Machine learning-based industrial information data security protection method and system

Abstract

The application relates to the technical field of data protection, and discloses an industrial information data security protection method and system based on machine learning. The method comprises the following steps: acquiring industrial information data and access permission data; pre-processing the industrial information data to obtain a real-time data set of the industrial information; performing abnormal behavior identification on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; constructing a decision tree model according to the abnormal behavior data and the access permission data to obtain a data risk level; determining target abnormal data according to the data risk level and judging whether the target abnormal data belongs to an abnormal database; when it is judged that the target abnormal data belongs to the abnormal database, a historical key is called to generate first encrypted data; and when it is judged that the target abnormal data does not belong to the abnormal database, a key in a key space is matched to generate second encrypted data. The method improves the efficiency of encryption and guarantees the security of data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data protection, and in particular to an industrial information data security protection method and system based on machine learning. BACKGROUND

[0002] With the deep integration of Internet technology and traditional manufacturing industry, the informatization and networking in the production field are developing rapidly, and information security problems are highlighted. Due to the high integration of automation and informatization of industrial processes, industrial control systems are vulnerable to intrusion and damage, leading to leakage, tampering, theft, and even serious safety accidents of confidential information. And with the application of Internet of Things technology in the industrial field, industrial data security faces more severe challenges. Therefore, an efficient encryption method for industrial data has become a problem to be solved.

[0003] In the existing encryption technology for industrial data, the existing encryption technology has high complexity, which brings many burdens to the industrial control system, directly affecting the system performance and operation efficiency. First of all, complex encryption algorithms often consume a large amount of computing resources, while industrial control systems usually run on resource-limited embedded devices or real-time systems. This resource competition may cause the key control tasks of the system (such as real-time monitoring and feedback control) to be unable to be completed efficiently, seriously affecting the response speed and control accuracy of the system. Secondly, the calculation complexity of these algorithms may significantly increase the delay, thereby reducing the real-time performance of the industrial control system, leading to control deviation and even unstable device operation. In addition, many encryption algorithms will greatly increase the data packet size when transmitting encrypted data, resulting in high communication bandwidth occupation, which may cause network bottlenecks and affect data synchronization and coordination between devices.

[0004] In summary, the complexity of the existing encryption technology not only increases the burden of the industrial control system, but also may seriously threaten the real-time performance, stability, economy, and maintainability of the system. SUMMARY

[0005] The present application provides an industrial information data security protection method and system based on machine learning, which can store new abnormal data and corresponding keys in the abnormal database, and the system gradually accumulates keys and abnormal data, optimizes future encryption and abnormal behavior identification, improves the efficiency of encryption, and ensures the security of data.

[0006] In the first aspect, to solve the above technical problems, the present application provides an industrial information data security protection method based on machine learning, comprising:

[0007] obtaining industrial information data and access permission data;

[0008] Preprocessing the industrial information data to obtain a real-time data set of industrial information;

[0009] Performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data;

[0010] According to the abnormal behavior data and the access permission data, a decision tree model is constructed, and data classification is performed to obtain a data risk level;

[0011] According to the data risk level from high to low, the highest ranked abnormal behavior data is determined as target abnormal data, and it is judged whether the target abnormal data belongs to an abnormal database;

[0012] When it is determined that the target abnormal data belongs to the abnormal database, the historical key in the abnormal database is called, and first encrypted data is generated based on the target abnormal data and the historical key;

[0013] When it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key;

[0014] The target abnormal data determined as not belonging to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as existing data in the abnormal database when the next abnormal behavior data is determined.

[0015] Preferably, the training process of the support vector machine comprises:

[0016] Obtaining a historical data set of industrial information;

[0017] Mapping the historical data set based on a kernel function to obtain a mapped data set;

[0018] According to the mapped data set, a decision function of the support vector machine is solved based on a Lagrange function, a hyperplane and an optimal classification to obtain a trained support vector machine model.

[0019] Preferably, according to the abnormal behavior data and the access permission data, a decision tree model is constructed, and data classification is performed to obtain a data risk level, comprising:

[0020] According to the abnormal behavior data and the access permission data, a data set is divided to obtain an abnormal behavior data subset and a user access permission data subset;

[0021] The abnormal behavior data subset and the user access permission data subset are set union to obtain a comprehensive data set;

[0022] performing dataset partitioning on the comprehensive dataset based on a Gini index to obtain a comprehensive dataset subset;

[0023] repeating the dataset partitioning on the comprehensive dataset subset, and stopping the dataset partitioning when the Gini index is less than a set threshold value to obtain a data risk level.

[0024] Preferably, the performing dataset partitioning on the comprehensive dataset based on a Gini index to obtain a comprehensive dataset subset comprises:

[0025] calculating the Gini index of the comprehensive dataset, and selecting a feature with the smallest Gini index as a partition attribute;

[0026] performing dataset partitioning on the comprehensive dataset according to the partition attribute to obtain a comprehensive dataset subset.

[0027] Preferably, the Gini index is calculated by the following formula:

[0028]

[0029] wherein, is a comprehensive dataset; is an i-th sample in the comprehensive dataset; is an i-th sample in the comprehensive dataset; is a total number of samples.

[0030] Preferably, the generating second encrypted data based on the target abnormal data and the key in the preset key space comprises:

[0031] calculating the Euclidean distance between the target abnormal data and the key in the key space;

[0032] sorting the Euclidean distances in size, and selecting the key corresponding to the Euclidean distance with the largest value as an encryption and decryption key;

[0033] performing data encryption on the target abnormal data according to the encryption and decryption key to generate second encrypted data.

[0034] Preferably, the Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula:

[0035]

[0036] wherein, is an i-th target abnormal data; is an i-th key in the i-th key space; is an i-th target abnormal data; is an i-th key in the i-th key space; is an i-th key in the i-th key space; and is an i-th key in the i-th key space. a target abnormal data and a Euclidean distance between a first key in a first key space and a second key in a second key space. a target abnormal data and a Euclidean distance between a first key in a first key space and a second key in a second key space. a target abnormal data and a Euclidean distance between a first key in a first key space and a second key in a second key space.

[0037] In a second aspect, the present application provides an industrial information data security protection system based on machine learning, comprising:

[0038] a data acquisition module, configured to acquire industrial information data and access permission data;

[0039] a data processing module, configured to pre-process the industrial information data to obtain a real-time data set of industrial information;

[0040] an abnormality identification module, configured to identify abnormal behavior of the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data;

[0041] a data classification module, configured to construct a decision tree model and perform data classification according to the abnormal behavior data and the access permission data to obtain a data risk level;

[0042] an abnormality judgment module, configured to sort the data risk level from high to low, determine the abnormal behavior data with the highest ranking as target abnormal data, and judge whether the target abnormal data belongs to an abnormal database;

[0043] a first encryption module, configured to, when it is judged that the target abnormal data belongs to the abnormal database, call a historical key in the abnormal database, and generate first encrypted data based on the target abnormal data and the historical key;

[0044] a second encryption module, configured to, when it is judged that the target abnormal data does not belong to the abnormal database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key;

[0045] a key storage module, configured to store the target abnormal data determined as not belonging to the abnormal database and the corresponding key in the abnormal database according to the data risk level, and use the key as existing data in the abnormal database when next abnormal behavior data is determined.

[0046] In a third aspect, the present application further provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the machine learning-based industrial information data security protection method of any one of the above.

[0047] In a fourth aspect, the present application also provides a computer readable storage medium comprising a stored computer program, wherein the computer program, when executed, controls a device in which the computer readable storage medium is located to perform the machine learning-based industrial information data security protection method according to any one of the preceding aspects.

[0048] Compared with the prior art, the present application has the following beneficial effects: the embodiments of the present application provide a machine learning-based industrial information data security protection method and system. The method comprises: obtaining industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of industrial information; performing abnormal behavior identification on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level; sorting the data risk level from high to low, determining the abnormal behavior data with the highest sorting as target abnormal data, and judging whether the target abnormal data belongs to an abnormal database; when it is determined that the target abnormal data belongs to the abnormal database, a historical key in the abnormal database is called, first encrypted data is generated based on the target abnormal data and the historical key; when it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, second encrypted data is generated based on the target abnormal data and the key; the target abnormal data determined as not belonging to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as existing data in the abnormal database when the next abnormal behavior data is determined.

[0049] In the present application, the method can ensure that the system has accurate and timely information input when processing real-time data by obtaining industrial information data and access permission data and preprocessing the industrial information data. Then, based on the pre-trained support vector machine model, the real-time data set is identified for abnormal behavior, and the potential abnormal behavior data is automatically identified, so that the abnormal activities can be quickly filtered out from a large amount of industrial data. On the basis of abnormal behavior data identification, a decision tree model is constructed in combination with access permission data, and the data is graded, so as to realize the evaluation of data risk level. Further, whether to call the historical key or the key for encryption is determined by judging whether the target abnormal data belongs to the abnormal database, which is an intelligent encryption strategy. For the target abnormal data already existing in the abnormal database, the first encrypted data is generated by using the historical key, which can quickly and effectively encrypt and protect the data, avoiding the need to recalculate the encryption key every time abnormal data occurs, thereby improving the encryption efficiency and system response speed. For the target abnormal data not belonging to the abnormal database, the second encrypted data is generated by matching the key in the preset key space. Finally, the target abnormal data not belonging to the abnormal database and the key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database in the next abnormal behavior data determination. In summary, the method improves the efficiency of encryption by combining abnormal data identification, risk grading and historical key management technology, while ensuring the security of data. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 is a flowchart of the industrial information data security protection method based on machine learning provided by the first embodiment of the present application;

[0051] Figure 2 is a structural schematic diagram of the industrial information data security protection system based on machine learning provided by the second embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0053] With reference to Figure 1 , the first embodiment of the present application provides an industrial information data security protection method based on machine learning, which comprises the following steps:

[0054] S11, obtaining industrial information data and access permission data.

[0055] S12, pre-processing the industrial information data to obtain a real-time data set of industrial information.

[0056] S13, performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data.

[0057] S14, constructing a decision tree model and performing data classification according to the abnormal behavior data and the access permission data to obtain a data risk level.

[0058] S15, sorting the data risk level from high to low, determining the abnormal behavior data with the highest sorting as target abnormal data, and judging whether the target abnormal data belongs to an abnormal database.

[0059] S16, when it is determined that the target abnormal data belongs to the abnormal database, a historical key in the abnormal database is called, and first encrypted data is generated based on the target abnormal data and the historical key.

[0060] S17, when it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key.

[0061] S18, storing the target abnormal data determined as not belonging to the abnormal database and the corresponding key in the abnormal database according to the data risk level, and using the key as existing data in the abnormal database when the next abnormal behavior data is determined.

[0062] It is worth noting that the main purpose of data encryption protection of industrial abnormal data is to ensure the confidentiality and integrity of sensitive information in the industrial system, prevent abnormal data from being maliciously tampered with, stolen or misused, and thus maintain the safety and stability of the entire industrial production process. Abnormal data generated by industrial control systems is often caused by system failure, equipment failure, external attack, internal operation error and other factors. These abnormal data not only have high security risks, but if not encrypted, they will become the target of hacker attacks or be maliciously manipulated, thereby causing serious impact on the production process, and even causing equipment damage or safety accidents. Therefore, encryption processing of abnormal data is an effective means to prevent these data from being illegally accessed or tampered with.

[0063] In order to facilitate the understanding of the present application, some preferred embodiments of the present application will be further described below.

[0064] In step S11, industrial information data and access permission data are obtained.

[0065] It is worth mentioning that industrial information data refers to all data related to industrial production and generated during the production process, including equipment state data, production process data, environmental monitoring data, sensor data, historical operation records, system performance data, etc. Specifically, these data are collected by various industrial control systems (such as PLC, SCADA system) in real time, reflecting the current running state of production lines, equipment and systems and their interaction with the environment. Industrial information data has high real-time, continuity and complexity, which needs to be used for real-time monitoring, process optimization, fault warning and other applications.

[0066] Specifically, industrial information data includes temperature, pressure, flow and other data collected by sensors, as well as operation data related to production scheduling, production efficiency, quality control, etc. Industrial systems are equipped with a large number of sensors to monitor physical quantities in the environment and production process, such as temperature, pressure, flow, humidity, pH value, gas concentration, etc. For example, sensors can monitor the steam temperature in a boiler or the pressure change in a liquid pipeline. These data are crucial to ensuring the safety of industrial processes.

[0067] Specifically, industrial information data also includes equipment operating state data, including information such as the start, stop and failure of equipment. For example, the working state data of an industrial equipment (such as motor, pump, valve, etc.), including whether the equipment is in running state, working frequency, load, vibration condition, etc. These data help to monitor the health status of equipment in real time and give early warning of possible failures.

[0068] Specifically, industrial information data also includes various operation data in the production process, such as the temperature, concentration, flow rate, reaction time, concentration and composition of materials. These data are very important for industrial production quality control, process optimization and adjustment. For example, in a chemical plant, the temperature, pressure and concentration data of chemical reactions in the reaction tower are extremely sensitive and need to be strictly monitored.

[0069] Specifically, in addition to the relevant data of equipment and materials, industrial information data also includes production line scheduling, process arrangement, operator operation records, etc. For example, the work task on a production line and the production task data of each operator. These data help managers optimize production scheduling, improve production efficiency and reduce downtime.

[0070] It is worth noting that in one possible implementation, the access permission data refers to the permission settings and related records that control access to industrial information data. Specifically, the access permission data includes detailed information on what operations each user or system entity (such as employees, managers, system administrators, devices or software programs, etc.) can perform within a specific time period. These operations include but are not limited to viewing data, modifying data, deleting data, setting alarms or making configurations, etc. The core function of access permission data is to define and manage who can access which data and effectively manage different permission levels. The management of access permission data can be based on user identity (such as workers, engineers, administrators, etc.) or based on role (such as different production lines, departments, projects, etc.). At the same time, access permission data also records access logs, detailing the user's access history to data (such as access time, access content, operation method, etc.). These logs not only help track and trace abnormal behavior, but also provide key evidence for security audits.

[0071] Specifically, in another possible implementation, the access permission data mainly refers to the security level data related to the access control of industrial information data. Specifically, access permission data determines which users or systems can access, view, modify or operate specific industrial information data. It includes detailed descriptions of security levels and permission configurations for data access. The specific content of access permission data can include the following aspects: access level and permission definition, each user or device is assigned a specific permission level, defining the type of data they can access and the operations they can perform. For example, an operator can only view data, while a manager can edit or modify data. The system ensures that users of different roles can only perform the operations they are authorized to perform based on the access permission data settings. Permission levels include: read-only (view), edit (edit), delete (delete), control (admin), and other different levels.

[0072] In step S12, the industrial information data is preprocessed to obtain a real-time data set of industrial information.

[0073] It is worth noting that the preprocessing of industrial information data refers to a series of operations on the original industrial data, aiming to clean, standardize and convert the data, so that it is suitable for further analysis, especially for preparing data for anomaly behavior recognition based on the support vector machine (SVM) model.

[0074] Specifically, data cleaning is performed first. Industrial information data comes from multiple sensors and devices, and there are missing values, outliers or duplicate data. The purpose of data cleaning is to fix these problems to ensure the accuracy and consistency of the data. Among them, the problem of missing values is due to sensor failure, network problems or data transmission errors, and some data points are missing. Exemplary, deleting missing data (if the missing values are few), or filling in missing values with mean, median, interpolation, etc. are common ways to deal with missing value problems. Industrial data sometimes contains outliers due to device failure or external interference. For example, if the temperature data suddenly jumps to an unusually high value, it indicates a sensor failure. Outliers can be identified and processed by statistical analysis (such as Z-score, box plot, etc.), such as rejection, correction or labeling. In multiple data sources or sensors, redundant data can be caused by duplicate records. These redundant data need to be removed during preprocessing to ensure the uniqueness of the data set.

[0075] Specifically, since industrial information data often comes from different types of sensors and devices, their dimensions are different (such as temperature, pressure, flow, etc.). In order to enable the machine learning model to effectively process these data, the data must be converted to a unified standard range. A common method is to standardize each feature to have a zero mean and unit variance (Z-score standardization). This is crucial for model training, especially for distance-based algorithms such as support vector machines (SVM), as they are sensitive to the scale of features. In certain cases, it is necessary to scale the data to a specific range (e.g. [0, 1]). Normalization can avoid bias caused by large differences in feature values when processing certain specific data.

[0076] Specifically, in industrial information data, there are many irrelevant or redundant features, which not only occupy computing resources, but also affect the effectiveness of the model. Therefore, feature selection or extraction is crucial in the preprocessing stage. Through correlation analysis, principal component analysis (PCA), information gain method, the most relevant features to the target task are selected. For example, some temperature data is related to production failure, while other non-critical sensor data can be ignored. Sometimes the information in the original data is not enough for direct and effective analysis. At this time, new features can be generated through aggregation, difference, smoothing techniques. For example, trend, periodicity, mean, standard deviation statistical features can be extracted from time series data.

[0077] Specifically, the support vector machine model requires input data to be numerical and standardized, therefore, all preprocessing steps (such as feature extraction, standardization, normalization, etc.) need to ensure that the data can be directly input into the support vector machine. Exemplary, for large-scale data sets, dimensionality reduction processing is also required to reduce the amount of calculation and improve the training efficiency of the model.

[0078] It is worth noting that the pre-processed real-time data set will be a standardized, non-missing value, non-outlier, feature-selected and extracted high-quality data set. This data set will be used for anomaly behavior recognition based on a trained support vector machine (SVM) model. The SVM model will identify abnormal behavior patterns in the data, such as device failure, system attack, operation error, etc., based on these data, and generate corresponding abnormal behavior data. Therefore, the purpose of preprocessing is to ensure that the input real-time data set can be effectively learned by the SVM model through steps such as cleaning, conversion, standardization and feature selection, and to improve the accuracy and generalization ability of the model, providing high-quality data support for subsequent anomaly behavior detection.

[0079] In step S13, the real-time data set is subjected to anomaly behavior recognition based on the pre-trained support vector machine model, and abnormal behavior data is obtained.

[0080] Preferably, the training process of the support vector machine comprises:

[0081] Obtaining a historical data set of industrial information;

[0082] Mapping the historical data set based on a kernel function to obtain a mapped data set;

[0083] According to the mapped data set, solving the decision function of the support vector machine based on the Lagrange function, hyperplane and optimal classification to obtain a trained support vector machine model.

[0084] Specifically, the training process of the vector machine first needs to collect a historical data set of industrial information data, which includes device operation data, sensor data and production process data. These data are used as the training set of the support vector machine model and are the basis for the model to identify abnormal behavior. The historical data set helps the model understand the patterns of normal and abnormal behavior and provides actual and representative samples for subsequent training.

[0085] It is worth noting that the kernel function (Kernel Function) is used in the support vector machine to map data from the original space to a higher-dimensional feature space, which can handle non-linearly separable cases. By using the kernel function, the support vector machine can find the optimal classification hyperplane in the high-dimensional space, even if the original data set cannot be separated in the low-dimensional space. This step maps the historical data set to convert the data into a form more suitable for classification.

[0086] Specifically, the decision function of the support vector machine is the core part of the support vector machine training based on the Lagrange function, hyperplane and optimal classification. Through the Lagrange multiplier method, the support vector machine can find the optimal hyperplane in the high-dimensional feature space, which can maximize the classification boundary, so that the data of different categories (normal and abnormal behavior) can be best separated. The training process includes calculating the optimal classification function, so that the model can correctly predict the category of new data.

[0087] It is worth noting that the optimal classification function is a decision function used in support vector machines (SVM) to effectively separate data of different categories. The core goal is to find a "hyperplane" that can separate data points of different categories and has the largest margin distance, that is, the distance from the hyperplane to the nearest sample point (called support vector) between two categories of data points. This "optimal" decision function can ensure the highest accuracy and generalization ability when classifying new data.

[0088] Specifically, after obtaining the mapped data set, an optimization problem is constructed based on the Lagrange function, the goal is to maximize the interval of the classification boundary, and the constraint condition yi(w·xi+ b)≥ 1 is introduced to ensure the correctness of the classification result. By optimizing the Lagrange function, the original constraint optimization problem is converted into a dual problem. The objective function of the dual problem is based on the inner product calculation of the samples in the historical data set, while introducing the definition of the hyperplane to find the optimal classification surface. After solving the dual problem, the sample points corresponding to the non-zero Lagrange multipliers are the support vectors, which are the key to constructing the classification decision function. Finally, based on the optimization result, the classification decision function of the SVM is generated, which is used for real-time data set anomaly behavior identification. The specific decision function form is:

[0089]

[0090] where, is the optimized Lagrange multiplier, is the kernel function, is the offset of the classification hyperplane.

[0091] It is worth noting that after obtaining the decision function, the model needs to be evaluated on an independent data set (validation set or test set) to check its accuracy, recall rate and generalization ability in actual anomaly behavior identification. When the accuracy of the model meets the preset requirements, such as reaching the preset error threshold, the trained support vector machine model can be obtained.

[0092] In step S14, a decision tree model is constructed according to the abnormal behavior data and the access permission data, and data classification is performed to obtain a data risk level.

[0093] It is worth noting that the decision tree model is a tree structure-based classification or regression algorithm. Its core idea is to divide the data set into multiple subsets through the splitting conditions of features, so as to classify or predict the data. Each splitting node represents a test condition of a feature, and the leaf node represents a classification result or a regression value. Common splitting criteria include Gini index, information gain, and mean square error, etc. In the present application, the decision tree model is used to combine the abnormal behavior data and the access permission data for data classification. The decision tree identifies and distinguishes data of different risk levels by combining the abnormal behavior data and the access permission data. The abnormal behavior data is extracted from the real-time data set by the pre-trained support vector machine model, and the access permission data reflects the operation permission of the user. The decision tree comprehensively analyzes these two types of data to determine the risk level of the data.

[0094] Preferably, the construction of the decision tree model according to the abnormal behavior data and the access permission data, and the data classification to obtain the data risk level comprises:

[0095] According to the abnormal behavior data and the access permission data, the data set is divided to obtain an abnormal behavior data subset and a user access permission data subset;

[0096] The abnormal behavior data subset and the user access permission data subset are set-union to obtain a comprehensive data set;

[0097] The comprehensive data set is divided based on the Gini index to obtain a comprehensive data set subset;

[0098] The comprehensive data set subset is repeatedly divided, and when the Gini index is less than a set threshold, the division of the data set is stopped to obtain a data risk level.

[0099] Preferably, the division of the comprehensive data set based on the Gini index to obtain a comprehensive data set subset comprises:

[0100] The Gini index of the comprehensive data set is calculated, and the feature with the smallest Gini index is selected as the division attribute;

[0101] The comprehensive data set is divided based on the division attribute to obtain a comprehensive data set subset.

[0102] Preferably, the Gini index is calculated by the following formula:

[0103]

[0104] wherein, is the comprehensive dataset; is the i-th sample in the comprehensive dataset; is the i-th sample in the comprehensive dataset; is the total number of samples.

[0105] Specifically, the initial step of the hierarchical process is to divide the dataset based on the abnormal behavior data and the access permission data. The abnormal behavior data is identified by a support vector machine model, reflecting the problematic behaviors in the industrial system; the access permission data records the scope of the user's operation permissions on the system. These two types of data are integrated into a comprehensive dataset through set operation union, serving as the input of the decision tree model. The comprehensive dataset combines behavior abnormalities and permission characteristics, and can more comprehensively reflect the risk characteristics of the data.

[0106] Next, the construction of the decision tree is guided by the Gini index. First, the Gini index of each feature (such as abnormal behavior type, operation permission level, etc.) in the comprehensive dataset is calculated. The Gini index is an indicator to measure the purity of classification, used to determine which feature can best separate low-risk and target abnormal data. Specifically, the model selects the feature with the lowest Gini index as the division attribute. Taking "access permission level" as an example, if the Gini index of this feature is the lowest, the decision tree will divide the dataset according to the value of the permission level (such as "high permission", "medium permission", "low permission"), generating multiple subsets. Each subset contains abnormal behavior data corresponding to a specific permission level.

[0107] Subsequently, the above division process is repeated for each subset. For each new subset, the Gini index of its internal features is calculated again, and the optimal feature is selected for further division. This process continues until the set stop condition is met. In one implementable way, when the Gini index of a subset is lower than a set threshold, it indicates that the subset is already pure enough and the division can be stopped. Through this recursive division, the comprehensive dataset is gradually decomposed into multiple smaller subsets, each corresponding to a specific risk level.

[0108] It is worth noting that for the processing of relatively low-risk data, a lighter method can be adopted to ensure data security and balance between protecting resources and system efficiency. The processing of low-risk data, in one implementable manner, can be desensitization of the data to hide part of the sensitive information. This way can reduce the harm of data leakage, while not affecting normal use. In another implementable manner, low-risk data can use a lightweight encryption algorithm (such as symmetric encryption algorithm SM4) to ensure its basic confidentiality during transmission or storage without occupying too many computing resources. In yet another implementable manner, by limiting the access rights to low-risk data, only the least privileged users or devices are authorized to access these data. For example, it is limited to allow reading data, but not allowing modification or copying of data. This way can reduce the risk of misuse or leakage of data.

[0109] In step S15, the abnormal behavior data is sorted according to the risk level from high to low, and the highest ranked abnormal behavior data is determined as the target abnormal data, and it is judged whether the target abnormal data belongs to the abnormal database.

[0110] It is worth noting that the abnormal database is used to store data that is determined to be abnormal. These data are identified as abnormal behavior data by machine learning model (support vector machine) and processed according to their risk level. If an abnormal data is determined to belong to the abnormal database, it will be encrypted using the historical key stored therein; if not, it will be encrypted based on a preset key space, and the data and the corresponding key will be stored in the abnormal database for future use.

[0111] It is worth noting that the abnormal database is also used to store the historical key related to the abnormal data. When new abnormal behavior data is identified and determined to belong to the abnormal database, the system will call the stored historical key to encrypt these data. This way can ensure that the encryption processing of abnormal data is more consistent and secure. The abnormal database not only helps the system to identify and process abnormal data, but also improves the efficiency of data protection. When new abnormal data appears, the system can automatically judge whether it belongs to the abnormal database, and decide whether to call the historical key or generate a new key for encryption according to the situation. This automated processing method improves the response speed and protection strength of the system.

[0112] In step S16, when it is determined that the target abnormal data belongs to the abnormal database, the historical key in the abnormal database is called, and the first encrypted data is generated based on the target abnormal data and the historical key.

[0113] Specifically, when the system determines that certain data is abnormal data through a machine learning model or other security mechanism, it checks whether the abnormal data has been stored in the abnormal database. If the data already exists in the abnormal database, the system will call the historical key related to the abnormal data from the database. These historical keys were previously used to encrypt similar types or the same data and serve as a reference for data encryption. Next, the system will use the target abnormal data and the historical key for encryption processing. The target abnormal data and the historical key will be input into the encryption algorithm together to generate first encrypted data.

[0114] In step S17, when it is determined that the target abnormal data does not belong to the abnormal database, a key in a preset key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key.

[0115] Preferably, the matching of the key in the preset key space according to the target abnormal data and the generation of the second encrypted data based on the target abnormal data and the key comprise:

[0116] calculating the Euclidean distance between the target abnormal data and the key in the key space;

[0117] sorting the Euclidean distances by size, and selecting the key corresponding to the Euclidean distance with the largest value as the encryption and decryption key;

[0118] encrypting the target abnormal data according to the encryption and decryption key to generate second encrypted data.

[0119] Preferably, the Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula:

[0120]

[0121] wherein, is the i-th target abnormal data; is the i-th key in the j-th key space; is the Euclidean distance between the i-th target abnormal data and the k-th key in the j-th key space.

[0122] ​​​​​​It is worth noting that the key space refers to the set of all legal keys used for encryption and decryption, including discrete key space and continuous key space. Among them, the discrete key space is common in symmetric encryption algorithms (such as SM4 symmetric encryption algorithm), and the value of the key is a fixed length binary number, for example, the key space size of a 128-bit key is 2 raised to the power of 128. In some specific applications, the key can be a set of real values, which is a continuous key space. The size of the key space is exponentially increased with the number of bits of the encryption algorithm. For example, the size of a 128-bit key space is

[0123] It is worth noting that the key space in the present application refers to the set of all keys used for high-risk data encryption. In practical applications, this key space is defined as a multi-dimensional feature space, where each key is composed of multiple feature values.

[0124] Specifically, if the target abnormal data does not belong to the abnormal database, the system will take another way to protect these data. Specifically, the system will match the target abnormal data with a key in a preset "key space" to generate second encrypted data. First, the system calculates the Euclidean distance between the target abnormal data and each key in the key space. Euclidean distance is a way to measure the difference between two data points. Next, the system sorts all the calculated Euclidean distances and selects the key corresponding to the largest Euclidean distance. This means that the key farthest from the target abnormal data is the most suitable key, and such selection ensures the effectiveness of the encryption process. Finally, based on this selected encryption and decryption key, the system will encrypt the target abnormal data to generate second encrypted data.

[0125] In an implementable manner, the encryption algorithm can be a symmetric encryption algorithm (such as SM4 symmetric encryption algorithm) or an asymmetric encryption algorithm (such as SM2 asymmetric encryption algorithm). This process ensures the confidentiality of high-risk data during storage and transmission, preventing unauthorized access or tampering. It is worth noting that the decryption process based on the key needs to use the same algorithm and key type as encryption.

[0126] In step S18, the target abnormal data and the corresponding key that are determined not to belong to the abnormal database are stored in the abnormal database according to the data risk level, and the key is used as existing data in the abnormal database when the next abnormal behavior data is determined.

[0127] ​Specifically, when the target abnormal data does not belong to the abnormal database, the system matches a suitable key (usually the target key obtained by calculating the Euclidean distance, etc.) for these data. Then, the system stores the target abnormal data and its corresponding key according to its data risk level. After storing the target abnormal data and its corresponding key in the abnormal database, the system prepares for future abnormal behavior data determination. Specifically, when new abnormal data is identified next time, the system checks whether the new data belongs to the existing data in the abnormal database. If the new data is similar or matched to the target abnormal data in the database, the system automatically uses the previously stored target key to process the new data. This means that when similar abnormal data appears again, the system can use the stored key for encryption processing without the need to recalculate the key or perform a complex matching process.

[0128] In summary, the present application provides an industrial information data security protection method based on machine learning, which includes: obtaining industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of industrial information; identifying abnormal behavior based on a pre-trained support vector machine model on the real-time data set to obtain abnormal behavior data; constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level; sorting the data risk level from high to low, determining the highest ranked abnormal behavior data as target abnormal data, and determining whether the target abnormal data belongs to an abnormal database; when it is determined that the target abnormal data belongs to the abnormal database, a historical key in the abnormal database is called, and first encrypted data is generated based on the target abnormal data and the historical key; when it is determined that the target abnormal data does not belong to the abnormal database, a key in a pre-set key space is matched according to the target abnormal data, and second encrypted data is generated based on the target abnormal data and the key; the target abnormal data determined not to belong to the abnormal database and the corresponding key are stored in the abnormal database according to the data risk level, and the key is used as existing data in the abnormal database when the next abnormal behavior data determination arrives.

[0129] In the present application, the method can ensure that the system has accurate and timely information input when processing real-time data by obtaining industrial information data and access permission data and preprocessing the industrial information data. Then, based on the pre-trained support vector machine model, the real-time data set is identified for abnormal behavior, and the potential abnormal behavior data is automatically identified, which can quickly filter out abnormal activities from a large amount of industrial data. On the basis of abnormal behavior data identification, a decision tree model is constructed in combination with access permission data, and the data is graded, so as to realize the evaluation of data risk level. Further, whether to call the historical key or the key for encryption is determined by judging whether the target abnormal data belongs to the abnormal database, which is an intelligent encryption strategy. For the target abnormal data already existing in the abnormal database, the first encrypted data is generated by using the historical key, which can quickly and effectively encrypt and protect the data, avoiding the need to recalculate the encryption key every time abnormal data occurs, thereby improving the encryption efficiency and system response speed. For the target abnormal data not belonging to the abnormal database, the second encrypted data is generated by matching the key in the preset key space. Finally, the target abnormal data not belonging to the abnormal database and the key are stored in the abnormal database according to the data risk level, and the key is used as the existing data in the abnormal database in the next abnormal behavior data determination. In summary, the method improves the efficiency of encryption by combining abnormal data identification, risk grading and historical key management technology, while ensuring the security of data.

[0130] Reference Figure 2 The second embodiment of the present application provides an industrial information data security protection system based on machine learning, comprising:

[0131] A data acquisition module is configured to acquire industrial information data and access permission data.

[0132] A data processing module is configured to preprocess the industrial information data to obtain a real-time data set of industrial information.

[0133] An abnormality identification module is configured to identify abnormal behavior of the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data.

[0134] A data grading module is configured to construct a decision tree model based on the abnormal behavior data and the access permission data, and grade the data to obtain a data risk level.

[0135] An abnormality judgment module is configured to sort the data risk level from high to low, determine the abnormal behavior data with the highest ranking as target abnormal data, and judge whether the target abnormal data belongs to an abnormal database.

[0136] The first encryption module is configured to, when determining that the target abnormal data belongs to the abnormal database, call a historical key in the abnormal database, and generate first encrypted data based on the target abnormal data and the historical key.

[0137] The second encryption module is configured to, when determining that the target abnormal data does not belong to the abnormal database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key.

[0138] The key storage module is configured to store the target abnormal data determined as not belonging to the abnormal database and the corresponding key in the abnormal database according to the data risk level, and use the key as existing data in the abnormal database when next abnormal behavior data is determined.

[0139] It should be noted that the industrial information data security protection system based on machine learning provided by the embodiments of the present application is used to execute all process steps of the industrial information data security protection method based on machine learning provided by the above embodiments, and the working principles and beneficial effects of the two are one-to-one correspondence, so they will not be repeated.

[0140] The embodiments of the present application also provide an electronic device. The electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, such as an industrial information data security protection method based on machine learning program. The processor implements the steps in each of the above industrial information data security protection method embodiments based on machine learning when executing the computer program, such as Figure 1 The steps S11 shown. Alternatively, the processor implements the functions of each module / unit in each of the above device embodiments when executing the computer program, such as the key storage module.

[0141] For example, the computer program can be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present application. The one or more modules / units can be a series of computer program instruction segments that can complete a specific function, which are used to describe the execution process of the computer program in the electronic device.

[0142] The electronic device can be a desktop computer, a notebook, a palm computer, and a smart tablet, etc. The electronic device can include, but is not limited to, a processor, a memory. Those skilled in the art can understand that the above components are only examples of the electronic device and do not constitute a limitation on the electronic device, and can include more or fewer components than the above, or combine certain components, or different components, for example, the electronic device can also include an input / output device, a network access device, a bus, etc.

[0143] The processor can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like, and is a control center of the electronic device, which connects various parts of the electronic device through various interfaces and lines.

[0144] The memory can be used to store the computer programs and / or modules, and the processor realizes various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and calling data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required by a function (such as a sound playing function, an image playing function, etc.), etc.; and the data storage area can store data created according to use of the electronic device (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a nonvolatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash storage device, or other volatile solid-state storage device.

[0145] The modules / units integrated in the electronic device, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. The computer program can implement the steps of each method embodiment when executed by a processor. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium, etc. that can carry the computer program code. It should be noted that the contents included in the computer readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer readable medium does not include electrical carrier signals and telecommunication signals.

[0146] It should be noted that the above-described device embodiments are only schematic, and the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment. In addition, the connection relationship between the modules in the device embodiment provided by the present application indicates that there is a communication connection between them, which can be realized as one or more communication buses or signal lines. Those skilled in the art can understand and implement it without creative labor.

[0147] The above-described specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above-described specific embodiments are only for the specific embodiments of the present application and are not used to limit the protection scope of the present application. It is particularly pointed out that any modification, equivalent replacement, improvement, etc. made by those skilled in the art within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A machine learning-based industrial information data security protection method, characterized by, The method comprises the following steps: acquiring industrial information data and access permission data; preprocessing the industrial information data to obtain a real-time data set of industrial information; performing abnormal behavior recognition on the real-time data set based on a pre-trained support vector machine model to obtain abnormal behavior data; constructing a decision tree model based on the abnormal behavior data and the access permission data, and performing data classification to obtain a data risk level; sorting the data risk level from high to low, determining the abnormal behavior data with the highest ranking as target abnormal data, and judging whether the target abnormal data belongs to an abnormal database; when it is determined that the target abnormal data belongs to the abnormal database, calling a historical key in the abnormal database, and generating first encrypted data based on the target abnormal data and the historical key; when it is determined that the target abnormal data does not belong to the abnormal database, matching a key in a preset key space according to the target abnormal data, and generating second encrypted data based on the target abnormal data and the key; storing the target abnormal data determined as not belonging to the abnormal database and the corresponding key in the abnormal database according to the data risk level, and using the key as existing data in the abnormal database when the next abnormal behavior data is determined; wherein the matching of the key in the preset key space according to the target abnormal data, and the generation of the second encrypted data based on the target abnormal data and the key, comprise: calculating the Euclidean distance between the target abnormal data and the key in the key space; sorting the Euclidean distances by size, and selecting the key corresponding to the largest Euclidean distance as the encryption and decryption key; encrypting the target abnormal data according to the encryption and decryption key to generate the second encrypted data; the construction of the decision tree model based on the abnormal behavior data and the access permission data, and the data classification to obtain the data risk level, comprise: performing data set division based on the abnormal behavior data and the access permission data to obtain an abnormal behavior data subset and a user access permission data subset; performing set union on the abnormal behavior data subset and the user access permission data subset to obtain a comprehensive data set; performing data set division on the comprehensive data set based on the Gini index to obtain a comprehensive data set subset; repeatedly performing data set division on the comprehensive data set subset, and stopping the data set division when the Gini index is less than a set threshold to obtain the data risk level; the Euclidean distance between the target abnormal data and the key in the key space is calculated by the following formula: ； wherein is the target anomaly data; is the key space; is the key; is the target anomaly data and the key in the key space; the key space is a set of all keys for high-risk data encryption, including discrete key space and continuous key space. 2.The machine learning based industrial information data security protection method of claim 1, wherein, The training process of the support vector machine comprises: acquiring a historical data set of industrial information; performing data mapping on the historical data set based on a kernel function to obtain a mapped data set; based on the mapped data set, solving the decision function of the support vector machine based on the Lagrange function, the hyperplane and the optimal classification to obtain the trained support vector machine model. 3.The industrial information data security protection method based on machine learning according to claim 1, characterized in that, The Gini index-based dataset partitioning on the comprehensive dataset obtains a comprehensive dataset subset, comprising: calculating the Gini index of the comprehensive dataset, and selecting the feature with the smallest Gini index as the partition attribute; performing dataset segmentation on the comprehensive dataset according to the partition attribute to obtain a comprehensive dataset subset. 4.The method of claim 3, wherein, The Gini index is calculated by the following formula: ； wherein is the comprehensive dataset; is the i-th sample in the comprehensive dataset; is the i-th sample in the comprehensive dataset; is the total number of samples.

5. A machine learning based industrial information data security protection system for implementing the machine learning based industrial information data security protection method according to any one of claims 1 to 4, characterized in that, comprising: a data acquisition module configured to acquire industrial information data and access permission data; a data processing module configured to preprocess the industrial information data to obtain a real-time dataset of industrial information; an anomaly identification module configured to identify abnormal behaviors of the real-time dataset based on a pre-trained support vector machine model to obtain abnormal behavior data; a data classification module configured to construct a decision tree model according to the abnormal behavior data and the access permission data, and perform data classification to obtain a data risk level; an anomaly judgment module configured to sort the data risk level from high to low, determine the abnormal behavior data with the highest ranking as target abnormal data, and judge whether the target abnormal data belongs to an anomaly database; a first encryption module configured to, when it is determined that the target abnormal data belongs to the anomaly database, call a historical key in the anomaly database, and generate first encrypted data based on the target abnormal data and the historical key; a second encryption module configured to, when it is determined that the target abnormal data does not belong to the anomaly database, match a key in a preset key space according to the target abnormal data, and generate second encrypted data based on the target abnormal data and the key; a key storage module configured to store the target abnormal data determined as not belonging to the anomaly database and the corresponding key in the anomaly database according to the data risk level, and use the key as existing data in the anomaly database when next abnormal behavior data is determined; wherein, the matching of the key in the preset key space according to the target abnormal data, and the generation of the second encrypted data based on the target abnormal data and the key, comprise: calculating the Euclidean distance between the target abnormal data and the key in the key space; sorting the Euclidean distances by size, and selecting the key corresponding to the largest Euclidean distance as the encryption and decryption key; performing data encryption on the target abnormal data according to the encryption and decryption key to generate the second encrypted data.

6. An electronic device, comprising: comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the machine learning-based industrial information data security protection method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the machine learning-based industrial information data security protection method according to any one of claims 1 to 4 when the computer program is running.

Images