Permeation prevention method based on neural network edge calculation

Abstract

The invention discloses an anti-permeation method based on neural network edge computing, which relates to the technical field of neural networks and comprises the steps of starting edge computing equipment, loading a neural network module, loading a peripheral interface, analyzing the neural network module, processing a recognition result of the neural network module and the like. Communication protocol information on edge computing equipment is collected in real time, the possibility of attacks is comprehensively analyzed from the dimensions of hardware MAC, request features, flow features, protocol ports, permission requests, time points, communication duration and the like, and once potential dangers are found, a system can immediately take prevention measures such as data transmission blocking, data transmission failure and the like. Therefore, invasion of illegal equipment and information leakage are effectively prevented, and the security and stability of the edge computing environment are greatly enhanced.

Description

Technical Field

[0001] The present invention relates to the field of neural network technology, and in particular to a method for anti-infiltration based on neural network edge computing. Background Art

[0002] Edge computing in the field of industrial control is a distributed computing model that places data processing and computing resources on edge devices, sensors or user devices close to the source of data generation; edge computing aims to reduce the latency and bandwidth requirements of data transmission, thereby providing faster response times and higher bandwidth utilization. In an industrial control environment, this usually means directly processing and analyzing data at the production line, device or sensor level, rather than transmitting all data to the cloud or central server for processing.

[0003] It is precisely because of the geographical location characteristics of edge computing that device terminals have security risks. Hackers illegally access devices, leading to sensitive data leakage, data tampering, remote attacks, eavesdropping attacks and other problems. There must be a flexible and effective means to timely analyze and discover these attacks in order to effectively prevent the occurrence of risks. Summary of the invention

[0004] In view of the defects in the prior art, the present invention provides an anti-infiltration method based on neural network edge computing to solve the existing problems.

[0005] The present invention is implemented by the following technical scheme: a method for anti-infiltration based on neural network edge computing, comprising the following steps: Step 1: Start the edge computing device, load the operating system, driver, and application software according to the preset parameters, and complete normal loading and self-test; Step 2: Load the neural network module, start the computing module of the neural network on the edge computing device, preset the parameters of the neural network module, contact the neural network AI server, and complete the authentication and data information synchronization; Step 3: Load the peripheral interface, complete the docking synchronization of external devices, analyze the working status, and prepare preliminary data synchronization for subsequent work; Step 4: The peripherals work normally and communicate according to the preset network protocol; Step 5: The neural network module performs analysis to determine whether the collected connection request is a high-risk behavior; Step 6: Process the recognition result of the neural network module. If the result does not have a high risk, no processing is required. Then go to step 7 for processing. If the result has a risk, go to step 9 for processing. Step 7: The enterprise server processes the link request: After being recognized by the neural network of the edge computing device, the enterprise server will communicate with the peripheral device; the enterprise server will store the authentication package sent from the edge computing device; Step 8: When an attack that the edge computing device fails to identify is discovered by the enterprise server-side preventive measures, the enterprise server-side will take measures to first block the link and save the scene, then establish a link with the neural network AI server, send the authentication package to the neural network AI server as a parameter for updating the preventive measures, and then jump to step 10; Step 9: After the neural network module of the edge computing device finds a high risk in step 6, it first blocks the link at the edge computing location and sends the authentication package to the neural network AI server; Step 10: After the neural network AI server receives the blocking request from the neural network module of the edge computing device, it will confirm again whether it meets the high risk and repeat step 5; Step 11: Based on the received feedback information, the neural network AI server will update the weight table; Step 12: After the weight table is updated, the neural network AI server will send these updated weight tables to the neural network module; Step 13: After receiving the updated weight table, the neural network module will immediately update its own database; Step 14: The neural network module calculates and analyzes the link request sent by the device based on the updated weight table.

[0006] Preferably, the neural network AI server will send the latest version of weight information corresponding to the edge computing device, including: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight ; Define variables: ; The parameters sent by the neural network AI server are stored in the database of the neural network AI server. For each edge computing device, the corresponding weight parameter list is stored. When a new edge computing device is added, the administrator manually adds information according to the actual situation of the edge computing device to complete the variable setting: Protocol variables : Used to identify data communication rules; Port variables : Indicates the channel for data transmission; Time period variables : Record the time range in which the connection request data is generated; Data volume variables : Measures the size and volume of data; Duration Variable : Record the duration of data transmission or event occurrence; Privileged Encoding Variables : Used to verify data access permissions or priorities; Define the variable x: ; After setting the parameters, the neural network AI server follows the following algorithm: , ; , ; , ; Generate an initial weight corresponding to the edge computing device and store it in a database; Define the risk calculation function F(x,b): ; in: , , It is the basic permission threshold, representing the most basic privilege information of the operation. The number of times verification packets have been sent on behalf of this link; The output value of F(x,b) is the final result of the neural network module analysis, which is used to determine the degree of danger of the information and calculate the initial gradient : ; Calculate the initial squared gradient : ; After the parameters are set, they are stored in the database and sent to the corresponding device after the corresponding edge computing device establishes a link with the neural network AI server and passes the authentication.

[0007] Preferably, the neural network module processes the request data sent by the peripheral, extracts the attribute information in the link request, and converts it into six specific variable parameters, namely protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables .

[0008] Preferably, in step 5, the neural network module performs analysis to determine whether the collected connection request is a high-risk behavior, based on the following algorithm: ; F(x,b) is the final result of the neural network module. like There are safety risks; like There is no high risk; The high-risk standard is the preset threshold , used to indicate the risk level, The value of is an adjustable parameter. The higher the security level required, the The closer the value is to 0.

[0009] Preferably, the information recorded in the authentication package includes: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight , protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables ,After storing the information, the enterprise server initiates communication with the ,peripheral device.

[0010] Preferably, in step 8, after the neural network AI server receives the high-risk request from the enterprise server, it also receives an authentication package sent by the enterprise server, which contains Information, according to the content of the authentication package, the weight is optimized, the steps are as follows: Calculate the gradient of high-risk packets : ; Calculate the squared gradient of high-risk packets : ; Update the exponentially weighted moving average of the squared gradients: ; in is the exponentially weighted moving average calculated, is the previous exponentially weighted moving average. When the function is run for the first time, the value is 0. is the decay rate, which is used to determine the weight of past gradient information in updating the moving average of the squared gradient, and is generally set to a value close to 1; Update weight parameters: ; in is the calculated new weight parameter, is the current old weight parameter, is the learning rate, which is used to control the convergence speed, stability and final performance of neural network training. The default value is between 0.001 and 0.01; It is used to prevent the denominator from being zero and update the calculated parameters into the database; Similarly, update other weights: , , , , ; Recalculate the risk factor F(x,b): ; Risk factor after verification ,The neural network AI server saves the updated parameters into the database.

[0011] The beneficial effects of the present invention are embodied in: by collecting communication protocol information on edge computing devices in real time, the possibility of attack is comprehensively analyzed from dimensions such as hardware MAC, request characteristics, traffic characteristics, protocols / ports, permission requests, time points, and communication duration. Once potential dangers are discovered, the system will immediately take preventive measures, such as blocking data transmission, thereby effectively preventing the intrusion of illegal devices and information leakage, greatly enhancing the security and stability of the edge computing environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for the specific embodiments or the description of the prior art. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn according to the actual scale.

[0013] Figure 1 is a flow chart of the computing system of the present invention; Figure 2 This is the overall architecture design diagram of the present invention; Figure 3 It is a schematic diagram of the overall process of the present invention. DETAILED DESCRIPTION

[0014] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0015] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is considered to be "connected to" another element, it may be directly connected to the other element or there may be an intermediate element at the same time.

[0016] For ease of description, spatial relative terms such as "upper," "lower," "left," and "right" may be used herein to describe the relationship of one element or feature shown in a figure relative to another element or feature. It should be understood that the spatial terms are intended to include different orientations of the device in use or operation in addition to the orientation shown in the figures. For example, if the device in the figure is inverted, elements described as being "below" other elements or features will be positioned "above" the other elements or features. Thus, the exemplary term "below" may include both upper and lower orientations.

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items.

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation of the present invention is described in detail below in conjunction with specific embodiments: Figure 1-Figure 3 The present invention is implemented by the following technical solution: a method for anti-infiltration based on neural network edge computing, comprising the following steps: Step 1: Start the edge computing device, load the operating system, driver, and application software according to the preset parameters, and complete normal loading and self-test; Step 2: Load the neural network module, start the computing module of the neural network on the edge computing device, preset the parameters of the neural network module, contact the neural network AI server, and complete the authentication and data information synchronization; Step 3: Load the peripheral interface, complete the docking synchronization of external devices, analyze the working status, and prepare preliminary data synchronization for subsequent work; Step 4: The peripherals work normally and communicate according to the preset network protocol; Step 5: The neural network module performs analysis to determine whether the collected connection request is a high-risk behavior; Step 6: Process the recognition result of the neural network module. If the result does not have a high risk, no processing is required. Then go to step 7 for processing. If the result has a risk, go to step 9 for processing. Step 7: The enterprise server processes the link request: After being recognized by the neural network of the edge computing device, the enterprise server will communicate with the peripheral device; the enterprise server will store the authentication package sent from the edge computing device; Step 8: When an attack that the edge computing device fails to identify is discovered by the enterprise server-side preventive measures, the enterprise server-side will take measures to first block the link and save the scene, then establish a link with the neural network AI server, send the authentication package to the neural network AI server as a parameter for updating the preventive measures, and then jump to step 10; Step 9: After the neural network module of the edge computing device finds a high risk in step 6, it first blocks the link at the edge computing location and sends the authentication package to the neural network AI server; Step 10: After the neural network AI server receives the blocking request from the neural network module of the edge computing device, it will confirm again whether it meets the high risk and repeat step 5; Step 11: Based on the received feedback information, the neural network AI server will update the weight table; Step 12: After the weight table is updated, the neural network AI server will send these updated weight tables to the neural network module; Step 13: After receiving the updated weight table, the neural network module will immediately update its own database; Step 14: The neural network module calculates and analyzes the link request sent by the device based on the updated weight table.

[0019] The neural network AI server will send the latest version of weight information corresponding to the edge computing device, including: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight ; Define variables: ; The parameters sent by the neural network AI server are stored in the database of the neural network AI server. For each edge computing device, the corresponding weight parameter list is stored. When a new edge computing device is added, the administrator manually adds information according to the actual situation of the edge computing device to complete the variable setting: Protocol variables : Used to identify data communication rules; Port variables : Indicates the channel for data transmission; Time period variables : Record the time range in which the connection request data is generated; Data volume variables : Measures the size and volume of data; Duration Variable : Record the duration of data transmission or event occurrence; Privileged Encoding Variables : Used to verify data access permissions or priorities; Define the variable x: ; After setting the parameters, the neural network AI server follows the following algorithm: , ; , ; , ; Generate an initial weight corresponding to the edge computing device and store it in a database; Define the risk calculation function F(x,b): ; in: , , It is the basic permission threshold, representing the most basic privilege information of the operation. The number of times verification packets have been sent on behalf of this link; The output value of F(x,b) is the final result of the neural network module analysis, which is used to determine the degree of danger of the information and calculate the initial gradient : ; Calculate the initial squared gradient : ; After the parameters are set, they are stored in the database and sent to the corresponding device after the corresponding edge computing device establishes a link with the neural network AI server and passes the authentication.

[0020] The neural network module processes the request data sent by the peripheral, extracts the attribute information in the link request, and converts it into six specific variable parameters, namely protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables .

[0021] In step 5, the neural network module performs analysis to determine whether the collected connection request is a high-risk behavior. The algorithm is as follows: ; F(x,b) is the final result of the neural network module. like There are safety risks; like There is no high risk; The high-risk standard is the preset threshold , used to indicate the risk level, The value of is an adjustable parameter. The higher the security level required, the The closer the value is to 0.

[0022] The information recorded in the authentication package includes: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight , protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables ,After storing the information, the enterprise server initiates communication with the ,peripheral device.

[0023] In step 8, after the neural network AI server receives the high-risk request from the enterprise server, it also receives the authentication package sent by the enterprise server, which contains Information, according to the content of the authentication package, the weight is optimized, the steps are as follows: Calculate the gradient of high-risk packets : ; Calculate the squared gradient of high-risk packets : ; Update the exponentially weighted moving average of the squared gradients: ; in is the exponentially weighted moving average calculated, is the previous exponentially weighted moving average. When the function is run for the first time, the value is 0. is the decay rate, which is used to determine the weight of past gradient information in updating the moving average of the squared gradient, and is generally set to a value close to 1; Update weight parameters: ; in is the calculated new weight parameter, is the current old weight parameter, is the learning rate, which is used to control the convergence speed, stability and final performance of neural network training. The default value is between 0.001 and 0.01; It is used to prevent the denominator from being zero and update the calculated parameters into the database; Similarly, update other weights: , , , , ; Recalculate the risk factor F(x,b): ; Risk factor after verification ,The neural network AI server saves the updated parameters into the database.

[0024] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be included in the scope of the claims and specification of the present invention.

Claims

1. A method for anti-infiltration based on neural network edge computing, comprising the following steps: Step 1: Start the edge computing device, load the operating system, driver, and application software according to the preset parameters, and complete normal loading and self-test; Step 2: Load the neural network module, start the computing module of the neural network on the edge computing device, preset the parameters of the neural network module, contact the neural network AI server, and complete the authentication and data information synchronization; Step 3: Load the peripheral interface, complete the docking synchronization of external devices, analyze the working status, and prepare preliminary data synchronization for subsequent work; Step 4: The peripherals work normally and communicate according to the preset network protocol; Step 5: The neural network module performs analysis to determine whether the collected connection request is a high-risk behavior; Step 6: Process the recognition results of the neural network module. If the processing results do not have high risk, no processing is required. At this time, go to step 7 for processing; If there is a risk in the processing result, go to step nine for processing; Step 7: The enterprise server processes the link request: After being recognized by the neural network of the edge computing device, the enterprise server will communicate with the peripheral device; the enterprise server will store the authentication package sent from the edge computing device; Step 8: When an attack that the edge computing device fails to identify is discovered by the enterprise server-side preventive measures, the enterprise server-side will take measures to first block the link and save the scene, then establish a link with the neural network AI server, send the authentication package to the neural network AI server as a parameter for updating the preventive measures, and then jump to step 10; Step 9: After the neural network module of the edge computing device finds a high risk in step 6, it first blocks the link at the edge computing location and sends the authentication package to the neural network AI server; Step 10: After the neural network AI server receives the blocking request from the neural network module of the edge computing device, it will confirm again whether it meets the high risk and repeat step 5; Step 11: Based on the received feedback information, the neural network AI server will update the weight table; Step 12: After the weight table is updated, the neural network AI server will send these updated weight tables to the neural network module; Step 13: After receiving the updated weight table, the neural network module will immediately update its own database; Step 14: The neural network module calculates and analyzes the link request sent by the device based on the updated weight table.

2. According to claim 1, a method for anti-infiltration based on neural network edge computing is characterized in that: The neural network AI server will send the latest version of weight information corresponding to the edge computing device, including: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight ; Define variables: ; The parameters sent by the neural network AI server are stored in the database of the neural network AI server. For each edge computing device, the corresponding weight parameter list is stored. When a new edge computing device is added, the administrator manually adds information according to the actual situation of the edge computing device to complete the variable setting: Protocol variables : Used to identify data communication rules; Port variables : Indicates the channel for data transmission; Time period variables : Record the time range in which the connection request data is generated; Data volume variables : Measures the size and volume of data; Duration Variable : Record the duration of data transmission or event occurrence; Privileged Encoding Variables : Used to verify data access permissions or priorities; Define the variable x: ; After setting the parameters, the neural network AI server follows the following algorithm: ， ； ， ； ， ； Generate an initial weight corresponding to the edge computing device and store it in a database; Define the risk calculation function F(x,b): ； in: ， ， It is the basic permission threshold, representing the most basic privilege information of the operation. The number of times verification packets have been sent on behalf of this link; The output value of F(x,b) is the final result of the neural network module analysis, which is used to determine the degree of danger of the information and calculate the initial gradient : ； Calculate the initial squared gradient : ； After the parameters are set, they are stored in the database and sent to the corresponding device after the corresponding edge computing device establishes a link with the neural network AI server and passes the authentication.

3. The method for anti-infiltration based on neural network edge computing according to claim 1 is characterized in that: The neural network module processes the request data sent by the peripheral, extracts the attribute information in the link request, and converts it into six specific variable parameters, namely protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables .

4. The method for anti-infiltration based on neural network edge computing according to claim 1 is characterized in that: In step 5, the neural network module performs analysis to determine whether the collected connection request is a high-risk behavior, based on the following algorithm: ； F(x,b) is the final result of the neural network module. like There are safety risks; like There is no high risk; The high-risk standard is the preset threshold , used to indicate the risk level, The value of is an adjustable parameter. The higher the security level required, The closer the value is to 0.

5. The method for anti-infiltration based on neural network edge computing according to claim 1 is characterized in that: The information recorded in the authentication package includes: protocol weight , Port Weight , Time period weight , Data volume weight , duration weight , privilege encoding weight , protocol variables , port variables , Time period variables , data volume variables , duration variables and privileged encoding variables ,After storing the information, the enterprise server initiates communication with the ,peripheral device.

6. The method for anti-infiltration based on neural network edge computing according to claim 1 is characterized in that: In step 8, after the neural network AI server receives the high-risk request from the enterprise server, it also receives the authentication package sent by the enterprise server, which contains Information, according to the content of the authentication package, the weight is optimized, the steps are as follows: Calculate the gradient of high-risk packets : ； Calculate the squared gradient of high-risk packets : ； Update the exponentially weighted moving average of the squared gradients: ； in is the exponentially weighted moving average calculated, is the previous exponentially weighted moving average. When the function is run for the first time, the value is 0. is the decay rate, which is used to determine the weight of past gradient information in updating the moving average of the squared gradient, and is generally set to a value close to 1; Update weight parameters: ； in is the calculated new weight parameter, is the current old weight parameter, is the learning rate, which is used to control the convergence speed, stability and final performance of neural network training. The default value is between 0.001 and 0.01; It is used to prevent the denominator from being zero and update the calculated parameters into the database; Similarly, update other weights: ， ， ， ， ； Recalculate the risk factor F(x,b): ； Risk factor after verification ,The neural network AI server saves the updated parameters into the database.

Images