Emergency command system based on endogenous safety and command method thereof

Abstract

The invention discloses an emergency command system based on endogenous safety and a command method thereof, and belongs to the technical field of cyberspace defense. In order to improve the network space defense capability, the system comprises an emergency command platform, a safety protection platform and a digital twin platform, the emergency command platform is connected with the safety protection platform; the safety protection platform is connected with the digital twin platform; the emergency command platform comprises an information management module, a multimedia cooperation module, a meteorological decision module, a map application module, an emergency plan module, a communication scheduling module, a guarding module, a field switching module, an application data temporary storage area and a code identification area. The security protection platform comprises a data acquisition module, a data processing module, a monitoring control module, an agent simulation module, a dynamic reconstruction module and a decision tracing module. According to the method, the dynamic defense strategy of the twin digital platform is formulated and the original framework of each built-in module of the digital twin platform is adjusted according to the comprehensive benefit expectation, so that the security isolation of the digital twin platform is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace defense, and in particular relates to an emergency command system based on intrinsic security and a command method thereof. Background Art

[0002] Endogenous security: It is a philosophical summary and discussion of the current security status of cyberspace by Chinese scientist Academician Wu Jiangxing. It is an emerging concept and technical development direction in the field of network security, which specifically includes two parts: endogenous security issues and endogenous security system mechanisms. Cyberspace mimicry defense (CMD) responds to unknown threats based on unknown vulnerabilities, backdoors, viruses or Trojans at the relevant application levels in different fields of cyberspace, and provides defense theories and methods with universal and innovative significance. Based on the non-similar redundancy architecture in the field of reliability, a multi-dimensional dynamic reconstruction mechanism is introduced, resulting in the non-similar redundancy structural elements inside the target object always making strategic changes or transformations in quantity or type, time or space dimensions under the condition that the function remains unchanged, and the uncertain defense principle is used to fight against the certain or uncertain threats in cyberspace. In addition, the existing emergency command system is easily breached by external network attacks, has low security protection, and is insufficient to respond to highly confusing malicious attacks in a timely manner. Summary of the invention

[0003] The problem to be solved by the present invention is to improve the ability of cyberspace defense, and to propose an emergency command system and a command method based on intrinsic security.

[0004] To achieve the above object, the present invention is implemented through the following technical solutions:

[0005] An emergency command system based on intrinsic safety, comprising an emergency command platform, a safety protection platform, and a digital twin platform; the emergency command platform is connected to the safety protection platform, and the safety protection platform is connected to the digital twin platform;

[0006] The emergency command platform includes an information management module, a multimedia collaboration module, a meteorological decision-making module, a map application module, an emergency plan module, a communication dispatch module, a watch module, an on-site switching module, an application data temporary storage area and a coding identification area;

[0007] The security protection platform includes a data acquisition module, a data processing module, a monitoring and control module, an agent simulation module, a dynamic reconstruction module and a ruling tracing module.

[0008] Furthermore, the information management module is a module for managing and maintaining emergency event information, and is used for data collection, integration, storage, query and analysis of emergency events;

[0009] The multimedia collaboration module is used to transmit and communicate video, audio, and images in real time to meet the communication and collaboration needs of the emergency command department;

[0010] The meteorological decision module is used to predict and analyze the collected meteorological data;

[0011] The map application module displays real-time data, events, and resource information through maps to help users monitor, analyze, and schedule;

[0012] The emergency plan module is to formulate emergency plans for various emergency situations in accordance with standard specifications and technical requirements, and support emergency material preparation and call operations;

[0013] The communication scheduling module communicates by channel selection, frequency setting, and encoding and decoding;

[0014] The watch module is a real-time monitoring and early warning module for emergency events. It analyzes potential emergency situations by integrating multi-source data, including sensor data, surveillance videos, and meteorological information.

[0015] The on-site switching module is used to implement information switching and resource allocation between the emergency scene and the command center;

[0016] The application data temporary storage area is used to temporarily store data for the emergency command platform;

[0017] The coding identification area is used to store the node number of this command platform.

[0018] Furthermore, the data acquisition module is used to collect the information data stream of each built-in module of each emergency command platform, and the information data stream includes application data and status information; the data acquisition module includes a status authentication unit, a communication feedback unit and an information acquisition unit, and the data acquisition module first verifies the node number of each emergency command platform by using a chaotic encryption algorithm through the status authentication unit; then detects and authenticates the communication status of each emergency command platform by using an abnormal authentication algorithm through the communication feedback unit; finally, the information acquisition unit collects the information data stream of each built-in module of the emergency command platform that has completed the communication authentication;

[0019] The data processing module is used to clean and classify the collected information data stream, and build the digital twin platform of each emergency command platform based on the information data stream; the data processing module includes a data cleaning unit, a data classification unit and a twin construction unit; the data cleaning unit uses a wavelet transform algorithm and a data filling algorithm to deduplicate information and fill missing values ​​in the information data stream; the data classification unit uses a clustering algorithm to classify the cleaned information data stream according to the node number; the data twin unit uses a network analysis algorithm and a Monte Carlo simulation algorithm to build a corresponding twin emergency command platform based on the classified information data stream.

[0020] Furthermore, the monitoring and control module is used to monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform;

[0021] The monitoring and control module includes a detection and analysis unit, a data distribution unit and an instruction generation unit;

[0022] The detection and analysis unit uses a deep analysis model to reduce the dimension of the information data stream. The expression of the dimensionality reduction process is as follows:

[0023] Z=σ(WX+b)+Q E (X, Y)(1)

[0024] Among them, Z represents the potential dimension, W represents the weight, σ() represents the activation function, b represents the bias vector, Q E represents the CVAE encoding network, X represents the information data stream sample, and Y represents the true label;

[0025] Then the information data stream after dimensionality reduction is input into the feature extraction layer to extract the feature information of the information data stream; the feature extraction layer includes 1 3×3 convolution layer, 1 1×1 point convolution layer, 2 3×3 maximum pooling layers and 3 normalization layers; then the extracted feature information is encoded using the Detec encoder, and the expression is as follows:

[0026] H i+1 =R((Z|H i ),A∨W) (2)

[0027] Among them, H i represents the i-th convolutional layer, R() represents the RELU activation function, i represents the number of convolutional layers, A represents the adjacency matrix, and Z represents the eigenvector;

[0028] Then, the compiled information data stream is input into the two network branches of the learning and training layer for iterative training to obtain deep feature values; the first network branch includes 3 3×3 convolutional layers, 1 3×3 upsampling layer, 1 3×3 downsampling layer, 1 1×1 point convolutional layer and 1 SoftPlus activation function, and the second network branch includes 2 1×1 convolutional layers, 4 3×1 upsampling layers, 4 1×3 downsampling layers, 2 SELU activation functions and 2 PRelu activation functions; at the same time, the deep feature values ​​output by the two network branches are spliced ​​and fused;

[0029] Then, the deep feature values ​​after splicing and fusion are reconstructed by the reconstruction decoder for both structure and attribute. The expression is:

[0030] S=P(H i ,A|W)+SM(H i H iT ) (3)

[0031] Among them, S represents the reconstructed decoding value, P() represents the PRelu activation function, SM() represents the SigMoid activation function, and T represents transposition;

[0032] Finally, the reconstructed information data stream is passed through the average pooling layer, the fully connected layer and the LRelu activation function in turn to divide the information data stream into benign data stream, malignant data stream and unknown suspicious data stream;

[0033] The data distribution unit transmits the information data streams that have completed the identification and analysis to the corresponding remote signaling channels respectively by using a parallel transmission algorithm;

[0034] The instruction generation unit generates corresponding control instructions according to the sequence number of the remote signaling channel and the node number of the emergency command platform.

[0035] Furthermore, the agent simulation module is used to receive and implement control instructions and transmit unknown suspicious data streams to multiple functionally equivalent digital twin platforms for judgment and evaluation;

[0036] The agent simulation module includes a control execution unit, an agent activation unit and a simulation judgment unit; the agent simulation module first decomposes the control instructions through the control execution unit using an instruction decoding algorithm; then activates the completed digital twin platform through the agent activation unit; finally, the simulation judgment unit uses a timing evaluation algorithm to conduct real-time analysis on the digital twin platform loaded with unknown suspicious data streams.

[0037] Furthermore, the dynamic reconstruction module is used to reconstruct the operating framework of each built-in module of the emergency command platform according to the judgment and evaluation results of the digital twin platform to generate a dynamic protection strategy;

[0038] The dynamic reconstruction module includes a judgment and analysis unit, a dynamic defense unit and a conversion and reconstruction unit; the judgment and analysis unit uses a consensus feedback algorithm to determine the essential architecture of the unknown suspicious data flow according to the real-time judgment results; the dynamic defense unit uses a mimic defense model to adjust the original framework of the digital twin platform according to the essential architecture of the unknown suspicious data flow to achieve security isolation of the digital twin platform;

[0039] The mimetic defense model includes a fully heterogeneous layer and a limited heterogeneous layer; the fully heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts continuous game on the digital twin platform; the limited heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts intermittent game on the digital twin platform; in the fully heterogeneous layer, the expected benefit of the unknown suspicious data flow is determined according to the probability of successful intrusion of the unknown suspicious data flow, and the expression is:

[0040] B1(μ)=B(-C(t0)+α-t0) / C(α-t0) (4)

[0041] Among them, B1 represents the total benefit, B() represents the expected benefit function, μ represents the benefit, C() represents the cost, t0 represents the attack time, and α represents the rotation period;

[0042] Considering the impact of the cost of attack and defense of unknown suspicious data flows during the cycle on the total benefit, the defense cycle of the digital twin platform is extended, making the expected benefit of the unknown suspicious data flow negative, and the expression for the unknown suspicious data flow to lose its intrusion capability is:

[0043]

[0044] Among them, γ represents the rational factor, f(t) represents the intrusion probability density function, and t represents time;

[0045] In the case of limited heterogeneous layers, the unknown suspicious data flow uses the number of intrusions as accumulated experience. When the unknown suspicious data flow invades again, the expected benefit expression of the unknown suspicious data flow is:

[0046] B2(μ)=B ( -k*C ( t 0) +α-t 0) *(1-3√k2)C(α-t0) (6)

[0047] Among them, B2 represents limited benefits, k represents the number of invasions;

[0048] When the two levels of the mimicry defense model operate irregularly, the expected comprehensive benefit expression is:

[0049]

[0050] Among them, β represents the level transition probability;

[0051] Finally, according to the comprehensive benefit expectations, a dynamic defense strategy for the digital twin platform is formulated and the original framework of each built-in module of the digital twin platform is adjusted to achieve secure isolation of the digital twin platform;

[0052] The conversion and reconstruction unit uses an adversarial conversion algorithm to reconstruct the operating framework of each built-in module of the emergency command platform according to the new framework of the digital twin platform, while improving the security protection level of the emergency command platform to form a dynamic protection strategy.

[0053] Furthermore, the adjudication and tracing module is used to adjudicate and trace back unknown suspicious data flows according to the dynamic protection strategy and the judgment and evaluation results;

[0054] The decision tracing module includes an abnormality determination unit, a path tracing unit and a decision cracking unit;

[0055] The anomaly identification unit locates the source of the unknown suspicious data flow according to the essential architecture of the information data flow; the path tracing unit uses a node time jumping algorithm to trace and reproduce the network path of the unknown suspicious data flow; the judgment cracking unit uses a dynamic and static analysis algorithm to deeply crack the essential architecture of the unknown suspicious data flow and generate corresponding vulnerability patches.

[0056] A command method for an emergency command system based on intrinsic safety is implemented based on the emergency command system based on intrinsic safety, and includes the following steps:

[0057] S1. Each built-in module of the emergency command platform processes and provides feedback on emergency events;

[0058] S2. Collecting the information data flow of each built-in module of the emergency command platform: Verify the node number of the emergency command platform through the data acquisition module, and detect and authenticate the communication status of the emergency command platform, and obtain the information data flow of each built-in module;

[0059] S3. Clean and classify the information data stream collected in step S2, and build a digital twin platform of the emergency command platform based on the information data stream;

[0060] The data processing module removes duplicate information and fills missing values ​​in the information data stream. At the same time, the information data stream is classified according to the node number, and the corresponding twin emergency command platform is built;

[0061] S4. Monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform; identify and analyze the information data flow using the deep analysis model through the monitoring and control module, and transmit it to the corresponding remote signaling channel, and generate corresponding control instructions at the same time;

[0062] S5. Receive and implement control instructions, and transmit unknown suspicious data streams to the digital twin platform for judgment and evaluation; decompose the control instructions through the agent simulation module, activate the completed digital twin platform, and conduct real-time judgment on the digital twin platform loaded with unknown suspicious data streams;

[0063] S6. According to the judgment and evaluation results of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed to generate a dynamic protection strategy; the essential architecture of the unknown suspicious data flow is determined through the dynamic reconstruction module, and the original framework of the digital twin platform is adjusted to achieve the security isolation of the digital twin platform. At the same time, according to the new framework of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed, thereby improving the security protection level of the emergency command platform and forming a dynamic protection strategy;

[0064] S7. According to the dynamic protection strategy and judgment and evaluation results, the unknown suspicious data flow is judged and traced back; the source of the unknown suspicious data flow is located through the judgment and tracing module, and the network path of the unknown suspicious data flow is traced and reproduced. At the same time, the essential architecture of the unknown suspicious data flow is deeply cracked, and the corresponding vulnerability patches are generated.

[0065] Beneficial effects of the present invention:

[0066] The emergency command system based on intrinsic security described in the present invention, in applying the deep analysis model of the intrinsic security model, innovatively first compresses the dimension of the information data flow, and finally passes the reconstructed information data flow through the average pooling layer, the fully connected layer and the LRelu activation function in sequence, so as to divide the information data flow into benign data flow, malignant data flow and unknown suspicious data flow.

[0067] The emergency command system based on intrinsic security described in the present invention modifies the mimetic defense model to meet the needs of emergency command. The mimetic defense model includes a fully heterogeneous layer and a limited heterogeneous layer; the fully heterogeneous layer is used for the conversion and change of the digital twin platform architecture when the unknown suspicious data flow conducts continuous game on the digital twin platform; the limited heterogeneous layer is used for the conversion and change of the digital twin platform architecture when the unknown suspicious data flow conducts intermittent game on the digital twin platform.

[0068] The emergency command system based on intrinsic security described in the present invention formulates a dynamic defense strategy for the twin digital platform and adjusts the original framework of each built-in module of the digital twin platform according to the comprehensive benefit expectations to achieve safe isolation of the digital twin platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 The present invention is a schematic structural diagram of an emergency command system based on intrinsic safety. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0071] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0072] In order to further understand the content, features and effects of the present invention, the following specific implementation methods are given as examples, and the attached Figure 1 The detailed instructions are as follows:

[0073] Embodiment 1:

[0074] An emergency command system based on intrinsic safety, comprising an emergency command platform, a safety protection platform, and a digital twin platform; the emergency command platform is connected to the safety protection platform, and the safety protection platform is connected to the digital twin platform;

[0075] The emergency command platform includes an information management module, a multimedia collaboration module, a meteorological decision-making module, a map application module, an emergency plan module, a communication dispatch module, a watch module, an on-site switching module, an application data temporary storage area and a coding identification area;

[0076] The security protection platform includes a data acquisition module, a data processing module, a monitoring and control module, an agent simulation module, a dynamic reconstruction module and a ruling tracing module.

[0077] Furthermore, the information management module is a module for managing and maintaining emergency event information, and is used for data collection, integration, storage, query and analysis of emergency events;

[0078] The multimedia collaboration module is used to transmit and communicate video, audio, and images in real time to meet the communication and collaboration needs of the emergency command department;

[0079] The meteorological decision module is used to predict and analyze the collected meteorological data;

[0080] The map application module displays real-time data, events, and resource information through maps to help users monitor, analyze, and schedule;

[0081] The emergency plan module is to formulate emergency plans for various emergency situations in accordance with standard specifications and technical requirements, and support emergency material preparation and call operations;

[0082] The communication scheduling module communicates by channel selection, frequency setting, and encoding and decoding;

[0083] The watch module is a real-time monitoring and early warning module for emergency events. It analyzes potential emergency situations by integrating multi-source data, including sensor data, surveillance videos, and meteorological information.

[0084] The on-site switching module is used to implement information switching and resource allocation between the emergency scene and the command center;

[0085] The application data temporary storage area is used to temporarily store data for the emergency command platform;

[0086] The coding identification area is used to store the node number of this command platform.

[0087] Furthermore, the data acquisition module is used to collect the information data stream of each built-in module of each emergency command platform, and the information data stream includes application data and status information; the data acquisition module includes a status authentication unit, a communication feedback unit and an information acquisition unit, and the data acquisition module first verifies the node number of each emergency command platform by using a chaotic encryption algorithm through the status authentication unit; then detects and authenticates the communication status of each emergency command platform by using an abnormal authentication algorithm through the communication feedback unit; finally, the information acquisition unit collects the information data stream of each built-in module of the emergency command platform that has completed the communication authentication;

[0088] The data processing module is used to clean and classify the collected information data stream, and build the digital twin platform of each emergency command platform based on the information data stream; the data processing module includes a data cleaning unit, a data classification unit and a twin construction unit; the data cleaning unit uses a wavelet transform algorithm and a data filling algorithm to deduplicate information and fill missing values ​​in the information data stream; the data classification unit uses a clustering algorithm to classify the cleaned information data stream according to the node number; the data twin unit uses a network analysis algorithm and a Monte Carlo simulation algorithm to build a corresponding twin emergency command platform based on the classified information data stream.

[0089] Furthermore, the monitoring and control module is used to monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform;

[0090] The monitoring and control module includes a detection and analysis unit, a data distribution unit and an instruction generation unit;

[0091] The detection and analysis unit uses a deep analysis model to reduce the dimension of the information data stream. The expression of the dimensionality reduction process is as follows:

[0092] Z=σ(WX+b)+Q E (X, Y)(1)

[0093] Among them, Z represents the potential dimension, W represents the weight, σ() represents the activation function, b represents the bias vector, Q E represents the CVAE encoding network, X represents the information data stream sample, and Y represents the true label;

[0094] Then the information data stream after dimensionality reduction is input into the feature extraction layer to extract the feature information of the information data stream; the feature extraction layer includes 1 3×3 convolution layer, 1 1×1 point convolution layer, 2 3×3 maximum pooling layers and 3 normalization layers; then the extracted feature information is encoded using the Detec encoder, and the expression is as follows:

[0095] H i+1 =R((Z|H i ),A∨W) (2)

[0096] Among them, H i represents the i-th convolutional layer, R() represents the RELU activation function, i represents the number of convolutional layers, A represents the adjacency matrix, and Z represents the eigenvector;

[0097] Then, the compiled information data stream is input into the two network branches of the learning and training layer for iterative training to obtain deep feature values; the first network branch includes 3 3×3 convolutional layers, 1 3×3 upsampling layer, 1 3×3 downsampling layer, 1 1×1 point convolutional layer and 1 SoftPlus activation function, and the second network branch includes 2 1×1 convolutional layers, 4 3×1 upsampling layers, 4 1×3 downsampling layers, 2 SELU activation functions and 2 PRelu activation functions; at the same time, the deep feature values ​​output by the two network branches are spliced ​​and fused;

[0098] Then, the deep feature values ​​after splicing and fusion are reconstructed by the reconstruction decoder for both structure and attribute. The expression is:

[0099] S=P(H i ,A|W)+SM(H i H iT ) (3)

[0100] Among them, S represents the reconstructed decoding value, P() represents the PRelu activation function, SM() represents the SigMoid activation function, and T represents transposition;

[0101] Finally, the reconstructed information data stream is passed through the average pooling layer, the fully connected layer and the LRelu activation function in turn to divide the information data stream into benign data stream, malignant data stream and unknown suspicious data stream;

[0102] The working principle of the deep analysis model is as follows: preprocess and normalize the original data, such as filtering out valid and invalid information in the data, removing some redundant or repeated data sections, normalizing the data, etc.; the deep analysis model uses deep learning algorithms such as convolutional neural networks (CNN) to extract features from the data stream, which include: ports, protocols, request methods, data types, protocol-based flags, etc.; the features are passed into the model, and the model is trained using training data with benign and malicious labels. The trained model can classify the data stream into benign data streams, malicious data streams, and unknown suspicious data streams; in the detection process of the deep analysis model, for the classified unknown suspicious data streams, it is usually necessary to further judge and analyze them through processes such as network environment detection, historical record checking, and user authority analysis; take corresponding security defense measures based on the output results of the deep analysis model, such as intercepting or isolating malicious data streams, or notifying system administrators to perform security defense and troubleshooting.

[0103] The data distribution unit transmits the information data streams that have completed the identification and analysis to the corresponding remote signaling channels respectively by using a parallel transmission algorithm;

[0104] The instruction generation unit generates corresponding control instructions according to the sequence number of the remote signaling channel and the node number of the emergency command platform.

[0105] Furthermore, the agent simulation module is used to receive and implement control instructions and transmit unknown suspicious data streams to multiple functionally equivalent digital twin platforms for judgment and evaluation;

[0106] In the emergency command platform, the dynamic reconstruction module plays a key role. With the continuous changes and increasing complexity of various emergencies, the traditional fixed operation framework may not be able to effectively respond. By introducing the dynamic reconstruction module, the operation framework of each built-in module of the emergency command platform can be adjusted in time according to the accurate judgment and evaluation results of the digital twin platform, so as to ensure that the generated dynamic protection strategy can be more in line with the actual situation and improve the efficiency and accuracy of emergency response.

[0107] The digital twin platform can provide accurate judgment and evaluation results for the dynamic reconstruction module through real-time simulation and data analysis of emergency scenarios in the real world. This synergy enables the emergency command platform to respond to various changes more intelligently. For example, when the digital twin platform detects that the scale of an emergency has expanded or the nature has changed, the dynamic reconstruction module can quickly adjust the operating framework of the built-in modules, reallocate resources, and optimize the decision-making process.

[0108] The agent simulation module includes a control execution unit, an agent activation unit and a simulation judgment unit; the agent simulation module first decomposes the control instructions through the control execution unit using an instruction decoding algorithm; then activates the completed digital twin platform through the agent activation unit; finally, the simulation judgment unit uses a timing evaluation algorithm to conduct real-time analysis on the digital twin platform loaded with unknown suspicious data streams.

[0109] Furthermore, the dynamic reconstruction module is used to reconstruct the operating framework of each built-in module of the emergency command platform according to the judgment and evaluation results of the digital twin platform to generate a dynamic protection strategy;

[0110] The dynamic reconstruction module includes a judgment and analysis unit, a dynamic defense unit and a conversion and reconstruction unit; the judgment and analysis unit uses a consensus feedback algorithm to determine the essential architecture of the unknown suspicious data flow according to the real-time judgment results; the dynamic defense unit uses a mimic defense model to adjust the original framework of the digital twin platform according to the essential architecture of the unknown suspicious data flow to achieve security isolation of the digital twin platform;

[0111] The mimetic defense model includes a fully heterogeneous layer and a limited heterogeneous layer; the fully heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts continuous game on the digital twin platform; the limited heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts intermittent game on the digital twin platform; in the fully heterogeneous layer, the expected benefit of the unknown suspicious data flow is determined according to the probability of successful intrusion of the unknown suspicious data flow, and the expression is:

[0112] B1(μ)=B(-C(t0)+α-t0) / C(α-t0) (4)

[0113] Among them, B1 represents the total benefit, B() represents the expected benefit function, μ represents the benefit, C() represents the cost, t0 represents the attack time, and α represents the rotation period;

[0114] Considering the impact of the cost of attack and defense of unknown suspicious data flows during the cycle on the total benefit, the defense cycle of the digital twin platform is extended, making the expected benefit of the unknown suspicious data flow negative, and the expression for the unknown suspicious data flow to lose its intrusion capability is:

[0115]

[0116] Among them, γ represents the rational factor, f(t) represents the intrusion probability density function, and t represents time;

[0117] In the case of limited heterogeneous layers, the unknown suspicious data flow uses the number of intrusions as accumulated experience. When the unknown suspicious data flow invades again, the expected benefit expression of the unknown suspicious data flow is:

[0118] B2(μ)=B ( -k*C ( t 0) +α-t 0) *(1-3√k2)C(α-t0) (6)

[0119] Among them, B2 represents limited benefits, k represents the number of invasions;

[0120] When the two levels of the mimicry defense model operate irregularly, the expected comprehensive benefit expression is:

[0121]

[0122] Among them, β represents the level transition probability;

[0123] Finally, according to the comprehensive benefit expectations, a dynamic defense strategy for the digital twin platform is formulated and the original framework of each built-in module of the digital twin platform is adjusted to achieve secure isolation of the digital twin platform;

[0124] The conversion and reconstruction unit uses an adversarial conversion algorithm to reconstruct the operating framework of each built-in module of the emergency command platform according to the new framework of the digital twin platform, while improving the security protection level of the emergency command platform to form a dynamic protection strategy.

[0125] Furthermore, the adjudication and tracing module is used to adjudicate and trace back unknown suspicious data flows according to the dynamic protection strategy and the judgment and evaluation results;

[0126] The decision tracing module includes an abnormality determination unit, a path tracing unit and a decision cracking unit;

[0127] The anomaly identification unit locates the source of the unknown suspicious data flow according to the essential architecture of the information data flow; the path tracing unit uses a node time jumping algorithm to trace and reproduce the network path of the unknown suspicious data flow; the judgment cracking unit uses a dynamic and static analysis algorithm to deeply crack the essential architecture of the unknown suspicious data flow and generate corresponding vulnerability patches.

[0128] Embodiment 2:

[0129] A command method for an emergency command system based on intrinsic safety is implemented based on an emergency command system based on intrinsic safety described in Example 1, and includes the following steps:

[0130] S1. Each built-in module of the emergency command platform processes and provides feedback on emergency events;

[0131] S2. Collecting the information data flow of each built-in module of the emergency command platform: Verify the node number of the emergency command platform through the data acquisition module, and detect and authenticate the communication status of the emergency command platform, and obtain the information data flow of each built-in module;

[0132] S3. Clean and classify the information data stream collected in step S2, and build a digital twin platform of the emergency command platform based on the information data stream;

[0133] The data processing module removes duplicate information and fills missing values ​​in the information data stream. At the same time, the information data stream is classified according to the node number, and the corresponding twin emergency command platform is built;

[0134] S4. Monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform; identify and analyze the information data flow using the deep analysis model through the monitoring and control module, and transmit it to the corresponding remote signaling channel, and generate corresponding control instructions at the same time;

[0135] S5. Receive and implement control instructions, and transmit unknown suspicious data streams to the digital twin platform for judgment and evaluation; decompose the control instructions through the agent simulation module, activate the completed digital twin platform, and conduct real-time judgment on the digital twin platform loaded with unknown suspicious data streams;

[0136] S6. According to the judgment and evaluation results of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed to generate a dynamic protection strategy; the essential architecture of the unknown suspicious data flow is determined through the dynamic reconstruction module, and the original framework of the digital twin platform is adjusted to achieve the security isolation of the digital twin platform. At the same time, according to the new framework of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed, thereby improving the security protection level of the emergency command platform and forming a dynamic protection strategy;

[0137] S7. According to the dynamic protection strategy and judgment and evaluation results, the unknown suspicious data flow is judged and traced back; the source of the unknown suspicious data flow is located through the judgment and tracing module, and the network path of the unknown suspicious data flow is traced and reproduced. At the same time, the essential architecture of the unknown suspicious data flow is deeply cracked, and the corresponding vulnerability patches are generated.

[0138] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0139] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and parts thereof may be replaced with equivalents without departing from the scope of the present application. In particular, as long as there is no structural conflict, the various features in the specific embodiments disclosed in the present application may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. An emergency command system based on intrinsic safety, characterized in that: It includes an emergency command platform, a safety protection platform, and a digital twin platform; the emergency command platform is connected to the safety protection platform, and the safety protection platform is connected to the digital twin platform; The emergency command platform includes an information management module, a multimedia collaboration module, a meteorological decision-making module, a map application module, an emergency plan module, a communication dispatch module, a watch module, an on-site switching module, an application data temporary storage area and a coding identification area; The security protection platform includes a data acquisition module, a data processing module, a monitoring and control module, an agent simulation module, a dynamic reconstruction module and a ruling tracing module.

2. The emergency command system based on intrinsic safety according to claim 1 is characterized in that: The information management module is a module for managing and maintaining emergency event information, and is used for data collection, integration, storage, query and analysis of emergency events; The multimedia collaboration module is used to transmit and communicate video, audio, and images in real time to meet the communication and collaboration needs of the emergency command department; The meteorological decision module is used to predict and analyze the collected meteorological data; The map application module displays real-time data, events, and resource information through maps to help users monitor, analyze, and schedule; The emergency plan module is to formulate emergency plans for various emergency situations in accordance with standard specifications and technical requirements, and support emergency material preparation and call operations; The communication scheduling module communicates by channel selection, frequency setting, and encoding and decoding; The watch module is a real-time monitoring and early warning module for emergency events. It analyzes potential emergency situations by integrating multi-source data, including sensor data, surveillance videos, and meteorological information. The on-site switching module is used to implement information switching and resource allocation between the emergency scene and the command center; The application data temporary storage area is used to temporarily store data for the emergency command platform; The coding identification area is used to store the node number of this command platform.

3. The emergency command system based on intrinsic safety according to claim 2 is characterized in that: The data acquisition module is used to collect the information data flow of each built-in module of each emergency command platform, and the information data flow includes application data and status information; the data acquisition module includes a status authentication unit, a communication feedback unit and an information acquisition unit. The data acquisition module first verifies the node number of each emergency command platform by using a chaotic encryption algorithm through the status authentication unit; then detects and authenticates the communication status of each emergency command platform by using an abnormal authentication algorithm through the communication feedback unit; finally, the information acquisition unit collects the information data flow of each built-in module of the emergency command platform that has completed communication authentication; The data processing module is used to clean and classify the collected information data stream, and build the digital twin platform of each emergency command platform based on the information data stream; the data processing module includes a data cleaning unit, a data classification unit and a twin construction unit; the data cleaning unit uses a wavelet transform algorithm and a data filling algorithm to deduplicate information and fill missing values ​​in the information data stream; the data classification unit uses a clustering algorithm to classify the cleaned information data stream according to the node number; the data twin unit uses a network analysis algorithm and a Monte Carlo simulation algorithm to build a corresponding twin emergency command platform based on the classified information data stream.

4. The emergency command system based on intrinsic safety according to claim 3 is characterized in that: The monitoring and control module is used to monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform; The monitoring and control module includes a detection and analysis unit, a data distribution unit and an instruction generation unit; The detection and analysis unit uses a deep analysis model to reduce the dimension of the information data stream. The expression of the dimensionality reduction process is as follows: Z=σ(WX+b)+Q E (X,Y)(1) Among them, Z represents the potential dimension, W represents the weight, σ() represents the activation function, b represents the bias vector, Q E represents the CVAE encoding network, X represents the information data stream sample, and Y represents the true label; Then the information data stream after dimensionality reduction is input into the feature extraction layer to extract the feature information of the information data stream; the feature extraction layer includes 1 3×3 convolution layer, 1 1×1 point convolution layer, 2 3×3 maximum pooling layers and 3 normalization layers; then the extracted feature information is encoded using the Detec encoder, and the expression is as follows: H i+1 =R((Z|H i ),A∨W) (2) Among them, H i represents the i-th convolutional layer, R() represents the RELU activation function, i represents the number of convolutional layers, A represents the adjacency matrix, and Z represents the eigenvector; Then, the compiled information data stream is input into the two network branches of the learning and training layer for iterative training to obtain deep feature values; the first network branch includes 3 3×3 convolutional layers, 1 3×3 upsampling layer, 1 3×3 downsampling layer, 1 1×1 point convolutional layer and 1 SoftPlus activation function, and the second network branch includes 2 1×1 convolutional layers, 4 3×1 upsampling layers, 4 1×3 downsampling layers, 2 SELU activation functions and 2 PRelu activation functions; at the same time, the deep feature values ​​output by the two network branches are spliced ​​and fused; Then, the deep feature values ​​after splicing and fusion are reconstructed by the reconstruction decoder for both structure and attribute. The expression is: S=P(H i ,A|W)+SM(H i H iT ) (3) Among them, S represents the reconstructed decoding value, P() represents the PRelu activation function, SM() represents the SigMoid activation function, and T represents transposition; Finally, the reconstructed information data stream is passed through the average pooling layer, the fully connected layer and the LRelu activation function in turn to divide the information data stream into benign data stream, malignant data stream and unknown suspicious data stream; The data distribution unit transmits the information data streams that have completed the identification and analysis to the corresponding remote signaling channels respectively by using a parallel transmission algorithm; The instruction generation unit generates corresponding control instructions according to the sequence number of the remote signaling channel and the node number of the emergency command platform.

5. The emergency command system based on intrinsic safety according to claim 4 is characterized in that: The agent simulation module is used to receive and implement control instructions and transmit unknown suspicious data streams to multiple functionally equivalent digital twin platforms for judgment and evaluation; The agent simulation module includes a control execution unit, an agent activation unit and a simulation judgment unit; the agent simulation module first decomposes the control instructions through the control execution unit using an instruction decoding algorithm; then activates the completed digital twin platform through the agent activation unit; finally, the simulation judgment unit uses a timing evaluation algorithm to conduct real-time analysis on the digital twin platform loaded with unknown suspicious data streams.

6. An emergency command system based on intrinsic safety according to claim 5, characterized in that: The dynamic reconstruction module is used to reconstruct the operating framework of each built-in module of the emergency command platform according to the judgment and evaluation results of the digital twin platform to generate a dynamic protection strategy; The dynamic reconstruction module includes a judgment and analysis unit, a dynamic defense unit and a conversion and reconstruction unit; the judgment and analysis unit uses a consensus feedback algorithm to determine the essential architecture of the unknown suspicious data flow according to the real-time judgment results; the dynamic defense unit uses a mimic defense model to adjust the original framework of the digital twin platform according to the essential architecture of the unknown suspicious data flow to achieve security isolation of the digital twin platform; The mimetic defense model includes a fully heterogeneous layer and a limited heterogeneous layer; the fully heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts continuous game on the digital twin platform; the limited heterogeneous layer is used for the transformation and change of the digital twin platform architecture when the unknown suspicious data flow conducts intermittent game on the digital twin platform; in the fully heterogeneous layer, the expected benefit of the unknown suspicious data flow is determined according to the probability of successful intrusion of the unknown suspicious data flow, and the expression is: B1(μ)=B(-C(t0)+α-t0) / C(α-t0) (4) Among them, B1 represents the total benefit, B() represents the expected benefit function, μ represents the benefit, C() represents the cost, t0 represents the attack time, and α represents the rotation period; Considering the impact of the cost of attack and defense of unknown suspicious data flows during the cycle on the total benefit, the defense cycle of the digital twin platform is extended, making the expected benefit of the unknown suspicious data flow negative, and the expression for the unknown suspicious data flow to lose its intrusion capability is: dB(μ)d∝=(1-γ2)∫ 0t0 f(t)dt (5) Among them, γ represents the rational factor, f(t) represents the intrusion probability density function, and t represents time; In the case of limited heterogeneous layers, the unknown suspicious data flow uses the number of intrusions as accumulated experience. When the unknown suspicious data flow invades again, the expected benefit expression of the unknown suspicious data flow is: B2(μ)=B(-k*C(t0)+α-t0)*(1-3√k2)C(α-t0) (6) Among them, B2 represents limited benefits, k represents the number of invasions; When the two levels of the mimicry defense model operate irregularly, the expected comprehensive benefit expression is: B2(μ)-B1(μ)=C((k-1)α+t0)γ2+(1-β)∫ 0t0 f(t)dtk*a (7) Among them, β represents the level transition probability; Finally, according to the comprehensive benefit expectations, a dynamic defense strategy for the digital twin platform is formulated and the original framework of each built-in module of the digital twin platform is adjusted to achieve secure isolation of the digital twin platform; The conversion and reconstruction unit uses an adversarial conversion algorithm to reconstruct the operating framework of each built-in module of the emergency command platform according to the new framework of the digital twin platform, while improving the security protection level of the emergency command platform to form a dynamic protection strategy.

7. An emergency command system based on intrinsic safety according to claim 6, characterized in that: The decision tracing module is used to make decisions and trace back unknown suspicious data flows according to dynamic protection strategies and judgment evaluation results; The decision tracing module includes an abnormality determination unit, a path tracing unit and a decision cracking unit; The anomaly identification unit locates the source of the unknown suspicious data flow according to the essential architecture of the information data flow; the path tracing unit uses a node time jumping algorithm to trace and reproduce the network path of the unknown suspicious data flow; the judgment cracking unit uses a dynamic and static analysis algorithm to deeply crack the essential architecture of the unknown suspicious data flow and generate corresponding vulnerability patches.

8. A command method for an emergency command system based on intrinsic safety, implemented by an emergency command system based on intrinsic safety according to any one of claims 1 to 7, characterized in that: The steps include: S1. Each built-in module of the emergency command platform processes and provides feedback on emergency events; S2. Collecting the information data flow of each built-in module of the emergency command platform: Verify the node number of the emergency command platform through the data acquisition module, and detect and authenticate the communication status of the emergency command platform, and obtain the information data flow of each built-in module; S3. Clean and classify the information data stream collected in step S2, and build a digital twin platform of the emergency command platform based on the information data stream; The data processing module removes duplicate information and fills missing values ​​in the information data stream. At the same time, the information data stream is classified according to the node number, and the corresponding twin emergency command platform is built; S4. Monitor and analyze the information data flow of the emergency command platform, and generate corresponding control instructions to control the information data flow of the emergency command platform; The monitoring and control module uses a deep analysis model to identify and analyze the information data stream, transmit it to the corresponding remote signal channel, and generate corresponding control instructions; S5. Receive and implement control instructions, and transmit unknown suspicious data streams to the digital twin platform for judgment and evaluation; decompose the control instructions through the agent simulation module, activate the completed digital twin platform, and conduct real-time judgment on the digital twin platform loaded with unknown suspicious data streams; S6. Based on the judgment and evaluation results of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed to generate a dynamic protection strategy; The essential architecture of unknown suspicious data flows is determined through dynamic reconstruction modules, and the original framework of the digital twin platform is adjusted to achieve security isolation of the digital twin platform. At the same time, according to the new framework of the digital twin platform, the operating framework of each built-in module of the emergency command platform is reconstructed to improve the security protection level of the emergency command platform and form a dynamic protection strategy; S7. According to the dynamic protection strategy and judgment and evaluation results, the unknown suspicious data flow is judged and traced back; the source of the unknown suspicious data flow is located through the judgment and tracing module, and the network path of the unknown suspicious data flow is traced and reproduced. At the same time, the essential architecture of the unknown suspicious data flow is deeply cracked, and the corresponding vulnerability patches are generated.

Images