Industrial information data security protection method and system based on machine learning

Abstract

The invention relates to the technical field of data protection, and discloses an industrial information data security protection method and system based on machine learning. The method comprises the following steps: acquiring industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of the industrial information; performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; according to the abnormal behavior data and the access permission data, constructing a decision tree model to obtain a data risk level; determining target abnormal data according to the data risk level, and judging whether the target abnormal data belongs to an abnormal database or not; when it is judged that the target abnormal data belongs to the abnormal database, calling a historical key to generate first encrypted data; and when judging that the target abnormal data does not belong to the abnormal database, matching a key in the key space, and generating second encrypted data. According to the method, the high efficiency of encryption is improved, and meanwhile, the security of data is ensured.

Description

Technical Field

[0001] The present invention relates to the field of data protection technology, and in particular to an industrial information data security protection method and system based on machine learning. Background Art

[0002] With the deep integration of Internet technology and traditional manufacturing, the informationization and networking in the production field are developing day by day, and information security issues are becoming more prominent. Due to the high integration of automation and informatization in industrial processes, industrial control systems are vulnerable to intrusion and destruction, which can lead to the leakage, tampering, and theft of confidential information, and even cause serious security accidents. And with the application of Internet of Things technology in the industrial field, industrial data security faces more severe challenges. Therefore, efficient encryption methods for industrial data have become an urgent problem to be solved.

[0003] Among the existing encryption technologies for industrial data, the existing encryption technologies have brought many burdens to industrial control systems due to their high complexity, which directly affects the system performance and operation efficiency. First, complex encryption algorithms often consume a lot of computing resources, and industrial control systems usually run on embedded devices or real-time systems with limited resources. This resource competition may cause the key control tasks of the system (such as real-time monitoring and feedback control) to be unable to be completed efficiently, seriously affecting the response speed and control accuracy of the system. Secondly, the computational complexity of these algorithms may significantly increase the delay, thereby reducing the real-time performance of the industrial control system, resulting in control deviations and even unstable equipment operation. In addition, many encryption algorithms will significantly increase the size of the data packet when transmitting encrypted data, resulting in excessive communication bandwidth occupancy, which may cause network bottlenecks and affect data synchronization and coordination between devices.

[0004] In summary, the complexity of existing encryption technology not only increases the burden on industrial control systems, but also may pose a serious threat to the real-time, stability, economy and maintainability of the system. Summary of the invention

[0005] The present invention provides an industrial information data security protection method and system based on machine learning, which can store new abnormal data and corresponding keys into an abnormal database. The system gradually accumulates keys and abnormal data, optimizes future encryption and abnormal behavior identification, improves the efficiency of encryption, and ensures data security.

[0006] In a first aspect, in order to solve the above technical problems, the present invention provides an industrial information data security protection method based on machine learning, comprising: Obtain industrial information data and access rights data; Preprocessing the industrial information data to obtain a real-time data set of industrial information; Based on the pre-trained support vector machine model, abnormal behavior recognition is performed on the real-time data set to obtain abnormal behavior data; According to the abnormal behavior data and the access permission data, a decision tree model is constructed, and data classification is performed to obtain a data risk level; Sort the data from high to low according to their risk levels, determine the abnormal behavior data with the highest ranking as target abnormal data, and determine whether the target abnormal data belongs to an abnormal database; When it is determined that the target abnormal data belongs to the abnormal database, calling the historical key in the abnormal database, and generating the first encrypted data based on the target abnormal data and the historical key; When it is determined that the target abnormal data does not belong to the abnormal database, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key; The target abnormal data determined not to belong to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0007] Preferably, the training process of the support vector machine includes: Access historical data sets of industrial information; Performing data mapping on the historical data set based on a kernel function to obtain a mapped data set; According to the mapped data set, the decision function of the support vector machine is solved based on the Lagrangian function, the hyperplane and the optimal classification to obtain a trained support vector machine model.

[0008] Preferably, the step of constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level includes: According to the abnormal behavior data and the access permission data, data sets are divided to obtain an abnormal behavior data subset and a user access permission data subset; Combining the abnormal behavior data subset with the user access permission data subset to obtain a comprehensive data set; Dividing the comprehensive data set based on the Gini index to obtain a subset of the comprehensive data set; The data set division is repeated for the comprehensive data set subset, and when the Gini index is less than a set threshold, the data set division is stopped to obtain the data risk level.

[0009] Preferably, the data set division is performed on the comprehensive data set based on the Gini index to obtain a comprehensive data set subset, including: Calculating the Gini index of the comprehensive data set, and selecting the feature with the smallest Gini index as a partitioning attribute; The comprehensive data set is segmented according to the segmentation attribute to obtain a comprehensive data set subset.

[0010] Preferably, the Gini index is calculated by the following formula: In the formula, For a comprehensive dataset; For the comprehensive data set samples; is the total number of samples.

[0011] Preferably, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key, comprises: Calculating the Euclidean distance between the target abnormal data and the key in the key space; Sort the Euclidean distances by size, and select the key corresponding to the Euclidean distance with the largest value as the encryption and decryption key; The target abnormal data is encrypted according to the encryption / decryption key to generate second encrypted data.

[0012] Preferably, the Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula: In the formula, For the Target abnormal data; For the The first keys; For the The target abnormal data and The first The Euclidean distance between the keys.

[0013] In a second aspect, the present invention provides an industrial information data security protection system based on machine learning, comprising: A data acquisition module, used to acquire industrial information data and access permission data; A data processing module, used for preprocessing the industrial information data to obtain a real-time data set of industrial information; An abnormality identification module, used to identify abnormal behavior of the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; A data classification module, used to construct a decision tree model based on the abnormal behavior data and the access permission data, and perform data classification to obtain a data risk level; An abnormality judgment module, used to sort the data from high to low according to the risk level of the data, determine the abnormal behavior data with the highest ranking as the target abnormal data, and judge whether the target abnormal data belongs to the abnormal database; A first encryption module, configured to, when determining that the target abnormal data belongs to an abnormal database, call a historical key in the abnormal database and generate first encrypted data based on the target abnormal data and the historical key; A second encryption module, configured to, when it is determined that the target abnormal data does not belong to the abnormal database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key; The key storage module is used to store the target abnormal data determined not to belong to the abnormal database and the corresponding key into the abnormal database according to the data risk level, and use the key as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0014] In a third aspect, the present invention also provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements any one of the above-mentioned industrial information data security protection methods based on machine learning.

[0015] In a fourth aspect, the present invention also provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned industrial information data security protection methods based on machine learning.

[0016] Compared with the prior art, the present invention has the following beneficial effects: An embodiment of the present invention provides an industrial information data security protection method and system based on machine learning. The method comprises: obtaining industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of industrial information; performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; constructing a decision tree model according to the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level; sorting the data from high to low according to the data risk level, determining the abnormal behavior data with the highest sorting as the target abnormal data, and judging whether the target abnormal data belongs to an abnormal database; when it is determined that the target abnormal data belongs to the abnormal database, calling a historical key in the abnormal database, and generating first encrypted data based on the target abnormal data and the historical key; when it is determined that the target abnormal data does not belong to the abnormal database, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key; storing the target abnormal data and the corresponding key determined not to belong to the abnormal database in the abnormal database according to the data risk level, and using the key as the existing data in the abnormal database when the abnormal behavior data is determined next time.

[0017] In the present invention, the method can ensure that the system has accurate and timely information input when processing real-time data by obtaining industrial information data and access permission data and preprocessing the industrial information data. Then, based on the pre-trained support vector machine model, abnormal behavior recognition is performed on the real-time data set. By automatically identifying potential abnormal behavior data, abnormal activities can be quickly screened out from a large amount of industrial data. On the basis of abnormal behavior data recognition, a decision tree model is constructed in combination with access permission data, and the data is graded to achieve data risk level assessment. Further, determining whether to call a historical key or a key for encryption by judging whether the target abnormal data belongs to an abnormal database is an intelligent encryption strategy. For target abnormal data that already exists in the abnormal database, directly using the historical key to generate the first encrypted data can quickly and effectively encrypt and protect the data, avoiding the need to recalculate the encryption key each time the abnormal data needs to be processed, thereby improving encryption efficiency and system response speed. For target abnormal data that does not belong to the abnormal database, the second encrypted data is generated by matching the key in the preset key space. Finally, the target abnormal data that does not belong to the abnormal database and its key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database during the next abnormal behavior data judgment. In summary, the method improves the efficiency of encryption and ensures the security of data by combining abnormal data identification, risk classification and historical key management technical means. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of an industrial information data security protection method based on machine learning provided by the first embodiment of the present invention; Figure 2 It is a structural diagram of an industrial information data security protection system based on machine learning provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Reference Figure 1 The first embodiment of the present invention provides an industrial information data security protection method based on machine learning, comprising the following steps: S11, obtaining industrial information data and access permission data.

[0021] S12, preprocessing the industrial information data to obtain a real-time data set of industrial information.

[0022] S13, performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data.

[0023] S14, constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level.

[0024] S15, sorting the data from high to low according to the risk level of the data, determining the abnormal behavior data with the highest ranking as the target abnormal data, and judging whether the target abnormal data belongs to the abnormal database.

[0025] S16, when it is determined that the target abnormal data belongs to the abnormal database, a historical key in the abnormal database is called to generate first encrypted data based on the target abnormal data and the historical key.

[0026] S17, when it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key.

[0027] S18, storing the target abnormal data determined not to belong to the abnormal database and the corresponding key in the abnormal database according to the data risk level, and using the key as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0028] It is worth noting that the main purpose of data encryption protection for industrial abnormal data is to ensure the confidentiality and integrity of sensitive information in the industrial system, prevent abnormal data from being maliciously tampered with, stolen or abused, and thus maintain the safety and stability of the entire industrial production process. Abnormal data generated by industrial control systems are often caused by factors such as system failures, equipment failures, external attacks, and internal operational errors. These abnormal data not only have high security risks, but if they are not encrypted and protected, they will become the target of hacker attacks or be maliciously manipulated, which will have a serious impact on the production process and even cause equipment damage or safety accidents. Therefore, encrypting abnormal data is an effective means to prevent these data from being illegally accessed or tampered with.

[0029] In order to facilitate the understanding of the present invention, some preferred embodiments of the present invention are further described below.

[0030] In step S11 , industrial information data and access permission data are acquired.

[0031] It is worth noting that industrial information data refers to all data related to industrial production and generated during the production process, including equipment status data, production process data, environmental monitoring data, sensor data, historical operation records, system performance data, etc. Specifically, these data are collected in real time by various industrial control systems (such as PLC, SCADA systems), reflecting the current operating status of production lines, equipment and systems and their interaction with the environment. Industrial information data is highly real-time, continuous and complex, and needs to be used for applications such as real-time monitoring, process optimization, and fault warning.

[0032] Specifically, industrial information data includes temperature, pressure, flow and other data collected by sensors, as well as operational data related to production scheduling, production efficiency, quality control, etc. Industrial systems are equipped with a large number of sensors to monitor physical quantities in the environment and production process, such as temperature, pressure, flow, humidity, pH value, gas concentration, etc. For example, sensors can monitor the steam temperature in a boiler or the pressure changes in a liquid pipeline. These data are crucial to ensure the safety of industrial processes.

[0033] Specifically, industrial information data also includes equipment operating status data, including equipment startup, shutdown, failure, etc. For example, the operating status data of an industrial equipment (such as a motor, pump, valve, etc.) includes whether the equipment is in operation, operating frequency, load, vibration, etc. These data help monitor the health status of the equipment in real time and warn of possible failures in advance.

[0034] Specifically, industrial information data also includes various operational data in the production process, such as material temperature, concentration, flow rate, reaction time, concentration, composition, etc. These data are very important for industrial production quality control, process optimization and adjustment. For example, in a chemical plant, the temperature, pressure and concentration data of the chemical reaction in the reaction tower are extremely sensitive and need to be strictly monitored.

[0035] Specifically, in addition to equipment and material data, industrial information data also includes production line scheduling, process arrangement, operator operation records, etc. For example, the work tasks on a production line and the production task data of each operator. These data help managers optimize production scheduling, improve production efficiency, and reduce downtime.

[0036] It is worth noting that, in an achievable way, access rights data refers to the permission settings and related records that control access to industrial information data. Specifically, access rights data includes detailed information on what operations each user or system entity (such as employees, managers, system administrators, equipment or software programs, etc.) can perform within a specific time period. These operations include but are not limited to viewing data, modifying data, deleting data, setting alarms or configuring, etc. The core function of access rights data is to define and manage who can access which data and effectively manage different permission levels. The management of access rights data can be based on user identity (such as workers, engineers, administrators, etc.) or role (such as different production lines, departments, projects, etc.). At the same time, access rights data will also record access logs, which describe in detail the user's access history to data (such as access time, access content, operation method, etc.). These logs not only help track and trace abnormal behavior, but also provide key evidence during security audits.

[0037] Specifically, in another achievable method, access permission data mainly refers to security level data related to access control of industrial information data. Specifically, access permission data determines which users or systems can access, view, modify or operate specific industrial information data. It includes a detailed description of the security level and permission configuration of data access. The specific content of access permission data may include the following aspects: access level and permission definition. Each user or device will be assigned a specific permission level, which defines the type of data it can access and the operations it can perform. For example, an operator can only view data, while an administrator can edit or modify data. The system sets the data of access permissions to ensure that users of different roles can only perform the operations they are authorized to perform. Permission levels include: read-only (view), edit (edit), delete (delete), control (admin) and other different levels.

[0038] In step S12, the industrial information data is preprocessed to obtain a real-time data set of industrial information.

[0039] It is worth mentioning that the preprocessing of industrial information data refers to a series of operations on raw industrial data, aiming to clean, standardize and transform the data to make it suitable for further analysis, especially to prepare data for abnormal behavior identification based on the support vector machine (SVM) model.

[0040] Specifically, data cleaning is performed first. Industrial information data comes from multiple sensors and devices, and there are missing values, outliers or duplicate data. The purpose of data cleaning is to fix these problems to ensure the accuracy and consistency of the data. Among them, there is a missing value problem. Due to sensor failure, network problems or data transmission errors, some data points are missing. Exemplarily, deleting missing data (if there are fewer missing values) or filling missing values ​​with mean, median, interpolation and other methods are common ways to deal with missing value problems. Industrial data sometimes contains outliers caused by equipment failure or external interference. For example, if the temperature data suddenly jumps to an unreasonably high value, it indicates a sensor failure. Outliers can be identified and processed through statistical analysis (such as Z-score, box plot, etc.), such as elimination, correction or marking. In multiple data sources or sensors, redundant data will be caused by duplicate records. These redundant data need to be removed during preprocessing to ensure the uniqueness of the data set.

[0041] Specifically, since industrial information data often comes from different types of sensors and devices, their dimensions are different (such as temperature, pressure, flow, etc.). In order for machine learning models to effectively process this data, the data must be converted to a unified standard range. A common method is to standardize each feature so that it has zero mean and unit variance (Z-score standardization). This is crucial for model training, especially distance-based algorithms such as support vector machines (SVMs), because they are sensitive to the scale of features. In certain cases, the data needs to be scaled to a specific range (such as [0, 1]). Normalization can avoid deviations caused by large differences in feature values ​​when processing certain specific data.

[0042] Specifically, in industrial information data, there are many irrelevant or redundant features, which not only occupy computing resources, but also affect the effect of the model. Therefore, it is crucial to perform feature selection or extraction in the preprocessing stage. Through correlation analysis, principal component analysis (PCA), and information gain methods, the features most relevant to the target task are selected. For example, some temperature data is related to production failures, while other non-critical sensor data can be ignored. Sometimes the information in the original data is not enough for direct and effective analysis. At this time, new features can be generated through aggregation, differentiation, and smoothing techniques. For example, trend, periodicity, mean, and standard deviation statistical features can be extracted from time series data.

[0043] Specifically, the support vector machine model requires that the input data is numerical and standardized, so all preprocessing steps (such as feature extraction, standardization, normalization, etc.) need to ensure that the data can be directly input into the support vector machine. For example, for large-scale data sets, dimensionality reduction is also required to reduce the amount of calculation and improve the training efficiency of the model.

[0044] It is worth noting that the preprocessed real-time data set will be a standardized, high-quality data set with no missing values, no outliers, and selected and extracted features. This data set will be used to identify abnormal behavior based on the trained support vector machine (SVM) model. The SVM model will identify abnormal behavior patterns in the data based on these data, such as equipment failure, system attack, operation error, etc., and generate corresponding abnormal behavior data. Therefore, the purpose of preprocessing is to ensure that the input real-time data set can be effectively learned by the SVM model through steps such as cleaning, conversion, standardization and feature selection, and to improve the accuracy and generalization ability of the model, so as to provide high-quality data support for subsequent abnormal behavior detection.

[0045] In step S13, abnormal behavior recognition is performed on the real-time data set based on the pre-trained support vector machine model to obtain abnormal behavior data.

[0046] Preferably, the training process of the support vector machine includes: Access historical data sets of industrial information; Performing data mapping on the historical data set based on a kernel function to obtain a mapped data set; According to the mapped data set, the decision function of the support vector machine is solved based on the Lagrangian function, the hyperplane and the optimal classification to obtain a trained support vector machine model.

[0047] Specifically, the training process of the support vector machine first requires the collection of historical data sets of industrial information data, including equipment operation data, sensor data, and production process data. These data are used as training sets for the support vector machine model and are the basis for the model to identify abnormal behaviors. Historical data sets help the model understand the patterns of normal and abnormal behaviors and provide actual and representative samples for subsequent training.

[0048] It is worth mentioning that the kernel function is used in the support vector machine to map the data from the original space to a higher-dimensional feature space, so that it can handle nonlinear separable situations. By using the kernel function, the support vector machine can find the optimal classification hyperplane in the high-dimensional space, even if the original data set cannot be separated in the low-dimensional space. This step converts the data into a form that is more suitable for classification by mapping the historical data set.

[0049] Specifically, solving the decision function of the support vector machine based on the Lagrangian function, hyperplane and optimal classification is the core part of the support vector machine training. Through the Lagrangian multiplier method, the support vector machine can find the optimal hyperplane in the high-dimensional feature space. The hyperplane can maximize the classification boundary so that different categories of data (normal and abnormal behavior) can be best separated. The training process includes calculating the optimal classification function so that the model can correctly predict the category of new data.

[0050] It is worth mentioning that the optimal classification function is a decision function used in the support vector machine (SVM) to effectively separate different categories of data. Its core goal is to find a "hyperplane" that can separate data points of different categories and has the largest margin, that is, the distance from the hyperplane to the closest sample point between the two categories of data points (called the support vector). This "optimal" decision function can ensure the highest accuracy and generalization ability when classifying new data.

[0051] Specifically, after obtaining the mapped data set, an optimization problem is constructed based on the Lagrangian function. The goal is to maximize the interval of the classification boundary, and the constraint condition yi(w·xi+ b)≥ 1 is introduced to ensure the correctness of the classification result. By optimizing the Lagrangian function, the original constrained optimization problem is transformed into a dual problem. The objective function of the dual problem is based on the inner product calculation of the samples in the historical data set, and the definition of the hyperplane is introduced to find the optimal classification surface. After solving the dual problem, the sample points corresponding to the non-zero Lagrangian multipliers are the support vectors, which are the key to constructing the classification decision function. Finally, the classification decision function of SVM is generated based on the optimization results, which is used to identify abnormal behavior of real-time data sets. The specific decision function form is: in, is the optimized Lagrange multiplier, is the kernel function, is the offset of the classification hyperplane.

[0052] It is worth noting that after obtaining the decision function, the model needs to be evaluated on an independent data set (validation set or test set) to check its accuracy, recall rate and generalization ability in actual abnormal behavior recognition. When the accuracy of the model meets the preset requirements, such as reaching the preset error threshold, the trained support vector machine model can be obtained.

[0053] In step S14, a decision tree model is constructed based on the abnormal behavior data and the access permission data, and data classification is performed to obtain a data risk level.

[0054] It is worth noting that the decision tree model is a classification or regression algorithm based on a tree structure. The core idea is to divide the data set into multiple subsets through the splitting conditions of the features, so as to classify or predict the data. Each splitting node represents the test condition of a feature, and the leaf node represents the classification result or regression value. Commonly used splitting criteria include the Gini index, information gain, and mean square error. In the present invention, the decision tree model is used to combine abnormal behavior data and access permission data for data classification. The decision tree identifies and distinguishes data of different risk levels by combining abnormal behavior data and access permission data. The abnormal behavior data is extracted from the real-time data set through a pre-trained support vector machine model, and the access permission data reflects the user's operating authority. The decision tree conducts a comprehensive analysis of these two types of data to determine the risk level of the data.

[0055] Preferably, the step of constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level includes: According to the abnormal behavior data and the access permission data, data sets are divided to obtain an abnormal behavior data subset and a user access permission data subset; Combining the abnormal behavior data subset with the user access permission data subset to obtain a comprehensive data set; Dividing the comprehensive data set based on the Gini index to obtain a subset of the comprehensive data set; The data set division is repeated for the comprehensive data set subset, and when the Gini index is less than a set threshold, the data set division is stopped to obtain the data risk level.

[0056] Preferably, the data set division is performed on the comprehensive data set based on the Gini index to obtain a comprehensive data set subset, including: Calculating the Gini index of the comprehensive data set, and selecting the feature with the smallest Gini index as a partitioning attribute; The comprehensive data set is segmented according to the segmentation attribute to obtain a comprehensive data set subset.

[0057] Preferably, the Gini index is calculated by the following formula: In the formula, For a comprehensive dataset; For the comprehensive data set samples; is the total number of samples.

[0058] Specifically, the initial step of classification is to divide the data set based on abnormal behavior data and access permission data. Abnormal behavior data is identified by the support vector machine model and reflects the problematic behavior in the industrial system; access permission data records the scope of user operation permissions on the system. These two types of data are integrated into a comprehensive data set through the union of set operations and used as the input of the decision tree model. The comprehensive data set combines behavioral anomalies and permission characteristics, and can more comprehensively reflect the risk characteristics of the data.

[0059] Next, the Gini index is used to guide the construction of the decision tree. First, the Gini index is calculated for each feature in the comprehensive data set (such as abnormal behavior type, operation permission level, etc.). The Gini index is an indicator of classification purity, which is used to determine which feature can best separate low-risk and target abnormal data. Specifically, the model selects the feature with the lowest Gini index as the partitioning attribute. Taking "access permission level" as an example, if the Gini index of this feature is the lowest, the decision tree will divide the data set according to the value of the permission level (such as "high permission", "medium permission", and "low permission") to generate multiple subsets. Each subset contains abnormal behavior data corresponding to a specific permission level.

[0060] Subsequently, the above division process is repeated for each subset. For each new subset, the Gini index of its internal features is calculated again, and the optimal features are selected for further division. This process continues until the set stop condition is met. In one achievable method, when the Gini index of a subset is lower than the set threshold, it means that the subset is pure enough and the division can be stopped. Through this recursive division, the comprehensive data set is gradually decomposed into multiple smaller subsets, each of which corresponds to a specific risk level.

[0061] It is worth noting that a lighter method can be used to process data with relatively low risks, which ensures data security while striking a balance between protecting resources and system efficiency. In one feasible way, the processing of low-risk data can be to desensitize the data to hide some sensitive information. This method can reduce the harm of data leakage without affecting normal use. In another feasible way, low-risk data can use a lightweight encryption algorithm (such as the symmetric encryption algorithm SM4) to ensure that it has basic confidentiality during transmission or storage without occupying too many computing resources. In another feasible way, by restricting access rights to low-risk data, only users or devices with the lowest permissions are authorized to access the data. For example, restrictions only allow reading of data, but do not allow modification or copying of data. This method can reduce the risk of data misuse or leakage.

[0062] In step S15, the data are sorted from high to low according to their risk levels, the abnormal behavior data with the highest ranking is determined as the target abnormal data, and it is determined whether the target abnormal data belongs to the abnormal database.

[0063] It is worth noting that the anomaly database is used to store data that is judged to be abnormal. This data is identified as abnormal behavior data through a machine learning model (support vector machine) and processed according to its risk level. If an abnormal data is determined to belong to the anomaly database, it will be encrypted using the historical key stored in it; if it does not belong, it will be encrypted based on a preset key space, and the data and the corresponding key will be stored in the anomaly database for future use.

[0064] It is worth noting that the anomaly database is also used to store historical keys related to abnormal data. When new abnormal behavior data is identified and determined to belong to the anomaly database, the system will call the stored historical keys to encrypt these data. This ensures that the encryption processing of abnormal data is more consistent and secure. The anomaly database not only helps the system identify and process abnormal data, but also improves the efficiency of data protection. When new abnormal data appears, the system can automatically determine whether it belongs to the anomaly database, and decide whether to call the historical key or generate a new key for encryption according to the situation. This automated processing method improves the system's response speed and protection strength.

[0065] In step S16, when it is determined that the target abnormal data belongs to the abnormal database, the historical key in the abnormal database is called, and the first encrypted data is generated based on the target abnormal data and the historical key.

[0066] Specifically, when the system determines that a certain data is abnormal data through a machine learning model or other security mechanism, it will check whether the abnormal data is already stored in the abnormal database. If the data already exists in the abnormal database, the system will call the historical keys related to the abnormal data from the database. These historical keys were previously used to encrypt similar or identical data and serve as a reference for data encryption. Next, the system will use the target abnormal data and historical keys for encryption processing. The target abnormal data and historical keys will be input into the encryption algorithm together to generate the first encrypted data.

[0067] In step S17, when it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key.

[0068] Preferably, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key, comprises: Calculating the Euclidean distance between the target abnormal data and the key in the key space; Sort the Euclidean distances by size, and select the key corresponding to the Euclidean distance with the largest value as the encryption and decryption key; The target abnormal data is encrypted according to the encryption / decryption key to generate second encrypted data.

[0069] Preferably, the Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula: In the formula, For the Target abnormal data; For the The first keys; For the The target abnormal data and The first The Euclidean distance between the keys.

[0070] It is worth noting that the key space refers to the set of all legal keys used for encryption and decryption. The key space includes discrete key space and continuous key space. Among them, discrete key space is common in symmetric encryption algorithms (such as SM4 symmetric encryption algorithm). The value of the key is a binary number of fixed length. For example, the key space size of a 128-bit key is 2 to the power of 128. In some specific applications, the key can be a set of real values, in which case it is a continuous key space. The size of the key space is an exponential growth of the number of bits of the encryption algorithm. For example, the size of a 128-bit key space is A key.

[0071] It is worth noting that the key space in the present invention refers to the set of all keys used for high-risk data encryption. In practical applications, this key space is defined as a multi-dimensional feature space, in which each key is composed of multiple feature values.

[0072] Specifically, if the target abnormal data does not belong to the abnormal database, the system will take another approach to protect the data. Specifically, the system will match the target abnormal data with a key in a preset "key space" to generate the second encrypted data. First, the system will calculate the Euclidean distance between the target abnormal data and each key in the key space. Euclidean distance is a way to measure the difference between two data points. Next, the system will sort all the calculated Euclidean distances and select the key corresponding to the Euclidean distance with the largest value. This means that the key farthest from the target abnormal data is the most appropriate key, and this choice ensures the effectiveness of the encryption process. Finally, based on this selected encryption and decryption key, the system will encrypt the target abnormal data to generate the second encrypted data.

[0073] In one possible implementation, the encryption algorithm can be a symmetric encryption algorithm (such as the SM4 symmetric encryption algorithm) or an asymmetric encryption algorithm (such as the SM2 asymmetric encryption algorithm). This process ensures the confidentiality of high-risk data during storage and transmission, preventing it from being accessed or tampered with by unauthorized access. It is worth noting that the process of decryption based on the key needs to use the same algorithm and key type as the encryption.

[0074] In step S18, the target abnormal data determined not to belong to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0075] Specifically, when the target abnormal data does not belong to the abnormal database, the system will match a suitable key for this data (usually the target key obtained by calculating the Euclidean distance, etc.). Then, the system will store this target abnormal data and its corresponding key according to its data risk level. After storing the target abnormal data and its corresponding key in the abnormal database, the system will be prepared for future abnormal behavior data judgments. Specifically, the next time new abnormal data is identified, the system will check whether the new data belongs to the existing data in the abnormal database. If the new data is similar or matches the target abnormal data in the database, the system will automatically use the previously stored target key to process the new data. This means that when similar abnormal data appears again, the system can use the stored key for encryption processing without recalculating the key or performing a complex matching process.

[0076] In summary, the present invention provides an industrial information data security protection method based on machine learning, comprising: obtaining industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of industrial information; identifying abnormal behavior on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; constructing a decision tree model according to the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level; sorting the data from high to low according to the data risk level, determining the abnormal behavior data with the highest sorting as the target abnormal data, and judging whether the target abnormal data belongs to an abnormal database; when it is determined that the target abnormal data belongs to the abnormal database, calling a historical key in the abnormal database, and generating first encrypted data based on the target abnormal data and the historical key; when it is determined that the target abnormal data does not belong to the abnormal database, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key; storing the target abnormal data and the corresponding key that are determined not to belong to the abnormal database in the abnormal database according to the data risk level, and using the key as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0077] In the present invention, the method can ensure that the system has accurate and timely information input when processing real-time data by obtaining industrial information data and access permission data and preprocessing the industrial information data. Then, based on the pre-trained support vector machine model, abnormal behavior recognition is performed on the real-time data set. By automatically identifying potential abnormal behavior data, abnormal activities can be quickly screened out from a large amount of industrial data. On the basis of abnormal behavior data recognition, a decision tree model is constructed in combination with access permission data, and the data is graded to achieve data risk level assessment. Further, determining whether to call a historical key or a key for encryption by judging whether the target abnormal data belongs to an abnormal database is an intelligent encryption strategy. For target abnormal data that already exists in the abnormal database, directly using the historical key to generate the first encrypted data can quickly and effectively encrypt and protect the data, avoiding the need to recalculate the encryption key each time the abnormal data needs to be processed, thereby improving encryption efficiency and system response speed. For target abnormal data that does not belong to the abnormal database, the second encrypted data is generated by matching the key in the preset key space. Finally, the target abnormal data that does not belong to the abnormal database and its key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database during the next abnormal behavior data judgment. In summary, the method improves the efficiency of encryption and ensures the security of data by combining abnormal data identification, risk classification and historical key management technical means.

[0078] Reference Figure 2 The second embodiment of the present invention provides an industrial information data security protection system based on machine learning, including: A data acquisition module, used to acquire industrial information data and access permission data; A data processing module, used for preprocessing the industrial information data to obtain a real-time data set of industrial information; An abnormality identification module, used to identify abnormal behavior of the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; A data classification module, used to construct a decision tree model based on the abnormal behavior data and the access permission data, and perform data classification to obtain a data risk level; An abnormality judgment module, used to sort the data from high to low according to the risk level of the data, determine the abnormal behavior data with the highest ranking as the target abnormal data, and judge whether the target abnormal data belongs to the abnormal database; A first encryption module, configured to, when determining that the target abnormal data belongs to an abnormal database, call a historical key in the abnormal database and generate first encrypted data based on the target abnormal data and the historical key; A second encryption module, configured to, when it is determined that the target abnormal data does not belong to the abnormal database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key; The key storage module is used to store the target abnormal data determined not to belong to the abnormal database and the corresponding key into the abnormal database according to the data risk level, and use the key as the existing data in the abnormal database when the next abnormal behavior data determination comes.

[0079] It should be noted that the industrial information data security protection system based on machine learning provided in an embodiment of the present invention is used to execute all the process steps of the industrial information data security protection method based on machine learning in the above-mentioned embodiment. The working principles and beneficial effects of the two correspond one to one, and therefore will not be repeated here.

[0080] An embodiment of the present invention further provides an electronic device. The electronic device includes: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a program for industrial information data security protection method based on machine learning. When the processor executes the computer program, the steps in the above-mentioned embodiments of the industrial information data security protection method based on machine learning are implemented, such as Figure 1Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are realized, such as the key storage module.

[0081] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the electronic device.

[0082] The electronic device may be a computing device such as a desktop computer, a notebook, a PDA, and a smart tablet. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. The electronic device may include more or fewer components than the above components, or may combine certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0083] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the electronic device, and uses various interfaces and lines to connect various parts of the entire electronic device.

[0084] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the electronic device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0085] Wherein, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0086] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0087] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for industrial information data security protection based on machine learning, characterized in that: include: Obtain industrial information data and access rights data; Preprocessing the industrial information data to obtain a real-time data set of industrial information; Based on the pre-trained support vector machine model, abnormal behavior recognition is performed on the real-time data set to obtain abnormal behavior data; According to the abnormal behavior data and the access permission data, a decision tree model is constructed, and data classification is performed to obtain a data risk level; Sort the data from high to low according to their risk levels, determine the abnormal behavior data with the highest ranking as target abnormal data, and determine whether the target abnormal data belongs to an abnormal database; When it is determined that the target abnormal data belongs to the abnormal database, calling the historical key in the abnormal database, and generating the first encrypted data based on the target abnormal data and the historical key; When it is determined that the target abnormal data does not belong to the abnormal database, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key; The target abnormal data determined not to belong to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database when the next abnormal behavior data determination comes; The step of matching a key in a preset key space according to the target abnormal data and generating second encrypted data based on the target abnormal data and the key includes: Calculating the Euclidean distance between the target abnormal data and the key in the key space; Sort the Euclidean distances by size, and select the key corresponding to the Euclidean distance with the largest value as the encryption and decryption key; The target abnormal data is encrypted according to the encryption / decryption key to generate second encrypted data.

2. The industrial information data security protection method based on machine learning according to claim 1 is characterized in that: The training process of the support vector machine includes: Access historical data sets of industrial information; Performing data mapping on the historical data set based on a kernel function to obtain a mapped data set; According to the mapped data set, the decision function of the support vector machine is solved based on the Lagrangian function, the hyperplane and the optimal classification to obtain a trained support vector machine model.

3. The industrial information data security protection method based on machine learning according to claim 1 is characterized in that: The step of constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level includes: According to the abnormal behavior data and the access permission data, data sets are divided to obtain an abnormal behavior data subset and a user access permission data subset; Combining the abnormal behavior data subset with the user access permission data subset to obtain a comprehensive data set; Dividing the comprehensive data set based on the Gini index to obtain a subset of the comprehensive data set; The data set division is repeated for the comprehensive data set subset, and when the Gini index is less than a set threshold, the data set division is stopped to obtain the data risk level.

4. The industrial information data security protection method based on machine learning according to claim 3 is characterized in that: The step of dividing the comprehensive data set based on the Gini index to obtain a comprehensive data set subset includes: Calculating the Gini index of the comprehensive data set, and selecting the feature with the smallest Gini index as a partitioning attribute; The comprehensive data set is segmented according to the segmentation attribute to obtain a comprehensive data set subset.

5. The industrial information data security protection method based on machine learning according to claim 4 is characterized in that: The Gini index is calculated using the following formula: In the formula, For a comprehensive dataset; For the comprehensive data set samples; is the total number of samples.

6. The industrial information data security protection method based on machine learning according to claim 1 is characterized in that: The Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula: In the formula, For the Target abnormal data; For the The first keys; For the The target abnormal data and The first The Euclidean distance between the keys.

7. An industrial information data security protection system based on machine learning, characterized in that: include: A data acquisition module, used to acquire industrial information data and access permission data; A data processing module, used for preprocessing the industrial information data to obtain a real-time data set of industrial information; An abnormality identification module, used to identify abnormal behavior of the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; A data classification module is used to construct a decision tree model based on the abnormal behavior data and the access permission data, and to perform data classification to obtain a data risk level; An abnormality judgment module, used to sort the data from high to low according to the risk level of the data, determine the abnormal behavior data with the highest ranking as the target abnormal data, and judge whether the target abnormal data belongs to the abnormal database; A first encryption module, configured to, when determining that the target abnormal data belongs to an abnormal database, call a historical key in the abnormal database and generate first encrypted data based on the target abnormal data and the historical key; A second encryption module, configured to, when it is determined that the target abnormal data does not belong to the abnormal database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key; A key storage module, used to store the target abnormal data determined not to belong to the abnormal database and the corresponding key into the abnormal database according to the data risk level, and use the key as the existing data in the abnormal database when the next abnormal behavior data determination comes; The step of matching a key in a preset key space according to the target abnormal data and generating second encrypted data based on the target abnormal data and the key includes: Calculating the Euclidean distance between the target abnormal data and the key in the key space; Sort the Euclidean distances by size, and select the key corresponding to the Euclidean distance with the largest value as the encryption and decryption key; The target abnormal data is encrypted according to the encryption / decryption key to generate second encrypted data.

8. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the industrial information data security protection method based on machine learning as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein, when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the industrial information data security protection method based on machine learning as described in any one of claims 1 to 6.

Images