Industrial internet security situation assessment system based on deep learning

Abstract

The invention discloses an industrial internet security situation assessment system based on deep learning, and relates to the technical field of industrial internet security, which comprises a data acquisition module, a data preprocessing module, a feature extraction module, a deep learning model training module and a data storage module, the system has the advantages that the deep learning model training module adopts a combined architecture and an optimization algorithm to train an accurate model, the real-time monitoring module monitors real-time data in the industrial internet according to received data, abnormal conditions are found in time, and the real-time monitoring module monitors the real-time data in the industrial internet according to the real-time data. The method comprises the following steps of: acquiring the security situation value data of the current industrial internet, transmitting the security situation value data of the current industrial internet to a situation awareness module, and performing deep quantitative evaluation and trend prediction by the situation awareness module by using a fuzzy logic and evidence theory fusion algorithm and integrating historical and real-time data to accurately calculate a comprehensive security situation value so as to calculate a more accurate comprehensive security situation value. And accurate judgment and timely and effective response to the security situation are ensured.

Description

Technical Field

[0001] The present invention relates to the field of industrial Internet security technology, and specifically to an industrial Internet security situation assessment system based on deep learning. Background Art

[0002] With the rapid development and widespread application of the Industrial Internet, its security issues have become increasingly prominent. In the process of integrating with the Internet, traditional industrial control systems are facing more and more network attacks and security threats. In the past, the security assessment of the Industrial Internet mainly relied on rule-based methods and simple statistical analysis. However, these methods have many limitations. They are difficult to handle massive, diverse and complex Industrial Internet data, and cannot accurately capture hidden patterns and dynamic changes in the data. At the same time, traditional assessment systems are often slow to respond to new and complex network attack methods, and cannot identify and warn in a timely and effective manner;

[0003] The existing industrial Internet security situation assessment system based on deep learning has poor security situation assessment capabilities, is inaccurate and lacks depth. It is difficult to integrate multi-source data to accurately judge the degree of risk. In addition, the existing assessment system has a high computational complexity, resulting in the speed of processing data unable to meet real-time requirements. In large-scale industrial networks, rapid detection and response to new attacks may be delayed. Then, existing technologies make it difficult to classify the current security situation into dangerous levels and give adaptive intervention measures based on specific categories. To this end, we propose an industrial Internet security situation assessment system based on deep learning. Summary of the invention

[0004] The purpose of the present invention is to provide an industrial Internet security situation assessment system based on deep learning.

[0005] In order to solve the problems raised in the above background technology, the present invention provides the following technical solutions: an industrial Internet security situation assessment system based on deep learning, the industrial Internet security situation assessment system includes a data acquisition module, a data preprocessing module, a feature extraction module, a deep learning model training module, a data storage module, a real-time monitoring module, a situation awareness module, an emergency response module and a result display module;

[0006] Data acquisition module: responsible for collecting data from various devices and systems in the industrial Internet;

[0007] Data preprocessing module: responsible for preprocessing the collected data, including cleaning, denoising and standardization;

[0008] Feature extraction module: responsible for extracting key features from preprocessed data;

[0009] Deep learning model training module: Use the extracted features to train the model and continuously optimize the model parameters;

[0010] Data storage module: used to store situation assessment data of historical data and store data of current system;

[0011] Real-time monitoring module: responsible for monitoring the real-time data in the industrial Internet based on the received data and timely discovering abnormal situations;

[0012] Situation awareness module: Comprehensively analyze monitoring data and model evaluation results to form an awareness of the security situation of the industrial Internet;

[0013] Emergency response module: responsible for formulating and implementing corresponding emergency measures based on the perceived security situation;

[0014] Result display module: responsible for displaying security situation assessment results to users in an intuitive manner.

[0015] As a further solution of the present invention: the data acquisition module obtains data of various devices and systems in the industrial Internet through the interfaces and protocols of Modbus, OPC UA, and MQTT. The data sources include temperature sensors, pressure sensors, PLC controllers, switches, and routers. The acquired data include network traffic data, equipment operation data, and system log data. For the collected network traffic data, the source address, destination address, protocol type, and traffic size data of the data packet will be collected. For the equipment operation data, the temperature, pressure, and speed parameter data of the equipment are collected. For the system log data, the login log and operation log data are collected. The integrity and accuracy of the data are ensured by parsing the data packet header and pre-analyzing the data content. The data acquisition is provided with a data caching mechanism based on the LRU algorithm. When the network fluctuation and data source failure cause data interruption, the untransmitted data can be stored. After the network is restored and the data source is normal, the data retransmission algorithm of the TCP protocol is relied on to automatically retransmit the data to ensure data continuity. The data acquisition module uses data compression technology based on the LZ77 algorithm and AES-256 encryption technology to transmit data to the data preprocessing module.

[0016] As a further solution of the present invention: the data preprocessing module is used to preprocess the data. For network traffic data, the data packet is first parsed to extract the source IP address, destination IP address, port number, protocol type, data packet size and transmission time data. The repeated data packets are identified and removed by a statistical method. Similar data packets that appear frequently in a short period of time are merged and processed. Then, the noise in the traffic data is eliminated by a median filtering method. For equipment operation data, the reasonable range of the data is first checked, and the data that exceeds the preset normal range is directly deleted. The preprocessing of system log data includes cleaning and normalizing the text content, removing irrelevant characters, spaces and special symbols in the log. , convert the log content into a unified JSON format. For login log data, extract the login time, login location and login user data and store them in corresponding fields. For operation log data, extract the type, object and time data of the operation and organize them in the prescribed format. Use natural language processing technology to perform word segmentation and stem extraction on the log for subsequent analysis and processing. For pre-processed network traffic data, equipment operation data or system log data, the Z-Score standardization method is used to map the data to a distribution with a mean of 0 and a standard deviation of 1 to facilitate subsequent feature extraction and model training. The data preprocessing module transmits the pre-processed data to the feature extraction module and the real-time monitoring module.

[0017] As a further solution of the present invention: the feature extraction module can extract features from the preprocessed data. For network traffic data, a feature extraction method based on statistics is used to calculate the statistical features of the average size of the data packet, the peak and valley values ​​of the traffic, and the mean and standard deviation of the time interval between the arrival of the data packet. At the same time, an analysis based on the frequency domain is used to convert the traffic data to the frequency domain through the fast Fourier transform (FFT), and the main frequency components and energy distribution features are extracted to detect abnormal traffic patterns. For equipment operation data, the equipment operation status feature data will be extracted, and the equipment operation data will be multi-scale analyzed through wavelet transform to obtain detailed features and approximate features at different time scales, and capture subtle changes and long-term trend data in equipment operation. For system log data, text classification feature extraction is first performed to divide the login log into normal login and abnormal login categories, and each category is assigned a corresponding feature identifier. For operation logs, the key actions of the operation and the importance of the operation object are extracted, and the log text is converted into a numerical vector using a bag of words model for subsequent processing. The feature extraction module transmits the extracted feature data to the deep learning model training module.

[0018] As a further solution of the present invention: the deep learning model training module is capable of receiving data transmitted by the feature extraction module, and using the received data as model training data. The deep learning model training module adopts a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network. Through the back-propagation algorithm combined with an adaptive momentum estimation optimization algorithm, the learning rate and momentum parameters are dynamically adjusted according to the characteristics of the training data, and the model weights and biases are optimized. The Dropout technology is introduced in the training process to randomly set the neuron output to 0 with a certain probability to prevent the model from overfitting. At the same time, the batch normalization technology is used to standardize the input of each layer of the neural network to accelerate model training and convergence. The data enhancement technology based on random rotation, scaling, cropping and adding Gaussian noise is used to enrich the diversity of training data to ensure the robustness and generalization ability of the model. The deep learning model training module will transmit the output result data of the model to the situation awareness module.

[0019] As a further solution of the present invention: the real-time monitoring module can receive data transmitted by the data preprocessing module, and the real-time monitoring module adopts Apache Flink streaming data processing technology, and combines the Hadoop YARN distributed computing framework to perform fast parallel analysis on the real-time data of the industrial Internet, and adopts an intelligent threshold setting algorithm, which automatically adjusts the threshold based on the statistical laws of historical data and the dynamic changes of real-time data, timely discovers abnormal fluctuations in the data, and calculates the security situation value of the current industrial Internet in real time, and sets the lower limit of the threshold as S min , set the upper threshold value to S max , the specific calculation formula is as follows:

[0020]

[0021] Where: S now A represents the security situation value of the current industrial Internet monitored in real time. i Indicates the indicator value obtained by real-time monitoring. represents the average value of all indicator values, and n represents the number of indicator values ​​obtained through real-time monitoring;

[0022] When S now ≤S min When the current security situation value of the industrial Internet is determined, S now is an outlier;

[0023] When S min <S now <S max When the current security situation value of the industrial Internet is determined, S now is the normal value;

[0024] When S max ≤Snow When it is time to determine the security situation value S of the current industrial Internet now as an outlier;

[0025] When it is determined that the security situation value of the current industrial Internet is an outlier, an alarm will be triggered through channels such as text messages, emails, and system pop-ups to ensure that relevant personnel respond in a timely manner. In addition, the real-time monitoring module uses a real-time data compression algorithm based on LZ4 and a memory optimization technology based on a memory pool to reduce storage and transmission overhead, improve resource utilization, and ensure the efficient and stable operation of monitoring. The real-time monitoring module will transmit the real-time data obtained in the industrial Internet to the situation awareness module.

[0026] As a further solution of the present invention: The situation awareness module can receive the data transmitted by the real-time monitoring module and the deep learning model training module. The situation awareness module uses a fusion algorithm based on fuzzy logic to define fuzzy sets and rules to handle the uncertainty of the received data. The fusion algorithm based on the evidence theory makes a fusion decision based on the credibility and uncertainty of the evidence. The situation awareness module establishes a situation assessment model based on a graph convolutional neural network, combines the time series analysis of historical data and the dynamic characteristics of real-time monitoring data, comprehensively quantifies and evaluates the security situation and predicts the trend, and calculates the comprehensive security situation value through a formula. The specific calculation formula is as follows:

[0027] S all = ω × S history +(1 - ω) × S now

[0028] Where: S all represents the comprehensive security situation value, S history represents the situation assessment value of the historical data stored in the data storage module, and ω represents the weight of the historical data set by the management personnel (0 < ω < 1);

[0029] The situation awareness module will transmit the output data to the emergency response module.

[0030] As a further solution of the present invention: The emergency response module can receive the data transmitted by the situation awareness module. The emergency response module is set with a low-risk threshold T1, a medium-risk threshold T2, and a high-risk threshold T3. When S all < T1, it means that the current is in a low-risk state. At this time, the system only records relevant information and conducts routine monitoring, generates a brief report every 24 hours, and conducts routine security checks such as vulnerability scanning and software updates on the system once a week. When T1 ≤ S allWhen T2, it is determined as medium risk. At this time, increase the monitoring frequency to once every 12 hours, issue a warning to notify relevant personnel, conduct key inspections on key equipment, and activate some security protection mechanisms, including increasing the complexity of access verification and making additional backups of important data. In addition, it is necessary to organize a security team to hold a daily risk assessment meeting to discuss the potential risk escalation possibilities and response strategies. When T2 ≤ S all When T3, it indicates a high-risk state. Immediately take more stringent emergency responses, including isolating some key equipment, restricting network access permissions, activating the emergency plan and conducting a comprehensive risk assessment every 6 hours, suspending some non-critical business services, deeply analyzing and filtering network traffic, and urgently deploying more security resources, including increasing the number of security personnel on duty and inviting external security experts for consultation and advice. When T3 ≤ S all When it is regarded as extremely dangerous, fully activate the emergency response mechanism, including urgently shutting down some services, comprehensively checking system vulnerabilities, notifying all relevant personnel to enter the emergency state, conducting real-time situation updates and response strategy adjustments every 2 hours, starting emergency off-site backups of data, conducting emergency communication and cooperation with relevant regulatory authorities and partners, and tracking and countering possible attack sources. The emergency response module will transmit the data to the result display module.

[0031] As a further solution of the present invention: The result display module is used to display the security situation assessment results to users in an intuitive, clear and highly interactive manner, including using dynamic bar charts, interactive line charts and scalable heat maps. The dynamic bar chart is used to display the change trend of the security situation in real time, and users can clearly see the increase and decrease of various data. The interactive line chart allows users to obtain detailed information of specific data points through mouse operations and deeply understand the change details of the data. The scalable heat map can present the distribution and concentration of data from a macroscopic perspective to help users quickly grasp the overall situation. In addition, the result display module provides an interactive user interface, and users can set flexible data screening conditions according to their own needs, including specific time periods, specific devices and specific security indicators, conduct in-depth drilling to view the underlying detailed data, and can compare the security situation of different time periods or different devices from multiple perspectives. The result display module supports display on computer, tablet and mobile phone devices.

[0032] Adopting the above technical solutions, compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] 1. The present invention is provided with a situation awareness module. When the feature extraction module integrates multiple technologies and comprehensively and accurately extracts data features, it can provide high-quality input for deep learning model training. The deep learning model training module adopts a combined architecture and optimization algorithm to train an accurate model. The real-time monitoring module monitors the real-time data in the industrial Internet according to the received data, discovers abnormal situations in time, and transmits the security situation value data of the current industrial Internet to the situation awareness module. The situation awareness module uses fuzzy logic and evidence theory fusion algorithm to comprehensively analyze historical and real-time data for in-depth quantitative evaluation and trend prediction, accurately calculates the comprehensive security situation value, and thus calculates a more accurate comprehensive security situation value, ensuring accurate judgment of the security situation and timely and effective response;

[0034] 2. The present invention uses advanced interfaces and protocols through the data acquisition module, which can quickly collect data from various devices and systems, and ensure the integrity and continuity of the data through the data caching mechanism. The real-time monitoring module uses Apache Flink streaming data processing technology and Hadoop YARN distributed computing framework to achieve fast parallel analysis of real-time data of the industrial Internet. At the same time, the intelligent threshold setting algorithm and dynamic rule engine can promptly and keenly discover abnormal fluctuations in the data. The LZ4 real-time data compression algorithm and memory optimization technology effectively improve resource utilization. The collaborative cooperation greatly improves the real-time performance and processing efficiency of the system, ensuring that new attacks can be quickly detected and responded to in large-scale industrial networks, and significantly reducing delays;

[0035] 3. The present invention can accurately analyze the risk level of the current industrial Internet security situation through the setting of the situation awareness module. It comprehensively uses the fusion algorithm based on fuzzy logic and evidence theory, comprehensively integrates multi-source data, and accurately judges the security situation. The emergency response module works closely with the situation awareness module to quickly make corresponding intervention measures according to the specific risk level. In low-risk, medium-risk, high-risk and extremely dangerous situations, corresponding detailed response measures can be made. The result display module presents the security situation assessment results in an intuitive and clear manner, so that relevant personnel can quickly understand the risk situation. The mutual cooperation of these three modules ensures that the system can accurately analyze the risk level and make effective interventions, greatly improving the security of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Schematic diagram of the system flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The specific embodiments of the present invention will be further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention.

[0038] In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0039] Please refer to the attached Figure 1 The present invention provides an industrial Internet security situation assessment system based on deep learning, and the industrial Internet security situation assessment system includes a data acquisition module, a data preprocessing module, a feature extraction module, a deep learning model training module, a data storage module, a real-time monitoring module, a situation awareness module, an emergency response module and a result display module;

[0040] Data acquisition module: responsible for collecting data from various devices and systems in the industrial Internet;

[0041] Data preprocessing module: responsible for preprocessing the collected data, including cleaning, denoising and standardization;

[0042] Feature extraction module: responsible for extracting key features from preprocessed data;

[0043] Deep learning model training module: Use the extracted features to train the model and continuously optimize the model parameters;

[0044] Data storage module: used to store situation assessment data of historical data and store data of current system;

[0045] Real-time monitoring module: responsible for monitoring the real-time data in the industrial Internet based on the received data and timely discovering abnormal situations;

[0046] Situation awareness module: Comprehensively analyze monitoring data and model evaluation results to form an awareness of the security situation of the industrial Internet;

[0047] Emergency response module: responsible for formulating and implementing corresponding emergency measures based on the perceived security situation;

[0048] Result display module: responsible for displaying security situation assessment results to users in an intuitive manner.

[0049] In one embodiment of the present invention: the data acquisition module obtains data from various devices and systems in the industrial Internet through the interfaces and protocols of Modbus, OPC UA, and MQTT. The data sources include temperature sensors, pressure sensors, PLC controllers, switches, and routers. The acquired data include network traffic data, equipment operation data, and system log data. For the collected network traffic data, the source address, destination address, protocol type, and traffic size data of the data packet will be collected. For the equipment operation data, the temperature, pressure, and speed parameter data of the equipment are collected. For the system log data, the login log and operation log data are collected. The integrity and accuracy of the data are ensured by parsing the data packet header and pre-analyzing the data content. The data acquisition is provided with a data caching mechanism based on the LRU algorithm. When the network fluctuation and data source failure cause data interruption, the untransmitted data can be stored. After the network is restored and the data source is normal, the data retransmission algorithm of the TCP protocol is relied on to automatically retransmit the data to ensure data continuity. The data acquisition module uses data compression technology based on the LZ77 algorithm and AES-256 encryption technology to transmit data to the data preprocessing module.

[0050] In one embodiment of the present invention: the data preprocessing module is used to preprocess the data. For network traffic data, the data packet is first parsed to extract the source IP address, destination IP address, port number, protocol type, data packet size and transmission time data. Duplicate data packets are identified and removed through statistical methods. Similar data packets that frequently appear in a short period of time are merged and processed. Then, the noise in the traffic data is eliminated by a median filtering method. For equipment operation data, the reasonable range of the data is first checked, and data that exceeds the preset normal range is directly deleted. The preprocessing of system log data includes cleaning and normalizing the text content, removing irrelevant characters, spaces and special symbols in the log. , convert the log content into a unified JSON format. For login log data, extract the login time, login location and login user data and store them in corresponding fields. For operation log data, extract the type, object and time data of the operation and organize them in the prescribed format. Use natural language processing technology to perform word segmentation and stem extraction on the log for subsequent analysis and processing. For pre-processed network traffic data, equipment operation data or system log data, the Z-Score standardization method is used to map the data to a distribution with a mean of 0 and a standard deviation of 1 to facilitate subsequent feature extraction and model training. The data preprocessing module will transmit the pre-processed data to the feature extraction module and the real-time monitoring module.

[0051] In one embodiment of the present invention: the feature extraction module can extract features from the preprocessed data. For network traffic data, a feature extraction method based on statistics is used to calculate the statistical features of the average size of the data packet, the peak and valley values ​​of the traffic, and the mean and standard deviation of the time interval between the arrival of the data packet. At the same time, an analysis based on the frequency domain is used to convert the traffic data to the frequency domain through the fast Fourier transform (FFT), and the main frequency components and energy distribution features are extracted to detect abnormal traffic patterns. For the equipment operation data, the equipment operation status feature data will be extracted, and the equipment operation data will be multi-scale analyzed through wavelet transform to obtain detailed features and approximate features at different time scales, and capture subtle changes and long-term trend data in the equipment operation. For the system log data, text classification feature extraction is first performed to divide the login log into normal login and abnormal login categories, and each category is assigned a corresponding feature identifier. For the operation log, the key actions of the operation and the importance of the operation object are extracted, and the log text is converted into a numerical vector using the bag of words model for subsequent processing. The feature extraction module transmits the extracted feature data to the deep learning model training module.

[0052] In one embodiment of the present invention: the deep learning model training module is capable of receiving data transmitted by the feature extraction module, and using the received data as model training data. The deep learning model training module adopts a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network. Through the back-propagation algorithm combined with an adaptive momentum estimation optimization algorithm, the learning rate and momentum parameters are dynamically adjusted according to the characteristics of the training data, and the model weights and biases are optimized. The Dropout technology is introduced in the training process to randomly set the neuron output to 0 with a certain probability to prevent the model from overfitting. At the same time, the batch normalization technology is used to standardize the input of each layer of the neural network to accelerate model training and convergence. The data enhancement technology based on random rotation, scaling, cropping and adding Gaussian noise is used to enrich the diversity of training data to ensure the robustness and generalization ability of the model. The deep learning model training module will transmit the output result data of the model to the situation awareness module.

[0053] In one embodiment of the present invention: the real-time monitoring module can receive data transmitted by the data preprocessing module. The real-time monitoring module adopts Apache Flink streaming data processing technology and combines the Hadoop YARN distributed computing framework to perform rapid parallel analysis on the real-time data of the industrial Internet. It adopts an intelligent threshold setting algorithm. Based on the statistical laws of historical data and the dynamic changes of real-time data, it automatically adjusts the threshold, promptly discovers abnormal fluctuations in the data, and calculates the security situation value of the current industrial Internet in real time. The lower limit of the threshold is set as S min , set the upper threshold value to S max , the specific calculation formula is as follows:

[0054]

[0055] Where: S now A represents the security situation value of the current industrial Internet monitored in real time. i Indicates the indicator value obtained by real-time monitoring. represents the average value of all indicator values, and n represents the number of indicator values ​​obtained through real-time monitoring;

[0056] When S now ≤S min When the current security situation value of the industrial Internet is determined, S now is an outlier;

[0057] When S min <S now <S max When the current security situation value of the industrial Internet is determined, S now is the normal value;

[0058] When S max ≤S now When the current security situation value of the industrial Internet is determined, S now is an outlier;

[0059] When the current security situation value of the industrial Internet is determined to be an abnormal value, an early warning will be triggered through SMS, email, and system pop-up windows to ensure that relevant personnel respond in a timely manner. In addition, the real-time monitoring module uses a real-time data compression algorithm based on LZ4 and memory optimization technology based on memory pool to reduce storage and transmission overhead, improve resource utilization, and ensure efficient and stable operation of monitoring. The real-time monitoring module will pass the real-time data obtained in the industrial Internet to the situation awareness module.

[0060] In one embodiment of the present invention: the situation awareness module can receive data transmitted by the real-time monitoring module and the deep learning model training module. The situation awareness module uses a fusion algorithm based on fuzzy logic to define fuzzy sets and rules to handle the uncertainty of the received data. The fusion algorithm based on evidence theory makes fusion decisions based on the credibility and uncertainty of the evidence. The situation awareness module establishes a situation assessment model based on a graph convolutional neural network, combines the time series analysis of historical data and the dynamic characteristics of real-time monitoring data, conducts a comprehensive quantitative assessment and trend prediction of the security situation, and calculates the comprehensive security situation value through a formula. The specific calculation formula is as follows:

[0061] S all =ω×S history +(1-ω)×S now

[0062] Where: Sall Represents the comprehensive security situation value, S history represents the situation assessment value of the historical data stored in the data storage module, and ω represents the weight of the historical data set by the management personnel (0<ω<1);

[0063] The situation awareness module will transmit the output data to the emergency response module.

[0064] In one embodiment of the present invention, the emergency response module can receive data transmitted by the situation awareness module, and the emergency response module is provided with a low risk threshold T1, a medium risk threshold T2 and a high risk threshold T3. all When T1≤S1, it indicates that the system is in a low-risk state. At this time, the system only records relevant information, performs routine monitoring, generates a brief report every 24 hours, and performs a weekly vulnerability scan and software update routine security check on the system. all When T2≤S, it is judged as medium risk. At this time, the monitoring frequency is increased to once every 12 hours, and an early warning is issued to notify relevant personnel. Key equipment is inspected and some security protection mechanisms are activated, including increasing the complexity of access verification and performing additional backup of important data. In addition, the security team needs to hold daily risk assessment meetings to discuss potential risk escalation possibilities and response strategies. When T2≤S all When T3≤S, it indicates a high-risk state. Immediately take more stringent emergency response measures, including isolating some key equipment, restricting network access rights, launching emergency plans and conducting a comprehensive risk assessment every 6 hours, suspending some non-critical business services, conducting in-depth analysis and filtering of network traffic, and urgently deploying more security resources, including increasing the number of security personnel on duty, inviting external security experts to consult and provide advice. When T3≤S all When the attack is detected, it is considered extremely dangerous and the emergency response mechanism is fully activated, including emergency shutdown of some services, comprehensive investigation of system vulnerabilities, notification of all relevant personnel to enter an emergency state, real-time situation updates and response strategy adjustments every 2 hours, initiation of emergency off-site backup of data, emergency communication and collaboration with relevant regulatory authorities and partners, tracking and countering possible sources of attack, and the emergency response module will transmit the data to the result display module.

[0065] In one embodiment of the present invention: the result display module is used to display the security situation assessment results to the user in an intuitive, clear and highly interactive manner, including the use of dynamic bar graphs, interactive line graphs and scalable heat maps. The dynamic bar graph is used to display the changing trend of the security situation in real time, and the user can clearly see the growth and decline of each data. The interactive line graph allows the user to obtain detailed information on specific data points through mouse operations and have an in-depth understanding of the details of data changes. The scalable heat map can present the distribution and concentration of data from a macro perspective, helping users to quickly grasp the overall situation. In addition, the result display module provides an interactive user interface, and users can set flexible data filtering conditions according to their own needs, including specific time periods, specific devices and specific security indicators, perform deep drilling to view the underlying detailed data, and can compare the security situation of different time periods or different devices from multiple angles. The result display module supports display on computers, tablets and mobile devices.

[0066] Example 1, please refer to the attached Figure 1 ,For the data acquisition module, in actual applications, the data acquisition module is connected to the PLC controller through the Modbus ,interface, to collect the operation data of the equipment in real time, such as temperature, pressure, etc. It communicates with the sensor through the OPCUA ,protocol to obtain the temperature data of the temperature sensor and the pressure data of the pressure sensor. ,For network traffic data, the MQTT protocol is used to obtain the source address, destination address, protocol type, and traffic size of the data packet from the ,switch. For example, in a certain industrial production scenario, the data acquisition module collects data from 100 sensors and 50 PLC controllers per second, ensuring the ,comprehensiveness and real-time nature of the data.

[0067] Example 2, please refer to the attached Figure 1 ,For the feature extraction module, for the network traffic data, the ,feature extraction module calculates statistical features such as the average size of the ,packet, the peak and valley values ​​of the traffic, and the mean and standard deviation of the time interval of the ,packet arrival., For example, the average size of the network traffic in a certain time period is 100Mbps, the peak value is 200Mbps, and the valley value is 20Mbps.,At the same time, the traffic data is converted to the ,frequency domain through the fast Fourier transform, the main frequency components and ,energy distribution features are extracted, and the abnormal traffic patterns within a specific ,frequency range are discovered.,For the equipment operation data, the equipment’s operation status features are ,extracted, such as the equipment’s vibration frequency features, and the ,detailed features at different time scales are obtained through the wavelet transform, ,so as to promptly discover subtle changes in the equipment operation.

[0068] Example 3, please refer to the attached Figure 1For the deep learning model training module, during the training process, the deep learning model training module receives the feature data transmitted by the feature extraction module. For the features of a set of equipment operation data, including temperature features, pressure features, etc., a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network is used for training. The weights and biases of the model are continuously adjusted through the back propagation algorithm combined with the adaptive momentum estimation optimization algorithm. During the training process, the Dropout technology is introduced to randomly set the neuron output to 0 with a probability of 50% to prevent the model from overfitting. At the same time, the batch normalization technology is used to standardize the input of each layer of the neural network to accelerate the model training and convergence. After multiple training and optimization, the model can accurately evaluate the operating status of the equipment.

[0069] Example 4, please refer to the attached Figure 1 ,For the situation awareness module, in a certain industrial control system, a fusion algorithm based on fuzzy logic is ,used to define fuzzy sets and rules to handle the uncertainty of sensor ,data and control system data.,For example, for temperature data, fuzzy sets such as “high ,temperature”, “normal”, and “low temperature” are defined, and corresponding rules are ,set according to the actual situation. The fusion algorithm based on ,evidence theory makes fusion decisions based on the credibility and uncertainty of ,evidence, and comprehensively judges the security situation of the system.

[0070] Example 5, please refer to the attached Figure 1 For the real-time monitoring module, in actual operation, Apache Flink streaming data processing technology is used in combination with the Hadoop YARN distributed computing framework to perform rapid parallel analysis on the real-time data of an industrial Internet platform. For example, 1,000 real-time data are processed per second, including equipment operation data and network traffic data. Through the intelligent threshold setting algorithm, according to the statistical law of historical data, the temperature threshold is set to 50°C and the traffic threshold is set to 150Mbps. When the temperature of a device exceeds 50°C or the network traffic exceeds 150Mbps in real time, the threshold is automatically adjusted and abnormal fluctuations in the data are discovered in time. At the same time, the real-time data compression algorithm based on LZ4 and the memory optimization technology based on the memory pool are used to reduce data storage and transmission overhead and improve resource utilization.

[0071] Example 6, please refer to the attached Figure 1 ,For the data storage module, the data storage module stores the situation assessment data of the historical data, and can record the detailed data displayed by the system during the evaluation process, and record the detailed display data through the result display module.

[0072] Specifically, by equipping the situation awareness module, when the feature extraction module integrates multiple technologies and extracts data features comprehensively and accurately, it can provide high-quality input for deep learning model training. The deep learning model training module uses advanced combined architecture and optimization algorithms to train accurate models. The real-time monitoring module monitors the real-time data in the industrial Internet based on the received data, detects abnormal conditions in time, and transmits the current industrial Internet security situation value data to the situation awareness module. The situation awareness module uses fuzzy logic and evidence theory fusion algorithms to integrate historical and real-time data to conduct in-depth quantitative evaluation and trend prediction, accurately calculate the comprehensive security situation value, and then obtain a more accurate comprehensive security situation value to ensure accurate judgment of the security situation and timely and effective response.

[0073] Specifically, the data collection module uses advanced interfaces and protocols to quickly collect data from various devices and systems, and relies on the data caching mechanism to ensure the integrity and continuity of the data. The real-time monitoring module uses Apache Flink streaming data processing technology and Hadoop YARN distributed computing framework to achieve fast parallel analysis of real-time data of the industrial Internet. At the same time, the intelligent threshold setting algorithm and dynamic rule engine can promptly and sensitively detect abnormal fluctuations in the data. The LZ4 real-time data compression algorithm and memory optimization technology effectively improve resource utilization. The collaborative cooperation greatly improves the real-time and processing efficiency of the system, ensuring that new attacks can be quickly detected and responded to in large-scale industrial networks, significantly reducing latency.

[0074] Specifically, through the setting of the situation awareness module, the risk level of the current industrial Internet security situation can be accurately analyzed. It comprehensively uses the fusion algorithm based on fuzzy logic and evidence theory, comprehensively integrates multi-source data, and accurately determines the security situation. The emergency response module and the situation awareness module work closely together to quickly make corresponding intervention measures according to the specific risk level. In low-risk, medium-risk, high-risk and extremely dangerous situations, corresponding detailed response measures can be implemented. The result display module presents the security situation assessment results in an intuitive and clear manner, so that relevant personnel can quickly understand the risk situation. The mutual cooperation of these three modules ensures that the system can accurately analyze the risk level and make effective interventions, greatly enhancing the security of the industrial Internet.

[0075] Working principle:

[0076] First, the data acquisition module obtains data from various devices and systems in the industrial Internet through the interfaces and protocols of Modbus, OPCUA, and MQTT. It collects data from various devices and systems in the industrial Internet, and uses data compression technology based on the LZ77 algorithm and AES-256 encryption technology to transmit the data to the data preprocessing module. The data preprocessing module will preprocess the collected data. The feature extraction module can extract key features from the preprocessed data and transmit the extracted data features to the deep learning model training module. The deep learning model training module adopts a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network, and uses the features extracted by the feature extraction module for model training, and continuously optimizes the model parameters. Then, these real-time feature data are analyzed and judged, and the security situation assessment results reflected by the current data are given. The real-time monitoring module can be based on the data preprocessing module through the formula Calculate the security situation value of the current industrial Internet. The situation awareness module can define fuzzy sets and rules based on the data transmitted by the real-time monitoring module and the deep learning model training module, and use the fusion algorithm based on fuzzy logic to calculate the security situation value of the current industrial Internet. all =ω×S history +(1-ω)×S now After calculating the comprehensive security situation value, the emergency response module can compare the calculated comprehensive security situation value with different thresholds to determine the specific risk category. Then the result display module displays the security situation assessment results to the user in an intuitive manner. At this point, the entire workflow ends.

[0077] At the same time, the present application uses specific words to describe the embodiments of the present application. For example, "one embodiment", "an embodiment", and / or "some embodiments" refer to a certain feature, structure or characteristic related to at least one embodiment of the present application. Therefore, it should be emphasized and noted that "one embodiment" or "an embodiment" or "an alternative embodiment" mentioned twice or more in different positions in this specification does not necessarily refer to the same embodiment. In addition, certain features, structures or characteristics in one or more embodiments of the present application can be appropriately combined.

[0078] Some aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". The processor may be one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present application may be expressed as computer products located in one or more computer-readable media, which include computer-readable program codes. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes ...), optical disks (e.g., compact disks CDs, digital versatile disks DVDs ...), smart cards, and flash memory devices (e.g., cards, sticks, key drives ...).

[0079] A computer-readable medium may include a propagated data signal containing computer program code, such as in baseband or as part of a carrier wave. The propagated signal may have a variety of manifestations, including electromagnetic, optical, etc., or a suitable combination. A computer-readable medium may be any computer-readable medium other than a computer-readable storage medium, which may be connected to an instruction execution system, device or apparatus to communicate, propagate or transmit a program for use. The program code on the computer-readable medium may be propagated through any suitable medium, including radio, cable, fiber optic cable, radio frequency signal, or similar medium, or a combination of any of the above mediums.

[0080] Similarly, it should be noted that in order to simplify the description disclosed in this application, so as to help understand one or more embodiments of the invention, in the above description of the embodiments of the present application, sometimes multiple features are merged into one embodiment, drawings or descriptions thereof. However, this disclosure method does not mean that the features required by the object of the present application are more than the features mentioned in the claims. In fact, the features of the embodiment are less than all the features of the single embodiment disclosed above. In some embodiments, numbers describing the number of components and attributes are used. It should be understood that such numbers used in the description of the embodiments are modified by the modifiers "approximately", "approximately" or "substantially" in some examples. Unless otherwise specified, "approximately", "approximately" or "substantially" indicate that the numbers allow a variation of ±20%. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximate values, which may change according to the characteristics required by individual embodiments. In some embodiments, the numerical parameters should take into account the specified significant digits and adopt the general method of retaining the digits. Although the numerical domains and parameters used to confirm the breadth of their range in some embodiments of the present application are approximate values, in specific embodiments, such numerical settings are as accurate as possible within the feasible range.

[0081] Although the present invention is disclosed as above in terms of preferred embodiments, it is not intended to limit the present invention, and any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the scope of protection defined by the claims of the present invention.

Claims

1. The industrial Internet security situation assessment system based on deep learning is characterized by: The industrial Internet security situation assessment system includes a data acquisition module, a data preprocessing module, a feature extraction module, a deep learning model training module, a data storage module, a real-time monitoring module, a situation awareness module, an emergency response module and a result display module; The data acquisition module obtains data from various devices and systems in the industrial Internet through the interfaces and protocols of Modbus, OPCUA, and MQTT. It collects data from various devices and systems in the industrial Internet, and uses data compression technology based on the LZ77 algorithm and AES-256 encryption technology to transmit the data to the data preprocessing module. The data preprocessing module preprocesses the collected data. The feature extraction module can extract key features from the preprocessed data and transmit the extracted data features to the deep learning model training module. The deep learning model training module adopts a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network, and uses the features extracted by the feature extraction module for model training, and continuously optimizes the model parameters, and then analyzes and judges these real-time feature data to give the security situation assessment results reflected by the current data. The real-time monitoring module can obtain the security situation assessment results reflected by the current data according to the formula after processing by the data preprocessing module. Calculate the security situation value of the current industrial Internet. The situation awareness module can define fuzzy sets and rules based on the fusion algorithm based on fuzzy logic according to the data transmitted by the real-time monitoring module and the deep learning model training module, and use the formula S all =ω×S history +(1-ω)×S now The comprehensive security situation value is calculated. The emergency response module can compare the calculated comprehensive security situation value with different thresholds to determine the specific risk category, and then the result display module displays the security situation assessment results to the user in an intuitive manner.

2. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The data acquisition module obtains data from various devices and systems in the industrial Internet through the interfaces and protocols of Modbus, OPC UA, and MQTT. The data sources include temperature sensors, pressure sensors, PLC controllers, switches, and routers. The acquired data includes network traffic data, equipment operation data, and system log data. For the collected network traffic data, the source address, destination address, protocol type, and traffic size data of the data packet will be collected. For the equipment operation data, the temperature, pressure, and speed parameter data of the equipment will be collected. For the system log data, the login log and operation log data are collected. The integrity and accuracy of the data are ensured by parsing the data packet header and pre-analyzing the data content. The data acquisition is provided with a data caching mechanism based on the LRU algorithm. When the network fluctuations and data source failures cause data interruption, the untransmitted data can be stored. After the network is restored and the data source is normal, the data retransmission algorithm of the TCP protocol is relied on to automatically retransmit the data to ensure data continuity. The data acquisition module uses data compression technology based on the LZ77 algorithm and AES-256 encryption technology to transmit data to the data preprocessing module.

3. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The data preprocessing module is used to preprocess the data. For network traffic data, the data packet will be parsed first to extract the source IP address, destination IP address, port number, protocol type, data packet size and transmission time data. Duplicate data packets will be identified and removed through statistical methods. Similar data packets that frequently appear in a short period of time will be merged and processed. Then, the noise in the traffic data will be eliminated by the median filtering method. For equipment operation data, the reasonable range of the data will be checked first, and the data that exceeds the preset normal range will be directly deleted. The preprocessing of system log data includes cleaning and normalizing the text content, removing irrelevant characters, spaces and special symbols in the log, and converting the log content into Convert to a unified JSON format. For login log data, extract the login time, login location and login user data and store them in corresponding fields. For operation log data, extract the type, object and time data of the operation and organize them in the specified format. Use natural language processing technology to perform word segmentation and stem extraction on the log for subsequent analysis and processing. For pre-processed network traffic data, equipment operation data or system log data, the Z-Score standardization method is used to map the data to a distribution with a mean of 0 and a standard deviation of 1 to facilitate subsequent feature extraction and model training. The data preprocessing module will transmit the pre-processed data to the feature extraction module and the real-time monitoring module.

4. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The feature extraction module can extract features from the preprocessed data. For network traffic data, a feature extraction method based on statistics is used to calculate the statistical features of the average size of data packets, the peak and valley values ​​of traffic, and the mean and standard deviation of the time interval between the arrival of data packets. At the same time, an analysis based on the frequency domain is used to convert the traffic data into the frequency domain through the fast Fourier transform (FFT), and the main frequency components and energy distribution features are extracted to detect abnormal traffic patterns. For equipment operation data, the equipment operation status feature data will be extracted, and the equipment operation data will be multi-scale analyzed through wavelet transform to obtain detailed features and approximate features at different time scales, and capture subtle changes and long-term trend data in equipment operation. For system log data, text classification feature extraction is first performed to divide the login log into normal login and abnormal login categories, and each category is assigned a corresponding feature identifier. For operation logs, the key actions of the operation and the importance of the operation object are extracted, and the log text is converted into a numerical vector using the bag of words model for subsequent processing. The feature extraction module transmits the extracted feature data to the deep learning model training module.

5. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The deep learning model training module can receive data transmitted by the feature extraction module, and use the received data as model training data. The deep learning model training module adopts a combined architecture of a recurrent neural network with long short-term memory units and a multi-layer convolutional neural network. Through the back-propagation algorithm combined with an adaptive momentum estimation optimization algorithm, the learning rate and momentum parameters are dynamically adjusted according to the characteristics of the training data, and the model weights and biases are optimized. The Dropout technology is introduced in the training process to prevent the model from overfitting by randomly setting the neuron output to 0 with a certain probability. At the same time, the batch normalization technology is used to standardize the input of each layer of the neural network to accelerate model training and convergence. The data enhancement technology based on random rotation, scaling, cropping and adding Gaussian noise is used to enrich the diversity of training data to ensure the robustness and generalization ability of the model. The deep learning model training module will transmit the output result data of the model to the situation awareness module.

6. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The real-time monitoring module can receive data transmitted by the data preprocessing module. The real-time monitoring module adopts Apache Flink streaming data processing technology and combines the Hadoop YARN distributed computing framework to perform rapid parallel analysis on the real-time data of the industrial Internet. It adopts an intelligent threshold setting algorithm. Based on the statistical laws of historical data and the dynamic changes of real-time data, it automatically adjusts the threshold, promptly discovers abnormal fluctuations in the data, and calculates the security situation value of the current industrial Internet in real time. The lower limit of the threshold is set as S min , set the upper threshold value to S max , the specific calculation formula is as follows: Where: S now A represents the security situation value of the current industrial Internet monitored in real time. i Indicates the indicator value obtained by real-time monitoring. represents the average value of all indicator values, and n represents the number of indicator values ​​obtained through real-time monitoring; When S now ≤S min When the current security situation value of the industrial Internet is determined, S now is an outlier; When S min now max When the current security situation value of the industrial Internet is determined, S now is the normal value;​​ When S max ≤S now When the current security situation value of the industrial Internet is determined, S now is an outlier; When the current security situation value of the industrial Internet is determined to be an abnormal value, an early warning will be triggered through SMS, email, and system pop-up windows to ensure that relevant personnel respond in a timely manner. In addition, the real-time monitoring module uses a real-time data compression algorithm based on LZ4 and a memory optimization technology based on a memory pool to reduce storage and transmission overhead, improve resource utilization, and ensure efficient and stable operation of monitoring. The real-time monitoring module will pass the real-time data obtained in the industrial Internet to the situation awareness module.

7. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The situation awareness module can receive data transmitted by the real-time monitoring module and the deep learning model training module. The situation awareness module uses a fusion algorithm based on fuzzy logic to define fuzzy sets and rules to deal with the uncertainty of the received data. The fusion algorithm based on evidence theory makes fusion decisions based on the credibility and uncertainty of the evidence. The situation awareness module establishes a situation assessment model based on a graph convolutional neural network, combines the time series analysis of historical data and the dynamic characteristics of real-time monitoring data, conducts a comprehensive quantitative assessment and trend prediction of the security situation, and calculates the comprehensive security situation value through a formula. The specific calculation formula is as follows: S all =ω×S history +(1-ω)×S now Where: S all Represents the comprehensive security situation value, S history represents the situation assessment value of the historical data stored in the data storage module, and ω represents the weight of the historical data set by the management personnel (0<ω<1); The situation awareness module transmits the output data to the emergency response module.

8. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The emergency response module can receive the data transmitted by the situation awareness module. In the emergency response module, there are set a low-risk threshold T1, a medium-risk threshold T2, and a high-risk threshold T3. When S all <T1, it indicates that the current state is a low-risk state. At this time, the system only records relevant information and conducts routine monitoring, generating a brief report every 24 hours, and performing routine security checks such as vulnerability scanning and software update on the system once a week. When T1 ≤ S all <T2, it is determined as a medium-risk state. At this time, the monitoring frequency is increased to once every 12 hours, and a warning notice is sent to relevant personnel. Key equipment is inspected intensively, and some security protection mechanisms are started, including increasing the complexity of access verification and making additional backups of important data. In addition, it is necessary to organize a daily risk assessment meeting for the security team to discuss the possibility of potential risk escalation and response strategies. When T2 ≤ S all <T3, it indicates a high-risk state. Immediately take more stringent emergency responses, including isolating some key equipment, restricting network access permissions, starting an emergency plan and conducting a comprehensive risk assessment every 6 hours, suspending some non-critical business services, deeply analyzing and filtering network traffic, and urgently deploying more security resources, including increasing the number of security personnel on duty, inviting external security experts for consultation and advice. When T3 ≤ S all , it is regarded as extremely dangerous, and the emergency response mechanism is fully activated, including urgently shutting down some services, comprehensively checking system vulnerabilities, notifying all relevant personnel to enter an emergency state, conducting real-time situation updates and response strategy adjustments every 2 hours, starting emergency off-site backups of data, communicating and collaborating urgently with relevant regulatory authorities and partners, and tracking and countering possible attack sources. The emergency response module will transmit the data to the result display module.

9. The industrial Internet security situation assessment system based on deep learning according to claim 1 is characterized in that: The result display module is used to display the security situation assessment results to the user in an intuitive, clear and highly interactive manner, including the use of dynamic bar charts, interactive line charts and scalable heat maps. The dynamic bar chart is used to display the changing trend of the security situation in real time, and the user can clearly see the growth and decline of each data. The interactive line chart allows the user to obtain detailed information on specific data points through mouse operations and have an in-depth understanding of the details of data changes. The scalable heat map can present the distribution and concentration of data from a macro perspective, helping users to quickly grasp the overall situation. In addition, the result display module provides an interactive user interface, and users can set flexible data filtering conditions according to their own needs, including specific time periods, specific devices and specific security indicators, perform deep drilling to view the underlying detailed data, and can compare the security situation of different time periods or different devices from multiple angles. The result display module supports display on computers, tablets and mobile devices.

Images