Full detection method and system based on the edge side of industrial Internet

Abstract

The present invention relates to the field of transmission data detection technology, and in particular to a full-scale detection method and system based on the edge side of the industrial Internet. The method includes determining the data collection sites on the edge side and obtaining the original data collected by each data collection site, determining the site monitoring status and data collection parameters of the corresponding data collection site according to each data collection site and the original data collected by it to determine the site characterization status, setting a preprocessor according to the site characterization status, judging the data security trend of the corresponding site through each preprocessor, determining the subsequent detection method of each data collection site by the core processor according to the data security trend, and determining the corresponding data detection cycle according to the number of data collection sites that perform queue-jumping processing; the present invention effectively ensures the scientificity and efficiency of edge-side data detection, can accurately control the data security situation and flexibly respond according to the actual situation, and plays an important role in improving the quality of data detection.

Description

Technical Field

[0001] The present invention relates to the field of transmission data detection technology, and in particular to a full-scale detection method and system based on the edge side of the industrial Internet. Background Art

[0002] Full detection on the edge is a data detection strategy in an edge computing environment. Edge computing refers to the technology of processing data at the edge of the network close to the source of objects or data. Full detection on the edge means detecting all data generated or transmitted by edge devices without missing any data samples.

[0003] Chinese patent announcement number CN108924150B discloses an edge side clone node integrated detection method based on back propagation neural network, including the following steps: S1. Edge side computing node collects data set; S2. Uses data set to train and test BPNN; S3. Waits for new information packet; S4. Extracts channel information from information packet, stores reference channel information, and calculates channel difference; S5. Accumulates the reputation of each node; S6. Inputs the reputation of each node into BPNN to determine whether there is a clone attack; S7. If there is no clone attack, updates the reference channel information, and if there is a clone attack, sends a clone attack alarm. The present invention uses BPNN at the edge side node to perform integrated detection on the data source node, and at the same time determines whether there is a clone attack in multiple nodes, thereby improving the efficiency of clone node detection and reducing network transmission load and central network load. The invention also reduces the influence of channel random noise and improves the accuracy of clone node detection by accumulating reputation and classifying BPNN. It can be seen that the invention has the following problems:

[0004] The problem of low detection quality is caused by not considering the importance of different data collection sites and not adjusting the order of full data detection according to the importance. Summary of the invention

[0005] To this end, the present invention provides a full detection method and system based on the edge side of the industrial Internet, so as to overcome the problem that the prior art does not consider the importance of different data collection sites and adjusts the order of full data detection according to the importance, resulting in low detection quality.

[0006] To achieve the above objectives, on the one hand, the present invention provides a full-scale detection method based on the edge side of the industrial Internet, comprising:

[0007] Determine the data collection sites on the edge side and obtain the original data collected by each of the data collection sites;

[0008] Determine the site monitoring state and data collection parameters of the corresponding data collection site according to each of the data collection sites and the raw data collected therefrom to determine the site characterization state;

[0009] Setting a preprocessor according to the site representation state;

[0010] Determine the data security trend of the corresponding site through each of the preprocessors;

[0011] Determine the subsequent detection method of each data collection site by the core processor according to the data security trend, including:

[0012] Using an emergency processor to evaluate the data security level and determine whether to perform queue interruption processing according to the data security level;

[0013] Or, perform data analysis on the collected raw data in the order in which they were collected;

[0014] The corresponding data detection cycle is determined according to the number of data collection sites for queue interruption processing, including:

[0015] Shorten the data detection cycle according to the number of data collection sites processed by queue interruption;

[0016] Or, the edge side data is detected according to a preset detection cycle.

[0017] Further, according to each of the data collection sites and the raw data collected therefrom, the site monitoring state and data collection parameters of the corresponding data collection sites are respectively determined to determine the site characterization state, including:

[0018] Determining a site monitoring state according to the density of each of the data collection sites;

[0019] Determine the data collection parameters of the corresponding data collection site according to the data type of the original data collected at each data collection site and the collection frequency of each data type;

[0020] The site characterization state is determined according to the site monitoring state and the data collection amount, wherein:

[0021] If the site monitoring state is multi-point monitoring and the data collection parameter is greater than the preset collection parameter, the site characterization state is determined to be a key site;

[0022] If the site monitoring state is multi-point monitoring or the data acquisition parameter is greater than the preset acquisition parameter, the site characterization state is determined to be a transition site, and the transition site includes an overlapping transition site and a parameter transition site;

[0023] If the site monitoring state is single-point monitoring and the data collection parameter is less than or equal to the preset collection parameter, the site characterization state is determined to be a common site.

[0024] Furthermore, the method for determining the site monitoring status according to the density of each of the data collection sites includes:

[0025] Determining the neighborhood range of each of the data collection sites;

[0026] The site monitoring state of the corresponding data collection site is determined according to the ratio of the overlapping area of ​​the overlapping area within the single neighborhood range to the neighborhood area of ​​the neighborhood range, wherein:

[0027] If the ratio of the overlapping area to the neighborhood area is greater than a preset ratio, the site monitoring state of the corresponding data collection site is determined to be multi-point monitoring;

[0028] If the ratio of the overlapping area to the neighborhood area is less than or equal to a preset ratio, it is determined that the site monitoring state of the corresponding data collection site is single-point monitoring.

[0029] Furthermore, the method for determining the data collection parameters of the data collection site includes:

[0030] Determine the data type of the raw data collected by the single data collection site and the collection frequency of each data type;

[0031] Determine a frequency ratio based on the acquisition frequency of each data type and the standard acquisition frequency;

[0032] The data acquisition parameters of the corresponding data acquisition sites are determined according to the sum of the frequency ratios of each data type.

[0033] Further, the method of setting a preprocessor according to the site characterization state includes:

[0034] Determine the site representation status of each data collection site on the edge of the industrial Internet;

[0035] Determine the number of first-type preprocessors according to the number of key sites, and connect the first-type preprocessors to the data acquisition devices of the key sites respectively;

[0036] The number and connection mode of the second type of preprocessors are determined according to the type of transition site.

[0037] Furthermore, the method of determining the data security trend of the corresponding site by each of the preprocessors includes:

[0038] Using the built-in security evaluation model of each of the first-type preprocessors to perform security evaluation on the original data of the corresponding key sites to determine the data security trend of each key site, and using the built-in security evaluation model of each of the second-type preprocessors to perform security evaluation on the original data of each type of transition site to determine the data security trend of each transition site;

[0039] The data security trends include explicit security trends and implicit security trends.

[0040] Further, the subsequent detection method of the core processor for each data collection site is determined according to the data security trend, including:

[0041] If the data security trend is an implicit security trend, the raw data of the data collection site is sent to the emergency processor to determine the data security level of the data collection site according to a pre-stored scoring model, and determine whether to perform queue interruption processing on the raw data collected by the data collection site according to the data security level;

[0042] If the data safety trend is an explicit safety trend, it is determined that no queue interruption processing is performed, and data analysis is performed on the original data collected at the data collection site in the order of collection.

[0043] Further, determining whether to perform queue interruption processing on the original data collected by the data collection site according to the data security level includes:

[0044] If the data security level exceeds the preset level, it is determined that the original data collected at the corresponding data collection site will be queued;

[0045] If the data security level does not exceed the preset level, it is determined that the original data collected at the corresponding data collection site will not be queued.

[0046] Further, the corresponding data detection cycle is determined according to the number of data collection sites for queue interruption processing, including:

[0047] If the number of data collection sites to be processed for queue interruption is greater than or equal to a preset number, it is determined to shorten the data detection cycle;

[0048] The data detection period is negatively correlated with the number of data collection sites that perform queue-jumping processing;

[0049] If the number of data collection sites to be queued is less than a preset number, it is determined that the data detection cycle is not changed and the edge side data is detected according to the preset detection cycle.

[0050] On the other hand, the present invention also provides a full-scale detection system based on the edge side of the industrial Internet, comprising:

[0051] The sensor units are distributed at each data collection site and are used to collect the original data of each data collection site;

[0052] A site analysis unit connected to the sensor unit for determining a site monitoring state of each data collection site and a data collection parameter to determine a site characterization state;

[0053] a preprocessor unit connected to the sensor unit to determine data security trends at key sites and transition sites;

[0054] an emergency processor unit connected to the preprocessor unit for receiving raw data of a data collection site of an implicit safety trend and determining a data security level of the data collection site;

[0055] The core processor unit is connected to the sensor unit and the emergency processor unit respectively, and is used to determine a data detection cycle to perform data detection on the original data collected at each data collection site.

[0056] Compared with the prior art, the beneficial effect of the present invention is that the full detection method based on the edge side of the industrial Internet provided by the embodiment of the present invention effectively ensures the scientificity and efficiency of edge side data detection from the determination of the data collection site to the flexible adjustment of the subsequent detection method and detection cycle, and can accurately control the data security situation and respond flexibly according to the actual situation, playing an important role in improving the quality of data detection and ensuring the stable operation of the industrial Internet.

[0057] Furthermore, by analyzing factors such as the site density of data collection sites, the data type and collection frequency of the original data, a site characterization status determination system is determined. This can not only accurately distinguish sites of different importance levels, providing a reliable basis for subsequent targeted data processing strategies, but also show excellent benefits in optimizing resource allocation, improving detection efficiency, and ensuring the comprehensiveness and accuracy of data detection, greatly promoting the efficient and robust operation of the entire edge-side data detection process;

[0058] Furthermore, the preprocessor is reasonably set according to the site representation status, from accurately determining the status of each data collection site to matching the corresponding number and connection method of preprocessors according to the different situations of key sites and transition sites, effectively realizing the differentiated preprocessing of data collection sites of different importance levels, which not only improves the pertinence and adaptability of preprocessing, but also optimizes resource allocation, ensures the efficient and orderly development of data preprocessing, and lays a solid foundation for subsequent more accurate judgment of data security trends.

[0059] Furthermore, determining the data security trend provides a key decision-making basis for the activation of the emergency processor or sequential data analysis. When it is found that the data security trend of a key site or transition site is a hidden security trend, the system starts the emergency processor to conduct a detailed assessment of the data security level and take emergency measures such as queue interruption. If the data security trend is an explicit security trend, data analysis can be performed in the normal order. This flexible response mechanism based on data security trends enhances the ability of the entire industrial Internet edge-side full-scale detection system to respond to data risks, enabling it to timely and effectively ensure data security and normal operation of the system in a complex and changing data environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 This is a step diagram of a method for full detection of the edge side of the industrial Internet according to an embodiment of the present invention;

[0061] Figure 2 A flow chart for determining a site characterization state according to an embodiment of the present invention;

[0062] Figure 3 A diagram of the steps for setting a preprocessor according to an embodiment of the present invention;

[0063] Figure 4 This is a connection diagram of an embodiment of the present invention based on a full-scale detection system at the edge of the industrial Internet. DETAILED DESCRIPTION

[0064] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0065] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0066] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0067] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0068] See also Figure 1 As shown, it is a step diagram of a method for full detection of the edge side of the industrial Internet according to an embodiment of the present invention. An embodiment of the present invention provides a method for full detection of the edge side of the industrial Internet, including:

[0069] Step S1, determining the data collection sites on the edge side and acquiring the original data collected by each of the data collection sites;

[0070] Step S2, determining the site monitoring state and data collection parameters of the corresponding data collection site according to each of the data collection sites and the raw data collected therefrom to determine the site characterization state;

[0071] Step S3, setting a preprocessor according to the site characterization state;

[0072] Step S4, determining the data security trend of the corresponding site through each of the preprocessors;

[0073] Step S5, determining the subsequent detection method of the core processor for each data collection site according to the data security trend, including:

[0074] Using an emergency processor to evaluate the data security level and determine whether to perform queue interruption processing according to the data security level;

[0075] Or, perform data analysis on the collected raw data in the order in which they were collected;

[0076] Step S6, determining the corresponding data detection cycle according to the number of data collection sites to be processed by queue interruption, including:

[0077] Shorten the data detection cycle according to the number of data collection sites processed by queue interruption;

[0078] Or, the edge side data is detected according to a preset detection cycle.

[0079] It can be understood that after determining the data collection site and obtaining the original data in step S1, the site characterization state is determined through step S2, which can comprehensively and accurately grasp the actual situation of each collection site, and provide a scientific basis for the subsequent targeted setting of the preprocessor (step S3), so that the preprocessing fits the characteristics of each site and better serves the subsequent data security trend judgment and other tasks; step S4 uses the preprocessor to judge the data security trend of the corresponding site, and step S5 determines the subsequent detection method of the core processor according to the trend to decide whether to jump the queue or analyze the data in the order of collection. This method can flexibly respond to data with different security conditions, and can promptly adopt processing for data that may have high security risks, while conventional data is analyzed in sequence, which ensures the rationality and effectiveness of data detection; step Step S6 determines the corresponding data detection period according to the number of data collection sites that perform queue-jumping processing. The detection period can be shortened as needed or detected according to a preset period, avoiding the drawbacks of using fixed-period detection regardless of the data security situation. The detection period can be flexibly changed according to the actual data security urgency and other situations, thereby improving the overall data detection efficiency and adaptability to different conditions, and helping to better ensure the high-quality development of data detection on the edge side of the Industrial Internet. The full-scale detection method provided by the present invention ensures the quality of edge-side data detection from many aspects through the close coordination and progressive progress of the above-mentioned links, and can promptly discover and respond to data security-related issues, reduce the adverse effects of data security risks on the Industrial Internet system, and thus help the Industrial Internet to operate stably and reliably.

[0080] See also Figure 2 Specifically, in step S2, the site monitoring state and data collection parameters of the corresponding data collection site are determined according to each of the data collection sites and the raw data collected to determine the site characterization state, including:

[0081] Step S21, determining the site monitoring state according to the density of each data collection site;

[0082] Step S22, determining the data collection parameters of the corresponding data collection sites according to the data types of the original data collected at the data collection sites and the collection frequency of each data type;

[0083] Step S23, determining the site characterization state according to the site monitoring state and the data collection amount, wherein:

[0084] If the site monitoring state is multi-point monitoring and the data collection parameter is greater than the preset collection parameter, the site characterization state is determined to be a key site;

[0085] If the site monitoring state is multi-point monitoring or the data acquisition parameter is greater than the preset acquisition parameter, the site characterization state is determined to be a transition site, and the transition site includes an overlapping transition site and a parameter transition site;

[0086] It can be understood that the site monitoring state of the overlapping transition site is multi-point monitoring and the data collection parameter is less than / equal to the preset collection parameter; the site monitoring state of the parameter transition site is single-point detection and the data collection parameter is greater than the preset collection parameter;

[0087] If the site monitoring state is single-point monitoring and the data collection parameter is less than or equal to the preset collection parameter, the site characterization state is determined to be a common site.

[0088] In implementation, the preset frequency ratio corresponding to the preset acquisition parameter is 1 to 1.5, so it is determined according to the number of data types at the data acquisition site, that is, the number of data types collected at a data acquisition site is A and its corresponding preset acquisition parameter is also A to 1.5A. The larger the preset acquisition parameter, the more accurate the key sites screened out. However, if it is too large, the screening conditions will be too harsh and many key sites will be missed. It is preferably set to 1.2A, so the preset acquisition parameters of each data acquisition site may be different.

[0089] It is understandable that the sites are clearly divided into key sites, transition sites and ordinary sites according to the site monitoring status and data collection parameters. Key sites correspond to multi-point monitoring and the data collection parameters are higher than the preset collection parameters. Such sites are often in the key area of ​​the data collection network or involve the convergence of multiple types of key data. For example, on large industrial production lines, sites with collaborative monitoring by multiple sensors and rich data are crucial for the overall production process monitoring; transition sites are further subdivided into overlapping transition sites (multi-point monitoring but relatively low data collection parameters) and parametric transition sites (single-point detection but large data collection parameters), which can It covers those sites that are at an intermediate level in importance. For example, in some local production links, sites with single-point detection but more critical data types can be used as parameter transition sites. In areas where the data are relatively scattered but still have a certain correlation, sites with multi-point monitoring and average data volume are overlapping transition sites. Ordinary sites are single-point monitoring with smaller data collection parameters, which usually represent areas where data monitoring is relatively independent and has less impact on the overall situation. Through this detailed division, subsequent data processing can be targeted, and different detection and analysis strategies can be adopted for sites of different importance to improve the pertinence and effectiveness of overall data processing.

[0090] Specifically, in step S21, the method for determining the site monitoring state according to the density of each data collection site includes:

[0091] Step S211, determining the neighborhood range of each data collection point;

[0092] In implementation, the neighborhood range is a geometric figure with the data collection site as the geometric center, usually a circle, the radius of which is usually ≤1m. The larger the radius, the larger the overlap area may be when the overlap area is subsequently determined, and the distance between the data collection sites of the multi-point monitoring determined is farther, so it is preferably set to 0.5m;

[0093] Step S212, determining the site monitoring state of the corresponding data collection site according to the ratio of the overlapping area of ​​the overlapping area within the single neighborhood range to the neighborhood area of ​​the neighborhood range, wherein:

[0094] If the ratio of the overlapping area to the neighborhood area is greater than a preset ratio, the site monitoring state of the corresponding data collection site is determined to be multi-point monitoring;

[0095] If the ratio of the overlapping area to the neighborhood area is less than or equal to a preset ratio, it is determined that the site monitoring state of the corresponding data collection site is single-point monitoring.

[0096] It can be understood that if a neighborhood range overlaps with another neighborhood range, the overlapping part is recorded as the overlapping area. If there are too many overlapping areas in a single neighborhood range, it means that there are many other data monitoring sites distributed around it;

[0097] In implementation, the preset ratio is ≥50%. If a single neighborhood range overlaps with several other neighborhood ranges, it means that they are very close to each other, and the closer the distance, the larger the overlapping area should be (the overlapping area of ​​a single neighborhood range may be larger than the neighborhood area. If it is larger than the neighborhood area, it means that there are other very close data collection sites around it). The larger the preset ratio, the closer the distance between the screened multi-point monitoring data collection site and other sites, so it is preferably set to 50%.

[0098] It can be understood that determining the monitoring status of the site according to the density of the data collection sites fully considers the spatial layout factors of data collection, avoids data detection loopholes caused by local data missing or ignoring regional correlation, and ensures the comprehensiveness of data detection in the spatial dimension.

[0099] Specifically, in step S22, the method for determining the data collection parameters of the data collection site includes:

[0100] Step S221, determining the data type of the raw data collected by a single data collection site and the collection frequency of each data type;

[0101] Step S222, determining a frequency ratio according to the acquisition frequency of each data type and the standard acquisition frequency;

[0102] Step S223, determining the data collection parameters corresponding to the data collection sites according to the sum of the frequency ratios of each data type.

[0103] It is understandable that a higher collection frequency means a larger amount of data is collected, which may mean that the data is very important. However, when the amount of data collected increases, problems such as missing data and collection errors may occur;

[0104] In implementation, the number of data types collected by a data collection site is 3, and their frequency ratios are a1, a2 and a3 respectively, then the data collection parameter of this site is a1+a2+a3.

[0105] It is understandable that determining data collection parameters based on data type and collection frequency is considered from the perspective of the characteristics of the data itself. Different data types have different importance in industrial production, and the collection frequency also reflects the dynamic change characteristics of the data. Combining these factors to determine the data collection parameters can more accurately measure the data value of each site; and the preset collection parameters are determined according to the number of data types and set reasonable preferred values. While pursuing the accuracy of key site screening, it also takes into account the risk of missing important sites due to overly harsh screening conditions, thereby ensuring the comprehensiveness and accuracy of data detection as a whole, and providing a solid data guarantee foundation for the stable operation of the Industrial Internet system.

[0106] See also Figure 3 As shown, it is a step diagram of setting a preprocessor according to an embodiment of the present invention. Specifically, in step S3, the method of setting a preprocessor according to the site characterization state includes:

[0107] Step S31, respectively determining the site representation status of each data collection site on the edge side of the industrial Internet;

[0108] Step S32, determining the number of first-type preprocessors according to the number of key sites, and connecting the first-type preprocessors to the data acquisition devices of the key sites respectively;

[0109] It can be understood that the number of key sites is equal to the number of first-type preprocessors, and one or more data acquisition devices at each key site are connected to a first-type preprocessor;

[0110] Step S33, determining the number and connection mode of the second type preprocessors according to the type of transition sites.

[0111] It can be understood that the number of the second-class preprocessors is ≥2; wherein the data acquisition devices of all overlapping transition sites are connected to a second-class preprocessor; the parameter transition site determines the number of its corresponding second-class preprocessors according to its data acquisition parameters, and usually one second-class preprocessor processes data with data acquisition parameters not exceeding 10A.

[0112] It can be understood that step S31 determines the site characterization status of each data collection site on the edge side of the industrial Internet, clearly sorts out the importance and characteristic differences of different sites, and clarifies which are key sites, which are different types of transition sites and ordinary sites, so that the subsequent configuration of preprocessors for different types of sites can be targeted, avoiding blind settings that result in preprocessing that cannot meet the actual needs of each site data; step S3 uses the above-mentioned orderly and targeted preprocessor setting method to match data collection sites of different importance levels with appropriate preprocessing mechanisms, avoiding the drawbacks of general and indiscriminate processing; each preprocessor performs its duties and preprocesses data according to the characteristics and importance of different sites, thereby improving the efficiency of the entire preprocessing link, and ensuring that data can enter the preprocessing process that suits its own situation in an orderly manner after collection, providing a high-quality preprocessing data foundation for subsequent further judgment of data security trends and implementation of corresponding detection methods.

[0113] Specifically, in step S4, the method of determining the data security trend of the corresponding location by each of the preprocessors includes steps S41 and S42.

[0114] Step S41, using the built-in security evaluation model of each of the first-type preprocessors to perform security evaluation on the original data of the corresponding key sites to determine the data security trend of each key site,

[0115] Step S42, using the built-in security assessment model of each of the second-type preprocessors to perform security assessment on the original data of each type of transition site to determine the data security trend of each transition site;

[0116] The data security trends include explicit security trends and implicit security trends.

[0117] It is understandable that the security evaluation model for judging data security trends is an existing technology, including but not limited to: (1) The DREAD model based on risk assessment evaluates risks from five dimensions: damage, reproducibility, exploitability, affected users, and discoverability. Taking the video surveillance data collection on the edge as an example, if the vulnerability of the monitoring equipment can be easily exploited (high exploitability), and once exploited, it will cause a large amount of monitoring data to be leaked (high damage), and at the same time, the vulnerability is easy to be discovered (high discovery difficulty), then according to the DREAD model evaluation, the security trend of the collected video surveillance data is poor and faces greater risks; (2) The IPsecVPN model and digital certificate authentication model that combine encryption and authentication technology. The IPsecVPN model encrypts and authenticates data at the network layer to ensure the confidentiality, integrity and authenticity of the data during the process of transmitting it to other nodes after it is collected on the edge; the digital certificate authentication model issues digital certificates to edge devices and related servers for identity verification and encrypted communication. In the edge data collection system, when the edge gateway interacts with the cloud platform for data, both parties verify the data through verification. The other party’s digital certificate is used to confirm the legitimacy of the identity, and then the public key in the certificate is used for encrypted communication. If the digital certificate is revoked or the certificate is forged, the security evaluation model will promptly discover and determine that the data security trend is deteriorating (i.e., hidden security trend); (3) Data integrity verification model: The hash algorithm verification model calculates the hash value of the collected data and compares it with the correct hash value stored in advance. If the hash values ​​are consistent, it means that the data has not been tampered with during the collection and transmission process, the data integrity is guaranteed, and the data security trend is good; digital signature model: Use the private key to sign the data, and the recipient uses the corresponding public key to verify it. Only the verified signature can confirm the source and integrity of the data. In supply chain management, the data such as the cargo transportation status collected by the edge device is transmitted to the relevant parties after being digitally signed. If the digital signature verification fails, it means that the data may have been forged or tampered with, and the data security trend has deteriorated. It is necessary to further verify the authenticity and source of the data.

[0118] Specifically, in step S5, the subsequent detection method of the core processor for each data collection site is determined according to the data security trend, including:

[0119] If the data security trend is an implicit security trend, the raw data of the data collection site is sent to the emergency processor to determine the data security level of the data collection site according to a pre-stored scoring model, and determine whether to perform queue interruption processing on the raw data collected by the data collection site according to the data security level;

[0120] In implementation, the scoring model is the CVSS model (Common Vulnerability Scoring System), which calculates a score between 0 and 10 by evaluating the basic metrics of the vulnerability, such as attack vectors, attack complexity, and permission requirements, to measure the severity of the vulnerability and thus assess the risk faced by the data. In implementation, if there is a known vulnerability (implicit security trend) in the edge device, the CVSS score can be used to determine the impact of the vulnerability on the security of the collected data after it is exploited, thereby determining the security trend of the data; for example, if the edge sensor has a vulnerability with a high CVSS score (exceeding the preset level), then the data security risk is high and the security trend is not optimistic.

[0121] It is understandable that the score between 0 and 10 calculated by the CVSS model represents the data security level. In the CVSS model, when the score is greater than 7.0, it is considered a high-risk vulnerability with poor security and needs to be handled first;

[0122] Therefore, in implementation, the preset level is 7. When the score determined by the CVSS model is higher than 7, it is determined that the original data collected by the corresponding data collection site will be queued.

[0123] If the data safety trend is an explicit safety trend, it is determined that no queue interruption processing is performed, and data analysis is performed on the original data collected at the data collection site in the order of collection.

[0124] Specifically, determining whether to perform queue interruption processing on the original data collected by the data collection site according to the data security level includes:

[0125] If the data security level exceeds the preset level, it is determined that the original data collected at the corresponding data collection site will be queued;

[0126] If the data security level does not exceed the preset level, it is determined that the original data collected at the corresponding data collection site will not be queued.

[0127] It can be understood that steps S4 to S5 use the preprocessor to accurately evaluate data security trends based on site characteristics, distinguish between explicit and implicit risks, and then reasonably determine the subsequent detection method of the core processor based on the security trend. The CVSS model is used to quantify the data security level and decide whether to queue up for processing, thereby achieving differentiated and efficient processing of data with different security conditions. It can not only focus on high-risk implicit data in a timely manner for in-depth evaluation and priority processing, but also process explicit security trend data in an orderly manner, effectively improving data detection accuracy and timeliness, and reasonably allocating system resources. This ensures the security and stability of industrial Internet data and the efficient and orderly operation of the detection process.

[0128] Specifically, in step S6, the corresponding data detection period is determined according to the number of data collection sites for queue interruption processing, including:

[0129] If the number of data collection sites to be processed for queue interruption is greater than or equal to a preset number, it is determined to shorten the data detection cycle;

[0130] The data detection period is negatively correlated with the number of data collection sites that perform queue-jumping processing;

[0131] In implementation, usually 0.25 times the number of data collection sites ≤ the preset number ≤ 0.5 times the number of data collection sites, preferably set to 0.4 times the number of data collection sites;

[0132] In implementation, if it is determined to shorten the data detection cycle, the shortened data detection cycle = preset detection cycle × preset number ÷ number of data collection sites for queue interruption processing.

[0133] If the number of data collection sites to be queued is less than a preset number, it is determined that the data detection cycle is not changed and the edge side data is detected according to the preset detection cycle.

[0134] It is understandable that the preset detection period is usually determined according to the requirements of the industrial automation system, and is preferably set to perform a full data detection every hour.

[0135] See also Figure 4 As shown, it is a connection diagram of a full-scale detection system based on the edge side of the industrial Internet according to an embodiment of the present invention. The present invention also provides a full-scale detection system based on the edge side of the industrial Internet, including:

[0136] The sensor units are distributed at each data collection site and are used to collect the original data of each data collection site;

[0137] A site analysis unit connected to the sensor unit for determining a site monitoring state of each data collection site and a data collection parameter to determine a site characterization state;

[0138] a preprocessor unit connected to the sensor unit to determine data security trends at key sites and transition sites;

[0139] An emergency processor unit, which is connected to the preprocessor unit, is used to receive the original data of the data collection site of the implicit security trend and determine the data security level of the data collection site; it can be understood that there is only one emergency processor, which is used to determine the data security level of the site of the implicit security trend according to the CVSS model;

[0140] The core processor unit is connected to the sensor unit and the emergency processor unit respectively, and is used to determine the data detection cycle to perform data detection on the original data collected at each data collection site; it can be understood that there is only one core processor unit, which is used to detect all edge measurement data.

[0141] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0142] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A full-scale detection method based on the edge side of the industrial Internet, characterized in that: include: Determine the data collection sites on the edge side and obtain the original data collected by each of the data collection sites; According to each of the data collection sites and the raw data collected therefrom, the site monitoring state and data collection parameters of the corresponding data collection sites are respectively determined to determine the site characterization state. The specific steps of determining the site characterization state include: The site monitoring state is determined according to the density of each data collection site, the data collection parameters of the corresponding data collection site are determined according to the data type of the original data collected by each data collection site and the collection frequency of each data type, and the site characterization state is determined according to the site monitoring state and the data collection parameters, wherein: If the site monitoring state is multi-point monitoring and the data collection parameter is greater than the preset collection parameter, the site characterization state is determined to be a key site; If the site monitoring state is multi-point monitoring or the data acquisition parameter is greater than the preset acquisition parameter, the site characterization state is determined to be a transition site, and the transition site includes an overlapping transition site and a parameter transition site; If the site monitoring state is single-point monitoring and the data collection parameter is less than or equal to the preset collection parameter, the site characterization state is determined to be a common site; Setting a preprocessor according to the site representation state; Determine the data security trend of the corresponding site through each of the preprocessors; Determine the subsequent detection method of each data collection site by the core processor according to the data security trend, including: According to the determination result that the data security trend is an implicit security trend, determining to use an emergency processor to evaluate the data security level and determining whether to perform queue interruption processing according to the data security level; Or, according to the determination result that the data security trend is an explicit security trend, determining to perform data analysis on the collected original data in the order of collection; The corresponding data detection cycle is determined according to the number of data collection sites for queue interruption processing, including: Shorten the data detection cycle according to the number of data collection sites processed by queue interruption; Or, the edge side data is detected according to a preset detection cycle.

2. The method for full detection based on the edge side of the industrial Internet according to claim 1 is characterized in that: The method for determining the monitoring status of a site according to the density of each of the data collection sites includes: Determining the neighborhood range of each of the data collection sites; The site monitoring state of the corresponding data collection site is determined according to the ratio of the overlapping area of ​​the overlapping area within the single neighborhood range to the neighborhood area of ​​the neighborhood range, wherein: If the ratio of the overlapping area to the neighborhood area is greater than a preset ratio, the site monitoring state of the corresponding data collection site is determined to be multi-point monitoring; If the ratio of the overlapping area to the neighborhood area is less than or equal to a preset ratio, it is determined that the site monitoring state of the corresponding data collection site is single-point monitoring.

3. The method for full detection based on the edge side of the industrial Internet according to claim 1 is characterized in that: The method for determining the data collection parameters of the data collection site includes: Determine the data type of the raw data collected by the single data collection site and the collection frequency of each data type; Determine a frequency ratio based on the acquisition frequency of each data type and the standard acquisition frequency; The data acquisition parameters of the corresponding data acquisition sites are determined according to the sum of the frequency ratios of each data type.

4. The method for full detection based on the edge side of the industrial Internet according to claim 3 is characterized in that: The method for setting a preprocessor according to the site characterization state includes: Determine the site representation status of each data collection site on the edge of the industrial Internet; Determine the number of first-type preprocessors according to the number of key sites, and connect the first-type preprocessors to the data acquisition devices of the key sites respectively; The number and connection mode of the second type of preprocessors are determined according to the type of transition site.

5. The method for full detection based on the edge side of the industrial Internet according to claim 4 is characterized in that: The method of judging the data security trend of the corresponding site by each of the preprocessors includes: Using the built-in security evaluation model of each of the first-type preprocessors to perform security evaluation on the original data of the corresponding key sites to determine the data security trend of each key site, and using the built-in security evaluation model of each of the second-type preprocessors to perform security evaluation on the original data of each type of transition site to determine the data security trend of each transition site; The data security trends include explicit security trends and implicit security trends.

6. The method for full detection based on the edge side of the industrial Internet according to claim 1 is characterized in that: Determine the subsequent detection method of each data collection site by the core processor according to the data security trend, including: If the data security trend is an implicit security trend, the raw data of the data collection site is sent to the emergency processor to determine the data security level of the data collection site according to a pre-stored scoring model, and determine whether to perform queue interruption processing on the raw data collected by the data collection site according to the data security level; If the data safety trend is an explicit safety trend, it is determined that no queue interruption processing is performed, and data analysis is performed on the original data collected at the data collection site in the order of collection.

7. The method for full detection based on the edge side of the industrial Internet according to claim 6 is characterized in that: Determining whether to perform queue interruption processing on the original data collected by the data collection site according to the data security level includes: If the data security level exceeds the preset level, it is determined that the original data collected at the corresponding data collection site will be queued; If the data security level does not exceed the preset level, it is determined that the original data collected at the corresponding data collection site will not be queued.

8. The method for full detection based on the edge side of the industrial Internet according to claim 1 is characterized in that: The corresponding data detection cycle is determined according to the number of data collection sites for queue interruption processing, including: If the number of data collection sites to be processed for queue interruption is greater than or equal to a preset number, it is determined to shorten the data detection cycle; The data detection period is negatively correlated with the number of data collection sites that perform queue-jumping processing; If the number of data collection sites to be queued is less than a preset number, it is determined that the data detection cycle is not changed and the edge side data is detected according to the preset detection cycle.

9. A full-volume detection system based on the edge side of the industrial Internet using the full-volume detection method based on the edge side of the industrial Internet as described in any one of claims 1 to 8, characterized in that: include, The sensor units are distributed at each data collection site and are used to collect the original data of each data collection site; A site analysis unit connected to the sensor unit for determining a site monitoring state of each data collection site and a data collection parameter to determine a site characterization state; a preprocessor unit connected to the sensor unit to determine data security trends at key sites and transition sites; an emergency processor unit connected to the preprocessor unit for receiving raw data of a data collection site of an implicit safety trend and determining a data security level of the data collection site; The core processor unit is connected to the sensor unit and the emergency processor unit respectively, and is used to determine a data detection cycle to perform data detection on the original data collected at each data collection site.

Images