Security situation awareness method and platform in industrial Internet environment

Abstract

The present invention discloses a security situation awareness method and platform in an industrial Internet environment, and relates to the relevant fields of industrial Internet security situation awareness. The method includes: fixed-point monitoring and collecting operation data of multiple welding equipment in an automated production line; fixed-point collection of communication data of multiple welding equipment; based on the equipment-flow anomaly association map, performing time-space alignment and abnormal linkage analysis according to multiple equipment state feature sets and multiple communication flow feature sets, and generating risk warning signals if double anomalies exist; continuously receiving monitoring data in a predetermined time zone, and performing abnormal location and feature analysis on the monitoring data to construct an abnormal distribution topology; performing potential attack risk identification, and outputting potential attack modes and potential risk levels. The method solves the technical problems of insufficient timeliness, comprehensiveness and accuracy of security situation awareness in the existing industrial Internet environment, and achieves the technical effect of improving the timeliness, comprehensiveness and accuracy of risk identification.

Description

Technical Field

[0001] The present application relates to fields related to security situation awareness of the industrial Internet, and in particular, to a security situation awareness method and platform in an industrial Internet environment. Background Art

[0002] As a product of the deep integration of new-generation information technology and manufacturing, the Industrial Internet is leading the manufacturing industry towards intelligent, networked, and service-oriented development. In the Industrial Internet environment, automated production lines are widely deployed, and various types of equipment are interconnected, generating a large amount of data information. These data contain rich information on the operation status and security situation of the production line, but at the same time, they also bring unprecedented challenges to security monitoring. Existing methods often only focus on a single data source and ignore the inherent connection between different data sources. This leads to the inability to timely discover potential security risks during anomaly detection, making it difficult to fully and accurately grasp the security situation of the production line.

[0003] Among the current related technologies, security situation awareness in the industrial Internet environment has technical problems such as lack of timeliness, comprehensiveness and accuracy. Summary of the invention

[0004] This application provides a security situation awareness method and platform in an industrial Internet environment. It uses equipment monitoring units and traffic monitoring units to collect the operation data and communication traffic data of multiple welding equipment in an automated production line, integrate and process them, and transmit them to a cloud server. On the cloud server, based on the equipment-traffic anomaly association map, the equipment operation data and communication traffic data are time-space aligned and analyzed for anomaly linkage. If a double anomaly is detected, a risk warning signal is generated and sent to the front-line management platform. At the same time, the monitoring data within the predetermined time zone is continuously received, anomaly location and feature analysis are performed, and an anomaly distribution topology is constructed. According to the anomaly distribution topology, machine learning and other technologies are used to identify potential attack risks, and technical means such as outputting potential attack modes and potential risk levels are used to achieve the technical effect of quickly identifying potential risks and improving the timeliness, comprehensiveness and accuracy of risk identification.

[0005] The present application provides a security situation awareness method in an industrial Internet environment, including: through an equipment monitoring unit, fixed-point monitoring and collecting operation data of multiple welding equipment in an automated production line, obtaining multiple equipment status feature sets and transmitting them to a cloud server; through a traffic monitoring unit, fixed-point collecting communication data of the multiple welding equipment, obtaining multiple communication traffic feature sets and transmitting them to a cloud server; on the cloud server, based on a device-traffic anomaly association map, performing spatiotemporal alignment and anomaly linkage analysis according to the multiple equipment status feature sets and the multiple communication traffic feature sets, if there are double anomalies, generating a risk warning signal and sending it to a front-line management platform; if the risk warning signal is not 0, continuously receiving monitoring data within a predetermined time zone, performing anomaly location and feature analysis on the monitoring data, and constructing an anomaly distribution topology; identifying potential attack risks according to the anomaly distribution topology, and outputting potential attack modes and potential risk levels as security situation awareness results.

[0006] In a possible implementation, a device-traffic anomaly association map is constructed, and the following processing is performed: the operation log of the automated production line is retrieved, and a sample device anomaly feature set and traffic anomaly features under different sample device anomaly features are collected to obtain multiple sample traffic anomaly feature sets; according to the sample device anomaly feature set and the multiple sample traffic anomaly feature sets, an equipment anomaly-traffic anomaly association analysis is performed respectively, and the analysis results are summarized and deduplicated to determine multiple device anomaly feature types and multiple traffic anomaly feature type sets, wherein the traffic anomaly feature type is identified with an associated frequency; based on the associated frequency, the multiple traffic anomaly feature type sets are screened according to a predetermined associated threshold to obtain multiple high-frequency traffic anomaly feature type sets, and the device-traffic anomaly association map is constructed in combination with the multiple device anomaly feature types.

[0007] In a possible implementation, time-space alignment and abnormal linkage analysis are performed based on the multiple equipment status feature sets and the multiple communication flow feature sets. If there is a double abnormality, a risk warning signal is generated, and the following processing is performed: the multiple equipment status feature sets and the multiple communication flow feature sets are aligned in the time domain and the frequency domain, and multiple monitoring feature sets of multiple welding equipment are integrated to obtain; based on the equipment-flow abnormality association map, the multiple monitoring feature sets are identified for abnormal linkage. If the same equipment has repeated abnormalities in the equipment status and the mapped communication flow under the same monitoring node, it is identified as an abnormal equipment and a risk warning signal is generated.

[0008] In a possible implementation, the monitoring data within a predetermined time zone is continuously received, and anomalies are located and features are analyzed on the monitoring data to construct an abnormal distribution topology, and the following processing is performed: the device status features and communication traffic features of multiple monitoring nodes within the predetermined time zone are continuously received, and multiple monitoring data sets are summarized to obtain; based on the device-traffic anomaly association map, anomaly linkage identification is performed on the multiple monitoring data sets to obtain multiple abnormal device sets under multiple monitoring nodes; the multiple abnormal device sets are visually identified according to a predetermined plan to generate the abnormal distribution topology.

[0009] In a possible implementation, the multiple abnormal equipment sets are visually identified according to a predetermined scheme to generate the abnormal distribution topology, and the following processing is performed: the welding equipment distribution characteristics of the automated production line are obtained, and the welding equipment distribution characteristics are mapped to a two-dimensional space to generate an abnormal equipment distribution topology; the abnormal positions and abnormal frequencies of the multiple abnormal equipment sets are read to obtain multiple abnormal positions and multiple abnormal frequencies corresponding to the multiple abnormal positions; the abnormal positions are used as pixels and the abnormal frequencies are used as grayscale values ​​of the pixels, and the abnormal equipment distribution topology is identified according to the multiple abnormal positions and the multiple abnormal frequencies, and an abnormal distribution map is generated and set as the abnormal distribution topology.

[0010] In a possible implementation, potential attack risks are identified according to the abnormal distribution topology, potential attack patterns and potential risk levels are output, and the following processing is performed: the operation log of the automated production line is retrieved, and multiple sample abnormal distribution topologies are obtained after processing, and the sample attack patterns and sample risk levels of different sample abnormal distribution topologies within a historical time range are obtained to obtain a sample abnormal distribution topology set, a sample attack pattern set, and a sample risk level set; N risk identification operators are configured, wherein the risk identification operator includes at least a BP neural network, a random forest, and a support vector machine, and N is an integer greater than 2; the sample abnormal distribution topology set, the sample attack pattern set, and the sample risk level set are used as training data, and are divided into N equal parts to obtain N training sets; the N risk identification operators are supervised and trained using the N training sets, and a risk identification plug-in is integrated to construct; the risk identification plug-in is used to identify potential attack risks for the abnormal distribution topology, and output potential attack patterns and potential risk levels.

[0011] In a possible implementation, the N risk identification operators are supervised and trained using the N training sets, and a risk identification plug-in is integrated to perform the following processing: the N risk identification operators are supervised and trained using the N training sets until convergence, and N risk identification branches and N identification accuracies are obtained; based on the principle of integrated learning, the N risk identification branches are fused according to the N identification accuracies to generate the risk identification plug-in.

[0012] The present application also provides a security situation awareness platform in an industrial Internet environment, including: an equipment operation data acquisition module, the equipment operation data acquisition module is used to monitor and collect the operation data of multiple welding equipment in an automated production line through an equipment monitoring unit, obtain multiple equipment status feature sets and transmit them to a cloud server; an equipment communication data acquisition module, the equipment communication data acquisition module is used to collect the communication data of the multiple welding equipment through a flow monitoring unit, obtain multiple communication flow feature sets and transmit them to a cloud server; an abnormal linkage analysis module, the abnormal linkage analysis module is used to perform spatiotemporal alignment and abnormal linkage analysis on the cloud server based on the equipment-flow abnormality association map, according to the multiple equipment state feature sets and the multiple communication flow feature sets, if there are double abnormalities, a risk warning signal is generated and sent to a front-line management platform; an abnormal distribution topology construction module, the abnormal distribution topology construction module is used to continuously receive monitoring data in a predetermined time zone if the risk warning signal is not 0, and perform abnormal location and feature analysis on the monitoring data to construct an abnormal distribution topology; a potential attack risk identification module, the potential attack risk identification module is used to identify potential attack risks according to the abnormal distribution topology, and output potential attack modes and potential risk levels as security situation awareness results.

[0013] The security situation awareness method and platform in the industrial Internet environment proposed in this application are firstly to monitor and collect the operation data of multiple welding equipment in the automated production line through the equipment monitoring unit, obtain multiple equipment status feature sets and transmit them to the cloud server, and then collect the communication data of multiple welding equipment through the traffic monitoring unit, obtain multiple communication traffic feature sets and transmit them to the cloud server, and then on the cloud server, based on the equipment-traffic anomaly association map, perform spatiotemporal alignment and anomaly linkage analysis according to multiple equipment status feature sets and multiple communication traffic feature sets. If there are double anomalies, a risk warning signal is generated and sent to the front-line management platform. If the risk warning signal is not 0, the monitoring data within the predetermined time zone is continuously received, and the monitoring data is anomaly located and feature analyzed to construct an anomaly distribution topology. Finally, the potential attack risk is identified according to the anomaly distribution topology, and the potential attack mode and potential risk level are output as the security situation awareness result, thereby achieving the technical effect of quickly identifying potential risks and improving the timeliness, comprehensiveness and accuracy of risk identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in this application to illustrate the operations performed by the platform according to the embodiment of the present application. It should be understood that the previous or following operations are not necessarily performed precisely in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0015] Figure 1 A flow chart of a security situation awareness method in an industrial Internet environment provided in an embodiment of the present application.

[0016] Figure 2 A schematic diagram of the structure of the security situation awareness platform in the industrial Internet environment provided in the embodiment of the present application.

[0017] Explanation of the reference numerals: device operation data collection module 10 , device communication data collection module 20 , abnormal linkage analysis module 30 , abnormal distribution topology construction module 40 , potential attack risk identification module 50 . DETAILED DESCRIPTION

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0019] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0020] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions. For example, a process, method, platform, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0021] The present application embodiment provides a security situation awareness method in an industrial Internet environment, such as Figure 1 As shown, the method includes:

[0022] Step S100, through the equipment monitoring unit, fixed-point monitoring and collection of operating data of multiple welding equipment in the automated production line, obtain multiple equipment status feature sets and transmit them to the cloud server. Specifically, through the equipment monitoring unit deployed in the automated production line, multiple welding equipment are monitored at fixed points. Among them, the equipment monitoring unit is used to monitor the operating status of the equipment, and can collect the operating data of the equipment in real time or regularly, such as key parameters such as current, temperature, and pressure. The multiple welding equipment includes different types of welding machines, welding robots, etc. The equipment monitoring unit organizes the collected data into an equipment status feature set (a data set containing various status characteristics generated by the equipment during operation, such as current value, temperature value, pressure value, etc.), and transmits it to the cloud server in real time or regularly through wired or wireless means for subsequent analysis.

[0023] Step S200, the communication data of the plurality of welding devices are collected at fixed points through the flow monitoring unit, and a plurality of communication flow feature sets are obtained and transmitted to the cloud server. Specifically, the communication data of the plurality of welding devices are collected at fixed points through the flow monitoring unit (used to monitor the network communication flow, capable of collecting communication data in real time or periodically), including communication flow features such as data packet size, transmission rate, abnormal instructions, connection duration, etc. These features are organized into a communication flow feature set (a data set containing various flow features generated by the device during the communication process, such as data packet size, transmission rate, etc.), and are also transmitted to the cloud server in real time or periodically through wired or wireless means.

[0024] Step S300, on the cloud server, based on the device-traffic anomaly association map, the multiple device status feature sets and the multiple communication traffic feature sets are subjected to time-space alignment and abnormal linkage analysis. If there is a double abnormality, a risk warning signal is generated and sent to the front-line management platform. Specifically, on the cloud server, based on the pre-built device-traffic anomaly association map (a map used to represent the association relationship between device anomalies and communication traffic anomalies), the received device status feature set and communication traffic feature set are subjected to time-space alignment and abnormal linkage analysis, including time-space alignment of the two to ensure consistency in time and space, and according to the device-traffic anomaly association map, by analyzing the abnormal association between device status and communication traffic, possible security risks are identified. If the same device has repeated abnormalities in device status and communication traffic at the same monitoring node, it is identified as an abnormal device, and a risk warning signal is generated and sent to the front-line management platform.

[0025] In one possible implementation, a device-traffic anomaly association map is constructed, and step S300 further includes step S310, retrieving the operation log of the automated production line, collecting sample device abnormality feature sets, and traffic abnormality features under different sample device abnormality features, and obtaining multiple sample traffic abnormality feature sets. Specifically, historical data is retrieved from the operation log of the automated production line, which records the operation status and communication activities of the production line equipment. Sample device abnormality feature sets are screened out from these historical data, and these feature sets represent the performance of the equipment under different abnormal conditions, such as excessive temperature, excessive current, etc. At the same time, for each sample device abnormality feature set, the traffic abnormality features related thereto are collected, including changes in the size of data packets, abnormal transmission rates, the appearance of abnormal instructions, and abnormal connection duration.

[0026] Step S320, according to the sample device abnormality feature set and the multiple sample traffic abnormality feature sets, respectively, perform device abnormality-traffic abnormality association analysis, and summarize and remove duplicates of the analysis results to determine multiple device abnormality feature types and multiple traffic abnormality feature type sets, wherein the traffic abnormality feature type identifier has an associated frequency. Specifically, an association analysis is performed on each sample device abnormality feature set and the corresponding traffic abnormality feature, specifically to identify the specific manifestation of the abnormal state of the device layer in the traffic layer, such as frequent sending of control commands and changes in data packet size caused by temperature abnormality, and traffic surges, repeated sending of data packets, abnormal instruction transmission, etc. caused by current / voltage abnormality. The analysis results are summarized and duplicates are removed to determine multiple device abnormality feature types and multiple traffic abnormality feature type sets related thereto. When determining the traffic abnormality feature type, the association frequency of each type with the device abnormality feature is also recorded, that is, the number of times the corresponding traffic abnormality type appears when the device is abnormal, which is used to evaluate the degree of association between the traffic abnormality and the device abnormality.

[0027] Step S330, based on the association frequency, the plurality of traffic anomaly feature type sets are screened according to a predetermined association threshold, a plurality of high-frequency traffic anomaly feature type sets are obtained, and the device-traffic anomaly association map is constructed in combination with the plurality of device anomaly feature types. Specifically, according to the association frequency, the plurality of traffic anomaly feature type sets are screened according to a predetermined association threshold (a threshold for screening high-frequency traffic anomaly feature types to ensure that only traffic anomaly features highly correlated with device anomalies are retained), and only those traffic anomaly feature type sets with an association frequency higher than the threshold are retained. The high-frequency traffic anomaly feature type set obtained by screening and the plurality of device anomaly feature types are combined to construct a device-traffic anomaly association map. This map shows the association relationship between device anomalies and traffic anomalies, and is used to guide subsequent anomaly monitoring and risk warning. This implementation method realizes the linkage monitoring and analysis of device anomalies and traffic anomalies by constructing a device-traffic anomaly association map, which helps to more accurately identify potential security risks and improve the accuracy and timeliness of security situation awareness.

[0028] In a possible implementation, time-space alignment and abnormal linkage analysis are performed according to the multiple equipment state feature sets and the multiple communication flow feature sets. If there is a double abnormality, a risk warning signal is generated. Step S300 further includes step S340, which performs time domain alignment and frequency domain alignment on the multiple equipment state feature sets and the multiple communication flow feature sets, and integrates multiple monitoring feature sets of multiple welding equipment. Specifically, the equipment state feature set (such as current, temperature, pressure and other data) collected by the equipment monitoring unit and the communication flow feature set (such as data packet size, transmission rate, abnormal instructions, etc.) collected by the flow monitoring unit are aligned in the time dimension, that is, a common time reference point or time window is determined to ensure that the equipment state and communication flow data are collected in the same time period. On the basis of time domain alignment, frequency domain alignment is further performed, that is, data is aligned in the frequency dimension. For data that is periodic or has specific frequency characteristics, such as the operating status of some equipment fluctuates with the fluctuation of the production cycle, and the communication flow also presents similar periodic changes, the frequency domain alignment is used to identify these frequency characteristics. After completing the time domain and frequency domain alignment, the equipment status feature set and the communication traffic feature set are integrated together to form multiple monitoring feature sets for multiple welding equipment. These feature sets contain comprehensive information on the equipment status and communication traffic, providing a basis for subsequent abnormal linkage identification.

[0029] Step S350, based on the device-traffic anomaly association map, the multiple monitoring feature sets are identified by abnormal linkage. If the same device has repeated abnormalities in the device state and the mapped communication traffic under the same monitoring node, it is identified as an abnormal device and a risk warning signal is generated. Specifically, based on the device-traffic anomaly association map, the integrated monitoring feature set is identified by abnormal linkage, the association between the device state and the communication traffic is analyzed, and it is determined whether there is a repeated abnormality. Specifically, if the device state and the mapped communication traffic of the same device under the same monitoring node (the device or location set for data collection in the automated production line) show abnormalities (such as the device temperature is too high and the abnormal transmission of the control command occurs at the same time), the device is identified as an abnormal device. Once the abnormal device is identified, a risk warning signal is immediately generated, which contains information such as the identification of the abnormal device, the type of abnormality, and the time when the abnormality occurs, and is sent to the front-line management platform so that timely measures can be taken to respond. This implementation method ensures the consistency of the device state and communication traffic data in time and space through time domain and frequency domain alignment, providing an accurate data basis for abnormal linkage identification. At the same time, abnormal linkage identification based on the equipment-traffic anomaly correlation map can accurately identify potential security risks, improve the accuracy and timeliness of security situation awareness, help to promptly discover and respond to security issues such as equipment failures or network attacks, and ensure the smooth progress of industrial production.

[0030] Step S400, if the risk warning signal is not 0, continue to receive monitoring data within a predetermined time zone, and perform abnormal location and feature analysis on the monitoring data to construct an abnormal distribution topology. Specifically, if the risk warning signal is not 0, continue to receive the device status feature set and communication traffic feature set within the predetermined time zone. Perform abnormal location on the received monitoring data to determine the specific location and time of the abnormality. Perform in-depth analysis on the abnormal data, extract abnormal features, and construct an abnormal distribution topology, which is a topological map used to represent the distribution of abnormal devices or abnormal data in the system.

[0031] In one possible implementation, the monitoring data within a predetermined time zone is continuously received, and the monitoring data is anomaly located and feature analyzed to construct an abnormal distribution topology. Step S400 further includes step S410, which continuously receives the device status characteristics and communication flow characteristics of multiple monitoring nodes within the predetermined time zone, and summarizes multiple monitoring data sets. Specifically, when the risk warning signal is not 0, data from multiple monitoring nodes within the automated production line is continuously received. The device status characteristics and communication flow characteristics are filtered out from the received data, and these characteristics reflect the operating status and communication status of the equipment. The filtered feature data are summarized according to the monitoring nodes and time sequence to form multiple monitoring data sets. Each monitoring data set contains the device status characteristics and communication flow characteristics of a specific monitoring node within a specific time period.

[0032] Step S420, based on the device-traffic anomaly association map, the multiple monitoring data sets are subjected to abnormal linkage identification, and multiple abnormal device sets under multiple monitoring nodes are obtained. Specifically, the device-traffic anomaly association map is used to perform abnormal linkage identification on multiple monitoring data sets to detect whether there are double anomalies. According to the results of abnormal linkage identification, the devices with abnormalities are screened out to form multiple abnormal device sets, each of which contains devices with abnormalities under a specific monitoring node. Step S430, the multiple abnormal device sets are visually identified according to a predetermined scheme to generate the abnormal distribution topology. Specifically, a visualization scheme is designed, including determining the identification method of abnormal devices, the presentation method of abnormal distribution topology, etc. According to the visualization scheme, multiple abnormal device sets are identified, for example, different abnormal devices can be distinguished by color, shape, size, etc. The identified abnormal device sets are laid out according to the positional relationship of the monitoring nodes to generate an abnormal distribution topology, which intuitively shows the distribution of abnormal devices in the automated production line. This implementation method intuitively shows the distribution of abnormal devices in the automated production line by generating an abnormal distribution topology, providing intuitive information support for decision makers.

[0033] In a possible implementation, the plurality of abnormal equipment sets are visually identified according to a predetermined scheme to generate the abnormal distribution topology. Step S430 further includes step S431, obtaining the distribution characteristics of welding equipment of the automated production line, and mapping the distribution characteristics of the welding equipment to a two-dimensional space to generate the abnormal equipment distribution topology. Specifically, the distribution information of the welding equipment of the automated production line is collected, including the physical location, type, connection relationship, etc. of the equipment. Through a geographic information system (GIS) or a customized two-dimensional layout map, these distribution information are mapped to a two-dimensional space, in which each welding equipment is assigned a unique coordinate. According to the coordinates and connection relationship of the equipment, an abnormal equipment distribution topology reflecting the actual layout of the welding equipment is generated. This topology map not only shows the physical location of the equipment, but also includes the communication path and connection relationship between the equipment. Step S432, read the abnormal positions and abnormal frequencies of the plurality of abnormal equipment sets, and obtain a plurality of abnormal positions, and a plurality of abnormal frequencies corresponding to the plurality of abnormal positions. Specifically, the abnormal position information of each abnormal equipment is extracted from the plurality of abnormal equipment sets, and the position information corresponds to the coordinates in the two-dimensional space generated in step S431. For each abnormal location, the frequency of abnormalities occurring in a predetermined time zone is counted by analyzing the monitoring data set, that is, the number of times the abnormality occurs. The extracted abnormal location information and the statistical abnormal frequency are sorted to form a list or data set containing multiple abnormal locations and corresponding frequencies.

[0034] Step S433, taking the abnormal position as a pixel point and the abnormal frequency as the grayscale value of the pixel point, marking the abnormal equipment distribution topology according to the multiple abnormal positions and the multiple abnormal frequencies, and generating an abnormal distribution map as the abnormal distribution topology. Specifically, each abnormal position is regarded as a pixel point and is located in the abnormal equipment distribution topology. According to the abnormal frequency of each abnormal position, a grayscale value is assigned to it, wherein the higher the abnormal frequency, the larger the grayscale value. Using image processing technology, the abnormal equipment distribution topology is converted into an image format and colored according to the grayscale value of each pixel point. In this way, an abnormal distribution map reflecting the abnormal distribution is generated. The generated abnormal distribution map is displayed to relevant personnel so that they can quickly identify, locate and analyze abnormal situations. This implementation method uses image processing technology to convert complex abnormal data into intuitive images, simplifies the data analysis process, and enables relevant personnel to quickly identify and understand abnormal situations, thereby improving the intuitiveness and efficiency of abnormal analysis.

[0035] Step S500, identify potential attack risks according to the abnormal distribution topology, and output potential attack patterns and potential risk levels as security situation awareness results. Specifically, based on the abnormal distribution topology, identify potential attack risks through algorithms or models, determine potential attack patterns (characteristics and rules of potential attack behaviors) and potential risk levels (levels for quantitatively evaluating potential attack risks, used to assess the severity and urgency of attacks). Output potential attack patterns and potential risk levels as security situation awareness results for subsequent processing by the frontline management platform. The embodiment of the present application utilizes an equipment monitoring unit and a traffic monitoring unit to respectively collect the operation data and communication traffic data of multiple welding equipment in the automated production line, integrate and process them, and transmit them to a cloud server. On the cloud server, based on the equipment-traffic anomaly association map, the equipment operation data and the communication traffic data are time-space aligned and analyzed for anomaly linkage. If a double anomaly is detected, a risk warning signal is generated and sent to the front-line management platform. At the same time, the monitoring data within the predetermined time zone is continuously received, anomaly location and feature analysis are performed, and an anomaly distribution topology is constructed. According to the anomaly distribution topology, machine learning and other technologies are used to identify potential attack risks, and technical means such as outputting potential attack modes and potential risk levels are used, thereby achieving the technical effect of quickly identifying potential risks and improving the timeliness, comprehensiveness and accuracy of risk identification.

[0036] In a possible implementation, potential attack risks are identified according to the abnormal distribution topology, and potential attack patterns and potential risk levels are output. Step S500 further includes step S510, retrieving the operation log of the automated production line, obtaining multiple sample abnormal distribution topologies after processing, and obtaining sample attack patterns and sample risk levels of different sample abnormal distribution topologies within the historical time range, and obtaining sample abnormal distribution topology sets, sample attack pattern sets, and sample risk level sets. Specifically, historical data is retrieved from the operation log system of the automated production line, and these logs record the operating status, communication data, fault alarms, and other information of the equipment. The retrieved log data is preprocessed, including data cleaning (removing invalid or redundant data), data conversion (converting log data into a format that can be used for analysis), and data alignment (ensuring that data from different sources are consistent in time). According to the preprocessed data, abnormal equipment, abnormal location, and abnormal frequency are identified, and this information is mapped into a two-dimensional space to form a visual abnormal distribution map, and multiple sample abnormal distribution topologies are constructed. For each sample abnormal distribution topology, the related sample attack mode (attack method or behavior pattern that has occurred in history and is related to the specific abnormal distribution topology) and sample risk level (risk level assigned to the specific abnormal distribution topology and attack mode based on historical experience and data analysis) are obtained from historical records.

[0037] Step S520, configure N risk identification operators, wherein the risk identification operators include at least BP neural network, random forest and support vector machine, and N is an integer greater than 2. Specifically, select N risk identification operators, which are algorithms or models for identifying potential attack risks and outputting attack modes and risk levels, and can be machine learning algorithms (such as BP neural network, random forest, support vector machine, etc.) or other intelligent algorithms. Necessary parameters are configured for each risk identification operator, such as learning rate, number of iterations, number of decision trees, etc., which affect the performance and accuracy of the operator.

[0038] Step S530, the sample abnormal distribution topology set, the sample attack pattern set and the sample risk level set are used as training data and divided into N equal parts to obtain N training sets. Specifically, the sample abnormal distribution topology set, the sample attack pattern set and the sample risk level set are integrated into a complete training data set. Using methods such as random sampling or stratified sampling, the integrated training data set is divided into N equal parts, each of which contains complete abnormal distribution topology, attack pattern and risk level information.

[0039] Step S540, supervise the N risk identification operators using the N training sets, and integrate and construct a risk identification plug-in. Specifically, use N training sets to train the N risk identification operators respectively. During the training process, each operator attempts to learn the mapping relationship from abnormal distribution topology to attack mode and risk level. The performance and accuracy of each operator are evaluated by cross-validation and other methods. Integrate the well-performing risk identification operators into a plug-in that can receive new abnormal distribution topology as input and output potential attack mode and risk level.

[0040] Step S550, using the risk identification plug-in, identify the potential attack risks of the abnormal distribution topology, and output the potential attack mode and potential risk level. Specifically, the new abnormal distribution topology is passed as input data to the risk identification plug-in, and the risk identification operator in the plug-in processes and analyzes the input data, and outputs the potential attack mode and risk level, and outputs the prediction results to relevant personnel or systems in the form of text, charts, etc. This implementation method integrates multiple risk identification operators, takes advantage of the advantages of different algorithms, and improves the accuracy of potential attack risk identification.

[0041] In a possible implementation, the N risk identification operators are supervised and trained using the N training sets, and a risk identification plug-in is integrated and constructed. Step S540 further includes step S541, wherein the N risk identification operators are supervised and trained using the N training sets until convergence, and N risk identification branches and N identification accuracies are obtained. Specifically, the prepared N training sets are respectively assigned to the N risk identification operators, and each training set contains a set of sample abnormal distribution topology, sample attack pattern set and sample risk level set, which are used to train the corresponding risk identification operator. Each risk identification operator is supervised and trained. During the training process, each operator attempts to learn the mapping relationship from sample abnormal distribution topology to sample attack pattern and sample risk level. The training process continuously adjusts the parameters of the operator to minimize the error between the predicted result and the actual result. The training continues until the convergence condition is met. The convergence condition includes that the training error reaches a preset threshold, the performance on the validation set no longer improves, etc. When the convergence condition is met, it is determined that the risk identification operator has learned to extract useful features from the abnormal distribution topology and can accurately predict potential attack patterns and risk levels. After the training is completed, each risk identification operator will generate a risk identification branch to identify potential attack risks for new abnormal distribution topologies. At the same time, the recognition accuracy of each risk identification branch on the training set or validation set is calculated to evaluate its performance.

[0042] Step S542, based on the principle of ensemble learning, the N risk identification branches are fused according to the N identification accuracies to generate the risk identification plug-in. Specifically, according to the level of identification accuracy, the branch with higher identification accuracy is selected as the final risk identification model, or different weights are assigned according to the identification accuracy of each branch, and multiple branches are weightedly fused. The selected branches or weighted fused branches are integrated into a plug-in to form the final risk identification plug-in. This plug-in can receive a new abnormal distribution topology as input and output potential attack modes and risk levels. This implementation method utilizes the advantages of different algorithms by integrating multiple risk identification operators. Each operator can extract different features from the abnormal distribution topology and fuse these features through ensemble learning, thereby improving the accuracy of potential attack risk identification.

[0043] In the above, refer to Figure 1 The security situation awareness method in the industrial Internet environment according to the embodiment of the present invention is described in detail. Figure 2 A security situation awareness platform in an industrial Internet environment according to an embodiment of the present invention is described.

[0044] The security situation awareness platform in the industrial Internet environment according to the embodiment of the present invention is used to solve the technical problems of insufficient timeliness, comprehensiveness and accuracy of security situation awareness in the existing industrial Internet environment, so as to achieve the technical effect of quickly identifying potential risks and improving the timeliness, comprehensiveness and accuracy of risk identification. The security situation awareness platform in the industrial Internet environment includes: an equipment operation data acquisition module 10, an equipment communication data acquisition module 20, an abnormal linkage analysis module 30, an abnormal distribution topology construction module 40, and a potential attack risk identification module 50.

[0045] The equipment operation data acquisition module 10 is used for fixed-point monitoring and collection of operation data of multiple welding equipment in the automated production line, and obtains multiple equipment status feature sets and transmits them to the cloud server; the equipment communication data acquisition module 20 is used for fixed-point collection of communication data of the multiple welding equipment, and obtains multiple communication traffic feature sets and transmits them to the cloud server; the abnormal linkage analysis module 30 is used to perform spatiotemporal alignment and abnormal linkage analysis on the cloud server based on the equipment-traffic anomaly association map according to the multiple equipment status feature sets and the multiple communication traffic feature sets. If there are double anomalies, a risk warning signal is generated and sent to the front-line management platform; the abnormal distribution topology construction module 40 is used to continuously receive monitoring data within a predetermined time zone if the risk warning signal is not 0, and perform abnormal location and feature analysis on the monitoring data to construct an abnormal distribution topology; the potential attack risk identification module 50 is used to identify potential attack risks according to the abnormal distribution topology, and output potential attack modes and potential risk levels as security situation awareness results.

[0046] The specific configuration of the abnormal linkage analysis module 30 will be described in detail below. As described above, based on the equipment-traffic anomaly association map, the abnormal linkage analysis module 30 can further include: a sample abnormality feature acquisition unit for retrieving the operation log of the automated production line, collecting the sample equipment abnormality feature set, and the traffic abnormality features under different sample equipment abnormality features, and obtaining multiple sample traffic abnormality feature sets; a correlation analysis unit for performing equipment abnormality-traffic abnormality correlation analysis based on the sample equipment abnormality feature set and the multiple sample traffic abnormality feature sets, and summarizing and deduplicating the analysis results, determining multiple equipment abnormality feature types, and multiple traffic abnormality feature type sets, wherein the traffic abnormality feature type identifier has an associated frequency; a screening unit for screening the multiple traffic abnormality feature type sets based on the associated frequency and according to a predetermined associated threshold, obtaining multiple high-frequency traffic abnormality feature type sets, and constructing the equipment-traffic abnormality association map in combination with the multiple equipment abnormality feature types.

[0047] Among them, time-space alignment and abnormal linkage analysis are performed according to the multiple equipment status feature sets and the multiple communication flow feature sets. If there is a double abnormality, a risk warning signal is generated. The abnormal linkage analysis module 30 may further include: an alignment unit is used to perform time domain alignment and frequency domain alignment on the multiple equipment status feature sets and the multiple communication flow feature sets, and integrate them to obtain multiple monitoring feature sets of multiple welding equipment; an abnormal linkage identification unit is used to perform abnormal linkage identification on the multiple monitoring feature sets based on the equipment-flow abnormality association map. If the same equipment has repeated anomalies in the equipment status and mapped communication flow under the same monitoring node, it is identified as an abnormal equipment and a risk warning signal is generated.

[0048] The specific configuration of the abnormal distribution topology construction module 40 will be described in detail below. As described above, the monitoring data within a predetermined time zone is continuously received, and the abnormal location and feature analysis of the monitoring data are performed to construct the abnormal distribution topology. The abnormal distribution topology construction module 40 may further include: a monitoring data set acquisition unit is used to continuously receive the device status characteristics and communication flow characteristics of multiple monitoring nodes within a predetermined time zone, and summarize to obtain multiple monitoring data sets; an abnormal linkage identification unit is used to perform abnormal linkage identification on the multiple monitoring data sets based on the device-flow abnormality association map, and obtain multiple abnormal device sets under multiple monitoring nodes; a visual identification unit is used to visually identify the multiple abnormal device sets according to a predetermined scheme, and generate the abnormal distribution topology.

[0049] Among them, the multiple abnormal equipment sets are visually identified according to a predetermined scheme to generate the abnormal distribution topology, and the visualization identification unit may further include: an abnormal equipment distribution topology generation unit is used to obtain the welding equipment distribution characteristics of the automated production line, and map the welding equipment distribution characteristics to a two-dimensional space to generate an abnormal equipment distribution topology; a data reading unit is used to read the abnormal positions and abnormal frequencies of the multiple abnormal equipment sets to obtain multiple abnormal positions and multiple abnormal frequencies corresponding to the multiple abnormal positions; an abnormal identification unit is used to use abnormal positions as pixel points and abnormal frequencies as grayscale values ​​of pixel points, identify the abnormal equipment distribution topology according to the multiple abnormal positions and multiple abnormal frequencies, and generate an abnormal distribution map set as the abnormal distribution topology.

[0050] Next, the specific configuration of the potential attack risk identification module 50 will be described in detail. As described above, potential attack risks are identified according to the abnormal distribution topology, and potential attack patterns and potential risk levels are output. The potential attack risk identification module 50 may further include: a sample data acquisition unit is used to retrieve the operation log of the automated production line, and after processing, multiple sample abnormal distribution topologies are obtained, and sample attack patterns and sample risk levels of different sample abnormal distribution topologies within a historical time range are obtained to obtain a sample abnormal distribution topology set, a sample attack pattern set, and a sample risk level set; a risk identification operator configuration unit is used to configure N risk identification operators, wherein the risk identification operator includes at least a BP neural network, a random forest, and a support vector machine, and N is an integer greater than 2; a training set acquisition unit is used to use the sample abnormal distribution topology set, the sample attack pattern set, and the sample risk level set as training data, and divide them into N equal parts to obtain N training sets; a supervised training unit is used to use the N training sets to perform supervised training on the N risk identification operators, and integrate and construct a risk identification plug-in; a potential attack risk identification unit is used to use the risk identification plug-in to identify potential attack risks on the abnormal distribution topology, and output potential attack patterns and potential risk levels.

[0051] Among them, the N risk identification operators are supervised and trained using the N training sets, and a risk identification plug-in is integrated to construct the supervised training unit, and the supervised training unit may further include: a risk identification branch acquisition unit is used to perform supervised training on the N risk identification operators using the N training sets until convergence, and obtain N risk identification branches and N identification accuracies; a risk identification plug-in generation unit is used to fuse the N risk identification branches according to the N identification accuracies based on the principle of integrated learning to generate the risk identification plug-in.

[0052] The security situation awareness platform in the industrial Internet environment provided by the embodiment of the present invention can execute the security situation awareness method in the industrial Internet environment provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0053] Although the present application makes various references to certain modules in the platform according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be implemented; in addition, the specific names of the functional modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0054] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A security situation awareness method in an industrial Internet environment, characterized in that: Methods include: Through the equipment monitoring unit, the operation data of multiple welding equipment in the automated production line is collected and monitored at fixed points, and multiple equipment status feature sets are obtained and transmitted to the cloud server; The communication data of the plurality of welding devices are collected at fixed points through a flow monitoring unit, and a plurality of communication flow feature sets are obtained and transmitted to a cloud server; On the cloud server, based on the device-traffic anomaly association graph, time-space alignment and anomaly linkage analysis are performed according to the multiple device status feature sets and the multiple communication traffic feature sets. If there are double anomalies, a risk warning signal is generated and sent to the front-line management platform; If the risk warning signal is not 0, the monitoring data within the predetermined time zone is continuously received, and abnormality positioning and feature analysis are performed on the monitoring data to construct an abnormal distribution topology; Identify potential attack risks based on the abnormal distribution topology, and output potential attack patterns and potential risk levels as security situation awareness results; Build a device-traffic anomaly correlation map, including: Retrieve the operation log of the automated production line, collect the sample equipment abnormality feature set, and the flow abnormality features under different sample equipment abnormality features, and obtain multiple sample flow abnormality feature sets; According to the sample device abnormality feature set and the multiple sample traffic abnormality feature sets, the device abnormality-traffic abnormality correlation analysis is performed respectively, and the analysis results are summarized and deduplicated to determine multiple device abnormality feature types and multiple traffic abnormality feature type sets, wherein the traffic abnormality feature type identifier has a correlation frequency; Based on the association frequency, the multiple traffic anomaly feature type sets are screened according to a predetermined association threshold to obtain multiple high-frequency traffic anomaly feature type sets, and the device-traffic anomaly association map is constructed in combination with the multiple device anomaly feature types; Continuously receive monitoring data within a predetermined time zone, locate anomalies and analyze features of the monitoring data, and build anomaly distribution topology, including: Continuously receive device status characteristics and communication traffic characteristics of multiple monitoring nodes in a predetermined time zone, and aggregate to obtain multiple monitoring data sets; Based on the device-traffic anomaly association graph, the multiple monitoring data sets are subjected to anomaly linkage identification to obtain multiple abnormal device sets under multiple monitoring nodes; Visually marking the multiple abnormal device sets according to a predetermined scheme to generate the abnormal distribution topology; Potential attack risks are identified based on the abnormal distribution topology, and potential attack modes and potential risk levels are output, including: Retrieve the operation log of the automated production line, obtain multiple sample anomaly distribution topologies after processing, and obtain sample attack patterns and sample risk levels of different sample anomaly distribution topologies within the historical time range to obtain a sample anomaly distribution topology set, a sample attack pattern set, and a sample risk level set; Configure N risk identification operators, where the risk identification operators include at least BP neural network, random forest and support vector machine, and N is an integer greater than 2; The sample abnormal distribution topology set, the sample attack mode set and the sample risk level set are used as training data and divided into N parts to obtain N training sets; Using the N training sets to perform supervised training on the N risk identification operators, and integrating and constructing a risk identification plug-in; The risk identification plug-in is used to identify potential attack risks of the abnormal distribution topology, and output potential attack patterns and potential risk levels.

2. The method for security situation awareness in an industrial Internet environment according to claim 1 is characterized in that: Performing time-space alignment and abnormal linkage analysis based on the multiple device status feature sets and the multiple communication traffic feature sets, and generating a risk warning signal if double abnormalities exist, including: Aligning the multiple device status feature sets and the multiple communication traffic feature sets in the time domain and the frequency domain, and integrating them to obtain multiple monitoring feature sets for multiple welding devices; Based on the device-traffic anomaly association map, the multiple monitoring feature sets are linked to identify anomalies. If the same device has repeated anomalies in device status and mapped communication traffic under the same monitoring node, it is identified as an abnormal device and a risk warning signal is generated.

3. The method for security situation awareness in an industrial Internet environment according to claim 1 is characterized in that: Visually marking the multiple abnormal device sets according to a predetermined scheme to generate the abnormal distribution topology includes: Obtaining distribution characteristics of welding equipment in an automated production line, and mapping the distribution characteristics of welding equipment to a two-dimensional space to generate an abnormal equipment distribution topology; Reading abnormal positions and abnormal frequencies of the plurality of abnormal device sets to obtain a plurality of abnormal positions and a plurality of abnormal frequencies corresponding to the plurality of abnormal positions; Taking the abnormal position as a pixel point and the abnormal frequency as the gray value of the pixel point, the abnormal equipment distribution topology is marked according to the multiple abnormal positions and the multiple abnormal frequencies, and an abnormal distribution map is generated and set as the abnormal distribution topology.

4. The method for security situation awareness in an industrial Internet environment according to claim 1 is characterized in that: The N risk identification operators are supervised and trained using the N training sets, and a risk identification plug-in is integrated and constructed, including: Using the N training sets to perform supervised training on the N risk identification operators until convergence, to obtain N risk identification branches and N identification accuracies; Based on the principle of integrated learning, the N risk identification branches are fused according to the N identification accuracies to generate the risk identification plug-in.

5. The security situation awareness platform in the industrial Internet environment is characterized by: The platform is used to implement the security situation awareness method in an industrial Internet environment according to any one of claims 1 to 4, and the platform includes: An equipment operation data collection module, which is used to monitor and collect the operation data of multiple welding equipment in the automated production line through an equipment monitoring unit, and obtain multiple equipment status feature sets to transmit to a cloud server; An equipment communication data acquisition module, the equipment communication data acquisition module is used to collect the communication data of the plurality of welding equipment at a fixed point through a flow monitoring unit, obtain a plurality of communication flow feature sets and transmit them to a cloud server; An abnormal linkage analysis module, which is used in a cloud server to perform spatiotemporal alignment and abnormal linkage analysis based on a device-traffic abnormality association map and a plurality of device status feature sets and a plurality of communication traffic feature sets. If a double abnormality exists, a risk warning signal is generated and sent to a front-line management platform; An abnormal distribution topology building module, wherein the abnormal distribution topology building module is used to continuously receive monitoring data within a predetermined time zone if the risk warning signal is not 0, and to perform abnormal location and feature analysis on the monitoring data to build an abnormal distribution topology; A potential attack risk identification module is used to identify potential attack risks according to the abnormal distribution topology, and output potential attack modes and potential risk levels as security situation awareness results.

Images