Internet-based management and control analysis system

Abstract

The invention discloses an internet-based management and control analysis system. An operation method of the system comprises the following steps: collecting and processing industrial internet data information; carrying out data cleaning and persistence processing on the collected industrial internet data information; operation analysis optimization management of the industrial internet is carried out; and security alarm control management of the industrial internet is carried out. The step of collecting and processing the industrial internet data information comprises the steps that a thread monitoring port is started to collect the industrial internet data information, data are received according to the corresponding port, and manufacturer information is written in. The step of carrying out data cleaning and persistence processing on the collected industrial internet data information comprises the steps of carrying out classification and data cleaning on the received data, carrying out classification on different types of data generated by different manufacturers and different devices, and carrying out filtering and filling processing on data information fields. The system has the characteristics of high safety and efficient analysis and management.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to an Internet-based management and analysis system. Background Art

[0002] In recent years, digitalization and informatization in industries and manufacturing have garnered global attention. Previously, industrial and manufacturing production primarily relied on automated models based on local area networks (LANs). However, with the development of advanced internet technologies such as big data, artificial intelligence, and blockchain, these production methods have gradually shifted to intelligent production models that are increasingly closely integrated with the internet. The Industrial Internet has become the foundation of industrial informatization. In industrial internet control systems, the network serves as the bridge for industrial data transmission, and data drives industrial intelligence. Protecting network and data security is essential for the Industrial Internet to improve efficiency, reduce costs, and create value. However, traditional, independent and fragmented protection strategies, such as firewalls, intrusion detection, vulnerability scanning, and virus sandboxing, are ineffective. These devices lack effective information sharing and offer a comprehensive view of existing network vulnerabilities, threats, and attacks. Therefore, it is imperative to design internet-based management and analysis systems that offer high security and efficient analysis and management. Summary of the Invention

[0003] The purpose of the present invention is to provide an Internet-based management and analysis system to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: an Internet-based management and control analysis method, comprising: Collect and process industrial Internet data information; Perform data cleaning and persistence processing on the collected industrial Internet data information; Conduct operational analysis and optimization management of the Industrial Internet; Conduct security alarm control and management of the Industrial Internet.

[0005] According to the above technical solution, the collection and processing of industrial Internet data information includes: Open the thread listening port to collect industrial Internet data information, receive data according to the corresponding port, and write the manufacturer information.

[0006] According to the above technical solution, the data cleaning and persistence processing of the collected industrial Internet data information includes: Classify and clean the received data, classify different types of data generated by different manufacturers and different devices, and filter and fill in the data information fields; The data received and cleaned by the data platform is persistently written to Elasticsearch or the message queue Kafka for use by other services.

[0007] According to the above technical solution, the operation analysis and optimization management of the Industrial Internet includes: After receiving the data information that has completed data cleaning and persistence processing, it is further normalized to achieve uniformity in structure and content; After completing the normalization of data information, perform data flow analysis and optimization processing on it; Debezium is used to monitor PostgresQL database change information and send it to the message queue Kafka for control and management.

[0008] According to the above technical solution, the security alarm control and management of the industrial Internet includes: By establishing a display page, the vulnerability information of the current industrial Internet is displayed and processed, and an interface for users to query asset vulnerabilities and historical vulnerabilities is provided; The display page further provides users with an alarm list, alarm statistics, and alarm settings, allowing users to view basic alarm information through the page. It also supports the creation of disposal tasks, effectively improving user satisfaction.

[0009] According to the above technical solution, an Internet-based management and analysis system includes: The acquisition and processing module is used to collect and process industrial Internet data information; Optimization management module, used for operation analysis and optimization management of the Industrial Internet; The control and management module is used for security alarm control and management of the industrial Internet.

[0010] According to the above technical solution, the acquisition and processing module includes: The acquisition and processing module is used to collect and process industrial Internet data information; Data cleaning module, used for cleaning data information; The persistence module is used to perform persistent processing of industrial Internet data information.

[0011] According to the above technical solution, the optimization management module includes: Normalization processing module, used for normalization processing of industrial Internet data information; Data flow module, used for data flow control analysis and processing; The management control module is used to control and manage database information.

[0012] According to the above technical solution, the control management module includes: Vulnerability management module, used to display, query and manage industrial Internet vulnerability information; The alarm control module is used to control and process alarm information.

[0013] Compared with the prior art, the beneficial effects achieved by the present invention are: the present invention, by providing an acquisition and processing module, an optimization management module and a control management module, can make the collection of data information more efficient and accurate, reduce the load pressure of a single listening port, effectively improve data cleaning efficiency, and make the records processed by the matching tree carry detailed data type fields, and filter out useless fields in the records, effectively reducing the matching difficulty of each type of data, making analysis and processing more efficient and accurate, and effectively improving the security and stability of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is a flow chart of an Internet-based management and analysis system method provided in Example 1 of the present invention; Figure 2 This is a module structure diagram of the Internet-based management and analysis system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0015] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0016] Example 1: Figure 1 This is a flowchart of the Internet-based management and analysis system method provided by the first embodiment of the present invention. This embodiment can be applied to the system. The method can be executed by the Internet-based management and analysis system provided by the embodiment of the present invention. The system consists of multiple software and hardware modules, such as Figure 1 As shown, the method specifically includes the following steps: S101. Collect and process industrial Internet data information; Exemplarily, in an embodiment of the present invention, a thread is opened to listen to a port to collect industrial Internet data information, data is received according to the corresponding port, and manufacturer information is written; since the data collection probes or security protection equipment deployed in the industrial plant area come from different manufacturers, including: protective walls, intrusion detection equipment, auditing equipment, host protection equipment, etc., and the equipment from which the data comes has significant differences and there is no unified standard, each equipment manufacturer has different definitions of the data format, resulting in complexity in the data type and form. Therefore, through this step, multiple threads are opened to listen to multiple ports, the listening ports corresponding to specific manufacturers are customized, and the data received at different ports are assigned manufacturer-specific values. According to the different probe manufacturers, multiple threads are opened to listen separately, and industrial Internet data information is collected while receiving data according to the corresponding ports, and manufacturer information is written. Through this processing, the collection of data information can be made more efficient and accurate, the load pressure of a single listening port can be reduced, and the subsequent data cleaning efficiency can be effectively improved.

[0017] S102. Clean and persist the collected industrial Internet data information; Exemplarily, in an embodiment of the present invention, the received data is classified and cleaned, different types of data generated from different manufacturers and different devices are classified, and the data information fields are filtered and filled; in this step, first, after determining the manufacturer based on the manufacturer field of the JSON object, the JSON object is matched with the rules in the device sub-node corresponding to the manufacturer node to determine the device type to which the JSON object belongs, and the JSON object is matched with the rules in the version sub-node corresponding to the device node to determine the device version information to which the JSON object belongs, and the JSON object is further matched with the rules in the data type sub-node of the corresponding device version node. After determining the data type, it is transmitted to a tree-type matching rule tree composed of rule nodes, so that the records processed by the matching tree carry the data detailed type field, and filter out useless fields in the records, effectively reducing the matching difficulty of each type of data, and making subsequent analysis and processing more efficient and accurate.

[0018] The data received and cleaned by the data platform is persistently written to Elasticsearch or the message queue Kafka for use by other services. In this step, the data writing operation adopts a multi-threaded asynchronous batch method. Atomic references and concurrent safety containers are used to avoid multi-threaded safety issues. The data in the cache is extracted regularly and written to Elasticsearch in batches. At the same time, relatively small amounts of data are written to the message queue Kafka for use by other services, effectively improving the processing security of the Industrial Internet.

[0019] S103. Conduct operational analysis and optimization management of the Industrial Internet; Exemplarily, in an embodiment of the present invention, after receiving the data information that has completed data cleaning and persistence processing, it is further normalized to achieve uniformity in structure and content; in this step, different measures are taken to perform data normalization processing according to factors such as the frequency and data volume of industrial Internet data. For traffic data with relatively high frequency of data volume reporting and data volume exceeding the set threshold, an aggregate query is performed from Elasticsearch according to the set time conditions through a scheduled task. For asset, alarm, vulnerability and other data with a data volume less than the set threshold, the data is processed by subscribing to messages in Kafka, and a thread is started at regular intervals through a scheduled task to aggregate and query the corresponding index in Elasticsearch according to the time conditions. Taking the traffic data of device A as an example, an aggregate query is performed according to conditions such as source IP, source port, destination IP, destination port and time, and the query results are converted into a unified traffic format of the system. After completing the normalization processing of the data information, it is subjected to data flow analysis and optimization processing; in this step, for the threat data flow, first determine whether this type of alarm will generate a loss alarm, then generate a unique identifier through multiple basic attributes of the alarm, merge the events, if the alarm exists, then add one to the alarm data of the alarm, if not, then put the alarm into the database and calculate the asset risk value corresponding to the alarm, for the vulnerability data flow, first verify the data, that is, if the vulnerability does not have corresponding asset data, then discard the data, otherwise create an asset vulnerability association object and save or update it to the database for the web module to perform business retrieval. Through this processing, the security and stability of the industrial Internet are effectively improved.

[0020] Debezium is used to monitor PostgresQL database change information and send it to the message queue Kafka for control and management. In this step, a paging search is first performed in Elasticsearch based on the search conditions, and then the primary key ID obtained from Elasticsearch is used to search in the relational database, thereby effectively improving the database search speed.

[0021] S104. Conduct security alarm control and management of the Industrial Internet; For example, in an embodiment of the present invention, a display page is established to display the vulnerability information of the current industrial Internet, and an interface for querying asset vulnerabilities and historical vulnerabilities is provided for users; The display page further provides users with an alarm list, alarm statistics, and alarm settings, allowing users to view basic alarm information through the page. It also supports the creation of disposal tasks, effectively improving user satisfaction.

[0022] Example 2: Example 2 of the present invention provides an Internet-based management and analysis system. Figure 2 This is a schematic diagram of the module structure of the Internet-based management and analysis system provided in Example 2, as shown in FIG. Figure 2 As shown, the system includes: The acquisition and processing module is used to collect and process industrial Internet data information; Optimization management module, used for operation analysis and optimization management of the Industrial Internet; The control and management module is used for security alarm control and management of the industrial Internet.

[0023] In some embodiments of the present invention, the acquisition and processing module includes: The acquisition and processing module is used to collect and process industrial Internet data information; Data cleaning module, used for cleaning data information; The persistence module is used to perform persistent processing of industrial Internet data information.

[0024] In some embodiments of the present invention, the optimization management module includes: Normalization processing module, used for normalization processing of industrial Internet data information; Data flow module, used for data flow control analysis and processing; The management control module is used to control and manage database information.

[0025] In some embodiments of the present invention, the control management module includes: Vulnerability management module, used to display, query and manage industrial Internet vulnerability information; The alarm control module is used to control and process alarm information.

[0026] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0027] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A management and control analysis method based on the Internet, characterized in that: include: Collect and process industrial Internet data information; Clean and persist the collected industrial Internet data information; Conduct operational analysis and optimization management of the Industrial Internet; Carry out security alarm control and management of the Industrial Internet.

2. The Internet-based management and control analysis method according to claim 1, characterized in that: The collection and processing of industrial Internet data information includes: Open the thread listening port to collect industrial Internet data information, receive data according to the corresponding port, and write the manufacturer information.

3. The Internet-based management and control analysis method according to claim 1, characterized in that: The data cleaning and persistence processing of the collected industrial Internet data information includes: Classify and clean the received data, classify different types of data generated by different manufacturers and different devices, and filter and fill in the data information fields; The data received and cleaned by the data platform is persistently written to Elasticsearch or the message queue Kafka for use by other services.

4. The Internet-based management and control analysis method according to claim 1, characterized in that: The operation analysis and optimization management of the Industrial Internet includes: After receiving the data information that has completed data cleaning and persistence processing, it is further normalized to achieve uniformity in structure and content; After completing the normalization of data information, perform data flow analysis and optimization processing on it; Debezium is used to monitor PostgresQL database change information and send it to the message queue Kafka for control and management.

5. The Internet-based management and control analysis method according to claim 1, characterized in that: The security alarm control and management of the industrial Internet includes: By establishing a display page, the vulnerability information of the current industrial Internet is displayed and processed, and an interface for querying asset vulnerabilities and historical vulnerabilities is provided for users; The display page further provides users with an alarm list, alarm statistics, and alarm settings, allowing users to view basic alarm information through the page. It also supports the creation of disposal tasks, effectively improving user satisfaction.

6. A management and control analysis system based on the Internet, characterized by: include: The collection and processing module is used to collect and process industrial Internet data information; Optimization management module, used for operation analysis and optimization management of the industrial Internet; The control and management module is used for security alarm control and management of the industrial Internet.

7. The Internet-based management and analysis system according to claim 6, characterized in that: The acquisition processing module includes: The acquisition and processing module is used to collect and process industrial Internet data information; Data cleaning module, used for cleaning data information; The persistence module is used to perform persistent processing of industrial Internet data information.

8. The Internet-based management and analysis system according to claim 6, characterized in that: The optimization management module includes: Normalization processing module, used for normalization processing of industrial Internet data information; Data flow module, used for data flow control analysis and processing; The management control module is used to control and manage database information.

9. The Internet-based management and analysis system according to claim 6, characterized in that: The control management module includes: Vulnerability management module, used to display, query and manage industrial Internet vulnerability information; The alarm control module is used to control and process the alarm information.

Images