtain the network security analyzer, and then using the network security analyzer to analyze the actual data, the public network network security parameters, regional network network security parameters and operation network security parameters can be accurately obtained, providing strong support for the network security early warning of the logistics warehouse.

[0038] Step S500, according to the data scarcity parameter and the frequency abnormality parameter, the public network network security parameter, the regional network network security parameter and the operation network security parameter are compensated and adjusted to obtain the adjusted public network network security parameter, the adjusted regional network network security parameter and the adjusted operation network security parameter. Specifically, the data scarcity parameter and the frequency abnormality parameter play an important role in the network security analysis of the logistics warehouse. The public network network security parameter, the regional network network security parameter and the operation network security parameter respectively reflect the probability of network risk events of the logistics warehouse under different scenarios. According to the data scarcity parameter and the frequency abnormality parameter of the public network, the regional network and the operation data, the public network network security parameter, the regional network network security parameter and the operation network security parameter are compensated, adjusted and amplified respectively. For example, if the public network application data has high scarcity and large frequency abnormality, it means that there may be potential risks that are ignored or the network security status has changed. The adjustment coefficient can be determined to amplify and adjust the public network network security parameter; the regional network and the operation data are similar. The adjusted parameters can more comprehensively consider the data characteristics, more accurately reflect the network security status of the logistics warehouse, provide a more reliable basis for network security early warning, and help managers prevent potential network security risks.

[0039] In a possible implementation, the public network network security parameters, the regional network network security parameters and the operational network security parameters are compensated and adjusted according to the data scarcity parameters and the frequency abnormality parameters to obtain the adjusted public network network security parameters, the adjusted regional network network security parameters and the adjusted operational network security parameters. Step S500 further includes step S510, according to the public network data scarcity parameters, the regional network data scarcity parameters and the operational data scarcity parameters, combined with the public network frequency abnormality parameters, the regional network frequency abnormality parameters and the operational frequency abnormality parameters, to calculate and obtain the public network security compensation parameters, the regional network security compensation parameters and the operational security compensation parameters. Specifically, the security compensation parameter is calculated based on the public network data scarcity parameter, the regional network data scarcity parameter and the operation data scarcity parameter, combined with the public network frequency anomaly parameter, the regional network frequency anomaly parameter and the operation frequency anomaly parameter. The calculation of the public network security compensation parameter is based on the public network data scarcity parameter and the public network frequency anomaly parameter. The public network data scarcity parameter reflects the scarcity of public network application data in historical data. If the public network application data is relatively scarce, it may mean that some potential risks have not been fully considered. The public network frequency anomaly parameter reflects the difference between the frequency of occurrence of public network application data and the historical average frequency. If the frequency anomaly is large, it means that there may be changes in the network security status of the public network application. For example, the compensation parameter = scarcity parameter * (1 + frequency Abnormality parameter) is used to calculate the public network security compensation parameter. For the regional network security compensation parameter, it is also based on the regional network data scarcity parameter and the regional network frequency abnormality parameter. The regional network data scarcity parameter indicates the scarcity of regional network application data in historical data, while the regional network frequency abnormality parameter reflects the difference between the occurrence frequency of regional network application data and the historical average frequency. Through a similar calculation method, the regional network security compensation parameter is obtained. For the operation security compensation parameter, the operation data scarcity parameter and the operation frequency abnormality parameter are combined. The operation data scarcity parameter reflects the scarcity of operator operation data in historical data, and the operation frequency abnormality parameter reflects the difference between the occurrence frequency of operator operation data and the historical average frequency. The operation security compensation parameter is calculated accordingly.

[0040] Step S520, using the public network security compensation parameter, the regional network security compensation parameter and the operational security compensation parameter, the public network network security parameter, the regional network network security parameter and the operational network security parameter are compensated and adjusted to obtain the adjusted public network network security parameter, the adjusted regional network network security parameter and the adjusted operational network security parameter. Specifically, using the public network security compensation parameter, the regional network security compensation parameter and the operational security compensation parameter, the public network network security parameter, the regional network network security parameter and the operational network security parameter are compensated and adjusted to obtain the adjusted public network network security parameter. For the adjustment of the public network network security parameter, the public network network security parameter represents the probability of a network risk event occurring in a logistics warehouse under a public network application scenario. For example, the compensation parameter is multiplied by the probability of a risk event in the network security parameter as a way of adjusting the security parameter. The public network security compensation parameter is multiplied by the probability of a risk event in the public network network security parameter to obtain the adjusted public network network security parameter. The adjusted parameter can more accurately reflect the network security status of the public network application, taking into account the impact of data scarcity and frequency abnormality on network security. For the adjustment of the regional network network security parameter, the regional network network security parameter reflects the network security risk under the regional network application scenario. The regional network security compensation parameter is multiplied by the regional network network security parameter. The probability of risk events in the data is used to obtain the adjusted regional network network security parameters. The adjusted parameters can better reflect the network security status of the regional network application. The scarcity and frequency abnormality of the regional network data are comprehensively considered. For the adjustment of the operation network security parameters, the operation network security parameters reflect the impact of the operator's operation on the network security. The operation security compensation parameters are multiplied by the probability of risk events in the operation network security parameters to obtain the adjusted operation network security parameters. The adjusted parameters can more comprehensively consider the impact of the scarcity and frequency abnormality of the operator's operation data on the network security. In summary, by calculating the security compensation parameters according to the data scarcity parameters and the frequency abnormality parameters, and then using the security compensation parameters to compensate and adjust the network security parameters, more accurate adjustments to the public network network security parameters, regional network network security parameters, and operation network security parameters can be obtained, providing a more reliable basis for network security early warning and management of logistics warehouses.

[0041] Step S600, according to the adjustment of the public network network security parameters, the adjustment of the regional network network security parameters and the adjustment of the operation network security parameters, the public network associated parameters, the regional network associated parameters and the operation associated parameters are combined, and the network security parameters are obtained by fusion processing, and risk identification and warning are performed. Specifically, firstly, according to the data scarcity parameters and frequency abnormality parameters of the three types of data, the public network associated parameters, the regional network associated parameters and the operation associated parameters are compensated, adjusted and amplified respectively, then, the adjusted public network network security parameters, the adjusted regional network network security parameters and the adjusted operation network security parameters are weightedly calculated to obtain a network security parameter that comprehensively considers the public network, the regional network and the operation data and contains the weighted warehouse network risk event probability, then, a threshold is set for risk identification and warning, if the network security parameter is greater than the threshold, it indicates that the logistics warehouse faces a high network security risk, and a warning signal needs to be issued in time so that the management personnel can take corresponding measures to prevent and deal with it, and at the same time, the specific composition of the parameters can be further analyzed to determine the source of the risk, and targeted measures can be taken, thereby effectively improving the accuracy and timeliness of the network security warning of the logistics warehouse, and providing a strong guarantee for the safe operation of the logistics warehouse.

[0042] In a possible implementation, according to the adjustment of the public network network security parameters, the adjustment of the regional network network security parameters and the adjustment of the operational network security parameters, the public network associated parameters, the regional network associated parameters and the operational associated parameters are combined, and the network security parameters are obtained by fusion processing to perform risk identification and warning. Step S600 further includes step S610, according to the public network security compensation parameters, the regional network security compensation parameters and the operational security compensation parameters, the public network associated parameters, the regional network associated parameters and the operational associated parameters are respectively compensated and calculated to obtain the adjusted public network associated parameters, the adjusted regional network associated parameters and the adjusted operational associated parameters. Specifically, the public network security compensation parameter, the regional network security compensation parameter and the operation security compensation parameter have been calculated in the previous steps based on the data scarcity parameter and the frequency abnormality parameter. The role of the compensation parameter is to adjust the public network association parameter, the regional network association parameter and the operation association parameter to more accurately reflect the degree of association between the public network, regional network application data and operation data and the warehouse network security. For the adjustment of the public network association parameter, a compensation adjustment calculation is performed based on the public network security compensation parameter. For example, the compensation parameter is multiplied by the association parameter as a way to adjust the association parameter. The public network security compensation parameter is multiplied by the public network association parameter to obtain the adjusted public network association parameter. The public network association parameter originally reflects the association between the public network application data and the warehouse network security. The degree of public network security compensation is combined with the public network security compensation parameters to take into account the impact of data scarcity and frequency anomaly on public network association, so that the adjusted public network association parameters can more accurately reflect the actual situation. For regional network association parameters, the regional network security compensation parameters are used for adjustment. The regional network security compensation parameters are multiplied by the regional network association parameters to obtain the adjusted regional network association parameters. The adjustment process takes into account the impact of the scarcity and frequency anomaly of regional network data on the association between regional network and network security. For operation association parameters, the operation security compensation parameters are used for adjustment. The operation security compensation parameters are multiplied by the operation association parameters to obtain the adjusted operation association parameters. The adjustment takes into account the impact of the scarcity and frequency anomaly of the operator's operation data on the association between operation and network security.

[0043] Step S620, according to the adjustment of the public network association parameter, the adjustment of the regional network association parameter and the adjustment of the operation association parameter, weighted calculation is performed on the adjustment of the public network network security parameter, the adjustment of the regional network network security parameter and the adjustment of the operation network security parameter to obtain the network security parameter. Specifically, according to the adjustment of the public network association parameter, the adjustment of the regional network association parameter and the adjustment of the operation association parameter, weighted calculation is performed on the adjustment of the public network network security parameter, the adjustment of the regional network network security parameter and the adjustment of the operation network security parameter to obtain the final network security parameter, and the sum of the adjustment of the public network association parameter, the adjustment of the regional network association parameter and the adjustment of the operation association parameter is calculated. This sum value reflects the overall correlation degree between the public network, the regional network and the operation data and the network security, and the ratio of the adjustment of the public network association parameter, the adjustment of the regional network association parameter and the adjustment of the operation association parameter to the sum of the three is calculated respectively as the weight. For example, the weight of the adjustment of the public network association parameter is the adjustment of the public network association parameter divided by the sum of the three. , use weights to perform weighted calculations on adjusting public network security parameters, adjusting regional network network security parameters, and adjusting operational network security parameters, multiply each adjusted network security parameter by its corresponding weight, and then add the three products to obtain the network security parameters. The network security parameters comprehensively consider the network security status of the public network, regional network, and operational data, as well as their degree of association with network security. In summary, by compensating and adjusting the associated parameters according to the security compensation parameters, and then using the adjusted associated parameters to perform weighted calculations on the network security parameters, more accurate and comprehensive network security parameters can be obtained, providing a strong basis for network security early warning and management of logistics warehouses.

[0044] The embodiment of the present application collects the public network data of the dispatching equipment in the logistics warehouse, the regional network data of the storage management equipment, and the operator operation data. Based on the historical public network, regional network and operation data and security records, correlation analysis is performed to obtain the respective correlation parameters. Data scarcity and frequency abnormality parameters are analyzed based on historical data. Network security analysis is performed on the historical public network, regional network and operation data to obtain the public network, regional network and operation network security parameters. The network security parameters are adjusted according to the data scarcity and frequency abnormality parameters. Risk identification and early warning are performed in combination with the adjusted parameters and the network security parameters processed by the fusion of the associated parameters, so as to achieve the technical effect of improving the accuracy of network security early warning of logistics warehouses and providing reliable protection for the network security of logistics warehouses by collecting multiple data and performing correlation analysis, adjusting parameters and fusion processing considering data characteristics.

[0045] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A logistics warehouse network security early warning method based on application data, characterized in that: The method comprises: Collect public network application data of dispatching equipment connected to the public network in logistics warehouses, local area network application data of storage management equipment connected to the internal local area network, and operator operation data; Perform correlation analysis based on the historical public network application data, historical local network application data, historical operation data and historical warehouse network security record data of the logistics warehouse to obtain public network correlation parameters, local network correlation parameters and operation correlation parameters; Based on historical data, analyzing data scarcity parameters and frequency abnormality parameters of the public network application data, regional network application data, and operation data; Conduct network security analysis on public network application data, regional network application data and operation data to obtain public network network security parameters, regional network network security parameters and operation network security parameters; According to the data scarcity parameter and the frequency abnormality parameter, the public network network security parameter, the regional network network security parameter and the operational network security parameter are compensated and adjusted to obtain the adjusted public network network security parameter, the adjusted regional network network security parameter and the adjusted operational network security parameter; According to the adjustment of the public network network security parameters, the adjustment of the regional network network security parameters and the adjustment of the operation network security parameters, the public network associated parameters, the regional network associated parameters and the operation associated parameters are combined and processed to obtain the network security parameters, and risk identification and warning are performed; Based on historical data, the data scarcity parameters and frequency abnormality parameters of the public network application data, regional network application data and operation data are analyzed, including: Obtaining historical public network application data, historical local network application data, and historical operation data of the logistics warehouse; Performing data clustering on the historical public network application data, the historical regional network application data, and the historical operation data to obtain a plurality of public network application data clustering results, a plurality of regional network application data clustering results, and a plurality of operation data clustering results, and calculating and obtaining an average occurrence rate of the public network data, an average occurrence rate of the regional network data, and an average occurrence rate of the operation data; Based on the public network application data, the regional network application data and the operation data, similar data clustering and occurrence rate calculation are performed in the historical public network application data, the historical regional network application data and the historical operation data to obtain the public network data occurrence rate, the regional network data occurrence rate and the operation data occurrence rate, and the public network data scarcity parameter, the regional network data scarcity parameter and the operation data scarcity parameter are calculated by combining the public network data average occurrence rate, the regional network data average occurrence rate and the operation data average occurrence rate; Analyze and obtain frequency anomaly parameters of the public network application data, the local network application data, and the operation data according to the historical public network application data, the historical local network application data, and the historical operation data; According to the historical public network application data, the historical local network application data, and the historical operation data, the frequency anomaly parameters of the public network application data, the local network application data, and the operation data are analyzed and obtained, including: Based on the public network application data, the local network application data and the operation data, similar data clustering and occurrence frequency detection are performed in the historical public network application data, the historical local network application data and the historical operation data to obtain the average public network data occurrence frequency, the average local network data occurrence frequency and the average operation data occurrence frequency; According to the last appearance time of similar data of the public network application data, the local network application data and the operation data, combined with the current time, the real-time public network data appearance frequency, the real-time local network data appearance frequency and the real-time operation data appearance frequency are calculated, and the public network frequency abnormality parameter, the local network frequency abnormality parameter and the operation frequency abnormality parameter are calculated in combination with the average public network data appearance frequency, the average local network data appearance frequency and the average operation data appearance frequency; According to the data scarcity parameter and the frequency abnormality parameter, in combination with the public network associated parameter, the regional network associated parameter and the operation associated parameter, the public network network security parameter, the regional network network security parameter and the operation network security parameter are compensated and adjusted, including: According to the public network data scarcity parameter, the regional network data scarcity parameter and the operation data scarcity parameter, in combination with the public network frequency abnormality parameter, the regional network frequency abnormality parameter and the operation frequency abnormality parameter, a public network security compensation parameter, a regional network security compensation parameter and an operation security compensation parameter are calculated; Using the public network security compensation parameter, the regional network security compensation parameter and the operational security compensation parameter, a compensation adjustment calculation is performed on the public network network security parameter, the regional network network security parameter and the operational network security parameter to obtain an adjusted public network network security parameter, an adjusted regional network network security parameter and an adjusted operational network security parameter; According to the adjusting of the public network security parameters, the adjusting of the regional network security parameters and the adjusting of the operational network security parameters, the integration of the public network associated parameters, the regional network associated parameters and the operational associated parameters to obtain the network security parameters includes: According to the public network security compensation parameter, the regional network security compensation parameter and the operation security compensation parameter, respectively, the public network associated parameter, the regional network associated parameter and the operation associated parameter are compensated and adjusted to obtain an adjusted public network associated parameter, an adjusted regional network associated parameter and an adjusted operation associated parameter; According to the adjustment of the public network associated parameters, the adjustment of the local network associated parameters and the adjustment of the operation associated parameters, weighted calculation is performed on the adjustment of the public network network security parameters, the adjustment of the local network network security parameters and the adjustment of the operation network security parameters to obtain the network security parameters.

2. The method for early warning network security of a logistics warehouse based on application data according to claim 1 is characterized in that: Collect the public network application data of the dispatching equipment connected to the public network in the logistics warehouse, the local area network application data of the warehouse management equipment connected to the internal local area network, and the operator's operation data, including: Collect the dispatch time data and dispatch content data of the dispatch equipment connected to the public network in the logistics warehouse as public network application data; Collect management time data and management content data of storage management equipment connected to the internal local area network in the logistics warehouse as local area network application data; The operator's operation time and operation content data are collected as operation data.

3. The method for early warning network security of a logistics warehouse based on application data according to claim 2 is characterized in that: According to the historical public network application data, historical local network application data, historical operation data and historical warehouse network security record data of the logistics warehouse, correlation analysis is performed, including: Collecting historical public network application data sequences, historical local network application data sequences, and historical operation data sequences of the dispatching equipment, warehouse management equipment, and operators; Divide the historical public network application data sequence, the historical regional network application data sequence, and the historical operation data sequence into time data and content data, and digitally annotate the content data to obtain the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, and the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence; According to the historical network security data records of logistics warehouses in the historical period, digital annotation is performed to obtain the historical warehouse network security data sequence; The historical warehouse network security data sequence is respectively combined with the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence to perform correlation analysis to obtain public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters, as well as public network content correlation parameters, regional network content correlation parameters, and operation content correlation parameters; According to the public network time associated parameters, the regional network time associated parameters and the operation time associated parameters, as well as the public network content associated parameters, the regional network content associated parameters and the operation content associated parameters, the public network associated parameters, the regional network associated parameters and the operation associated parameters are calculated to obtain the public network associated parameters, the regional network associated parameters and the operation associated parameters.

4. The method for early warning network security of a logistics warehouse based on application data according to claim 3 is characterized in that: The historical warehouse network security data sequence is combined with the historical public network time data sequence, the historical regional network time data sequence, the historical operation time data sequence, the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence to perform correlation analysis, including: Taking the historical warehouse network security data sequence as a passive sequence, and taking the historical public network time data sequence, the historical regional network time data sequence, and the historical operation time data sequence as active sequences, based on grey correlation analysis, processing to obtain public network time correlation parameters, regional network time correlation parameters, and operation time correlation parameters; Taking the historical warehouse network security data sequence as the passive sequence, and the historical public network content data sequence, the historical regional network content data sequence, and the historical operation content data sequence as the active sequences, based on the grey correlation analysis, the public network content association parameters, the regional network content association parameters, and the operation content association parameters are obtained.

5. The method for early warning network security of a logistics warehouse based on application data according to claim 1 is characterized in that: Conduct network security analysis on public network application data, regional network application data and operation data to obtain public network network security parameters, regional network network security parameters and operation network security parameters, including: Collect sample public network application data sets, sample regional network application data sets and sample operation data sets, and annotate the probability of logistics warehouse network risk events under different sample public network application data, different sample regional network application data and different sample operation data, and obtain sample public network network security parameter sets, sample regional network network security parameter sets and sample operation network security parameter sets; The sample public network application data set and the sample public network network security parameter set, the sample regional network application data set and the sample regional network network security parameter set, the sample operation data set and the sample operation network security parameter set are respectively used to train the public network security analysis branch, the regional network security analysis branch and the operation security analysis branch to obtain a network security analyzer; The network security analyzer is used to perform network security analysis on the public network application data, the local network application data and the operation data to obtain public network network security parameters, local network network security parameters and operation network security parameters.

Images