A data security intelligent protection method and system for industrial switches

Abstract

The present invention discloses a data security intelligent protection method and system for industrial switches, which relates to the technical field of industrial switches. The method constructs a dynamic network topology structure Tnet based on a preprocessed industrial switch monitoring data set, and generates a node N of each network device. i And calculate the topological path P between devices i，i+1 , realizing the real-time topology map of network devices. It can automatically detect potential problems in network connections. At the same time, the system calculates by constructing flow anomaly and path anomaly algorithm formulas, and outputs flow anomaly index Aflow and path anomaly index Apath respectively, thereby realizing in-depth analysis of the entire network. This intelligent anomaly detection based on topology structure can quickly locate abnormal nodes and abnormal paths in the network, and display the health status of the current network equipment through a visual interface to help administrators monitor in real time, thereby improving the reliability and security of the network.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial switches, and in particular to a data security intelligent protection method and system for industrial switches. Background Art

[0002] In industrial automation systems, industrial switches are core network devices that are responsible for connecting and managing various industrial devices such as PLCs, sensors, and robots, ensuring the real-time and reliability of data transmission. In this specific field, data security issues are particularly important. Industrial switches must not only handle high-frequency data flows, but also ensure the security and stability of data transmission. With the rapid development of industrial Internet and intelligent manufacturing, industrial switches need to deal with more network security threats, such as packet loss, network latency, malicious traffic, and network attacks.

[0003] In the Chinese invention application with application number 200810233159.2, a network topology discovery method for EPA network is disclosed, which relates to industrial Ethernet technology. The method comprises the following steps: the EPA network monitoring server constructs the connection relationship of EPA bridge according to the network topology information in the EPA bridge network topology information storage module; constructs the connection relationship of EPA switch according to the network topology information in the EPA switch network topology information storage module; constructs the connection relationship between EPA bridge and EPA switch and EPA terminal device through the bridge and switch port adjacent device object information in the EPA bridge and EPA switch network topology information storage module; draws the network topology structure diagram according to the above connection relationship; the present invention can timely and accurately provide the EPA network topology structure update information, and provide effective support for the real-time monitoring and control of EPA network.

[0004] In combination with the prior art, the above application still has the following deficiencies:

[0005] At present, current industrial switches usually have basic monitoring functions, but there are still obvious deficiencies in network topology visualization, real-time monitoring and intelligent protection. Traditional network management methods often rely on manual detection and static configuration, which not only increases the workload of administrators, but also may lead to security issues that cannot be discovered in time. When the network has abnormal traffic, path failure or data packet loss, it usually takes a long time to locate the problem, especially for complex industrial network structures, there is a lack of effective real-time visualization tools to monitor and analyze the connection status and changes between devices. Existing solutions cannot efficiently identify potential network threats and problem nodes, thereby increasing the risk of data loss and network attacks. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a data security intelligent protection method and system for an industrial switch, which solves the problems mentioned in the background technology.

[0007] To achieve the above objectives, the present invention is implemented by the following technical scheme: comprising the following steps:

[0008] S1. Use the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, pre-process the security data, and obtain the industrial switch monitoring data set;

[0009] S2. Generate the node N of the network device based on the acquired industrial switch monitoring data set i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1 , construct the network topology algorithm formula, and pass the node N i and topological path P i，i+1 , calculate and output the topological structure Tnet;

[0010] S3. By constructing a flow anomaly algorithm formula and a path anomaly algorithm formula, extracting the industrial switch monitoring data set, inputting them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively, and calculating and outputting the flow anomaly index Aflow and the path anomaly index Apath;

[0011] S4, display the topology structure Tnet, flow anomaly index Aflow and path anomaly index Apath results through a visual interface;

[0012] S5. According to the flow anomaly index Aflow and the path anomaly index Apath, a comprehensive calculation is performed to obtain the warning signal value Walcrt, and the output result of the warning signal value Walcrt is evaluated to indicate the data security of the switch. At the same time, a network security evaluation formula is constructed. i The comprehensive situation is used to calculate and output the network security coefficient Snet, and the preset security threshold S is compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

[0013] Preferably, S1 includes S11 and S12;

[0014] S11. Real-time collection of security data in industrial switches through built-in software and network protocols of industrial switches;

[0015] Built-in software includes network interface controller NIC and traffic monitoring module;

[0016] Network protocols include SNMP and ICMP;

[0017] Security data includes data packet transmission time T, average transmission time Tavg, number of lost data packets Plost, total number of transmitted data packets Ptotal, traffic peak change △Fpcak, time window Twindow, per-hop delay Thop, data packet loss rate Ploss and number of retries Retry;

[0018] The packet transmission time T and the average transmission time Tavg are the total time taken for each packet to enter the switch and leave the switch. This data is recorded by the timestamp function provided by the network interface controller NIC of the industrial switch. The entry and exit time of each packet can be collected by the traffic monitoring module.

[0019] The number of lost data packets Plost, the total number of transmitted data packets Ptotal, the flow peak change △Fpcak, and the time window Twindow are monitored in real time through the SNMP protocol proprietary management software of the industrial switch, and the data transmission status of each port of the industrial switch is recorded and obtained;

[0020] The hop delay Thop, packet loss rate Ploss, and retry times Retry are obtained through the ICMP protocol detection function of the industrial switch.

[0021] Preferably, S12, preprocessing is performed based on the acquired security data, the preprocessing method includes calculation after denoising, and an industrial switch monitoring data set is obtained, the industrial switch monitoring data set includes a port jitter rate Jport, a data packet loss rate Lpackct, an abnormal traffic frequency Fanom, and a network path delay Dpath, and the specific calculation method is as follows;

[0022] The port jitter rate Jport is obtained by calculating the transmission time Tk and the average transmission time Tavg. The calculation formula is: , where m represents the total number of packets in the time period, k represents the kth packet, and Tk represents the transmission time of the kth packet;

[0023] The packet loss rate Lpackct is obtained by calculating the number of lost packets Plost and the total number of transmitted packets Ptotal. The calculation formula is: ;

[0024] The abnormal flow frequency Fanom is obtained by calculating the flow peak change △Fpcak and the time window Twindow. The calculation formula is: ;

[0025] The network path delay Dpath is obtained by calculating the delay per hop Thop, the packet loss rate Ploss, and the number of retries Retry. The calculation formula is: , where B represents the total number of hops, t represents the index of the current hop, and represents the 1st hop to the Bth hop.

[0026] Preferably, S2 includes S21, S22 and S23;

[0027] S21. Set each network device connected to the industrial switch as a node N. i , based on the acquired industrial switch monitoring data set, generate the node information of each network device, and output the node N of the current network device through the node construction formula i ;

[0028] Node N i Constructed by the following node construction formula;

[0029] ;

[0030] In the formula, Di represents the network device identifier, which is used to uniquely identify each device in the network. It is identified by the MAC address of the network device, and N i Represents the i-th node in the industrial switch, that is, the i-th network device connected to the industrial switch;

[0031] S22, based on the acquired node N i , calculate the connection path between network device nodes and obtain the topological path P i，i+1 ;

[0032] Topological path P i，i+1 Obtained through the following algorithm formula;

[0033] ;

[0034] Where N i+1 represents the node of the next network device, f represents the mapping function, and determines each node N i Whether the connection between nodes is normal or whether there is a potential problem is determined by the node N. i With the next node N i+1 Between, evaluate the health of the connection between devices. If the topological path P i，i+1 If the latency or packet loss indicated is abnormal, the connection can be marked as problematic.

[0035] Preferably, S23, by constructing a network topology algorithm formula, the obtained node N i and topological path P i，i+1Input into the network topology algorithm formula to generate the topology structure Tnet of the entire industrial switch network;

[0036] The topology structure Tnet is calculated and output by the following network topology algorithm formula;

[0037] ;

[0038] In the formula, n represents the total number of nodes, that is, the total number of network devices connected to the industrial switch, and i represents the index of the current node, indicating that the i-th node is currently being calculated.

[0039] Preferably, S3 includes S31 and S32;

[0040] S31, construct a flow anomaly algorithm formula, extract the port jitter rate Jport and the abnormal flow frequency Fanom in the industrial switch monitoring data set, input them into the flow anomaly algorithm formula, calculate and output the flow anomaly index Aflow;

[0041] The flow anomaly index Aflow is calculated using the following flow anomaly algorithm formula:

[0042] ;

[0043] In the formula, and They represent the preset weight values ​​of the port jitter rate Jport and the abnormal traffic frequency Fanom, respectively, and + =1, the specific value is set by the user;

[0044] S32, used to construct a path anomaly algorithm formula, extract the data packet loss rate Lpackct and network path delay Dpath in the industrial switch monitoring data set and the per-hop delay Thop and retry number Retry in the security data, input them into the path anomaly algorithm formula, calculate and output the path anomaly index Apath;

[0045] The path anomaly index Apath is calculated and output by the following path anomaly algorithm formula;

[0046] ;

[0047] In the formula, represents the data transmission quality, log represents the logarithmic function, It represents the logarithm of the number of retries Retry and the delay per hop Thop, and is used to indicate the stability of data transmission.

[0048] Preferably, S4 includes S41;

[0049] S41, displaying the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath in a graphical interface, dynamically updating and displaying them in a multi-level view through a visualization interface;

[0050] Graphical interface display is used to display the node N of each network device in real time i Health status, green indicates normal and red indicates abnormal;

[0051] Dynamic update: By continuously collecting security data from industrial switches and processing them to obtain industrial switch monitoring data sets, the system automatically updates the topology structure Tnet and marks abnormal topology paths P. i，i+1 and node N i ;

[0052] The multi-level view displays the topology structure Tnet in layers according to the device data connected to the industrial switch network.

[0053] Preferably, S5 includes S51 and S52;

[0054] S51 includes S511 and S512;

[0055] S511, used to dynamically set the flow anomaly threshold Athreshold based on the obtained flow anomaly index Aflow and path anomaly index Apath and the security policy of the industrial switch network operation f and path anomaly threshold Athreshold p , perform comprehensive calculation to obtain the warning signal value Walcrt;

[0056] The warning signal value Walcrt is calculated by the following algorithm formula;

[0057] ;

[0058] S512: perform an evaluation based on the result output by the warning signal value Walcrt, and generate warning information based on the evaluation result to prompt the abnormal situation of the industrial switch. The specific evaluation content is as follows;

[0059] When the warning signal value Walcrt>0, it means that there is an abnormality in the network connection of the industrial switch network device, indicating that there is at least one abnormality, such as abnormal traffic, excessive packet loss rate, or abnormal path delay. At this time, a warning signal is generated to remind the administrator that there is a security risk in the network;

[0060] When the warning signal value Walcrt≤0, it means that the network connection of the industrial switch network device is normal, and there is no need to generate a warning signal.

[0061] Preferably, S52 includes S521 and S522;

[0062] S521. Through the network security evaluation formula, all normal network devices are traversed according to the warning signal value Walcrt, the normal node number Si is extracted and input into the network security evaluation formula, and the network security coefficient Snet is calculated and output;

[0063] The network security coefficient Snet is calculated and output by the following network security evaluation formula;

[0064] ;

[0065] S522, by comparing the security threshold S set by the administrator with the obtained network security coefficient Snet, the overall health and security status of the industrial switch network is evaluated and analyzed, and the specific evaluation content is as follows;

[0066] When the network security coefficient Snet> security threshold S, it means that the network device connected to the current industrial switch is normal and the network connection is in normal state;

[0067] When the network security coefficient Snet ≤ security threshold S, it means that the network device connected to the current industrial switch is abnormal and the network is in an abnormal state. Then an early warning signal is generated to remind the administrator that the network is in an unsafe state and that the abnormal node N needs to be checked and repaired. i and topological path P i，i+1 .

[0068] A data security intelligent protection system for industrial switches, including a data acquisition and preprocessing module, a network topology structure building module, a data flow anomaly detection and analysis module, an intelligent visualization display module, and an intelligent early warning and security assessment module;

[0069] The data collection and preprocessing module uses the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, and preprocesses the security data to obtain the industrial switch monitoring data set;

[0070] The network topology building module is used to generate the node N of the network device based on the acquired industrial switch monitoring data set. i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1 , construct the network topology algorithm formula, and pass the node N i and topological path P i，i+1 , calculate and output the topological structure Tnet;

[0071] The data flow anomaly detection and analysis module constructs the flow anomaly algorithm formula and the path anomaly algorithm formula, extracts the industrial switch monitoring data set, inputs them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively, and calculates and outputs the flow anomaly index Aflow and the path anomaly index Apath;

[0072] The intelligent visualization display module is used to display the topology structure Tnet, traffic anomaly index Aflow and path anomaly index Apath results through a visualization interface;

[0073] Intelligent early warning and security assessment is used to obtain the early warning signal value Walcrt by comprehensive calculation based on the flow anomaly index Aflow and the path anomaly index Apath, and evaluate the output result of the early warning signal value Walcrt to prompt the data security of the switch. At the same time, a network security assessment formula is constructed based on the node N i的 Based on the comprehensive situation, the network security coefficient Snet is calculated and output, and the preset security threshold S is compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

[0074] The present invention provides a data security intelligent protection method and system for an industrial switch, which has the following beneficial effects:

[0075] (1) This method can collect the security data of all network devices in the industrial switch in real time through the built-in software of the industrial switch and the SNMP and ICMP protocols, and perform intelligent preprocessing on it to obtain the industrial switch monitoring data set. This process can ensure the real-time and accuracy of security data and avoid delays and errors in the data collection process. Through efficient data preprocessing, the industrial switch monitoring data set generated by the system can accurately reflect the current network status, thereby helping administrators obtain complete monitoring information and response suggestions before potential security risks occur. Such an intelligent monitoring mechanism effectively reduces the data errors and delays caused by traditional manual monitoring, and greatly improves the monitoring efficiency and response speed of the industrial network system.

[0076] (2) This method constructs the dynamic network topology structure Tnet of industrial switches based on the preprocessed industrial switch monitoring data set. It generates node information of each network device and calculates the topological path P between devices. i，i+1, realizing the real-time topology map of network devices. It can automatically evaluate the health of topological paths and detect potential problems in network connections, such as delay or packet loss anomalies. At the same time, the system constructs flow anomaly and path anomaly algorithm formulas, inputs monitoring data for calculation, and outputs flow anomaly index Aflow and path anomaly index Apath respectively, thereby realizing in-depth analysis of the entire network. This intelligent anomaly detection based on topology structure can quickly locate abnormal nodes and abnormal paths in the network, and display the health status of current network devices through a visual interface, helping administrators to monitor in real time and discover potential problems in advance, thereby reducing equipment downtime and improving network reliability and security.

[0077] (3) This method can construct an intelligent early warning mechanism that can integrate the flow anomaly index Aflow and the path anomaly index Apath, dynamically calculate the early warning signal value Walert, and monitor the abnormal situation of the network in real time. When Walert>0, the system will trigger an early warning signal to indicate that there is a security risk in the network. At the same time, the system calculates the network security coefficient Snet based on the comprehensive situation of the node Ni, and compares and evaluates it with the preset security threshold S. If Snet≤S, the system will generate an early warning to prompt the administrator that the network security status is abnormal. This early warning and security assessment mechanism based on intelligent analysis can respond in time and provide problem prompts when network anomalies occur, thereby effectively reducing security risks in data transmission, ensuring the safe operation of industrial switches in complex network environments, and preventing further deterioration of problems such as data loss and path failures. At the same time, this automated protection mechanism reduces the frequency of manual intervention and improves the overall security and stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 A schematic diagram of a data security intelligent protection method for an industrial switch of the present invention;

[0079] Figure 2 The present invention is a schematic diagram of the steps of a data security intelligent protection system for an industrial switch. DETAILED DESCRIPTION

[0080] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0081] Example 1

[0082] See also Figure 1The present invention provides a data security intelligent protection method for an industrial switch. To achieve the above purpose, the present invention is implemented through the following technical scheme: comprising the following steps:

[0083] S1. Use the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, pre-process the security data, and obtain the industrial switch monitoring data set;

[0084] S2. Generate the node N of the network device based on the acquired industrial switch monitoring data set i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1 , construct the network topology algorithm formula, and pass the node N i and topological path P i，i+1 , calculate and output the topological structure Tnet;

[0085] S3. By constructing a flow anomaly algorithm formula and a path anomaly algorithm formula, extracting the industrial switch monitoring data set, inputting them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively, and calculating and outputting the flow anomaly index Aflow and the path anomaly index Apath;

[0086] S4, display the topology structure Tnet, flow anomaly index Aflow and path anomaly index Apath results through a visual interface;

[0087] S5. According to the flow anomaly index Aflow and the path anomaly index Apath, a comprehensive calculation is performed to obtain the warning signal value Walcrt, and the output result of the warning signal value Walcrt is evaluated to indicate the data security of the switch. At the same time, a network security evaluation formula is constructed. i The comprehensive situation is used to calculate and output the network security coefficient Snet, and the preset security threshold S is compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

[0088] In this embodiment, the method collects and preprocesses the security data of all connected devices in real time through the built-in software and network protocol of the industrial switch, ensuring the accuracy and real-time nature of the monitoring data. The network topology is then reconstructed to generate each device node and connection path, dynamically displaying the topological state of the entire network, which helps to quickly identify and locate potential anomalies in the network. By calculating the flow anomaly index Aflow and the path anomaly index Apath, intelligent detection of flow and path is achieved, further improving the accuracy of anomaly identification. The results of the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath are displayed through a visual interface, which facilitates the administrator to intuitively view the health status of the network. Based on the comprehensive calculation, the warning signal Walert is generated, and the network security coefficient Snet is calculated through the network security evaluation formula, the data transmission security is timely evaluated, and the corresponding protection mechanism is generated. The method can significantly improve the efficiency and accuracy of anomaly detection and reduce the fault location time by combining intelligent algorithms with visual display. At the same time, by dynamically calculating the warning signal and the network security evaluation coefficient, the system can detect potential risks earlier, prompt the administrator to take measures in time, and optimize the overall performance of network protection. Compared with traditional manual monitoring and static configuration, this method realizes automated and intelligent network security protection, effectively reduces network interruption, data loss and security threats, and significantly improves the security and stability of the network.

[0089] Example 2

[0090] This embodiment is explained in Example 1, please refer to Figure 1 , specifically: S1 includes S11 and S12;

[0091] S11. Real-time collection of security data in industrial switches through built-in software and network protocols of industrial switches;

[0092] Built-in software includes network interface controller NIC and traffic monitoring module

[0093] Network protocols include SNMP and ICMP;

[0094] Security data includes data packet transmission time T, average transmission time Tavg, number of lost data packets Plost, total number of transmitted data packets Ptotal, traffic peak change △Fpcak, time window Twindow, per-hop delay Thop, data packet loss rate Ploss and number of retries Retry;

[0095] The packet transmission time T and the average transmission time Tavg are the total time taken for each packet to enter the switch and leave the switch. This data is recorded by the timestamp function provided by the network interface controller NIC of the industrial switch. The entry and exit time of each packet can be collected by the traffic monitoring module.

[0096] The number of lost data packets Plost, the total number of transmitted data packets Ptotal, the flow peak change △Fpcak, and the time window Twindow are monitored in real time through the SNMP protocol proprietary management software of the industrial switch, and the data transmission status of each port of the industrial switch is recorded and obtained;

[0097] The hop delay Thop, packet loss rate Ploss, and retry times Retry are obtained through the ICMP protocol detection function of the industrial switch.

[0098] S12. Preprocessing is performed based on the acquired security data. The preprocessing method includes calculation after denoising to obtain an industrial switch monitoring data set. The industrial switch monitoring data set includes a port jitter rate Jport, a data packet loss rate Lpackct, an abnormal traffic frequency Fanom, and a network path delay Dpath. The specific calculation method is as follows;

[0099] The port jitter rate Jport is obtained by calculating the transmission time Tk and the average transmission time Tavg. The calculation formula is: , where m represents the total number of packets in the time period, k represents the kth packet, and Tk represents the transmission time of the kth packet;

[0100] The packet loss rate Lpackct is obtained by calculating the number of lost packets Plost and the total number of transmitted packets Ptotal. The calculation formula is: ;

[0101] The abnormal flow frequency Fanom is obtained by calculating the flow peak change △Fpcak and the time window Twindow. The calculation formula is: ;

[0102] The network path delay Dpath is obtained by calculating the delay per hop Thop, the packet loss rate Ploss, and the number of retries Retry. The calculation formula is: , where B represents the total number of hops, t represents the index of the current hop, and represents the 1st hop to the Bth hop.

[0103] In this embodiment, the method realizes the real-time collection of security data of all network devices through the built-in software and network protocol of the industrial switch, and collects security data in real time through components such as the network interface controller NIC and the traffic monitoring module as well as the SNMP protocol and the ICMP protocol. Subsequently, a complete industrial switch monitoring data set is generated by denoising and preprocessing the collected data. These steps effectively improve the degree of automation of data collection and processing and reduce the error of human intervention. This method not only realizes more accurate real-time monitoring, but also greatly reduces noise interference through preprocessing, ensuring the efficiency and reliability of monitoring data. This improvement provides a solid foundation for the accurate implementation of subsequent network anomaly detection and protective measures, significantly shortens the problem identification and response time, and improves the overall security and operation efficiency of the network. At the same time, the integrated multi-parameter analysis method makes the analysis of network status more comprehensive, avoids misjudgment under single parameter detection, and improves the data transmission and processing capabilities of the industrial switch system.

[0104] Example 3

[0105] This embodiment is explained in Example 2. Please refer to Figure 1 , specifically: S2 includes S21, S22 and S23;

[0106] S21. Set each network device connected to the industrial switch as a node N. i , based on the acquired industrial switch monitoring data set, generate the node information of each network device, and output the node N of the current network device through the node construction formula i ;

[0107] Node N i Constructed by the following node construction formula;

[0108] ;

[0109] In the formula, Di represents the network device identifier, which is used to uniquely identify each device in the network. It is identified by the MAC address of the network device, and N i represents the i-th node in the industrial switch, that is, the i-th network device connected to the industrial switch;

[0110] S22, based on the acquired node N i , calculate the connection path between network device nodes and obtain the topological path P i，i+1 ;

[0111] Topological path P i，i+1 Obtained through the following algorithm formula;

[0112] ;

[0113] Where N i+1 represents the node of the next network device, f represents the mapping function, and determines each node N i Whether the connection between nodes is normal or whether there is a potential problem is determined by the node N. i With the next node N i+1 Between, evaluate the health of the connection between devices. If the topological path P i，i+1 If the latency or packet loss indicated is abnormal, the connection can be marked as problematic.

[0114] S23, by constructing a network topology algorithm formula, the obtained node N i and topological path P i，i+1 Input into the network topology algorithm formula to generate the topology structure Tnet of the entire industrial switch network;

[0115] The topology structure Tnet is calculated and output by the following network topology algorithm formula;

[0116] ;

[0117] In the formula, n represents the total number of nodes, that is, the total number of network devices connected to the industrial switch, and i represents the index of the current node, indicating that the i-th node is currently being calculated.

[0118] In this embodiment, the method constructs a network topology structure to effectively set each network device connected to the industrial switch as an independent node, and obtains the node N through the node construction formula. i Identify and manage each network device. First, use the monitoring data set to generate the node information of each network device, ensuring the uniqueness and identification ability of the device. S22 further calculates the connection path P between the devices. i,i+1 , the connection relationship between each node in the network topology is generated to ensure comprehensive monitoring of the network status, especially to identify potential problem nodes and connections in a timely manner when delays or packet loss are abnormal. Then all node and path information is input into the network topology algorithm to generate and output the topology structure Tnet of the entire industrial switch network, so that the network connection status can be fully presented through the topology map. This method realizes dynamic and automated management of network devices and connection status, and improves the accuracy and real-time performance of network topology construction. By calculating the health of the path, the system can automatically detect and mark abnormal connections, greatly shortening the time for troubleshooting and problem location.

[0119] Example 4

[0120] This embodiment is explained in Example 3, please refer to Figure 1, specifically: S3 includes S31 and S32;

[0121] S31, construct a flow anomaly algorithm formula, extract the port jitter rate Jport and the abnormal flow frequency Fanom in the industrial switch monitoring data set, input them into the flow anomaly algorithm formula, calculate and output the flow anomaly index Aflow;

[0122] The flow anomaly index Aflow is calculated using the following flow anomaly algorithm formula:

[0123] ;

[0124] In the formula, and They represent the preset weight values ​​of the port jitter rate Jport and the abnormal traffic frequency Fanom, respectively, and + =1, the specific value is set by the user;

[0125] S32, used to construct a path anomaly algorithm formula, extract the data packet loss rate Lpackct and network path delay Dpath in the industrial switch monitoring data set and the per-hop delay Thop and retry number Retry in the security data, input them into the path anomaly algorithm formula, calculate and output the path anomaly index Apath;

[0126] The path anomaly index Apath is calculated and output by the following path anomaly algorithm formula;

[0127] ;

[0128] In the formula, represents the data transmission quality, log represents the logarithmic function, It represents the logarithm of the number of retries Retry and the delay per hop Thop, and is used to indicate the stability of data transmission.

[0129] In this embodiment, the method improves the ability to accurately detect abnormal situations in industrial switch networks by constructing traffic anomalies and path anomalies algorithms. Using the port jitter rate Jport and the abnormal traffic frequency Fanom, a traffic anomaly algorithm formula is constructed to calculate the traffic anomaly index Aflow, thereby effectively identifying traffic fluctuations and abnormal transmission behaviors in the network. Then, through the path anomaly algorithm formula, combined with data such as the packet loss rate Lpacket, the network path delay Dpath, the per-hop delay Thop, and the number of retries Retry, the path anomaly index Apath is calculated to evaluate the stability of data transmission and help locate potential faults in network transmission. This method forms a more comprehensive and accurate anomaly detection model by comprehensively calculating multiple network parameters. The automated calculation of traffic anomalies and path anomalies improves the ability to respond to network problems in real time and avoids the limitations of relying on single parameter monitoring.

[0130] Example 5

[0131] This embodiment is explained in Example 4. Please refer to Figure 1 , specifically: S4 includes S41;

[0132] S41, displaying the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath in a graphical interface, dynamically updating and displaying them in a multi-level view through a visualization interface;

[0133] Graphical interface display is used to display the node N of each network device in real time i Health status, green indicates normal and red indicates abnormal;

[0134] Dynamic update: By continuously collecting security data from industrial switches and processing them to obtain industrial switch monitoring data sets, the system automatically updates the topology structure Tnet and marks abnormal topology paths P. i，i+1 and node N i ;

[0135] The multi-level view displays the topology structure Tnet in layers according to the device data connected to the industrial switch network.

[0136] In this embodiment, the method realizes real-time monitoring and display of the topology structure Tnet, flow anomaly index Aflow and path anomaly index Apath of network devices through visual interface display and dynamic update function. Not only the topology structure Tnet is presented intuitively, but also the health status of each node Ni is identified by color, so that the administrator can quickly identify abnormal devices and connection paths in the network. The multi-level view display function of this step can also view the device connection and operation status in the industrial switch network in layers, further enhancing the visual management capability of the network. This method significantly improves the real-time and accuracy of monitoring. By dynamically updating data, the system can not only automatically refresh the topology structure, but also immediately mark abnormal nodes and paths, reducing the reliance on manual monitoring and greatly improving the speed of network fault discovery and response. Through this visualization and multi-level display, network administrators can understand and manage complex network environments more efficiently, greatly improving the efficiency of troubleshooting and the accuracy of decision-making.

[0137] Example 6

[0138] This embodiment is explained in Example 2. Please refer to Figure 1 , specifically: S5 includes S51 and S52;

[0139] S51 includes S511 and S512;

[0140] S511, used to dynamically set the flow anomaly threshold Athreshold based on the obtained flow anomaly index Aflow and path anomaly index Apath and the security policy of the industrial switch network operation f and path anomaly threshold Athreshold p , perform comprehensive calculation to obtain the warning signal value Walcrt;

[0141] The warning signal value Walcrt is calculated by the following algorithm formula;

[0142] ;

[0143] S512: perform an evaluation based on the result output by the warning signal value Walcrt, and generate warning information based on the evaluation result to prompt the abnormal situation of the industrial switch. The specific evaluation content is as follows;

[0144] When the warning signal value Walcrt>0, it means that there is an abnormality in the network connection of the industrial switch network device, indicating that there is at least one abnormality, such as abnormal traffic, excessive packet loss rate, or abnormal path delay. At this time, a warning signal is generated to remind the administrator that there is a security risk in the network;

[0145] When the warning signal value Walcrt≤0, it means that the network connection of the industrial switch network device is normal, and there is no need to generate a warning signal.

[0146] S52 includes S521 and S522;

[0147] S521. Through the network security evaluation formula, all normal network devices are traversed according to the warning signal value Walcrt, the normal node number Si is extracted and input into the network security evaluation formula, and the network security coefficient Snet is calculated and output;

[0148] The network security coefficient Snet is calculated and output by the following network security evaluation formula;

[0149] ;

[0150] S522, by comparing the security threshold S set by the administrator with the obtained network security coefficient Snet, the overall health and security status of the industrial switch network is evaluated and analyzed, and the specific evaluation content is as follows;

[0151] When the network security coefficient Snet> security threshold S, it means that the network device connected to the current industrial switch is normal and the network connection is in normal state;

[0152] When the network security coefficient Snet ≤ security threshold S, it means that the network device connected to the current industrial switch is abnormal and the network is in an abnormal state. Then an early warning signal is generated to remind the administrator that the network is in an unsafe state and that the abnormal node N needs to be checked and repaired. i and topological path P i，i+1 .

[0153] In this embodiment, the dual mechanism of early warning signal generation and network security assessment effectively improves the security protection capability of the industrial switch network. First, through the flow anomaly index Aflow and the path anomaly index Apath, combined with the security policy of the industrial switch, the flow anomaly threshold Athresholdf and the path anomaly threshold Athresholdp are dynamically set, and the early warning signal value Walert is comprehensively calculated to ensure that the system can detect anomalies in time and generate early warning signals. S512 evaluates the network status based on the early warning signal value. When anomalies are detected, the system automatically reminds the administrator to take corresponding repair measures. Further, through the network security assessment formula, combined with Walert, all normal nodes are traversed, the network security coefficient Snet is calculated, and compared with the preset security threshold S to comprehensively evaluate the health status of the network. If Snet is less than the security threshold S, the system will issue a warning to remind the administrator to repair the abnormal nodes and connection paths. This method significantly improves the security and reliability of the network through automated real-time early warning and security assessment. The system can dynamically adjust the security threshold S according to real-time data and anomaly detection results, and intelligently generate early warning signals, avoiding the delay and misjudgment problems caused by relying on fixed thresholds in traditional systems. In addition, the introduction of security assessment formulas enables the system to accurately quantify the health of the network and implement a more comprehensive network security monitoring and early warning mechanism. Through these improvements, network administrators can detect potential security threats earlier and take timely measures to reduce the possibility of equipment failure or data transmission interruption, greatly improving the overall security and stability of the network.

[0154] Example 7

[0155] See also Figure 1 and Figure 2 , a data security intelligent protection system for industrial switches, including a data acquisition and preprocessing module, a network topology structure building module, a data flow anomaly detection and analysis module, an intelligent visualization display module and an intelligent early warning and security assessment;

[0156] The data acquisition and preprocessing module uses the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, and preprocesses the security data to obtain the industrial switch monitoring data set;

[0157] The network topology building module is used to generate the node N of the network device according to the acquired industrial switch monitoring data set. i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1 , construct the network topology algorithm formula, and pass the node N i and topological path P i，i+1, calculate and output the topological structure Tnet;

[0158] The data flow anomaly detection and analysis module extracts the industrial switch monitoring data set by constructing a flow anomaly algorithm formula and a path anomaly algorithm formula, and inputs them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively to calculate and output the flow anomaly index Aflow and the path anomaly index Apath;

[0159] The intelligent visualization display module is used to display the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath results through a visualization interface;

[0160] The intelligent early warning and security assessment is used to perform comprehensive calculations based on the flow anomaly index Aflow and the path anomaly index Apath to obtain the early warning signal value Walcrt, and evaluate the output result of the early warning signal value Walcrt to prompt the data security of the switch, and at the same time construct a network security assessment formula. i的 Based on the comprehensive situation, the network security coefficient Snet is calculated and output, and the preset security threshold S is compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

[0161] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.

Claims

1. A data security intelligent protection method for an industrial switch, characterized in that: The following steps are involved: S1. Use the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, pre-process the security data, and obtain the industrial switch monitoring data set; Said S1 includes S11 and S12; S11. Real-time collection of security data in industrial switches through built-in software and network protocols of industrial switches; The built-in software includes a network interface controller NIC and a traffic monitoring module The network protocols include SNMP protocol and ICMP protocol; The security data includes data packet transmission time T, average transmission time Tavg, number of lost data packets Plost, total number of transmitted data packets Ptotal, flow peak change △Fpcak, time window Twindow, each hop delay Thop, data packet loss rate Ploss and number of retries Retry; S12, preprocessing is performed according to the acquired security data, wherein the preprocessing method includes calculation after denoising, and an industrial switch monitoring data set is obtained, wherein the industrial switch monitoring data set includes a port jitter rate Jport, a data packet loss rate Lpackct, an abnormal traffic frequency Fanom, and a network path delay Dpath, and the specific calculation method is as follows; The port jitter rate Jport is obtained by calculating the transmission time Tk and the average transmission time Tavg, and the calculation formula is: , where m represents the total number of packets in the time period, k represents the kth packet, and Tk represents the transmission time of the kth packet; The packet loss rate Lpackct is obtained by calculating the number of lost packets Plost and the total number of transmitted packets Ptotal, and the calculation formula is: ; The abnormal flow frequency Fanom is obtained by calculating and processing the flow peak change △Fpcak and the time window Twindow, and the calculation formula is: ; The network path delay Dpath is obtained by calculating the delay per hop Thop, the packet loss rate Ploss and the number of retries Retry, and the calculation formula is: , where B represents the total number of hops, t represents the index of the current hop, and represents the 1st hop to the Bth hop; S2. Generate the node N of the network device based on the acquired industrial switch monitoring data set i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1， Construct the network topology algorithm formula and pass the node N i and topological path P i，i+1 , calculate and output the topological structure Tnet; The S2 includes S21, S22 and S23; S21. Set each network device connected to the industrial switch as a node N. i , based on the acquired industrial switch monitoring data set, generate the node information of each network device, and output the node N of the current network device through the node construction formula i ; The node N i Constructed by the following node construction formula; ； In the formula, Di represents the network device identifier, which is used to uniquely identify each device in the network. It is identified by the MAC address of the network device, and N i represents the i-th node in the industrial switch; S22, based on the acquired node N i , calculate the connection path between network device nodes and obtain the topological path P i，i+1； The topological path P i，i+1 Obtained through the following algorithm formula; ； Where N i+1 represents the node of the next network device, and f represents the mapping function; S23, by constructing a network topology algorithm formula, the obtained node N i and topological path P i，i+1 Input into the network topology algorithm formula to generate the topology Tnet of the entire industrial switch network ； The topology structure Tnet is calculated and output by the following network topology structure algorithm formula; ； In the formula, n represents the total number of nodes, i represents the index of the current node, indicating that the i-th node is currently being calculated; S3. By constructing a flow anomaly algorithm formula and a path anomaly algorithm formula, extracting the industrial switch monitoring data set, inputting them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively, and calculating and outputting the flow anomaly index Aflow and the path anomaly index Apath; The S3 includes S31 and S32; S31, construct a flow anomaly algorithm formula, extract the port jitter rate Jport and the abnormal flow frequency Fanom in the industrial switch monitoring data set, input them into the flow anomaly algorithm formula, calculate and output the flow anomaly index Aflow; The flow anomaly index Aflow is calculated and obtained by the following flow anomaly algorithm formula; ； In the formula, and They represent the preset weight values ​​of the port jitter rate Jport and the abnormal traffic frequency Fanom, respectively, and + =1, the specific value is set by the user; S32, used to construct a path anomaly algorithm formula, extract the data packet loss rate Lpackct and network path delay Dpath in the industrial switch monitoring data set and the per-hop delay Thop and retry number Retry in the security data, input them into the path anomaly algorithm formula, calculate and output the path anomaly index Apath; The path anomaly index Apath is calculated and output by the following path anomaly algorithm formula; ； In the formula, represents the data transmission quality, log represents the logarithmic function, It represents the logarithm of the number of retries Retry and the delay per hop Thop, which is used to indicate the stability of data transmission; S4, display the topology structure Tnet, flow anomaly index Aflow and path anomaly index Apath results through a visual interface; S5. According to the flow anomaly index Aflow and the path anomaly index Apath, a comprehensive calculation is performed to obtain the warning signal value Walcrt, and the output result of the warning signal value Walcrt is evaluated to indicate the data security of the switch. At the same time, a network security evaluation formula is constructed. i Based on the comprehensive situation, the network security coefficient Snet is calculated and output, and the security threshold S is preset. The security threshold S is then compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

2. The data security intelligent protection method of an industrial switch according to claim 1 is characterized in that: The S4 includes S41; S41, displaying the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath in a graphical interface, dynamically updating and displaying them in a multi-level view through a visualization interface; The graphical interface is used to display the node N of each network device in real time. i Health status, green indicates normal and red indicates abnormal; The dynamic update continuously collects the security data of the industrial switch and processes it to obtain the industrial switch monitoring data set. The system automatically updates the topology structure Tnet and marks the abnormal topology path P i，i+1 and node N i ; The multi-level view displays the topology structure Tnet in layers according to the device data connected to the industrial switch network.

3. The data security intelligent protection method of an industrial switch according to claim 1 is characterized in that: The S5 includes S51 and S52; The S51 includes S511 and S512; S511, used to dynamically set the flow anomaly threshold Athreshold based on the obtained flow anomaly index Aflow and path anomaly index Apath and the security policy of the industrial switch network operation f and path anomaly threshold Athreshold p , perform comprehensive calculation to obtain the warning signal value Walcrt; S512: perform an evaluation based on the result output by the warning signal value Walcrt, and generate warning information based on the evaluation result to prompt the abnormal situation of the industrial switch. The specific evaluation content is as follows; When the warning signal value Walcrt>0, it means that there is an abnormality in the network connection of the industrial switch network device. At this time, a warning signal is generated to remind the administrator that there is a security risk in the network; When the warning signal value Walcrt≤0, it means that the network connection of the industrial switch network device is normal, and there is no need to generate a warning signal.

4. The data security intelligent protection method of an industrial switch according to claim 3 is characterized in that: The S52 includes S521 and S522; S521. Through the network security evaluation formula, all normal network devices are traversed according to the warning signal value Walcrt, the normal node number Si is extracted and input into the network security evaluation formula, and the network security coefficient Snet is calculated and output; S522, by comparing the security threshold S set by the administrator with the obtained network security coefficient Snet, the overall health and security status of the industrial switch network is evaluated and analyzed, and the specific evaluation content is as follows; When the network security coefficient Snet> security threshold S, it means that the network device connected to the current industrial switch is normal and the network connection is in normal state; When the network security coefficient Snet ≤ security threshold S, it means that the network device connected to the current industrial switch is abnormal and the network is in an abnormal state. Then an early warning signal is generated to remind the administrator that the network is in an unsafe state and that the abnormal node N needs to be checked and repaired. i and topological path P i，i+1。 5. A data security intelligent protection system for an industrial switch, applied to a data security intelligent protection method for an industrial switch according to any one of claims 1 to 4, characterized in that: It includes data collection and preprocessing module, network topology building module, data flow anomaly detection and analysis module, intelligent visualization display module and intelligent early warning and security assessment; The data acquisition and preprocessing module uses the built-in software and network protocol of the industrial switch to collect the security data of all network devices in the industrial switch in real time, and preprocesses the security data to obtain the industrial switch monitoring data set; The network topology building module is used to generate the node N of the network device according to the acquired industrial switch monitoring data set. i , and then through node N i Calculate the connection path between network devices to obtain the topological path P i，i+1， Construct the network topology algorithm formula and pass the node N i and topological path P i，i+1 , calculate and output the topological structure Tnet; The data flow anomaly detection and analysis module extracts the industrial switch monitoring data set by constructing a flow anomaly algorithm formula and a path anomaly algorithm formula, and inputs them into the flow anomaly algorithm formula and the path anomaly algorithm formula respectively to calculate and output the flow anomaly index Aflow and the path anomaly index Apath; The intelligent visualization display module is used to display the topology structure Tnet, the flow anomaly index Aflow and the path anomaly index Apath results through a visualization interface; The intelligent early warning and security assessment is used to perform comprehensive calculations based on the flow anomaly index Aflow and the path anomaly index Apath to obtain the early warning signal value Walcrt, and evaluate the output result of the early warning signal value Walcrt to prompt the data security of the switch, and at the same time construct a network security assessment formula. i The comprehensive situation is used to calculate and output the network security coefficient Snet, and the preset security threshold S is compared with the output network security coefficient Snet to evaluate and analyze the security status of the industrial switch during data transmission, and a protection mechanism is generated.

Images