An IMC embedded PC remote control system

Abstract

The invention belongs to the technical field of PC remote control, and discloses an IMC embedded PC remote control system, comprising: a first analysis module, which generates an operation coefficient according to an industrial control system operation parameter set, wherein the industrial control system operation parameter set is hardware data required for the normal operation of the industrial control system, and is uploaded to a blockchain; an upload module, which is used to upload the current control parameters of the industrial control system and the current control process of the industrial control system to the blockchain; an anomaly detection module, which is used to input the real-time collected system operation data into a pre-built anomaly recognition model, obtain an anomaly recognition result, and mark the industrial control system corresponding to the anomaly as an abnormal industrial control system; an instruction generation module, which generates an isolation instruction and a request takeover instruction when the anomaly recognition result is an abnormality, and publishes them to the blockchain; ICS can quickly exchange information, speed up the takeover decision-making speed, avoid the abnormality of controlled industrial equipment, and ensure the normal operation of the equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of PC remote control, and more specifically to an IMC embedded PC remote control system. Background Art

[0002] With the in-depth development of Industry 4.0 and intelligent manufacturing, the position of industrial control systems (ICS) in modern industry has become increasingly important. ICS is widely used in key fields such as electricity, petrochemicals, and manufacturing, responsible for monitoring and controlling industrial equipment and production processes. However, with the popularization of network technology and the rise of the industrial Internet, ICS faces unprecedented security challenges.

[0003] Traditional ICS usually adopts closed networks with relatively simple security protection measures. However, with the improvement of network interconnection, ICS is gradually exposed to open network environments and faces the following security risks:

[0004] 1. Hackers may invade ICS through the network, causing equipment to lose control and triggering serious production accidents.

[0005] 2. Traditional ICS usually adopts a centralized architecture. Once the core control system fails, the controlled industrial equipment will malfunction, causing the entire production line to stagnate and causing huge losses.

[0006] 3. In an open network environment, transmitted data may be intercepted, tampered with or lost, affecting the accuracy and timeliness of control instructions.

[0007] In view of this, the present invention proposes an IMC embedded PC remote control system to solve the above problems. Summary of the invention

[0008] In order to overcome the above defects of the prior art and achieve the above purpose, the present invention provides the following technical solutions: an IMC embedded PC remote control system, Industrial control systems are connected through the blockchain network, including:

[0009] The first analysis module generates an operation coefficient based on the industrial control system operation parameter set, which is the hardware data required for the normal operation of the industrial control system and is uploaded to the blockchain;

[0010] The upload module is used to upload the current control parameters and the current control process of the industrial control system to the blockchain;

[0011] The anomaly detection module is used to input the real-time collected system operation data into the pre-built anomaly recognition model to obtain anomaly recognition results, which include normal and abnormal, and mark the industrial control system corresponding to the abnormality as an abnormal industrial control system;

[0012] The instruction generation module generates isolation instructions and takeover request instructions when the abnormality identification result is abnormal, and publishes them on the blockchain;

[0013] The second analysis module is used to record the takeover adaptability scores published by other industrial control systems on the blockchain, and screen from other industrial control systems according to the operation coefficient and the takeover adaptability score to determine the takeover industrial control system; the takeover industrial control system obtains the current control parameters and the current control process of the abnormal industrial control system from the blockchain, and the takeover industrial control system sends control instructions to the controlled industrial equipment controlled by the abnormal industrial control system according to the current control parameters and the current control process for synchronous control, and the abnormal industrial control system is isolated according to the isolation instruction.

[0014] Furthermore, the takeover adaptation score is calculated according to the load capacity and the data transmission delay; the method for generating the takeover adaptation score includes:

[0015] ;

[0016] In the formula, For the Takeover adaptability score of each industrial control system; and All are weight coefficients; For the The load capacity of an industrial control system; For the The data transmission delay of an industrial control system.

[0017] Furthermore, the load capacity calculation method includes:

[0018] ;

[0019] In the formula, is the load capacity; is the processor occupancy rate; is the total number of processors; is the memory usage; is the total amount of memory;

[0020] The calculation method of data transmission delay includes:

[0021] ;

[0022] In the formula, Delay in data transmission; is the amount of data; For the The available network bandwidth between an industrial control system and the controlled industrial equipment, For the The network latency between an industrial control system and the controlled industrial equipment.

[0023] Furthermore, the training method of the anomaly recognition model includes:

[0024] Pre-collect k groups of detection data, where k is an integer greater than 1, and the detection data includes system operation data and abnormality recognition results corresponding to the system operation data, and convert the detection data into feature vectors;

[0025] Each group of feature vectors is used as the input of an anomaly recognition model, and the anomaly recognition model takes a group of predicted anomaly recognition results corresponding to each group of system operation data as output, and takes the actual anomaly recognition results corresponding to each group of system operation data as the prediction target; minimizing the sum of prediction errors of all system operation data is used as the training target; the anomaly recognition model is trained until the sum of prediction errors reaches convergence, and the training is stopped; the anomaly recognition model is a decision tree model, a random forest model or a gradient boosting tree model.

[0026] Furthermore, the system operation data includes hardware resource usage data, network behavior data, process thread activity data, user behavior data, temperature data, and log data; the hardware resource usage data includes real-time CPU load, memory usage data, hard disk read and write rate, and space usage data;

[0027] Network behavior data includes packet flow, network latency, number of connection requests, and number of abnormal ports; user behavior data includes number of login attempts, changes in user permission levels, and frequency of file access; temperature data includes temperature data of the CPU and GPU.

[0028] Furthermore, the current control parameter is the control parameter of the industrial control system currently controlling the controlled industrial equipment; the current control process is the progress data in the control parameter.

[0029] Furthermore, it also includes:

[0030] Data collection module, used to collect system performance data, network performance data and the volume of control instruction data at the future time T. System performance data includes takeover adaptation score and load capacity, and network performance data includes data transmission delay, network bandwidth, network jitter and packet loss rate;

[0031] The feature module is used to smooth the takeover adaptation score and the load capacity to obtain smoothed data of the takeover adaptation score and the load capacity; and calculate the data transmission delay change rate and the takeover adaptation score change rate;

[0032] The third analysis module is used to input the system performance data, network performance data, the volume of control instruction data at the future time T, the smoothed data of the takeover adaptation score, the smoothed data of the load capacity, the data transmission delay change rate and the takeover adaptation score change rate into the pre-trained prediction model to obtain the data transmission delay and the takeover adaptation score at the future time T;

[0033] The fourth analysis module comprehensively analyzes the data transmission delay at the future time T, the takeover adaptation score at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score to determine whether to generate an early execution instruction, the early execution instruction includes a first early execution instruction and a second early execution instruction;

[0034] The fifth analysis module calculates the advance sending time according to the first advance execution instruction; according to the second advance execution instruction, marks the current industrial control system as an overloaded industrial control system, and publishes the control instruction data volume at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score to the blockchain. The remaining industrial control systems connected to the blockchain execute the operations from the data acquisition module to the fourth analysis module, and the industrial control system that does not generate the advance execution instruction takes over the task of sending control instructions to the controlled industrial equipment at the future time T by the overloaded industrial control system.

[0035] Furthermore, the method for obtaining the takeover adaptation score smoothing data and the load capacity smoothing data includes:

[0036] ;

[0037] In the formula, For the The industrial control system is Load capacity smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in Load capacity at any time; For the Industrial control systems in The load capacity smoothing data of the moment before the moment; the initial value of the load capacity smoothing data is the average value of the load capacity collected per unit time before the current moment;

[0038] ;

[0039] In the formula, For the The industrial control system is Take over the adaptation score smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in The takeover adaptation score at the moment; For the Industrial control systems are The smoothed data of the takeover adaptation score at the moment before the moment; the initial value of the smoothed data of the takeover adaptation score is the average value of the takeover adaptation score collected in the unit time before the current moment.

[0040] Furthermore, the method for generating the first advance execution instruction and the second advance execution instruction includes:

[0041] If the data transmission delay at the future time T is greater than the maximum acceptable delay, and the takeover adaptation score at the future time T is greater than the minimum takeover adaptation score, a first early execution instruction is generated;

[0042] If the takeover adaptation score at the future time T is less than the minimum takeover adaptation score, a second early execution instruction is generated.

[0043] Furthermore, the method for calculating the advance sending time includes:

[0044] ;

[0045] To send the time in advance; For the The data transmission delay of an industrial control system at the future time T; The preset maximum acceptable delay.

[0046] The technical effects and advantages of an IMC embedded PC remote control system of the present invention are as follows:

[0047] By connecting multiple industrial control systems (ICS) to the blockchain network, the security and integrity of the data on the blockchain are ensured by utilizing its decentralized and tamper-proof characteristics. Each ICS will upload its own operating parameters, current control parameters, and current control process to the blockchain, so that other ICS can take over at any time.

[0048] Each ICS inputs the real-time collected system operation data into the pre-built anomaly recognition model to obtain anomaly recognition results. If an anomaly is identified, the corresponding ICS is marked as an abnormal ICS. When an anomaly is detected, the system generates an isolation instruction and a takeover request instruction and publishes them to the blockchain.

[0049] The abnormal ICS will record the takeover adaptability scores published by other ICS on the blockchain, and select the most suitable takeover ICS from other ICS based on its own operating parameters and these adaptability scores. The takeover ICS obtains the current control parameters and control process of the abnormal ICS from the blockchain, and then sends control instructions to the controlled industrial equipment controlled by the abnormal ICS based on this information to achieve synchronous control. At the same time, the abnormal ICS is isolated according to the isolation instruction.

[0050] In summary, by introducing blockchain and multi-ICS collaboration mechanism, even if an ICS fails, other ICS can quickly take over to ensure the continuous operation of industrial equipment and avoid production interruptions. The immutability of blockchain ensures the integrity of data and prevents malicious tampering. At the same time, the anomaly identification model can promptly detect abnormal behavior in the system and prevent potential network attacks and internal failures.

[0051] By leveraging the real-time data sharing feature of blockchain, ICS can quickly exchange information, speed up exception handling and takeover decision-making, avoid abnormalities in controlled industrial equipment, and ensure the normal operation of equipment; automated anomaly detection and takeover processes reduce the need for manual intervention, reduce operation and maintenance costs, and improve management efficiency; all operations and data are recorded on the blockchain, providing a complete audit trail to facilitate post-analysis and regulatory compliance.

[0052] By taking over the adaptation scoring mechanism, the system can intelligently allocate control tasks and optimize resource utilization according to the operating status and capabilities of each ICS; new ICS can easily join the network and enjoy the same security and collaboration mechanism, and the scalability and flexibility of the system are improved; the sharing characteristics of the blockchain network eliminate the information barriers between ICS, promote the interconnection and interoperability of data, and enhance the synergy of the overall system.

[0053] Centrally shared real-time data and operating parameters provide a rich information basis for advanced analysis and optimization, supporting more accurate business decisions; unified data upload and takeover processes contribute to the formulation and promotion of industry standards and improve standardization in the field of industrial control. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a schematic diagram of an IMC embedded PC remote control system according to Embodiment 1 of the present invention;

[0055] Figure 2 This is a schematic diagram of an IMC embedded PC remote control system according to Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Example 1

[0058] See also Figure 1 As shown, the IMC embedded PC remote control system described in this embodiment, An industrial control system is connected through a blockchain network, including a first analysis module, an upload module, an anomaly detection module, an instruction generation module and a second analysis module, and each module is connected through wired and / or wireless connections.

[0059] The anomaly detection module is used to input the real-time collected system operation data into the pre-built anomaly recognition model to obtain anomaly recognition results. The anomaly recognition results include normal and abnormal. The abnormalities include system hardware failures and attacks. The industrial control system with abnormal anomaly recognition results is marked as an abnormal industrial control system.

[0060] System operation data includes hardware resource usage data, network behavior data, process thread activity data, user behavior data, temperature data, log data and other data; hardware resource usage data includes real-time CPU load, memory usage data, hard disk read and write rate and space usage data.

[0061] Network behavior data includes packet flow, network latency, number of connection requests, and number of abnormal ports; user behavior data includes number of login attempts, changes in user permission levels, and frequency of file access; temperature data includes temperature data of components such as CPU and GPU.

[0062] The training method of the anomaly recognition model includes:

[0063] K groups of detection data are collected in advance, where k is an integer greater than 1. The detection data includes system operation data and anomaly recognition results corresponding to the system operation data, and the detection data is converted into a feature vector.

[0064] Each group of feature vectors is used as the input of an anomaly recognition model. The anomaly recognition model takes a group of predicted anomaly recognition results corresponding to each group of system operation data as output, and takes the actual anomaly recognition results corresponding to each group of system operation data as the prediction target; minimizing the sum of prediction errors of all system operation data is used as the training target; the anomaly recognition model is trained until the sum of prediction errors reaches convergence, and the training is stopped.

[0065] The anomaly recognition model is specifically a decision tree model, a random forest model or a gradient boosting tree model; it includes an input layer, a hidden layer and an output layer; each hidden layer includes multiple neurons, each neuron is connected to the neurons in the next layer, and the connection contains weights that determine the importance and influence of data transmission in the neural network; an activation function is applied to each neuron between the hidden layer and the output layer.

[0066] The introduction of activation functions gives the network nonlinear characteristics, allowing the network to learn more complex patterns and features.

[0067] The first analysis module generates an operating coefficient based on the industrial control system operating parameter set. The industrial control system operating parameter set is the hardware data required for the normal operation of the industrial control system and is uploaded to the blockchain; the industrial control system operating parameter set is the hardware data required for the normal operation of the industrial control system. The hardware data required for the normal operation of the industrial control system includes CPU utilization, cache capacity, floating-point computing power, total memory capacity, memory usage, memory access speed, hard disk / SSD total capacity, hard disk / SSD utilization, and data transmission rate.

[0068] Methods for generating operating factors include:

[0069]

[0070] In the formula, is the operating coefficient; is the CPU utilization weight; is the CPU utilization; is the cache capacity weight; is the cache capacity; is the floating point computing capability weight; is the floating point computing capability; is the total memory capacity weight; is the total memory capacity; is the memory usage weight; is the memory usage; is the memory access speed weight; is the memory access speed; is the total capacity weight of the hard disk / SSD; is the total capacity of the hard disk / SSD; is the utilization weight of the hard disk / SSD; is the hard disk / SSD utilization; is the data transmission rate weight; is the data transmission rate.

[0071] The upload module is used to upload the current control parameters and the current control process of the industrial control system to the blockchain.

[0072] The current control parameters of the industrial control system are the control parameters of the industrial equipment currently controlled by the industrial control system; the current control process of the industrial control system is the progress data in the control parameters, the purpose of which is to record the current control parameters and control process of each industrial control system to ensure that other industrial control systems can take over accurately.

[0073] The instruction generation module generates isolation instructions and request takeover instructions when the abnormality identification result is abnormal, and publishes them to the blockchain. At this time, other normal industrial control systems on the blockchain record them.

[0074] The second analysis module is used to record the takeover adaptability scores published by other industrial control systems on the blockchain, and screen from other industrial control systems according to the operation coefficient and the takeover adaptability score to determine the takeover industrial control system; the takeover industrial control system obtains the current control parameters and the current control process of the abnormal industrial control system from the blockchain, and the takeover industrial control system sends control instructions to the controlled industrial equipment controlled by the abnormal industrial control system according to the current control parameters and the current control process to perform synchronous control. After the synchronous control is completed, the abnormal industrial control system is isolated according to the isolation instruction, and the connection with the external network and other industrial control systems is disconnected.

[0075] Ensure the continuity of takeover; ensure timely isolation when the industrial control system is abnormal, and quickly and reliably select the most suitable other industrial control system to take over the control task to ensure the continuous operation of the controlled industrial equipment. The whole process fully considers factors such as system load, network delay and bandwidth, and uses clear formulas for quantitative evaluation to improve the scientificity and reliability of decision-making.

[0076] The takeover adaptation score is calculated based on the load capacity and the data transmission delay. The method for generating the takeover adaptation score includes:

[0077] ;

[0078] In the formula, For the Takeover adaptability score of each industrial control system; and All are weight coefficients; =1; For the The load capacity of an industrial control system; For the The data transmission delay of an industrial control system. The larger the value, the more suitable the corresponding industrial control system is for takeover.

[0079] Load capacity calculation methods include:

[0080] ;

[0081] In the formula, is the load capacity. The smaller the value, the lower the load and the greater the ability to take over. is the processor occupancy rate; is the total number of processors; is the memory usage; The total amount of memory.

[0082] The calculation method of data transmission delay includes:

[0083] ;

[0084] In the formula, is the data transmission delay. The smaller the value, the smaller the data transmission delay. is the amount of data; For the The available network bandwidth between an industrial control system and the controlled industrial equipment, For the The network delay between an industrial control system and the controlled industrial equipment can be measured by PING or other network testing tools.

[0085] Example 2

[0086] In high-precision machining, timely transmission of control instructions is critical to machining quality. Network latency and real-time changes in the takeover adaptation score can cause delays in the transmission of control instructions, which can affect machining accuracy. To prevent this, refer to Figure 1 As shown, the IMC embedded PC remote control system described in this embodiment also includes:

[0087] The data collection module is used to collect system performance data, network performance data and the volume of control instruction data at the future time T. The system performance data includes the takeover adaptation score and load capacity. The takeover adaptation score reflects the performance and load of the current ICS; the network performance data includes data transmission delay, network bandwidth, network jitter and packet loss rate.

[0088] The feature module is used to smooth the takeover adaptation score and load capacity to obtain smoothed data of the takeover adaptation score and load capacity; and calculate the data transmission delay change rate and the takeover adaptation score change rate.

[0089] Methods for obtaining smoothed data of takeover adaptability score and load capacity include:

[0090] ;

[0091] In the formula, For the The industrial control system is Load capacity smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in Load capacity at any time; For the Industrial control systems in The load capacity smoothing data of the moment before the moment; the initial value of the load capacity smoothing data is the average value of the load capacity collected per unit time before the current moment.

[0092] ;

[0093] In the formula, For the The industrial control system is Take over the adaptation score smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in The takeover adaptation score at the moment; For the Industrial control systems are The smoothed data of the takeover adaptation score at the moment before the moment; the initial value of the smoothed data of the takeover adaptation score is the average value of the takeover adaptation score collected in the unit time before the current moment.

[0094] The third analysis module is used to input system performance data, network performance data, control instruction data volume at future time T, takeover adaptation score smoothing data, load capacity smoothing data, data transmission delay change rate and takeover adaptation score change rate into the pre-trained prediction model to obtain the data transmission delay and takeover adaptation score at future time T.

[0095] The training methods of the prediction model include:

[0096] H groups of prediction data are collected in advance, and the prediction data include prediction feature data and the data transmission delay and takeover adaptation score at the future time T corresponding to the prediction feature data; the prediction feature data include system performance data, network performance data, control instruction data volume at the future time T, takeover adaptation score smoothing data, load capacity smoothing data, data transmission delay change rate and takeover adaptation score change rate.

[0097] The H groups of prediction data are converted into feature vectors and divided into training set and test set. The prediction feature data in the training set is used as the input of the prediction model. The data transmission delay and takeover adaptation score at the future T moment in the training set are used as the output of the prediction model. The prediction model is tested with the test set, and the prediction model that meets the prediction accuracy is output. The prediction model uses the long short-term memory network (LSTM) or the gradient boosting decision tree (GBDT).

[0098] The fourth analysis module conducts a comprehensive analysis of the data transmission delay at the future time T, the takeover adaptation score at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score to determine whether to generate an early execution instruction; the maximum acceptable delay is the maximum delay that can be tolerated by the control instruction at the future time T, and the minimum takeover adaptation score is lower than this value, indicating poor system performance.

[0099] The method for determining whether to generate an advance execution instruction includes:

[0100] The advance execution instruction includes a first advance execution instruction and a second advance execution instruction.

[0101] If the data transmission delay at the future time T is greater than the maximum acceptable delay, and the takeover adaptation score at the future time T is greater than the minimum takeover adaptation score, the first early execution instruction is generated, otherwise it is not generated.

[0102] If the takeover adaptation score at the future time T is less than the minimum takeover adaptation score (resulting in the control instruction being unable to be generated and requiring the generation of another industrial control system), the second advance execution instruction is generated, otherwise it is not generated.

[0103] The fifth analysis module calculates the advance sending time according to the first advance execution instruction; according to the second advance execution instruction, the current industrial control system is marked as an overloaded industrial control system, and the control instruction data volume at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score are published on the blockchain. The remaining industrial control systems connected to the blockchain execute the operations from the data acquisition module to the fourth analysis module. The industrial control system that does not generate the advance execution instruction takes over the task of sending the control instruction to the controlled industrial equipment at the future time T by the overloaded industrial control system; multiple security measures are implemented to ensure that the control instructions arrive on time, maintain the stable operation of the controlled industrial equipment to the maximum extent, and ensure the processing accuracy of the product.

[0104] Methods for calculating the lead time include:

[0105] ;

[0106] To send the time in advance; For the The data transmission delay of an industrial control system at the future time T; The preset maximum acceptable delay.

[0107] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0108] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An IMC embedded PC remote control system, characterized in that: Industrial control systems are connected through the blockchain network, including: The first analysis module generates an operation coefficient based on the industrial control system operation parameter set, which is the hardware data required for the normal operation of the industrial control system and is uploaded to the blockchain; The upload module is used to upload the current control parameters and the current control process of the industrial control system to the blockchain; The anomaly detection module is used to input the real-time collected system operation data into the pre-built anomaly recognition model to obtain anomaly recognition results, which include normal and abnormal, and mark the industrial control system corresponding to the abnormality as an abnormal industrial control system; The instruction generation module generates isolation instructions and takeover request instructions when the abnormality identification result is abnormal, and publishes them on the blockchain; The second analysis module is used to record the takeover adaptability scores published by other industrial control systems on the blockchain, and screen from other industrial control systems according to the operation coefficient and the takeover adaptability score to determine the takeover industrial control system; the takeover industrial control system obtains the current control parameters and current control process of the abnormal industrial control system from the blockchain, and the takeover industrial control system sends control instructions to the controlled industrial equipment controlled by the abnormal industrial control system according to the current control parameters and current control process, performs synchronous control, and the abnormal industrial control system is isolated according to the isolation instruction; The takeover adaptation score is calculated based on the load capacity and the data transmission delay. The method for generating the takeover adaptation score includes: ； In the formula, For the Takeover adaptability score of each industrial control system; and All are weight coefficients; For the The load capacity of an industrial control system; For the Data transmission delay of an industrial control system; Load capacity calculation methods include: ； In the formula, is the load capacity; is the processor occupancy; is the total number of processors; is the memory usage; is the total amount of memory; The calculation method of data transmission delay includes: ； In the formula, Delay in data transmission; is the amount of data; For the The available network bandwidth between an industrial control system and the controlled industrial equipment, For the The network latency between an industrial control system and the controlled industrial equipment.

2. An IMC embedded PC remote control system according to claim 1, characterized in that: The training method of the anomaly recognition model includes: Collect k groups of detection data in advance, where k is an integer greater than 1, and the detection data includes system operation data and abnormality recognition results corresponding to the system operation data, and convert the detection data into feature vectors; Each group of feature vectors is used as the input of an anomaly recognition model, and the anomaly recognition model takes a group of predicted anomaly recognition results corresponding to each group of system operation data as output, and takes the actual anomaly recognition results corresponding to each group of system operation data as the prediction target; minimizing the sum of prediction errors of all system operation data is used as the training target; the anomaly recognition model is trained until the sum of prediction errors reaches convergence, and the training is stopped; the anomaly recognition model is a decision tree model, a random forest model or a gradient boosting tree model.

3. An IMC embedded PC remote control system according to claim 1, characterized in that: System operation data includes hardware resource usage data, network behavior data, process thread activity data, user behavior data, temperature data, and log data; hardware resource usage data includes real-time CPU load, memory usage data, hard disk read and write speed, and space usage data; Network behavior data includes packet flow, network latency, number of connection requests, and number of abnormal ports; user behavior data includes number of login attempts, changes in user permission levels, and frequency of file access; temperature data includes temperature data of the CPU and GPU.

4. The IMC embedded PC remote control system according to claim 1, characterized in that: The current control parameters are the control parameters of the industrial control system currently controlling the controlled industrial equipment; the current control process is the progress data in the control parameters.

5. The IMC embedded PC remote control system according to claim 1, characterized in that: Also includes: Data collection module, used to collect system performance data, network performance data and the volume of control instruction data at the future time T. System performance data includes takeover adaptation score and load capacity, and network performance data includes data transmission delay, network bandwidth, network jitter and packet loss rate; The feature module is used to smooth the takeover adaptation score and the load capacity to obtain smoothed data of the takeover adaptation score and the load capacity; and calculate the data transmission delay change rate and the takeover adaptation score change rate; The third analysis module is used to input the system performance data, network performance data, the volume of control instruction data at the future time T, the smooth data of the takeover adaptation score, the load capacity smooth data, the data transmission delay change rate and the takeover adaptation score change rate into the pre-trained prediction model to obtain the data transmission delay and the takeover adaptation score at the future time T; The fourth analysis module comprehensively analyzes the data transmission delay at the future time T, the takeover adaptation score at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score to determine whether to generate an early execution instruction, the early execution instruction includes a first early execution instruction and a second early execution instruction; A fifth analysis module, calculating the advance sending time according to the first advance execution instruction; According to the second advance execution instruction, the current industrial control system is marked as an overloaded industrial control system, and the control instruction data volume at the future time T, the preset maximum acceptable delay and the minimum takeover adaptation score are published on the blockchain. The remaining industrial control systems connected to the blockchain execute the operations from the data acquisition module to the fourth analysis module, and the industrial control system that does not generate the advance execution instruction takes over the task of sending control instructions to the controlled industrial equipment at the future time T by the overloaded industrial control system.

6. An IMC embedded PC remote control system according to claim 5, characterized in that: Methods for obtaining smoothed data of takeover adaptability score and load capacity include: ； In the formula, For the An industrial control system is Load capacity smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in Load capacity at any time; For the Industrial control systems in The load capacity smoothing data of the moment before the moment; the initial value of the load capacity smoothing data is the average value of the load capacity collected per unit time before the current moment; ； In the formula, For the An industrial control system is Take over the adaptation score smoothing data at all times; is the smoothing coefficient, the value range is 0< <1; For the Industrial control systems in The takeover adaptation score at the moment; For the Industrial control systems are The smoothed data of the takeover adaptation score at the moment before the moment; the initial value of the smoothed data of the takeover adaptation score is the average value of the takeover adaptation score collected in the unit time before the current moment.

7. An IMC embedded PC remote control system according to claim 6, characterized in that: The method for generating the first advance execution instruction and the second advance execution instruction includes: If the data transmission delay at the future time T is greater than the maximum acceptable delay, and the takeover adaptation score at the future time T is greater than the minimum takeover adaptation score, a first early execution instruction is generated; If the takeover adaptation score at the future time T is less than the minimum takeover adaptation score, a second early execution instruction is generated.

8. The IMC embedded PC remote control system according to claim 5, characterized in that: Methods for calculating the lead time include: ； To send the time in advance; For the The data transmission delay of an industrial control system at the future time T; The preset maximum acceptable delay.

Images