Risk detection method and risk detection device for oil and gas pipeline network equipment

Abstract

The invention provides a risk detection method and a risk detection device for oil and gas pipeline network equipment. The method comprises the following steps: acquiring network interface flow data generated by a plurality of network equipment in a network environment of an oil and gas pipeline valve chamber; performing feature extraction on the network interface traffic data to obtain feature data including a plurality of feature dimensions; inputting the feature data into a pre-trained dual anomaly analysis model, determining abnormal risk traffic data, and determining a network device to which the risk traffic data belongs as a risk device; wherein the dual anomaly analysis module comprises a time sequence model and an early warning score model. Through the method and the device, the capability of detecting the abnormal flow data of the valve chamber side of the oil and gas pipeline is improved, and the efficiency and the accuracy of risk detection of the network equipment of the valve chamber side of the oil and gas pipeline are also improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a risk detection method and a risk detection device for oil and gas pipeline network equipment. Background Art

[0002] In the construction and development of the energy industry, oil and gas pipelines are an important construction content, and their application scope is very broad. In order to meet the demand for oil and gas resources in the process of economic development, it is necessary to continuously expand the investment in the construction of oil and gas pipelines; oil and gas pipeline projects are currently in the stage of intelligent upgrading and digital transformation; in the era of industrial Internet, intelligent and networked control systems and terminal equipment are constantly introduced into the intranet of oil and gas pipelines, which has brought more and more complex security risks to the information security of the oil and gas pipeline industry; at the same time, traditional information security and industrial control system security are also facing new threats and challenges.

[0003] At present, in the oil and gas pipeline scenario in the field of industrial control, the research on the security protection technology of oil and gas pipelines is mainly based on the security protection strategy of the centralized control center and the station, and the research on the security protection technology of the network equipment on the valve room side of the oil and gas pipeline is still in its infancy. Most of the valve room side only protects the valve room of the oil and gas pipeline based on the network messages of the network equipment in the valve room of the oil and gas pipeline. The existing method is to manually check the risks of the network messages. In the process of risk investigation, there are problems such as slow investigation speed and low accuracy. Therefore, how to efficiently and accurately detect the risks of the network equipment on the valve room side of the oil and gas pipeline has become a technical problem that cannot be underestimated. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a risk detection method and a risk detection device for oil and gas pipeline network equipment, which not only improves the detection capability of abnormal flow data on the valve chamber side of the oil and gas pipeline, but also improves the efficiency and accuracy of risk detection of network equipment on the valve chamber side of the oil and gas pipeline.

[0005] In a first aspect, an embodiment of the present application provides a risk detection method for oil and gas pipeline network equipment, the risk detection method comprising:

[0006] Acquire network interface flow data generated by multiple network devices in a network environment of an oil and gas pipeline valve room;

[0007] Extracting features from the network interface traffic data to obtain feature data including multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features, and behavior features;

[0008] The characteristic data is input into a pre-trained dual anomaly analysis model to determine the presence of abnormal risk traffic data, and the network device to which the risk traffic data belongs is determined as a risk device; wherein the dual anomaly analysis module includes a time series model and a warning score model.

[0009] Furthermore, the feature data is input into a pre-trained dual anomaly analysis model to determine the abnormal risk flow data, including:

[0010] For each feature data, the feature data is input into the time series model to determine a first risk detection score, and the feature data is input into the early warning score model to determine a second risk detection score;

[0011] Based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model, the first risk detection score and the second risk detection score are fused to obtain a target detection score;

[0012] If the target detection score is greater than or equal to the risk score threshold, the feature data is determined as the risk flow data.

[0013] Furthermore, the first risk detection score and the second risk detection score are fused based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model to obtain a target detection score, including:

[0014] Multiplying the first preset weight by the first risk detection score to obtain a third risk detection score;

[0015] Multiplying the second preset weight by the second risk detection score to obtain a fourth risk detection score;

[0016] The sum of the third risk detection score and the fourth risk detection score is determined as the target detection score.

[0017] Furthermore, the dual anomaly analysis model is trained by the following steps:

[0018] Acquire a sample data set; wherein each piece of sample feature data in the sample data set includes the protocol feature, the port feature, and the behavior feature, and each piece of sample feature data carries a corresponding first risk sample score and a second risk sample score;

[0019] Inputting a plurality of the sample feature data into the original time series model, determining a first risk prediction score corresponding to each sample feature data, and training the original time series model using the first risk prediction score corresponding to each sample feature data and the first risk sample score to obtain the time series model;

[0020] Inputting a plurality of the sample feature data into the original early warning score model, determining the second risk prediction score corresponding to each sample feature data, and using the second risk prediction score corresponding to each sample feature data and the second risk sample score to train the original early warning score model to obtain the early warning score model;

[0021] Corresponding weights are assigned to the time series model and the early warning score model respectively to obtain the dual anomaly analysis model.

[0022] Furthermore, after determining that there is abnormal risk traffic data, the risk detection method further includes:

[0023] Recording and storing the risk flow data;

[0024] The risk traffic data of each network device is aggregated and the security status of each network device is displayed in real time on the global monitoring screen.

[0025] Furthermore, before extracting features from the network interface traffic data, the risk detection method further includes:

[0026] The network interface flow data is cleaned to obtain processed network interface flow data, and the processed network interface flow data is used as the network interface flow data.

[0027] Furthermore, after obtaining the feature data including multiple feature dimensions, the risk detection method further includes:

[0028] The characteristic data is stored.

[0029] In a second aspect, an embodiment of the present application further provides a risk detection device for oil and gas pipeline network equipment, the risk detection device comprising:

[0030] A flow data acquisition module is used to acquire network interface flow data generated by multiple network devices in the network environment of the oil and gas pipeline valve room;

[0031] A feature extraction module, used to extract features from the network interface traffic data to obtain feature data containing multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features and behavior features;

[0032] The risk detection module is used to input the feature data into a pre-trained dual anomaly analysis model, determine the risk traffic data with abnormalities, and determine the network device to which the risk traffic data belongs as a risk device; wherein the dual anomaly analysis module includes a time series model and a warning score model.

[0033] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory through the bus, and when the machine-readable instructions are executed by the processor, the steps of the risk detection method for oil and gas pipeline network equipment as described above are performed.

[0034] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the risk detection method for oil and gas pipeline network equipment as described above are executed.

[0035] The embodiments of the present application provide a risk detection method and a risk detection device for oil and gas pipeline network equipment. First, network interface flow data generated by multiple network devices in a network environment of an oil and gas pipeline valve room are obtained; then, feature extraction is performed on the network interface flow data to obtain feature data including multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features, and behavior features; finally, the feature data is input into a pre-trained dual anomaly analysis model to determine the presence of abnormal risk flow data, and the network device to which the risk flow data belongs is determined as a risk device; wherein the dual anomaly analysis module includes a time series model and an early warning score model.

[0036] This application collects the flow data of the network interface of the oil and gas pipeline valve room equipment in real time without affecting the normal operation of the terminal network, and extracts features from the network interface flow data to obtain feature data containing multiple features. The feature data is then subjected to risk detection through a pre-trained dual anomaly analysis model to obtain risk flow data with abnormalities, and then risky devices with risks are identified from multiple network devices. This not only improves the ability to detect abnormal flow data on the oil and gas pipeline valve room side, but also improves the efficiency and accuracy of risk detection of network equipment on the oil and gas pipeline valve room side.

[0037] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 A flow chart of a risk detection method for oil and gas pipeline network equipment provided in an embodiment of the present application;

[0040] Figure 2 One of the structural schematic diagrams of a risk detection device for oil and gas pipeline network equipment provided in an embodiment of the present application;

[0041] Figure 3 A second structural diagram of a risk detection device for oil and gas pipeline network equipment provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0044] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of computer technology.

[0045] In the construction and development of the energy industry, oil and gas pipelines are an important construction content, and their application scope is very broad. In order to meet the demand for oil and gas resources in the process of economic development, it is necessary to continuously expand the investment in the construction of oil and gas pipelines; oil and gas pipeline projects are currently in the stage of intelligent upgrading and digital transformation; in the era of industrial Internet, intelligent and networked control systems and terminal equipment are constantly introduced into the intranet of oil and gas pipelines, which has brought more and more complex security risks to the information security of the oil and gas pipeline industry; at the same time, traditional information security and industrial control system security are also facing new threats and challenges.

[0046] The research found that, at present, in the oil and gas pipeline scenario in the field of industrial control target field, the research on the security protection technology of oil and gas pipelines is mainly based on the security protection strategy of the centralized control center and the station, and the research on the security protection technology of the network equipment on the valve room side of the oil and gas pipeline is still in its infancy. Most of the valve room side only protects the valve room of the oil and gas pipeline based on the network messages of the network equipment in the valve room of the oil and gas pipeline. The existing method is to manually check the risks of the network messages. In the process of risk investigation, there are problems such as slow investigation speed and low accuracy. Therefore, how to efficiently and accurately detect the risks of the network equipment on the valve room side of the oil and gas pipeline has become a technical issue that cannot be underestimated.

[0047] Based on this, an embodiment of the present application provides a risk detection method for oil and gas pipeline network equipment, which not only improves the detection capability of abnormal flow data on the valve chamber side of the oil and gas pipeline, but also improves the efficiency and accuracy of risk detection of network equipment on the valve chamber side of the oil and gas pipeline.

[0048] See also Figure 1 , Figure 1 This is a flow chart of a risk detection method for oil and gas pipeline network equipment provided by an embodiment of the present application. Figure 1 As shown in , the risk detection method provided by the embodiment of the present application includes:

[0049] S101, obtaining network interface flow data generated by multiple network devices in a network environment of an oil and gas pipeline valve room.

[0050] It should be noted that the oil and gas pipeline valve room is a key facility in the oil and gas transmission system, which is mainly used to control and regulate the flow of fluid in the pipeline. The network equipment on the oil and gas pipeline valve room side refers to various machines and devices used to build and maintain the oil and gas transmission pipeline. These devices usually include the following categories: PLC, host, server and switch.

[0051] For the above step S101, in the specific implementation, the flow information is collected in combination with the prior knowledge of the expert, and the network interface flow data of various protocols generated by multiple network devices in the network environment of the oil and gas pipeline valve room are obtained in real time through the mirror interface. The network interface flow data may include the valve room industrial control protocol flow, valve room information collection and control flow, network layer and industrial control protocol application layer flow, etc., which is not specifically limited in this application.

[0052] As an optional embodiment, after acquiring the network interface traffic data and before extracting features from the network interface traffic data, the risk detection method provided in the embodiment of the present application further includes:

[0053] The network interface flow data is cleaned to obtain processed network interface flow data, and the processed network interface flow data is used as the network interface flow data.

[0054] Here, data cleaning processing refers to filtering out the network interface traffic data generated by some non-critical network devices and the network interface traffic data of non-critical protocols. As an example, non-critical network devices can be business-related network devices such as PLCs, hosts, and servers), and the network interface traffic data of non-critical protocols refers to traffic data related only to network connections.

[0055] With respect to the above steps, during specific implementation, data cleaning processing is performed on the network interface flow data collected in step S101 to obtain processed network interface flow data, and the processed network interface flow data is used as the network interface flow data.

[0056] S102, extracting features from the network interface traffic data to obtain feature data including multiple feature dimensions.

[0057] Here, according to the embodiment provided by the present application, the multiple feature dimensions include protocol features, port features and behavior features.

[0058] For the above step S102, in the specific implementation, feature extraction is performed on the network interface flow data to obtain feature data including protocol features, port features and behavior features. Here, the method for feature extraction can refer to the protocol identification steps and principles of wireshark, specifically including data analysis, feature extraction and feature fusion of network interface flow data.

[0059] As an optional embodiment, after obtaining feature data including multiple feature dimensions, the risk detection method provided in the embodiment of the present application further includes:

[0060] The characteristic data is stored.

[0061] Regarding the above steps, during specific implementation, after extracting the characteristics of the network interface traffic data, the characteristic data is stored and stored in a data storage module.

[0062] S103, inputting the characteristic data into a pre-trained dual anomaly analysis model, determining that there is abnormal risk traffic data, and determining the network device to which the risk traffic data belongs as a risk device.

[0063] Here, the dual anomaly analysis module includes a time series model and a warning score model.

[0064] Regarding the above step S103, in the specific implementation, the feature data obtained in step S102 is input into a pre-trained dual anomaly analysis model to determine the abnormal risk traffic data, and the network device to which the risk traffic data belongs is determined as a risk device.

[0065] As an optional embodiment, for the above step S103, the inputting of the feature data into a pre-trained dual anomaly analysis model to determine the abnormal risk flow data includes:

[0066] Step 1031, for each feature data, input the feature data into the time series model to determine a first risk detection score, and input the feature data into the early warning score model to determine a second risk detection score.

[0067] For the above step 1031, in the specific implementation, for each feature data, the feature data is input into the time series model of the double anomaly analysis model to determine the first risk detection score, expressed as RA. The feature data is input into the early warning score model of the double anomaly analysis model to determine the second risk detection score, expressed as RB.

[0068] Step 1032: Based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model, the first risk detection score and the second risk detection score are fused to obtain a target detection score.

[0069] For the above step 1032, in the specific implementation, corresponding weights are pre-assigned to the time series model and the early warning score model. Here, the first preset weight corresponding to the time series model is represented by wA, and the second preset weight corresponding to the early warning score model is represented by wB. Among them, wA and wB satisfy wA+wB=1. Here, as an example, based on the credibility of the two models, the weights are set to the first preset weight wA of 0.65 and the second preset weight wB of 0.35. Then, based on the first preset weight wA corresponding to the time series model and the second preset weight wB corresponding to the early warning score model, the first risk detection score RA and the second risk detection score RB are fused to obtain the target detection score.

[0070] As an optional embodiment, for the above step 1032, the first risk detection score and the second risk detection score are fused based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model to obtain the target detection score, including:

[0071] Step 10321: multiply the first preset weight by the first risk detection score to obtain a third risk detection score.

[0072] Regarding the above step 10321, in the specific implementation, the first preset weight wA is multiplied by the first risk detection score RA to obtain the third risk detection score, that is, the third risk detection score = wA*RA.

[0073] Step 10322: multiply the second preset weight by the second risk detection score to obtain a fourth risk detection score.

[0074] Regarding the above step 10322, in specific implementation, the second preset weight wB is multiplied by the second risk detection score RB to obtain the fourth risk detection score, that is, the fourth risk detection score = wB*RB.

[0075] Step 10323: Determine the sum of the third risk detection score and the fourth risk detection score as the target detection score.

[0076] Regarding the above step 10323, in the specific implementation, the sum of the third risk detection score and the fourth risk detection score is determined as the target detection score, that is, the target detection score = wA*RA+wB*RB.

[0077] Step 1033: If the target detection score is greater than or equal to the risk score threshold, the feature data is determined as the risk flow data.

[0078] Regarding the above step 1033, in a specific implementation, if the target detection score corresponding to the feature data is greater than or equal to the risk score threshold, the feature data is determined as risky traffic data.

[0079] As an optional embodiment, the dual anomaly analysis model is trained through the following steps:

[0080] A: Get a sample dataset.

[0081] For the above step A, in the specific implementation, a sample data set is obtained. The sample data set includes multiple sample feature data, each of which includes a protocol feature, a port feature, and a behavior feature, and each of which carries a corresponding first risk sample score and a second risk sample score.

[0082] B: Input multiple sample feature data into the original time series model, determine the first risk prediction score corresponding to each sample feature data, and use the first risk prediction score corresponding to each sample feature data and the first risk sample score to train the original time series model to obtain the time series model.

[0083] For the above step B, in the specific implementation, multiple sample feature data are input into the original time series model, the first risk prediction score corresponding to each sample feature data is determined, and the original time series model is trained using the first risk prediction score corresponding to each sample feature data and the first risk sample score to obtain a time series model. Here, how to train the model according to the predicted value and the sample value is described in detail in the prior art and will not be repeated here.

[0084] C: Input multiple sample feature data into the original early warning score model, determine the second risk prediction score corresponding to each sample feature data, and use the second risk prediction score corresponding to each sample feature data and the second risk sample score to train the original early warning score model to obtain the early warning score model.

[0085] For the above step C, in the specific implementation, multiple sample feature data are input into the original warning score model, the second risk prediction score corresponding to each sample feature data is determined, and the second risk prediction score corresponding to each sample feature data and the second risk sample score are used to train the original warning score model to obtain the warning score model. Here, how to train the model according to the prediction value and the sample value is described in detail in the prior art and will not be repeated here.

[0086] D: Assign corresponding weights to the time series model and the early warning score model respectively to obtain the dual anomaly analysis model.

[0087] Regarding the above step D, in the specific implementation, corresponding weights are respectively assigned to the time series model and the early warning score model trained in the above step to obtain a dual anomaly analysis model.

[0088] As an optional embodiment, after determining that there is abnormal risk traffic data, the risk detection method provided by the present application further includes:

[0089] The risk traffic data is recorded and stored; the risk traffic data of each network device is aggregated, and the security status of each network device is displayed in real time on the global monitoring screen.

[0090] For the above steps, when implementing them, after detecting the risk traffic data of each network device, the risk traffic data is recorded and stored for relevant analysis and tracing, so as to take targeted measures as soon as possible to prevent abnormal events from happening again. The risk traffic data of each network device is summarized, and the security status of each network device in all monitored areas is displayed in real time on the global monitoring screen. Here, when there is no risk traffic data for a network device, the security status of the network device is installed; when there is risk traffic data for a network device, the security status of the network device is risky. In this way, visual threat alerts and remote risk rapid disposal capabilities can be provided for network devices that are detected to be at risk.

[0091] The risk detection method for oil and gas pipeline network equipment provided in the embodiment of the present application first obtains network interface flow data generated by multiple network devices in the network environment of the oil and gas pipeline valve room; then, features are extracted from the network interface flow data to obtain feature data containing multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features and behavior features; finally, the feature data is input into a pre-trained dual anomaly analysis model to determine the presence of abnormal risk flow data, and the network device to which the risk flow data belongs is determined as a risk device; wherein the dual anomaly analysis module includes a time series model and an early warning score model.

[0092] This application collects the flow data of the network interface of the oil and gas pipeline valve room equipment in real time without affecting the normal operation of the terminal network, and extracts features from the network interface flow data to obtain feature data containing multiple features. The feature data is then subjected to risk detection through a pre-trained dual anomaly analysis model to obtain risk flow data with abnormalities, and then risky devices with risks are identified from multiple network devices. This not only improves the ability to detect abnormal flow data on the oil and gas pipeline valve room side, but also improves the efficiency and accuracy of risk detection of network equipment on the oil and gas pipeline valve room side.

[0093] See also Figure 2 and Figure 3 , Figure 2 This is one of the structural schematic diagrams of a risk detection device for oil and gas pipeline network equipment provided in an embodiment of the present application. Figure 3 This is a second structural diagram of a risk detection device for oil and gas pipeline network equipment provided in an embodiment of the present application. Figure 2 As shown in , the risk detection device 200 includes:

[0094] The flow data acquisition module 201 is used to acquire network interface flow data generated by multiple network devices in the network environment of the oil and gas pipeline valve room;

[0095] A feature extraction module 202 is used to extract features from the network interface traffic data to obtain feature data including multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features, and behavior features;

[0096] The risk detection module 203 is used to input the feature data into a pre-trained dual anomaly analysis model, determine the risk traffic data with abnormalities, and determine the network device to which the risk traffic data belongs as a risk device; wherein the dual anomaly analysis module includes a time series model and a warning score model.

[0097] Furthermore, when the risk detection module 203 is used to input the feature data into a pre-trained dual anomaly analysis model and determine that there is abnormal risk flow data, the risk detection module 203 is also used to:

[0098] For each feature data, the feature data is input into the time series model to determine a first risk detection score, and the feature data is input into the early warning score model to determine a second risk detection score;

[0099] Based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model, the first risk detection score and the second risk detection score are fused to obtain a target detection score;

[0100] If the target detection score is greater than or equal to the risk score threshold, the feature data is determined as the risk flow data.

[0101] Further, when the risk detection module 203 is used to fuse the first risk detection score and the second risk detection score based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model to obtain a target detection score, the risk detection module 203 is also used to:

[0102] Multiplying the first preset weight by the first risk detection score to obtain a third risk detection score;

[0103] Multiplying the second preset weight by the second risk detection score to obtain a fourth risk detection score;

[0104] The sum of the third risk detection score and the fourth risk detection score is determined as the target detection score.

[0105] See also Figure 3The risk detection device 200 further includes a model training module 204, and the model training module 204 is used to train the dual anomaly analysis model through the following steps:

[0106] Acquire a sample data set; wherein each piece of sample feature data in the sample data set includes the protocol feature, the port feature, and the behavior feature, and each piece of sample feature data carries a corresponding first risk sample score and a second risk sample score;

[0107] Inputting a plurality of the sample feature data into the original time series model, determining a first risk prediction score corresponding to each sample feature data, and training the original time series model using the first risk prediction score corresponding to each sample feature data and the first risk sample score to obtain the time series model;

[0108] Inputting a plurality of the sample feature data into the original early warning score model, determining the second risk prediction score corresponding to each sample feature data, and using the second risk prediction score corresponding to each sample feature data and the second risk sample score to train the original early warning score model to obtain the early warning score model;

[0109] Corresponding weights are assigned to the time series model and the early warning score model respectively to obtain the dual anomaly analysis model.

[0110] See also Figure 3 The risk detection device 200 further includes a risk monitoring module 205. After determining that there is abnormal risk flow data, the risk monitoring module 205 is used to:

[0111] Recording and storing the risk flow data;

[0112] The risk traffic data of each network device is aggregated and the security status of each network device is displayed in real time on the global monitoring screen.

[0113] See also Figure 3 The risk detection device 200 further includes a data cleaning module 206. Before extracting features from the network interface traffic data, the data cleaning module 206 is used to:

[0114] The network interface flow data is cleaned to obtain processed network interface flow data, and the processed network interface flow data is used as the network interface flow data.

[0115] See also Figure 3The risk detection device 200 further includes a data storage module 207. After obtaining the feature data including multiple feature dimensions, the data storage module 207 is used to:

[0116] The characteristic data is stored.

[0117] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0118] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 The steps of the risk detection method for oil and gas pipeline network equipment in the method embodiment shown, and the specific implementation method can be found in the method embodiment, which will not be repeated here.

[0119] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the risk detection method for oil and gas pipeline network equipment in the method embodiment shown, and the specific implementation method can be found in the method embodiment, which will not be repeated here.

[0120] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0121] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0124] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or in other words, the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0125] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A risk detection method for oil and gas pipeline network equipment, characterized in that: The risk detection method comprises: Acquire network interface flow data generated by multiple network devices in a network environment of an oil and gas pipeline valve room; Extracting features from the network interface traffic data to obtain feature data including multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features, and behavior features; The characteristic data is input into a pre-trained dual anomaly analysis model to determine the presence of abnormal risk traffic data, and the network device to which the risk traffic data belongs is determined as a risk device; wherein the dual anomaly analysis module includes a time series model and a warning score model.

2. The risk detection method according to claim 1, characterized in that: The step of inputting the characteristic data into a pre-trained dual anomaly analysis model to determine the abnormal risk flow data includes: For each feature data, the feature data is input into the time series model to determine a first risk detection score, and the feature data is input into the early warning score model to determine a second risk detection score; Based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model, the first risk detection score and the second risk detection score are fused to obtain a target detection score; If the target detection score is greater than or equal to the risk score threshold, the feature data is determined as the risk flow data.

3. The risk detection method according to claim 2, characterized in that: The step of fusing the first risk detection score and the second risk detection score based on the first preset weight corresponding to the time series model and the second preset weight corresponding to the early warning score model to obtain a target detection score includes: Multiplying the first preset weight by the first risk detection score to obtain a third risk detection score; Multiplying the second preset weight by the second risk detection score to obtain a fourth risk detection score; The sum of the third risk detection score and the fourth risk detection score is determined as the target detection score.

4. The risk detection method according to claim 2, characterized in that: The dual anomaly analysis model is trained by the following steps: Acquire a sample data set; wherein each piece of sample feature data in the sample data set includes the protocol feature, the port feature, and the behavior feature, and each piece of sample feature data carries a corresponding first risk sample score and a second risk sample score; Inputting a plurality of the sample feature data into the original time series model, determining a first risk prediction score corresponding to each sample feature data, and training the original time series model using the first risk prediction score corresponding to each sample feature data and the first risk sample score to obtain the time series model; Inputting a plurality of the sample feature data into the original early warning score model, determining the second risk prediction score corresponding to each sample feature data, and using the second risk prediction score corresponding to each sample feature data and the second risk sample score to train the original early warning score model to obtain the early warning score model; Corresponding weights are assigned to the time series model and the early warning score model respectively to obtain the dual anomaly analysis model.

5. The risk detection method according to claim 1, characterized in that: After determining that there is abnormal risk traffic data, the risk detection method further includes: Recording and storing the risk flow data; The risk traffic data of each network device is aggregated and the security status of each network device is displayed in real time on the global monitoring screen.

6. The risk detection method according to claim 1, characterized in that: Before extracting features from the network interface traffic data, the risk detection method further includes: The network interface flow data is cleaned to obtain processed network interface flow data, and the processed network interface flow data is used as the network interface flow data.

7. The risk detection method according to claim 1, characterized in that: After obtaining the feature data including multiple feature dimensions, the risk detection method further includes: The characteristic data is stored.

8. A risk detection device for oil and gas pipeline network equipment, characterized in that: The risk detection device comprises: A flow data acquisition module is used to acquire network interface flow data generated by multiple network devices in the network environment of the oil and gas pipeline valve room; A feature extraction module, used to extract features from the network interface traffic data to obtain feature data containing multiple feature dimensions; wherein the multiple feature dimensions include protocol features, port features and behavior features; The risk detection module is used to input the feature data into a pre-trained dual anomaly analysis model, determine the risk traffic data with abnormalities, and determine the network device to which the risk traffic data belongs as a risk device; wherein the dual anomaly analysis module includes a time series model and a warning score model.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the risk detection method for oil and gas pipeline network equipment as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the risk detection method for oil and gas pipeline network equipment according to any one of claims 1 to 7 are executed.

Images