Ore wharf production network security situation awareness and monitoring early warning method and device

Abstract

The invention provides an ore wharf production network security situation awareness and monitoring early warning method and device. The method comprises the steps of collecting security data, performing preprocessing (data cleaning and Z-score standardization), and dividing the processed data into network traffic and structural data. A traffic anomaly coefficient is calculated through the network traffic monitoring model, and a structure anomaly coefficient is calculated through the network structure analysis model. And calculating a network security situation anomaly index according to the two coefficients, and comparing the network security situation anomaly index with a preset threshold to judge whether the network is abnormal or not. According to the method, potential security threats and attack modes are deeply mined, timely discovery and automatic early warning are realized, and safe and stable operation of an ore wharf production network is ensured.

Description

Technical Field

[0001] The present application belongs to the field of terminal safety monitoring, and in particular, relates to a method and device for sensing and monitoring early warning of production network safety at an ore terminal. Background Art

[0002] In today's highly developed information technology, the production network environment of ore terminals faces threats from all aspects, including but not limited to hacker attacks, virus transmission, phishing, etc., which bring huge risks to the normal operation of ore terminals. As the country pays more and more attention to production safety management, ore terminals need to achieve comprehensive monitoring and early warning of their production network environment to ensure the smooth progress of the production process and the safety of employees and equipment.

[0003] Network security situation awareness technology is an important technical means. It can monitor the security status of the network in real time by collecting and analyzing network data, and issue an alarm in time when potential threats are found. However, traditional network security situation awareness technology often focuses more on macro monitoring of the entire network environment, but it is unable to provide targeted monitoring and early warning for specific scenarios such as the production network environment of ore terminals. Summary of the invention

[0004] The purpose of this application is to overcome the defects in the above-mentioned prior art and provide a method and device for security situation awareness and monitoring and early warning of ore terminal production network.

[0005] The present application provides a method for security situation awareness and monitoring and early warning of an ore terminal production network, including:

[0006] Collecting cybersecurity data from ore terminal production;

[0007] Performing preprocessing operations on the collected safety data, including data cleaning and Z-score standardization;

[0008] The preprocessed secondary data is divided into network flow data and network structure data;

[0009] Based on the network traffic data, a network traffic anomaly coefficient is calculated by a network traffic monitoring mathematical model;

[0010] Based on the network structure data, a network structure abnormality coefficient is calculated by a network structure analysis mathematical model;

[0011] Calculate the network security situation anomaly index based on the network traffic anomaly coefficient and the network structure anomaly coefficient;

[0012] The network security situation anomaly index is compared with the preset network security situation awareness threshold to determine whether the first abnormal behavior occurs in the ore terminal production network.

[0013] Optionally, it also includes: monitoring and early warning of abnormal results.

[0014] Optionally, the steps of collecting the ore terminal production network security data include:

[0015] Use network monitoring tools to monitor network traffic and network structure in real time;

[0016] Configure the rules for collecting and analyzing the elements that affect system safety in the ore terminal production network;

[0017] Log analysis tools are used to regularly collect and analyze elements in the ore terminal production network that affect system security.

[0018] Optionally, the formula for the Z-score normalization process is:

[0019] X'=(X-μ) / σ

[0020] Among them, X is the original data, X' is the standardized data, μ is the mean value of the original data, and σ is the standard deviation of the original data.

[0021] Optionally, the network traffic data includes:

[0022] The network traffic data sampling time period, the network traffic value corresponding to each time period, and the number of data packets corresponding to each time period;

[0023] The network structure data includes:

[0024] The network structure data is sampled through the number of network nodes, the number of nodes with abnormal events, the probability of abnormal events occurring at a single node, and the network signal value of each node.

[0025] Optionally, the step of calculating the network traffic anomaly coefficient based on the network traffic data includes:

[0026] Divide the network traffic data sampling time into multiple time periods evenly;

[0027] Establish the functional relationship between network traffic and the number of data packets in each time period;

[0028] The network traffic anomaly coefficient is calculated through the network traffic monitoring mathematical model.

[0029] Optionally, the calculation formula of the network traffic monitoring mathematical model is:

[0030] Wz=f(x,y)

[0031] Among them, Wz represents the network traffic anomaly coefficient, x represents the network traffic value corresponding to each time period, y represents the number of data packets corresponding to each time period, and f is the calculation function.

[0032] Optionally, the step of calculating the network structure anomaly coefficient based on the network structure data includes:

[0033] Assume that the network structure data sampling passes through multiple nodes;

[0034] Calculate the confidence of network points using binomial distribution;

[0035] Calculate the network structure anomaly coefficient.

[0036] Optionally, the calculation formula of the network structure abnormality coefficient is:

[0037] Ru=g(m,k,p,qi,Q)

[0038] Among them, Ru represents the network structure anomaly coefficient, m represents the number of network nodes, k represents the number of nodes with abnormal events, p represents the probability of an abnormal event occurring in a single node, qi represents the network signal value of each node, Q represents the average network signal of m nodes, and g is the calculation function.

[0039] Optionally, the formula for calculating the network security situation anomaly index based on the network traffic anomaly coefficient and the network structure anomaly coefficient is:

[0040] D=αWz+βRu+γ

[0041] Among them, D represents the network security situation anomaly index, Wz represents the network traffic anomaly coefficient, Ru represents the network structure anomaly coefficient, α and β are weight coefficients, and γ is a constant.

[0042] The present application also provides a security situation awareness and monitoring early warning device for an ore terminal production network, including:

[0043] Collection module, collecting production network security data of ore terminals;

[0044] A preprocessing module performs preprocessing operations on the collected security data, including data cleaning and Z-score standardization processing;

[0045] The data module divides the preprocessed secondary data into network flow data and network structure data;

[0046] A coefficient module, based on the network flow data, calculates the network flow anomaly coefficient through a network flow monitoring mathematical model; based on the network structure data, calculates the network structure anomaly coefficient through a network structure analysis mathematical model;

[0047] A calculation module, which calculates a network security situation anomaly index according to the network traffic anomaly coefficient and the network structure anomaly coefficient;

[0048] The judgment module compares the network security situation anomaly index with the preset network security situation awareness threshold to determine whether there is any anomaly in the ore terminal production network.

[0049] The beneficial effects of this application are:

[0050] The present application provides a method for the perception and monitoring of the security situation of the production network of an ore terminal, including: collecting the data of the production network of the ore terminal; performing preprocessing operations on the collected security data, including data cleaning and Z-score standardization processing; dividing the preprocessed secondary data into network flow data and network structure data; based on the network flow data, calculating the network flow anomaly coefficient through the network flow monitoring mathematical model; based on the network structure data, calculating the network structure anomaly coefficient through the network structure analysis mathematical model; calculating the network security situation anomaly index according to the network flow anomaly coefficient and the network structure anomaly coefficient; comparing the network security situation anomaly index with the preset network security situation perception threshold to determine whether the production network of the ore terminal is abnormal. The present application deeply explores potential security threats and attack modes, timely discovers and automatically warns of potential threats, thereby ensuring the safe and stable operation of the production network of the ore terminal. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a schematic diagram of the ore terminal production network security situation awareness and monitoring and early warning process in this application.

[0052] Figure 2 This is a schematic diagram of the ore terminal production network security situation awareness and monitoring early warning device in this application; DETAILED DESCRIPTION

[0053] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that various forms of implementing the present disclosure should not be limited by the embodiments set forth herein. On the contrary, the embodiments are provided to more thoroughly understand the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0054] Please refer to Figure 1 As shown, this embodiment provides a method for security situation awareness and monitoring and early warning of an ore terminal production network, the steps of which include:

[0055] S101. Collect production network security data at ore terminals.

[0056] Through network detection tools, the factors that affect system security in the ore terminal production network are detected and collected.

[0057] The network detection tool includes a network monitoring tool and a log analysis tool. The method for detecting and collecting the elements that affect the system security in the ore terminal production network is as follows:

[0058] Use network monitoring tools to monitor network traffic and network structure in real time;

[0059] Configure the rules for collecting and analyzing the elements that affect system safety in the ore terminal production network;

[0060] Log analysis tools are used to regularly collect and analyze elements in the ore terminal production network that affect system security.

[0061] S102: Preprocessing the collected security data, including data cleaning and Z-score standardization.

[0062] The collected original data is preprocessed, and the preprocessed secondary data is divided into network flow data and network structure data.

[0063] Preprocess the collected raw data:

[0064] Data cleaning: including deleting duplicate data, processing missing values ​​and dealing with outliers;

[0065] Z-score standardization processing: The Z-score standardization processing formula is:

[0066]

[0067] Among them, X is the original data, μ is the mean value of the original data, and σ is the standard deviation of the original data.

[0068] S103, dividing the pre-processed secondary data into network flow data and network structure data.

[0069] The preprocessed secondary data is divided into network flow data and network structure data. The network flow data includes the network flow data sampling time period, the network flow value corresponding to each time period and the number of data packets corresponding to each time period. The network structure data includes the number of network nodes through which the network structure data is sampled, the number of nodes where abnormal events occur, the probability of abnormal events occurring at a single node and the network signal value of each node.

[0070] S104: Based on the network traffic data, a network traffic anomaly coefficient is calculated using a network traffic monitoring mathematical model.

[0071] The specific steps to calculate the network traffic anomaly coefficient through the network traffic monitoring mathematical model are as follows:

[0072] The network traffic data sampling time is evenly divided into t segments, where t = 1, 2, 3, ..., t, ..., n;

[0073] Establish the function z(x, y) of network traffic and number of packets in each time period:

[0074]

[0075] Where x represents the network traffic value corresponding to each time period, and y represents the number of data packets corresponding to each time period.

[0076] The network traffic anomaly coefficient is calculated through the network traffic monitoring mathematical model. The calculation formula is:

[0077]

[0078] Where Wz represents the network traffic anomaly coefficient, x represents the network traffic value corresponding to each time period, and y represents the number of data packets corresponding to each time period.

[0079] S105. Based on the network structure data, a network structure abnormality coefficient is calculated using a network structure analysis mathematical model.

[0080] The specific steps for calculating the network structure anomaly coefficient through the network structure analysis mathematical model are as follows:

[0081] Assume that the network structure data sampling passes through j nodes, where j = 1, 2, 3, ..., j, ..., m;

[0082] The confidence of network points is calculated using binomial distribution, and the calculation formula is:

[0083]

[0084] Among them, η(k) represents the network confidence, m represents the number of network nodes, k represents the number of nodes with abnormal events, and p represents the probability of an abnormal event occurring in a single node.

[0085] Calculate the network structure abnormality coefficient, the calculation formula is:

[0086]

[0087] Among them, Ru represents the network structure abnormality coefficient, r j Represents the network signal value of each node, represents the average network signal of m nodes, It represents the absolute difference between the network signal value of each node and the average value, and η(k) represents the network confidence.

[0088] S106. Calculate a network security situation anomaly index based on the network traffic anomaly coefficient and the network structure anomaly coefficient.

[0089] A network security situation awareness model is established, and the calculation formula of the network security situation anomaly index is calculated as follows:

[0090]

[0091] Among them, D represents the network security situation anomaly index, Wz represents the network traffic anomaly coefficient, Ru represents the network structure anomaly coefficient, and k1 and k2 represent constants.

[0092] S107. Compare the network security situation anomaly index with a preset network security situation awareness threshold to determine whether the ore terminal production network has a first abnormal behavior.

[0093] The network security situation anomaly index D is compared with the preset network security situation perception threshold β. If the network security situation anomaly index D is less than the preset network security situation perception threshold β, it is judged that there is no anomaly in the ore terminal production network. If the network security situation anomaly index D is greater than or equal to the preset network security situation perception threshold β, it is judged that there is an anomaly in the ore terminal production network.

[0094] Furthermore, through situation correlation analysis, the pre-processed secondary data is deeply analyzed to identify the specific contents of abnormal behavior:

[0095] A network attack association rule base for the monitoring system is established based on the characteristics of the ore terminal production network.

[0096] The network attack abnormal event data is selected to form the abnormal event attribute set. The event attribute set construction includes: event definition: clarify the definition of network attack events including DDoS attacks and SQL injections, attribute extraction: extract key attributes from each abnormal event, the attributes include attack source IP, target IP, attack time, attack type, attack intensity, attribute set construction: combine the extracted attributes into an event attribute set.

[0097] The preprocessed secondary data constitute the comparison event attribute set.

[0098] The situation correlation analysis algorithm is used to calculate the abnormal correlation degree of network attacks in the comparison event attribute set.

[0099] When the abnormal correlation degree of the network attack exceeds the preset threshold, the result is judged as the second abnormal behavior.

[0100] Abnormal results are monitored and warned. If an abnormal result of the first abnormal behavior or the second abnormal behavior is received, the system will issue a low-risk warning. If two abnormal results are received, the system will issue a high-risk warning. The warning notification is sent in the following ways: official website, mobile application and user terminal message reminder.

[0101] Please refer to Figure 2 As shown, the present application also provides a security situation awareness and monitoring early warning device for production network of an ore terminal, including:

[0102] Collection module 201, collecting ore terminal production network security data;

[0103] A preprocessing module 202 performs preprocessing operations on the collected security data, including data cleaning and Z-score standardization processing;

[0104] Data module 203, divides the pre-processed secondary data into network flow data and network structure data;

[0105] The coefficient module 204 calculates the network flow anomaly coefficient through the network flow monitoring mathematical model based on the network flow data; calculates the network structure anomaly coefficient through the network structure analysis mathematical model based on the network structure data;

[0106] A calculation module 205 calculates a network security situation anomaly index according to the network traffic anomaly coefficient and the network structure anomaly coefficient;

[0107] The judgment module 206 compares the network security situation anomaly index with a preset network security situation perception threshold to judge whether the ore terminal production network is abnormal.

[0108] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0109] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: include: Collecting cybersecurity data from ore terminal production; Performing preprocessing operations on the collected safety data, including data cleaning and Z-score standardization; The preprocessed secondary data is divided into network flow data and network structure data; Based on the network traffic data, a network traffic anomaly coefficient is calculated by a network traffic monitoring mathematical model; Based on the network structure data, a network structure abnormality coefficient is calculated by a network structure analysis mathematical model; Calculate the network security situation anomaly index based on the network traffic anomaly coefficient and the network structure anomaly coefficient; The network security situation anomaly index is compared with the preset network security situation awareness threshold to determine whether the first abnormal behavior occurs in the ore terminal production network.

2. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: Also includes: Monitor and warn of abnormal results.

3. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The steps to collect cybersecurity data for ore terminal production include: Use network monitoring tools to monitor network traffic and network structure in real time; Configure the rules for collecting and analyzing the elements that affect system safety in the ore terminal production network; Log analysis tools are used to regularly collect and analyze elements in the ore terminal production network that affect system security.

4. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The formula for the Z-score standardization process is: X'=(X-μ) / σ Among them, X is the original data, X' is the standardized data, μ is the mean value of the original data, and σ is the standard deviation of the original data.

5. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The network traffic data includes: The network traffic data sampling time period, the network traffic value corresponding to each time period, and the number of data packets corresponding to each time period; The network structure data includes: The network structure data is sampled through the number of network nodes, the number of nodes with abnormal events, the probability of abnormal events occurring at a single node, and the network signal value of each node.

6. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The step of calculating the network traffic anomaly coefficient based on the network traffic data comprises: Divide the network traffic data sampling time into multiple time periods evenly; Establish the functional relationship between network traffic and the number of data packets in each time period; The network traffic anomaly coefficient is calculated through the network traffic monitoring mathematical model.

7. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The calculation formula of the network traffic monitoring mathematical model is: Wz=f(x,y) Among them, Wz represents the network traffic anomaly coefficient, x represents the network traffic value corresponding to each time period, y represents the number of data packets corresponding to each time period, and f is the calculation function.

8. According to claim 1, a method for security situation awareness and monitoring and early warning of ore terminal production network, characterized in that: The calculation formula of the network structure abnormality coefficient is: Ru=g(m,k,p,qi,Q) Among them, Ru represents the network structure anomaly coefficient, m represents the number of network nodes, k represents the number of nodes with abnormal events, p represents the probability of an abnormal event occurring in a single node, qi represents the network signal value of each node, Q represents the average network signal of m nodes, and g is the calculation function.

9. The method for security situation awareness and monitoring and early warning of an ore terminal production network according to claim 1, characterized in that: The formula for calculating the network security situation anomaly index based on the network traffic anomaly coefficient and the network structure anomaly coefficient is: D=αWz+βRu+γ Among them, D represents the network security situation anomaly index, Wz represents the network traffic anomaly coefficient, Ru represents the network structure anomaly coefficient, α and β are weight coefficients, and γ is a constant.

10. A security situation awareness and monitoring early warning device for production network of ore terminal, characterized in that: include: Collection module, collecting production network security data of ore terminals; A preprocessing module performs preprocessing operations on the collected security data, including data cleaning and Z-score standardization processing; The data module divides the preprocessed secondary data into network flow data and network structure data; A coefficient module, based on the network traffic data, calculates the network traffic anomaly coefficient through a network traffic monitoring mathematical model; Based on the network structure data, a network structure abnormality coefficient is calculated by a network structure analysis mathematical model; A calculation module, which calculates a network security situation anomaly index according to the network traffic anomaly coefficient and the network structure anomaly coefficient; The judgment module compares the network security situation anomaly index with the preset network security situation awareness threshold to determine whether there is any anomaly in the ore terminal production network.

Images