Equipment safety detection response method and system and equipment safety detection controller

Abstract

The invention provides an equipment security detection response method and system and an equipment security detection controller, the method is applied to the equipment security detection controller, and the method comprises the following steps: acquiring interface information of target equipment; performing message subscription on the target equipment based on the interface information to obtain equipment process information; performing risk assessment on the target equipment based on the equipment process information to obtain an equipment risk score; and based on the equipment risk score, carrying out light adjustment on the panel lamp, so that the panel lamp carries out safety detection response on the target equipment according to the equipment risk score. According to the embodiment of the invention, the risk assessment is carried out on the equipment process information of the target equipment to obtain the equipment risk score, and then light adjustment is carried out on the panel lamp according to the equipment risk score, so that the panel lamp carries out safety detection response on the target equipment according to the equipment risk score. And the response efficiency of the worker to the safety detection result of the equipment is improved.

Description

Technical Field

[0001] The present invention relates to the field of equipment safety detection engineering, and in particular to an equipment safety detection response method, system and equipment safety detection controller. Background Art

[0002] The device security detection response refers to a security detection response system set up to ensure the security of the device. In the prior art, the device security detection response is delivered to the device manager through an email warning.

[0003] However, since the person in charge of the equipment may ignore emails, take leave or be absent from work, when there is a problem with the safety of the equipment, it is easy not to be discovered in time, thus causing damage to the equipment. Summary of the invention

[0004] The main purpose of the present invention is to provide a device safety detection response method, system and device safety detection controller, aiming to improve the efficiency of staff's response to the device safety detection results when a problem occurs in the device.

[0005] To achieve the above object, the present invention provides a device safety detection response method, system and device safety detection controller, the method is applied to the device safety detection controller, the device safety detection controller includes a panel light, and the method includes:

[0006] Get the interface information of the target device;

[0007] Based on the interface information, subscribe to messages of the target device to obtain device process information;

[0008] Based on the device process information, a risk assessment is performed on the target device to obtain a device risk score;

[0009] Based on the device risk score, the panel light is adjusted so that the panel light performs a security detection response for the target device according to the device risk score.

[0010] Optionally, performing risk assessment on the target device based on the device process information to obtain a device risk score includes:

[0011] Parsing the device process information to obtain device process operations;

[0012] Based on a preset attack behavior database, behavior matching is performed on the device process operation to obtain a process behavior matching result, wherein the process behavior matching result is used to indicate that there is an operation in the device process operation that matches the attack behavior database, or there is no operation in the device process operation that matches the attack behavior database;

[0013] Based on the process behavior matching result, the target device is scored to obtain the device risk score.

[0014] Optionally, the performing behavior matching on the device process operation based on a preset attack behavior database to obtain a process behavior matching result includes:

[0015] Traversing the attack behavior database to obtain process attack behavior;

[0016] The device process operation is data matched with the process attack behavior to obtain the behavior matching result.

[0017] Optionally, scoring the target device based on the process behavior matching result to obtain the device risk score includes:

[0018] If the process behavior matching result indicates that there is no operation in the device process operation that matches the attack behavior database, it is determined that there is no security threat to the target device, and a risk score of the device with a value of zero is generated;

[0019] If the process behavior matching result indicates that there is an operation in the device process operation that matches the attack behavior database, then according to the process behavior matching result, the process attack operation is filtered out from the device process operation;

[0020] Based on a preset device behavior risk score mapping function and the process attack operation, a score is calculated for the target device to obtain the device risk score.

[0021] Optionally, the subscribing to a message of the target device based on the interface information to obtain device process information includes:

[0022] Parsing the interface information to obtain interface attributes;

[0023] Based on the interface attributes, selecting a process information subscription interface from preset device interfaces;

[0024] Based on the process information subscription interface, the process information of the target device is subscribed to obtain the device process information.

[0025] Optionally, adjusting the light of the panel light based on the device risk score so that the panel light performs a security detection response for the target device according to the device risk score includes:

[0026] Acquire a score-light-color mapping relationship between the device risk score of the target device and the light color of the panel light;

[0027] Determining a target light color of the panel light based on the equipment risk score and the score-light-color mapping relationship;

[0028] Based on the target light color, the light color of the panel light is changed to obtain a safety detection response light color.

[0029] Optionally, after adjusting the lighting of the panel light based on the device risk score so that the panel light performs a security detection response for the target device according to the device risk score, the method further includes:

[0030] Performing light color monitoring on the safety detection response light color to obtain light color monitoring information, wherein the light color monitoring information is used to indicate whether the safety detection response light color has changed or has not changed;

[0031] If the light color monitoring information indicates that the safety detection response light color has not changed, it is determined that the state of the target device has not changed;

[0032] If the light color monitoring information indicates that the safety detection response light color has changed, it is determined that the occurrence state of the target device has changed.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a device security detection response system, the device security detection response system comprising:

[0034] An interface information acquisition module is used to acquire interface information of a target device;

[0035] A device process subscription module, used to subscribe to messages of the target device based on the interface information to obtain device process information;

[0036] A process risk assessment module, used to perform risk assessment on the target device based on the device process information to obtain a device risk score;

[0037] The device detection response module is used to adjust the lighting of the panel light based on the device risk score, so that the panel light performs a security detection response for the target device according to the device risk score.

[0038] In addition, to achieve the above-mentioned purpose, the present invention also provides an equipment safety detection controller, wherein the mine equipment includes an equipment safety detection response system, a panel light and a light color control system, and the light color control device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned equipment safety detection response method when executing the computer program.

[0039] Optionally, the light source of the panel light is a light emitting diode light source, and the panel light has at least three light colors.

[0040] The present invention provides an equipment safety detection response method, system and equipment safety detection controller. The above method is applied to the equipment safety detection controller. The above method includes: subscribing to messages of the target device through the interface information of the acquired target device to obtain the equipment process information; secondly, performing risk assessment on the target device according to the equipment process information to obtain the equipment risk score; finally, adjusting the light of the panel light according to the equipment risk score, so that the panel light performs safety detection response for the target device according to the equipment risk score, which helps to improve the response speed of mine staff to the results of mine equipment safety detection, thereby reducing the probability of equipment damage in the mine due to untimely safety detection response. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0043] Figure 2 is a flow chart of a device security detection response method provided by an embodiment of the present invention;

[0044] Figure 3 It is a structural diagram of a device security detection response system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0045] The device security detection response method provided by the embodiment of the present invention is applied to tunnels. Unless otherwise defined, all technical and scientific terms used in this document have the same meaning as those generally understood by technicians in the technical field of this application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" in the specification and claims of this application and the above-mentioned drawings and any variations thereof are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0046] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0047] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0048] The device security detection response refers to a security detection response system set up to ensure the security of the device. In the prior art, the device security detection response is delivered to the device manager through an email warning.

[0049] However, since the person in charge of the equipment may ignore emails, take leave or be absent from work, when there is a problem with the safety of the equipment, it is easy not to be discovered in time, thus causing damage to the equipment.

[0050] Based on this, the embodiments of the present application provide a device safety detection response method, system and device safety detection controller to improve the efficiency of staff's response to the device's safety detection results when a problem occurs with the device.

[0051] The device safety detection response method, system and device safety detection controller provided in the embodiments of the present application are specifically described through the following embodiments.

[0052] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0053] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social online platform software, etc.

[0054] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0055] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0056] It should be noted that, optionally, the device security detection response method provided in the embodiment of the present application can be executed by a server / terminal device, and accordingly, the device security detection response method is generally set in the server / terminal device.

[0057] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers, or the device security detection response system may be composed of any number of terminal devices, networks and servers.

[0058] refer to Figure 2 , shows a flowchart of an embodiment of the device security detection response method proposed in this application.

[0059] It should be noted that the equipment safety detection response method provided in the embodiment of the present invention is applied to the equipment safety detection controller. By acquiring the interface information of the target device, the target device is subscribed to messages to obtain the equipment process information. Secondly, according to the equipment process information, the target device is risk assessed to obtain the equipment risk score. Finally, according to the equipment risk score, the panel light is adjusted so that the panel light performs safety detection response for the target device according to the equipment risk score, which helps to improve the response speed of mine workers to the results of mine equipment safety detection, thereby reducing the probability of equipment damage in the mine due to untimely safety detection response. The equipment safety detection controller can be an equipment safety detection controller for mine equipment to improve the safety detection response efficiency of mine equipment; it can also be an equipment safety detection controller for outdoor equipment to improve the safety of outdoor work.

[0060] It should be understood that the device safety detection response method provided in the embodiment of the present invention can also be applied in other scenarios, which are not specifically limited here. For example, in tunnel device safety detection, by subscribing to the device process information of the tunnel device, the safety of the tunnel device is detected in real time, reducing the probability of damage to the tunnel device due to the failure to detect the danger in time, thereby improving the safety of the tunnel device.

[0061] See also Figure 2 ,like Figure 2 As shown, the device security detection response method provided by the embodiment of the present invention includes the following steps:

[0062] S210, obtaining interface information of a target device.

[0063] Optionally, the target device refers to a device for performing safety detection, which can be determined according to the application scenario. For example, when operating in a mine, the target device may be mine equipment, when operating in a tunnel, the target device may be tunnel equipment, and when operating outdoors, the target device may be outdoor equipment.

[0064] Optionally, by querying the interface attributes of the configuration file of the target device, information of each interface on the target device, ie, interface information, can be obtained.

[0065] Optionally, the configuration file includes device configuration information of the target device, wherein the device configuration information may include interface attribute information such as calling conditions and interface functions of each interface on the target device.

[0066] S220, based on the interface information, subscribe to messages of the target device to obtain device process information.

[0067] It should be understood that message subscription is a communication mode between a client and a server, in which the client actively requests updates to the server for specific data. When new information or events occur, the server will push these updates to the subscribed clients, thereby achieving real-time data transmission and processing. This mechanism is widely used in real-time data monitoring, etc., and can improve the system response speed. For example, the device security detection controller requests updates to the target device for device process information, that is, when new device process information occurs, the target device will push the updated device process information to the subscribed device security detection controller, thereby achieving real-time data monitoring of the target device's device process information.

[0068] Optionally, the interface information is parsed to determine the interface properties of each interface on the target device. Secondly, based on the interface properties, a process information subscription interface is selected from the device interface of the target device. Finally, the process information of the target device is subscribed through the process information subscription interface to obtain the device process information.

[0069] S230, based on the device process information, perform risk assessment on the target device to obtain a device risk score.

[0070] It should be understood that the device process information is the basic information of each process in the target device, mainly including the name information of the device process, the operation information of the device process, etc., wherein the operation information of the device process refers to operations such as the device process's access behavior to the database.

[0071] Optionally, the device process operation is obtained by parsing the device process information. Secondly, the device process operation is behavior matched according to a preset attack behavior database to obtain a process behavior matching result indicating that there is an operation in the device process operation that matches the attack behavior database, or that there is no operation in the device process operation that matches the attack behavior database. Finally, based on the process behavior matching result, the target device is scored to obtain a device risk score.

[0072] Optionally, by matching the device process operation of the target device with a pre-set attack behavior database, a security assessment of the target device is achieved, thereby improving the speed and accuracy of security detection of the target device.

[0073] S240, based on the device risk score, adjusting the lighting of the panel light so that the panel light performs a security detection response for the target device according to the device risk score.

[0074] It should be understood that the panel light refers to a device installed on the surface of the equipment safety detection controller to assist the equipment safety detection controller in performing detection responses.

[0075] Optionally, by obtaining the score-light-color mapping relationship between the device risk score of the target device and the light color of the panel light, as well as the device risk score of the target device, the target light color of the panel light can be determined. Furthermore, based on the target light color, the light color of the panel light is transformed to obtain the safety detection response light color.

[0076] Optionally, the panel light contains at least three light colors. For example, in mining operations, the panel light of the equipment safety detection controller may contain three light colors: green, yellow and red. Green indicates normal operation of the mining equipment, yellow indicates potential threats to the mining equipment, and red indicates security threats to the mining equipment.

[0077] In the embodiment of the present invention, the target device is subscribed to messages by acquiring the interface information of the target device to obtain the device process information. Secondly, the target device is risk assessed based on the device process information to obtain the device risk score. Finally, the panel light is adjusted based on the device risk score so that the panel light performs a safety detection response for the target device based on the device risk score. This helps to improve the response speed of mine staff to the results of mine equipment safety detection, thereby reducing the probability of equipment damage due to untimely safety detection response.

[0078] Optionally, based on the interface information, a message subscription is performed on the target device to obtain device process information, including:

[0079] Parse the interface information to obtain interface properties;

[0080] Based on the interface attributes, a process information subscription interface is selected from the preset device interfaces;

[0081] Based on the process information subscription interface, subscribe to the process information of the target device to obtain the device process information.

[0082] In this embodiment, the interface attributes may include information such as interface calling conditions, interface functions, etc. The preset device interface refers to a callable interface located on the target device.

[0083] It should be understood that in order to detect the security of the target device, it is necessary to monitor the process and device status of the target device in real time. Therefore, the interface information of the target device is first parsed to obtain the interface properties of each target device interface, and then according to the interface properties, the device interface used to transmit the target device's progress information is selected from the callable interfaces located on the target device, that is, the process information subscription interface. Secondly, the device security detection controller can request the target device to obtain an update of the device process information through the process information subscription interface, thereby realizing real-time acquisition of the target device's process information, that is, real-time acquisition of the device process information.

[0084] Optionally, based on the device process information, a risk assessment is performed on the target device to obtain a device risk score, including:

[0085] Parse the device process information to obtain the device process operation;

[0086] Based on a preset attack behavior database, a behavior match is performed on the device process operation to obtain a process behavior matching result, wherein the process behavior matching result is used to indicate that there is an operation in the device process operation that matches the attack behavior database, or there is no operation in the device process operation that matches the attack behavior database;

[0087] Based on the process behavior matching results, the target device is scored to obtain the device risk score.

[0088] It should be understood that the attack behavior database is a database for storing attack behaviors, where attack behaviors refer to destructive activities performed by malicious users or programs on target devices to achieve specific purposes. Attack behaviors mainly include data theft, system destruction, malware propagation, etc. It should be known that the attack behavior database provides a set of structured attack patterns and behaviors for device security detection, which can help the device security detection controller effectively monitor and respond to abnormal operations of the target device's processes.

[0089] Optionally, the device process information of the target device is parsed to obtain basic information of the device process, and then the operation information of the process is extracted from the basic information to obtain the device process operation. Secondly, the device process operation is matched one by one with the attack behavior in a pre-built attack behavior database to obtain a process behavior matching result of successful or failed matching, wherein a successful match indicates that there is an operation in the device process operation that matches the attack behavior database, and a failed match indicates that there is no operation in the device process operation that matches the attack behavior database. Finally, based on the process behavior matching result, the security threat level of the target device is evaluated to obtain a device risk score for the target device.

[0090] Optionally, by matching the device process operation with a pre-built attack behavior database to obtain a process behavior matching result, it is possible to promptly detect whether the process of the target device has attack behavior, thereby ensuring the security of the target device.

[0091] Optionally, based on a preset attack behavior database, a behavior match is performed on the device process operation to obtain a process behavior matching result, including:

[0092] Traverse the attack behavior database to obtain the process attack behavior;

[0093] The device process operation is matched with the process attack behavior to obtain the behavior matching result.

[0094] It should be understood that the process attack behavior, namely the above-mentioned attack behavior, is a structured attack pattern and behavior.

[0095] Optionally, by traversing the data in the attack behavior database, each process attack behavior recorded in the attack behavior database can be obtained, and then each device process operation is matched with the process attack behavior one by one, so as to determine whether there is an operation in the device process operation that matches the attack behavior database, and generate a behavior matching result.

[0096] Optionally, based on the process behavior matching result, the target device is scored to obtain a device risk score, including:

[0097] If the process behavior matching result indicates that there is no operation in the device process operation that matches the attack behavior database, it is determined that there is no security threat to the target device, and a device risk score of zero is generated;

[0098] If the process behavior matching result indicates that there is an operation in the device process operation that matches the attack behavior database, then the process attack operation is filtered out from the device process operation according to the process behavior matching result;

[0099] Based on the preset device behavior risk score mapping function and process attack operation, the target device is scored and the device risk score is obtained.

[0100] It should be understood that the device behavior risk score mapping function is used to represent the mapping relationship between each attack operation of the target device and the risk score. For example, the risk score mapped to data theft can be 80 points, and the risk score mapped to system damage can be 90 points. The device risk score is used to indicate the possibility of security threats to the target device. The smaller the device risk score, the smaller the possibility of security threats to the target device. The larger the device risk score, the greater the possibility of security threats to the target device.

[0101] Optionally, when the process behavior matching result indicates that there is no operation in the device process operation that matches the attack behavior database, it means that there is no security threat to the target device. Therefore, the device risk score of the target device can be the minimum value of zero. When the process behavior matching result indicates that there is an operation in the device process operation that matches the attack behavior database, it means that there is a security threat to the target device. At this time, it is also necessary to filter out the process attack operation of the target device from the device process operation according to the process behavior matching result, and then calculate the score of the target device according to the preset device behavior risk score mapping function and the process attack operation to obtain the device risk score.

[0102] Optionally, based on the device risk score, the panel light is adjusted so that the panel light performs a security detection response for the target device according to the device risk score, including:

[0103] Obtain the score-light-color mapping relationship between the device risk score of the target device and the light color of the panel light;

[0104] Determine the target light color of the panel light based on the equipment risk score and the mapping relationship between the score and light color;

[0105] Based on the target light color, the light color of the panel light is changed to obtain the safety detection response light color.

[0106] It should be understood that the score-to-light color mapping relationship represents the mapping relationship between the device risk score of the target device and the light color of the panel light. For example, when the device risk score is 0, the light color of the panel light may be green. When the device risk score is greater than 0 and less than 50, the light color of the panel light may be yellow. When the device risk score is greater than 50, the light color of the panel light may be red.

[0107] Optionally, by obtaining the mapping relationship between the equipment risk score of a preset target device and the light color of the panel light, a score-light-color mapping relationship is obtained. Secondly, based on the score-light-color mapping relationship and the equipment risk score of the above-mentioned target device, the target light color that the panel light should display can be determined. Finally, based on the target light color, the light color of the panel light is changed to obtain the safety detection response light color, thereby facilitating the staff to quickly understand the safety status of the target device and improving the speed of the equipment safety detection response.

[0108] Optionally, after adjusting the lighting of the panel light based on the device risk score so that the panel light performs a security detection response for the target device according to the device risk score, the method further includes:

[0109] Performing light color monitoring on the safety detection response light color to obtain light color monitoring information, wherein the light color monitoring information is used to indicate whether the safety detection response light color has changed or has not changed;

[0110] If the light color monitoring information indicates that the safety detection response light color has not changed, it is determined that the state of the target device has not changed;

[0111] If the light color monitoring information indicates that the safety detection response light color has changed, it is determined that the state of the target device has changed.

[0112] It should be understood that the device safety detection controller detects the process changes of the target device in real time. Therefore, the present application can determine whether the device status of the target device has changed by monitoring the changes in the light color of the panel light, thereby responding to the safety detection of the target device.

[0113] Optionally, by performing light color monitoring on the safety detection response light color, light color monitoring information indicating whether the safety detection response light color has changed or not is obtained, and when the light color monitoring information indicates that the safety detection response light color has not changed, it is determined that no state change has occurred in the target device; and when the light color monitoring information indicates that the safety detection response light color has changed, it is determined that a state change has occurred in the target device.

[0114] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a device security detection response system 300. Figure 2Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0115] An embodiment of the present invention provides a device security detection response system 300, and the device security detection response system 300 includes:

[0116] The interface information acquisition module 310 is used to acquire the interface information of the target device;

[0117] The device process subscription module 320 is used to subscribe to messages of the target device based on the interface information to obtain the device process information;

[0118] The process risk assessment module 330 is used to perform risk assessment on the target device based on the device process information to obtain a device risk score;

[0119] The device detection response module 340 is used to adjust the lighting of the panel light based on the device risk score, so that the panel light performs a safety detection response for the target device according to the device risk score.

[0120] The specific implementation of the device security detection response system is basically the same as the specific implementation of the device security detection response method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of this application, the device security detection response system can also set other functional modules to implement the device security detection response method in the above embodiment.

[0121] The embodiment of the present application also provides an equipment safety detection controller, which includes an equipment safety detection response system, a panel light, and a light color control system. The light color control device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the above equipment safety detection response method is implemented. The light source of the panel light is a light emitting diode light source, and the panel light has at least three light colors.

[0122] It should be understood that the panel light uses light-emitting diodes (LEDs) as light sources, which have the advantages of high energy efficiency, long life and adjustability. The panel light contains at least three light colors, which can help staff to clearly understand the severity of equipment security threats and set different equipment repair plans according to the severity.

[0123] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A device security detection response method, characterized in that: The method is applied to a device safety detection controller, the device safety detection controller includes a panel light, and the method includes: Get the interface information of the target device; Based on the interface information, subscribe to messages of the target device to obtain device process information; Based on the device process information, a risk assessment is performed on the target device to obtain a device risk score; Based on the device risk score, the panel light is adjusted so that the panel light performs a security detection response for the target device according to the device risk score.

2. The device security detection response method according to claim 1, characterized in that: The step of performing risk assessment on the target device based on the device process information to obtain a device risk score includes: Parsing the device process information to obtain device process operations; Based on a preset attack behavior database, behavior matching is performed on the device process operation to obtain a process behavior matching result, wherein the process behavior matching result is used to indicate that there is an operation in the device process operation that matches the attack behavior database, or there is no operation in the device process operation that matches the attack behavior database; Based on the process behavior matching result, the target device is scored to obtain the device risk score.

3. The device security detection response method according to claim 2, characterized in that: The performing behavior matching on the device process operation based on the preset attack behavior database to obtain the process behavior matching result includes: Traversing the attack behavior database to obtain process attack behavior; The device process operation is data matched with the process attack behavior to obtain the behavior matching result.

4. The device security detection response method according to claim 2, characterized in that: Scoring the target device based on the process behavior matching result to obtain the device risk score includes: If the process behavior matching result indicates that there is no operation in the device process operation that matches the attack behavior database, it is determined that there is no security threat to the target device, and a risk score of the device with a value of zero is generated; If the process behavior matching result indicates that there is an operation in the device process operation that matches the attack behavior database, then according to the process behavior matching result, the process attack operation is filtered out from the device process operation; Based on a preset device behavior risk score mapping function and the process attack operation, a score is calculated for the target device to obtain the device risk score.

5. The device security detection response method according to claim 1, characterized in that: The method of subscribing to a message of the target device based on the interface information to obtain device process information includes: Parsing the interface information to obtain interface attributes; Based on the interface attributes, selecting a process information subscription interface from preset device interfaces; Based on the process information subscription interface, the process information of the target device is subscribed to obtain the device process information.

6. The device security detection response method according to claim 1, characterized in that: The step of adjusting the light of the panel light based on the device risk score so that the panel light performs a security detection response for the target device according to the device risk score includes: Acquire a score-light-color mapping relationship between the device risk score of the target device and the light color of the panel light; Determining a target light color of the panel light based on the equipment risk score and the score-light-color mapping relationship; Based on the target light color, the light color of the panel light is changed to obtain a safety detection response light color.

7. The device security detection response method according to claim 1, characterized in that: After adjusting the lighting of the panel light based on the device risk score so that the panel light performs a security detection response for the target device according to the device risk score, the method further includes: Performing light color monitoring on the safety detection response light color to obtain light color monitoring information, wherein the light color monitoring information is used to indicate whether the safety detection response light color has changed or has not changed; If the light color monitoring information indicates that the safety detection response light color has not changed, it is determined that the state of the target device has not changed; If the light color monitoring information indicates that the safety detection response light color has changed, it is determined that the occurrence state of the target device has changed.

8. A device security detection response system, characterized in that: The device safety detection response system includes: An interface information acquisition module is used to acquire interface information of a target device; A device process subscription module, used to subscribe to messages of the target device based on the interface information to obtain device process information; A process risk assessment module, used to perform risk assessment on the target device based on the device process information to obtain a device risk score; The device detection response module is used to adjust the lighting of the panel light based on the device risk score, so that the panel light performs a security detection response for the target device according to the device risk score.

9. A device safety detection controller, characterized in that: The mining equipment includes an equipment safety detection response system, a panel light and a light color control system. The light color control device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the equipment safety detection response method according to any one of claims 1 to 7 is implemented.

10. The equipment safety detection controller according to claim 9, characterized in that: The light source of the panel light is a light emitting diode light source, and the panel light has at least three light colors.

Images