Log collection method of industrial control system

Abstract

The invention discloses a log collection method of an industrial control system, and relates to the technical field of industrial control systems, and the log collection method of the industrial control system provides an accurate quantitative index for comprehensive evaluation of a system security state through a first stage value S1 and a second stage value S2 obtained through calculation. According to the method, through weighted logarithm processing on different data sources, the data integration process is optimized, and the influence of an extreme value on a result is reduced. Besides, the intervention value K is flexibly adjusted to enhance the adaptability of the index, so that the safety monitoring system can more effectively identify and respond to the system abnormity, the overall safety and reliability are improved, the calculation method of the intervention value K performs logarithmic processing on the CPU utilization rate, the memory usage amount and the variation of the disk read-write speed at different time points, and the calculation accuracy of the intervention value K is improved. And a dynamic and flexible data processing mechanism is provided.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a log collection method for an industrial control system. Background Art

[0002] In the field of modern industrial automation, industrial control systems (ICS) play a vital role as core components. Industrial control systems are responsible for managing and regulating various equipment and systems in the production process, covering multiple technical links from data acquisition, process control to system monitoring and fault diagnosis. Among these technical links, log collection and analysis, as a key area, focuses on collecting operating status information from the system, processing and analyzing this data to generate system health reports and abnormal alarms. Specifically, the work involved in log collection and analysis includes obtaining information from multiple data sources, achieving a comprehensive understanding of the system's operating status through scientific data processing and analysis methods, and promptly handling potential security threats and performance issues.

[0003] Traditional log collection and analysis methods have many deficiencies when processing complex data from industrial control systems. Existing methods are usually poorly adaptable to changes in system load and performance, making it difficult to dynamically adjust monitoring parameters, and thus unable to accurately reflect the changing trends of system status. These methods are often overly sensitive to extreme values, which can easily lead to inaccurate data analysis results and affect the effectiveness of anomaly detection. Because traditional methods cannot fully integrate and process information from different data sources, they may miss key information, resulting in incomplete and in-time identification of system security and performance issues. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the deficiencies in the prior art, the present invention provides a log collection method for an industrial control system, which solves the problems mentioned in the above background technology.

[0006] (II) Technical solution

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a log collection method for an industrial control system, the specific steps are as follows:

[0008] S1. Information collection: deploying collection equipment on industrial control systems to collect multi-source data from work logs;

[0009] S2, data processing, performing data preprocessing on the collected multi-source data, and arranging the preprocessed data into a first data set, a second data set, and a third data set;

[0010] S3, data calculation, integrating and calculating the first data set, the second data set and the third data set to generate a safety alarm coefficient AQX;

[0011] S4, data analysis, comparing the safety alarm coefficient AQX with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the control system is in an abnormal state according to the first comparison result;

[0012] S5, abnormal level. When the first comparison result determines that the control system is currently in an abnormal state, the safety alarm coefficient AQX is integrated with the first threshold value Y to generate an abnormal level value LJZ and a second threshold value R, and the abnormal level value LJZ is compared with the preset second threshold value R to generate a second comparison result, and the abnormal level of the current control system is determined according to the second comparison result;

[0013] S6. Issue appropriate alarms based on the magnitude of the abnormality.

[0014] Preferably, in step S1, the multi-source data includes: network traffic data, system performance data and log data;

[0015] Among them, network traffic data includes the number of data packets, the size of data packets, and the data transmission speed;

[0016] System performance data includes CPU utilization, memory usage, and disk read and write speeds;

[0017] Log data includes event volume, event severity, and response time.

[0018] Preferably, in step S2, after preprocessing the network traffic data, the system performance data and the log data, they are rearranged into a first data set, a second data set and a third data set according to timestamps;

[0019] The first data set includes the number of data packets SJL, the size of data packets SJD, and the data transmission speed CSS;

[0020] The second data set includes CPU utilization, memory usage, and disk read and write speeds;

[0021] The CPU utilization is recorded as CPL1, CPL2, CPL3, ..., CPLn according to the timestamp;

[0022] The memory usage is recorded as NCL1, NCL2, NCL3, ..., NCLn according to the timestamp;

[0023] The disk read and write speeds are recorded as CPD1, CPD2, CPD3, ..., CPDn according to the timestamps;

[0024] The third data set includes the event record volume SGL, event severity SYZ, and response time XYS.

[0025] Preferably, in step S3, the safety alarm coefficient AQX is calculated and obtained by the following formula:

[0026] ;

[0027] Wherein: ln is a logarithmic function, S1 is the first stage value, S2 is the second stage value, the first stage value S1 and the second stage value S2 are obtained by integrating and calculating the first data set and the third data set respectively, a1 and a2 are weight values, and the values ​​of a1 and a2 are adjusted and set by the user.

[0028] Preferably, the first stage value S1 and the second stage value S2 are calculated and obtained by the following formulas respectively:

[0029] ;

[0030] ;

[0031] Where: ln is a logarithmic function, SJL is the number of packets, SJD is the packet size, CSS is the data transmission speed, SGL is the number of event records, SYZ is the event severity, XYS is the response time, and K is the intervention value, which is obtained by integrating and calculating the second data set.

[0032] Preferably, the intervention value K is calculated by the following formula:

[0033] ;

[0034] Where: CPLn, NCLn and CPDn are the CPU utilization, memory usage and disk read / write speed at timestamp n, respectively; CPLn-1, NCLn-1 and CPDn-1 are the CPU utilization, memory usage and disk read / write speed at timestamp n-1, respectively; CPLn-2, ​​NCLn-2 and CPDn-2 are the CPU utilization, memory usage and disk read / write speed at timestamp n-2, respectively; Ln is a logarithmic function.

[0035] Preferably, in step S4, the first comparison result is as follows:

[0036] when When , it means that there is no abnormality in the current industrial control system;

[0037] when , it means that the current industrial control system is abnormal.

[0038] Preferably, in step S5, the second comparison result is as follows:

[0039] when When , it means the current situation is level 1 abnormality;

[0040] when When , it means the current situation is level 2 abnormality;

[0041] when , it means the current abnormality is level 3.

[0042] Preferably, in step S5, the abnormal magnitude value LJZ and the second threshold value R are calculated and obtained by the following formulas respectively:

[0043] ;

[0044] ;

[0045] Where: AQX is the safety alarm coefficient AQX, and Y is the first threshold.

[0046] Preferably, in step S6, the specific alarm method is as follows:

[0047] If the current industrial control system is in a level 1 abnormality, the system administrator will be notified via email or SMS. The email content includes the abnormality details and preliminary diagnosis results;

[0048] If the current industrial control system is in a level 2 abnormality, the system administrator and relevant persons in charge will be notified via email, SMS and instant messaging. The information includes abnormality details, preliminary diagnosis results and recommended treatment measures;

[0049] If the current industrial control system is in the third level of abnormality, the system administrator, senior management and emergency response team will be notified urgently via email, SMS, instant message and phone. The information content includes abnormal details, emergency handling measures and recommended processing steps.

[0050] (III) Beneficial effects

[0051] The present invention provides a log collection method for an industrial control system having the following beneficial effects:

[0052] 1. This log collection method for industrial control systems achieves comprehensive monitoring and accurate evaluation of industrial control systems by collecting and analyzing multi-source data. This method improves the transparency of system operation status and can promptly detect and handle potential security threats and performance issues, thereby enhancing system stability and security. The optimized monitoring capabilities and response mechanisms enable the system to operate more efficiently, reduce the possibility of failures, and reduce the impact on business operations.

[0053] 2. The log collection method of an industrial control system provides accurate quantitative indicators for the comprehensive evaluation of the system security status through the calculated first-stage value S1 and the second-stage value S2. This method not only optimizes the data integration process by weighted logarithmic processing of different data sources, but also reduces the impact of extreme values ​​on the results. In addition, the flexible adjustment of the intervention value K enhances the adaptability of the indicator, so that the security monitoring system can more effectively identify and respond to system anomalies, and improve the overall security and reliability. The calculation method of the intervention value K provides a dynamic and flexible data processing mechanism by logarithmically processing the changes in CPU utilization, memory usage, and disk read and write speed at different time points. This method can not only reflect the changing trend of system load, but also enhance the sensitivity to data changes and the balance of various performance indicators. By optimizing data processing efficiency and providing dynamic adjustment capabilities, the intervention value K makes system monitoring more accurate and adaptable, and can effectively improve the overall system performance and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 It is a step diagram of the method of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Example 1

[0057] See also Figure 1 , a log collection method for an industrial control system, the specific steps are as follows:

[0058] S1. Information collection: deploying collection equipment on industrial control systems to collect multi-source data from work logs;

[0059] S2, data processing, performing data preprocessing on the collected multi-source data, and arranging the preprocessed data into a first data set, a second data set, and a third data set;

[0060] S3, data calculation, integrating and calculating the first data set, the second data set and the third data set to generate a safety alarm coefficient AQX;

[0061] S4, data analysis, comparing the safety alarm coefficient AQX with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the control system is in an abnormal state according to the first comparison result;

[0062] S5, abnormal level. When the first comparison result determines that the control system is currently in an abnormal state, the safety alarm coefficient AQX is integrated with the first threshold value Y to generate an abnormal level value LJZ and a second threshold value R, and the abnormal level value LJZ is compared with the preset second threshold value R to generate a second comparison result, and the abnormal level of the current control system is determined according to the second comparison result;

[0063] S6. Issue appropriate alarms based on the magnitude of the abnormality.

[0064] In this embodiment: In step S1, by deploying efficient collection equipment in the industrial control system, multi-source data collection is performed on the work log. The core task of this step is to obtain log information of the system operation status from multiple data sources. The collection equipment can comprehensively monitor and record information such as network traffic, device status, and operation records. Multi-source data collection ensures the comprehensiveness and accuracy of information and provides reliable basic data for subsequent data processing and analysis. This method improves the understanding of the operation of each part of the system and helps to fully grasp the health status of the system.

[0065] In step S2, after completing the collection of multi-source data, data preprocessing is performed to organize the data into a first data set, a second data set, and a third data set. Data preprocessing includes tasks such as data cleaning, format conversion, and data integration. These operations are intended to remove noise and errors in the data, make the data more standardized and consistent, and ensure data quality. By organizing the data into different data sets, structured data support can be provided for subsequent analysis, enhancing the availability of data and the accuracy of analysis.

[0066] Step S3 involves integrating and calculating the first data set, the second data set, and the third data set to generate a safety alarm coefficient AQX. The key to this step is to comprehensively evaluate the contents of each data set to calculate a comprehensive safety alarm coefficient AQX. This coefficient can reflect the overall safety status of the system and provide a basis for quickly identifying potential risks. Through integrated calculation, the safety performance of the system can be more comprehensively evaluated, effectively supporting the risk management of the system.

[0067] In step S4, the safety alarm coefficient AQX is compared with the preset first threshold value Y to generate a first comparison result, and based on this, it is determined whether the control system is in an abnormal state. The main task of this step is to determine the current state of the system through data analysis and to detect abnormal conditions in a timely manner. By comparing with the preset threshold value, it is possible to quickly determine whether further measures need to be taken, thereby improving the response speed to system abnormalities.

[0068] Step S5: After determining that the system is in an abnormal state, further calculate the integrated value of the safety alarm coefficient AQX and the first threshold value Y to generate an abnormal magnitude value LJZ and a second threshold value R. Then, the abnormal magnitude value LJZ is compared with the second threshold value R to generate a second comparison result. The purpose of this step is to refine the abnormal judgment and clarify the severity of the abnormality. Through further magnitude analysis, the impact range of the abnormality can be accurately assessed, providing a basis for formulating corresponding treatment measures.

[0069] In step S6, corresponding alarm processing is performed according to the abnormal magnitude. The main task of this step is to take appropriate alarm measures according to different abnormal magnitudes to ensure that the abnormality is handled in a timely manner. The hierarchical alarm mechanism helps to reasonably allocate resources, avoid unnecessary interference and waste of resources, and ensure effective response to abnormal situations of different severity.

[0070] This method significantly improves the security and reliability of the system through steps such as multi-source data collection, data preprocessing, comprehensive calculation and hierarchical alarm. Compared with the existing technical means, this method can more accurately judge the system status and timely discover and handle abnormal situations through comprehensive information collection and refined data analysis. The overall operating efficiency of the system is optimized, resource allocation is more reasonable, and safety performance is significantly improved. The implementation of this method ensures comprehensive monitoring and rapid response to industrial control systems, and improves the stability and security of the system.

[0071] Example 2

[0072] See also Figure 1 ,In step S1, the multi-source data includes: network traffic data, system performance data, and log data;

[0073] Among them, network traffic data includes the number of data packets, the size of data packets, and the data transmission speed;

[0074] System performance data includes CPU utilization, memory usage, and disk read and write speeds;

[0075] Log data includes event volume, event severity, and response time.

[0076] In this embodiment: By monitoring the number of packets, it is possible to identify abnormal changes in network traffic and detect whether there are network attacks or abnormal traffic peaks. Timely detection of these abnormal network activities helps improve network security and prevent potential attacks. Monitoring packet size helps identify potential abnormal data transmission situations; for example, excessively large packets may indicate abnormal or malicious activity in data transmission. Monitoring data transmission speed can assess the health of the network, and a sudden drop in speed may indicate network congestion or equipment failure.

[0077] By monitoring CPU utilization, you can understand the system load. Excessive CPU utilization may cause the system to respond slowly or crash. Analyzing memory usage can help detect memory leaks or abnormal application memory usage. Monitoring disk read and write speeds can evaluate system storage performance and identify possible hardware failures or performance bottlenecks.

[0078] Analyzing the volume of event logs can assess the system's activity and event processing, thereby identifying potential anomalies or system problems. Tracking the severity of events helps prioritize high-risk anomalies and ensure that critical issues are resolved in a timely manner. Recording and analyzing response times can assess the efficiency of the system in handling events and identify processing delays or performance bottlenecks.

[0079] By collecting and analyzing multi-source data, this method achieves comprehensive monitoring and accurate evaluation of industrial control systems. This method improves the transparency of system operation status and can promptly detect and deal with potential security threats and performance issues, thereby enhancing system stability and security. The optimized monitoring capabilities and response mechanisms enable the system to operate more efficiently, reduce the possibility of failures, and reduce the impact on business operations.

[0080] Example 3

[0081] See also Figure 1 , in step S2, after preprocessing the network traffic data, the system performance data and the log data, they are rearranged into a first data set, a second data set and a third data set according to the timestamps;

[0082] The first data set includes the number of data packets SJL, the size of data packets SJD, and the data transmission speed CSS;

[0083] The second data set includes CPU utilization, memory usage, and disk read and write speeds;

[0084] The CPU utilization is recorded as CPL1, CPL2, CPL3, ..., CPLn according to the timestamp;

[0085] The memory usage is recorded as NCL1, NCL2, NCL3, ..., NCLn according to the timestamp;

[0086] The disk read and write speeds are recorded as CPD1, CPD2, CPD3, ..., CPDn according to the timestamps;

[0087] The third data set includes the event record volume SGL, event severity SYZ, and response time XYS.

[0088] In this embodiment: by arranging network traffic data, system performance data and log data into different data sets according to timestamps, this method provides detailed time series data that can accurately reflect the operating status and performance trends of the system. Such data preprocessing and organization not only improves the analysis accuracy of the data, but also better supports subsequent anomaly detection and performance evaluation. Overall, the optimized data processing and analysis method enables the system to run more efficiently, discover and solve potential problems in a timely manner, and improve the stability and security of the system.

[0089] Example 4

[0090] See also Figure 1 In step S3, the safety alarm coefficient AQX is calculated by the following formula:

[0091] ;

[0092] Wherein: ln is a logarithmic function, S1 is the first stage value, S2 is the second stage value, the first stage value S1 and the second stage value S2 are obtained by integrating and calculating the first data set and the third data set respectively, a1 and a2 are weight values, and the values ​​of a1 and a2 are adjusted and set by the user.

[0093] In this embodiment: the security alarm coefficient AQX comprehensively considers the first stage value S1 and the second stage value S2, and uses a logarithmic function to weight the data to comprehensively evaluate the security status of the system. The first stage value usually reflects the security status of network traffic data, and the second stage value involves the abnormal situation of system performance and log data.

[0094] Through the weight values ​​adjusted by the user, the formula can flexibly adjust the data at different stages according to actual needs. This enables the system to dynamically adjust the calculation method of the security alarm factor AQX according to different application scenarios or priorities.

[0095] Using logarithmic functions to perform weighted calculations on data can help reduce the impact of extreme data values ​​on the safety alarm coefficient AQX, thereby reducing the interference of abnormal values. The nonlinear processing of data by logarithmic functions can more accurately reflect the actual change trend of the data.

[0096] The AQX effectively integrates multi-dimensional information from different data sets through logarithmic functions and weighted average calculations. This method simplifies the processing of complex data and enables information from multiple data sources to be presented in the form of a single indicator.

[0097] Users can adjust the weight values ​​according to actual conditions to reflect the importance of different data sets. This dynamic adjustment capability allows the alarm threshold to be consistent with the system operation status and requirements.

[0098] This method can detect anomalies more accurately and simplify the data integration process by weighting and logarithmically transforming multidimensional information from different data sources. In addition, users can adjust the weight value according to actual needs, so that the alarm mechanism can be more adapted to different application scenarios and needs. Overall, this calculation method significantly improves the efficiency of system security monitoring and enhances the ability to respond to potential security threats and performance issues.

[0099] Example 5

[0100] See also Figure 1 , the first stage value S1 and the second stage value S2 are calculated and obtained by the following formulas respectively;

[0101] ;

[0102] ;

[0103] Where: ln is a logarithmic function, SJL is the number of packets, SJD is the packet size, CSS is the data transmission speed, SGL is the number of event records, SYZ is the event severity, XYS is the response time, and K is the intervention value, which is obtained by integrating and calculating the second data set.

[0104] In this embodiment, the first stage value S1 and the second stage value S2 respectively comprehensively consider the data of network traffic and system performance, and use the logarithmic function to weight the data. This method can accurately reflect the overall state of the system and provide a quantitative indicator of system security.

[0105] By performing weighted logarithmic calculations on multi-dimensional data such as the number of packets, packet size, data transmission speed, event record volume, event severity, and response time, the first-stage value S1 and the second-stage value S2 integrate data from different sources into a single indicator.

[0106] The use of logarithmic functions can effectively reduce the impact of extreme data values ​​on calculation results, especially in indicators such as the number of data packets, data packet size, and event record volume where extreme conditions may occur.

[0107] By adjusting the intervention value K, users can optimize the calculation process according to the needs of different systems and flexibly adjust the degree of attention to different data sources.

[0108] By comprehensively calculating the first-stage value S1 and the second-stage value S2, the abnormal state of the system can be detected more comprehensively and relevant safety alarm information can be provided.

[0109] The calculated first-stage value S1 and second-stage value S2 provide accurate quantitative indicators for the comprehensive evaluation of the system security status. This method not only optimizes the data integration process by weighted logarithmic processing of different data sources, but also reduces the impact of extreme values ​​on the results. In addition, the flexible adjustment of the intervention value K enhances the adaptability of the indicator, enabling the security monitoring system to more effectively identify and respond to system anomalies, thereby improving overall safety and reliability.

[0110] Example 6

[0111] See also Figure 1 , the intervention value K is calculated by the following formula;

[0112] ;

[0113] Where: CPLn, NCLn and CPDn are the CPU utilization, memory usage and disk read / write speed at timestamp n, respectively; CPLn-1, NCLn-1 and CPDn-1 are the CPU utilization, memory usage and disk read / write speed at timestamp n-1, respectively; CPLn-2, ​​NCLn-2 and CPDn-2 are the CPU utilization, memory usage and disk read / write speed at timestamp n-2, respectively; Ln is a logarithmic function.

[0114] In this embodiment, the intervention value K can effectively reflect the change trend of the system load by performing logarithmic calculation on the changes of CPU utilization, memory usage and disk read / write speed at different timestamps. In particular, by calculating the change rate in different time periods, the fluctuation of the system load can be identified.

[0115] By performing logarithmic processing on the changes in the CPU, memory, and disk read / write speeds, the intervention value K can enhance the system's sensitivity to data changes. This logarithmic processing can effectively reduce the impact of extreme data values ​​and make the evaluation of changes smoother and more stable.

[0116] The intervention value K combines the changes in CPU utilization, memory usage, and disk read and write speed to ensure that each performance indicator is balanced in the calculation. By weighting the changes in these indicators, a comprehensive adjustment value can be obtained.

[0117] By integrating the performance data changes at different timestamps into an intervention value K, the degree of attention paid to various performance indicators can be dynamically adjusted. Users can adjust the calculation method of K according to the actual system status and needs to adapt to different monitoring needs.

[0118] The calculation method of the intervention value K simplifies the data processing process and improves the calculation efficiency by performing logarithmic calculation and weighted processing on the performance data at different time points.

[0119] The calculation method of the intervention value K provides a dynamic and flexible data processing mechanism by performing logarithmic processing on the changes in CPU utilization, memory usage, and disk read and write speed at different time points. This method can not only reflect the changing trend of system load, but also enhance the sensitivity to data changes and the balance of various performance indicators. By optimizing data processing efficiency and providing dynamic adjustment capabilities, the intervention value K makes system monitoring more accurate and adaptable, and can effectively improve the overall system performance and stability.

[0120] Example 7

[0121] See also Figure 1 , in step S4, the first comparison result is as follows;

[0122] when When , it means that there is no abnormality in the current industrial control system;

[0123] when , it means that the current industrial control system is abnormal.

[0124] In step S5, the second comparison result is as follows;

[0125] when When , it means the current situation is level 1 abnormality;

[0126] when When , it means the current situation is level 2 abnormality;

[0127] when , it means the current abnormality is level 3.

[0128] In step S5, the abnormal magnitude value LJZ and the second threshold value R are calculated and obtained by the following formulas respectively;

[0129] ;

[0130] ;

[0131] Where: AQX is the safety alarm coefficient AQX, and Y is the first threshold.

[0132] In step S6, the specific alarm method is as follows:

[0133] If the current industrial control system is in a level 1 abnormality, the system administrator will be notified via email or SMS. The email content includes the abnormality details and preliminary diagnosis results;

[0134] If the current industrial control system is in a level 2 abnormality, the system administrator and relevant persons in charge will be notified via email, SMS and instant messaging. The information includes abnormality details, preliminary diagnosis results and recommended treatment measures;

[0135] If the current industrial control system is in the third level of abnormality, the system administrator, senior management and emergency response team will be notified urgently via email, SMS, instant message and phone. The information content includes abnormal details, emergency handling measures and recommended processing steps.

[0136] In this embodiment: by comparing the safety alarm coefficient AQX with the first threshold value Y, and comparing the abnormal magnitude value LJZ with the second threshold value R, the system can accurately determine the current abnormal state, and respond appropriately according to the abnormal level, and adopt different alarm and notification methods according to different abnormal levels (level 1, level 2, level 3), including email, SMS, instant message and phone call. The response method of each level matches the severity of the abnormality, and provides corresponding processing suggestions and steps.

[0137] Through the hierarchical alarm mechanism, appropriate resources and personnel can be arranged according to the severity of the anomaly. For example, a level 1 anomaly only requires sending a basic notification, while a level 3 anomaly requires urgent notification of all key personnel and quick action. By accurately calculating the safety alarm coefficient AQX and the anomaly magnitude value LJZ, and combining it with the preset threshold for judgment, potential problems in the system can be identified in a timely manner and corresponding measures can be taken. This mechanism can quickly respond to and handle anomalies to prevent system crashes or performance degradation.

[0138] By calculating and comparing the safety alarm coefficient AQX and the abnormal magnitude value LJZ, combined with a multi-level response method, accurate abnormal judgment, timely response and effective processing of industrial control systems can be achieved. This mechanism not only optimizes resource scheduling and management, improves system stability and reliability, but also enhances team communication and collaboration, and improves overall emergency response capabilities.

[0139] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A log collection method for an industrial control system, characterized in that: The specific steps are as follows: S1. Information collection: deploying collection equipment on industrial control systems to collect multi-source data from work logs; S2, data processing, performing data preprocessing on the collected multi-source data, and arranging the preprocessed data into a first data set, a second data set, and a third data set; S3, data calculation, integrating and calculating the first data set, the second data set and the third data set to generate a safety alarm coefficient AQX; S4, data analysis, comparing the safety alarm coefficient AQX with a preset first threshold value Y, thereby generating a first comparison result, and judging whether the control system is in an abnormal state according to the first comparison result; S5, abnormal level. When the first comparison result determines that the control system is currently in an abnormal state, the safety alarm coefficient AQX is integrated with the first threshold value Y to generate an abnormal level value LJZ and a second threshold value R, and the abnormal level value LJZ is compared with the preset second threshold value R to generate a second comparison result, and the abnormal level of the current control system is determined according to the second comparison result; S6. Issue appropriate alarms based on the magnitude of the abnormality.

2. The log collection method of an industrial control system according to claim 1, characterized in that: In step S1, the multi-source data includes: network traffic data, system performance data, and log data; Among them, network traffic data includes the number of data packets, the size of data packets, and the data transmission speed; System performance data includes CPU utilization, memory usage, and disk read and write speeds; Log data includes event volume, event severity, and response time.

3. The log collection method of an industrial control system according to claim 2 is characterized in that: In step S2, after preprocessing the network traffic data, the system performance data and the log data, they are rearranged into a first data set, a second data set and a third data set according to timestamps; The first data set includes the number of data packets SJL, the size of data packets SJD, and the data transmission speed CSS; The second data set includes CPU utilization, memory usage, and disk read and write speeds; The CPU utilization is recorded as CPL1, CPL2, CPL3, ..., CPLn according to the timestamp; The memory usage is recorded as NCL1, NCL2, NCL3, ..., NCLn according to the timestamp; The disk read and write speeds are recorded as CPD1, CPD2, CPD3, ..., CPDn according to the timestamps; The third data set includes the event record volume SGL, event severity SYZ, and response time XYS.

4. The log collection method of an industrial control system according to claim 3 is characterized in that: In step S3, the safety alarm coefficient AQX is calculated by the following formula: ； Wherein: ln is a logarithmic function, S1 is the first stage value, S2 is the second stage value, the first stage value S1 and the second stage value S2 are obtained by integrating and calculating the first data set and the third data set respectively, a1 and a2 are weight values, and the values ​​of a1 and a2 are adjusted and set by the user.

5. The log collection method of an industrial control system according to claim 4 is characterized in that: The first stage value S1 and the second stage value S2 are calculated and obtained by the following formulas respectively; ； ； Where: ln is a logarithmic function, SJL is the number of packets, SJD is the packet size, CSS is the data transmission speed, SGL is the number of event records, SYZ is the event severity, XYS is the response time, and K is the intervention value, which is obtained by integrating and calculating the second data set.

6. The log collection method of an industrial control system according to claim 5, characterized in that: The intervention value K is calculated by the following formula: ； Where: CPLn, NCLn and CPDn are the CPU utilization, memory usage and disk read / write speed at timestamp n, respectively; CPLn-1, NCLn-1 and CPDn-1 are the CPU utilization, memory usage and disk read / write speed at timestamp n-1, respectively; CPLn-2, ​​NCLn-2 and CPDn-2 are the CPU utilization, memory usage and disk read / write speed at timestamp n-2, respectively; Ln is a logarithmic function.

7. The log collection method of an industrial control system according to claim 6 is characterized in that: In step S4, the first comparison result is as follows; when When , it means that there is no abnormality in the current industrial control system; when , it means that the current industrial control system is abnormal.

8. The log collection method of an industrial control system according to claim 7, characterized in that: In step S5, the second comparison result is as follows; when When , it means the current situation is level 1 abnormality; when When , it means the current situation is level 2 abnormality; when , it means the current abnormality is level 3.

9. The log collection method of an industrial control system according to claim 8, characterized in that: In step S5, the abnormal magnitude value LJZ and the second threshold value R are calculated and obtained by the following formulas respectively; ； ； Where: AQX is the safety alarm coefficient AQX, and Y is the first threshold.

10. The log collection method of an industrial control system according to claim 9, characterized in that: In step S6, the specific alarm method is as follows: If the current industrial control system is in a level 1 abnormality, the system administrator will be notified via email or SMS. The email content includes the abnormality details and preliminary diagnosis results; If the current industrial control system is in a level 2 abnormality, the system administrator and relevant persons in charge will be notified via email, SMS and instant messaging. The information includes abnormality details, preliminary diagnosis results and recommended treatment measures; If the current industrial control system is in the third level of abnormality, the system administrator, senior management and emergency response team will be notified urgently via email, SMS, instant message and phone. The information content includes abnormal details, emergency handling measures and recommended processing steps.

Images