Industrial network security log collection method, system and medium

Abstract

The present invention relates to the technical field of security log collection, and in particular to an industrial network security log collection method, system and medium, including: obtaining a number of security logs, maintenance times and duration of each maintenance of each device in a food production workshop within a preset operating time; obtaining the production output and production quality rating of each device within the time interval of adjacent security logs; obtaining the two-dimensional discrete space of the device and the security log; obtaining the final abnormal degree of the visitor in each security log of each device in the food production workshop; obtaining the significant value of each two-dimensional data point in the two-dimensional discrete space; screening a number of normal security logs and a number of abnormal security logs; and storing the normal security logs and the abnormal security logs separately. The present invention helps to ensure the stability of the production line of the food production workshop and the safety of food.

Description

Technical Field

[0001] The present invention relates to the technical field of security log collection, and in particular to an industrial network security log collection method, system and medium. Background Art

[0002] In the food processing industry, automated production lines rely on core parameters such as temperature, humidity, stirring speed, and final quality inspection. These core parameters directly determine the quality and safety of food and are crucial to the operational behavior of production equipment. However, with the development of networking and informatization of industrial equipment, food production plants face higher network security risks. Potential illegal remote access, parameter modification, or malicious attacks may cause equipment to operate abnormally, directly affecting the quality and safety of food. For example, unauthorized parameter adjustments may cause abnormalities in the temperature, humidity, stirring speed, etc. of the production line, affecting production efficiency and product qualification rate. In addition, the leakage of industrial equipment operating parameters or recipe data may also lead to the loss of core confidential information of the enterprise, resulting in economic losses.

[0003] When collecting security logs of equipment in food production workshops, the security logs generated by the equipment in the food production workshops are collected in real time and stored. However, with the development of networking and informatization of industrial equipment, food production factories are facing higher network security risks. Some non-staff or staff members remotely access and illegally modify the equipment maliciously. If the security logs of the equipment are collected only through the existing collection methods, it is impossible to determine whether the security logs have been maliciously and illegally accessed or illegally modified, which may lead to hidden dangers in the quality and safety of the final food produced. Summary of the invention

[0004] To solve the above problems, the present invention provides an industrial network security log collection method, system and medium.

[0005] The industrial network security log collection method, system and medium of the present invention adopt the following technical solutions:

[0006] An embodiment of the present invention provides an industrial network security log collection method, the method comprising the following steps:

[0007] Obtain several security logs, maintenance times and duration of each maintenance for each device in the food production workshop during the preset operating time, wherein the security log includes the visitor information, access time and access times of the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop;

[0008] According to the running time, maintenance times and duration of each maintenance of the equipment, the instability of each equipment in the food production workshop is obtained; according to the change of the interval between adjacent safety logs of the equipment, the production output and production quality rating of the equipment in the time interval between adjacent safety logs, the importance of each safety log of each equipment in the food production workshop is obtained; according to the instability and importance, a two-dimensional discrete space of equipment and safety logs is constructed;

[0009] According to the difference between the visitor's access time and the employee's working time in the security log, the number of visits to the equipment in the security log and the instability of the equipment, the initial abnormality degree of the visitor in each security log of each equipment in the food production workshop is obtained; according to the number of other security logs before the visitor's visit in the security log to be analyzed and the frequency of visits, the initial abnormality degree is corrected to obtain the final abnormality degree of the visitor in each security log of each equipment in the food production workshop;

[0010] The final abnormality degree of the visitor in each security log of each device in the food production workshop is used as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, the significance value of each two-dimensional data point in the two-dimensional discrete space is obtained; according to the size of the significance value, several normal security logs and several abnormal security logs are screened out; the normal security logs and the abnormal security logs are stored separately.

[0011] Furthermore, the instability of each device in the food production workshop is obtained according to the running time of the equipment, the number of maintenance times and the duration of each maintenance, and the specific steps included are as follows:

[0012] Any equipment in the food production workshop is recorded as the equipment to be analyzed;

[0013]

[0014] In the formula, is the operating time of the equipment to be analyzed; The number of maintenance times for the equipment to be analyzed; The device to be analyzed The duration of the maintenance; is the sigmoid function; is the instability of the device to be analyzed.

[0015] Furthermore, the importance of each safety log of each device in the food production workshop is obtained according to the change of the interval length of adjacent safety logs of the device, the production output and production quality rating of the device in the time interval of adjacent safety logs, and the specific steps include the following:

[0016]

[0017] In the formula, For the device to be analyzed The standardized value of the time interval between adjacent security logs; For the device to be analyzed The production output in the time interval of the adjacent safety logs is The absolute difference in production output within the time interval of adjacent security logs, the The specific time interval between adjacent security logs is: The time of the security log is The length of the time period formed by the time of the i-th security log is recorded as the time interval between the i-th adjacent security logs; For the device to be analyzed The production quality ratings in the time interval between the first and second security logs are The absolute difference in production quality ratings within the time interval of adjacent security logs; is the first preset hyperparameter; To take the absolute value; is the sigmoid function; The device to be analyzed The importance of a security log.

[0018] Furthermore, the two-dimensional discrete space of the device and security log is constructed according to the instability and importance, and the specific steps include the following:

[0019] Obtain the instability of all equipment in a food production workshop; obtain the importance of all safety logs of all equipment in the food production workshop; construct a two-dimensional rectangular coordinate system using instability as the horizontal axis and importance as the vertical axis, mark the two-dimensional data points determined by the instability of each equipment in the food production workshop and the importance of each safety log of each equipment in the two-dimensional rectangular coordinate system, and use the two-dimensional rectangular coordinate system containing several marks as the two-dimensional discrete space of the equipment and the safety log.

[0020] Furthermore, the initial abnormality degree of the visitor in each security log of each device in the food production workshop is obtained according to the difference between the visitor's access time and the employee's working time in the security log, the number of visits to the device in the security log, and the instability of the device, including the following specific steps:

[0021] Any security log of the device to be analyzed is recorded as the security log to be analyzed;

[0022]

[0023] In the formula, The access time of the visitor in the security log to be analyzed; is the median working hours of employees in food production workshops; Working hours for employees in food production workshops; The number of times the visitor in the security log to be analyzed accesses the device to be analyzed; The number of times the visitor in the security log to be analyzed accesses all the equipment in the food production workshop; To take the absolute value; is the preset second hyperparameter; The initial abnormality level of the visitor in the security log to be analyzed.

[0024] Furthermore, the initial abnormality degree is corrected according to the number of other security logs accessed by the visitor in the security log to be analyzed and the frequency of access, so as to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop, including the following specific steps:

[0025]

[0026] In the formula, is the initial abnormality degree of the visitor in the security log to be analyzed; the visitor in the security log to be analyzed is recorded as the target visitor, The number of other security logs before the target visitor accesses the security log to be analyzed. Before the target visitor accesses the security log to be analyzed The initial abnormality level of the visitor in other security logs, Before the target visitor accesses the security log to be analyzed The time interval between other security logs and the security log to be analyzed; The final abnormality level of the visitor in the security log to be analyzed.

[0027] Furthermore, the step of obtaining the significant value of each two-dimensional data point in the two-dimensional discrete space according to the abnormality degree and the two-dimensional discrete space includes the following specific steps:

[0028] The two-dimensional data points corresponding to the security log to be analyzed in the two-dimensional discrete space are recorded as target points;

[0029]

[0030] In the formula, is the number of other two-dimensional data points in the neighborhood of the target point. The specific method for obtaining the neighborhood of the target point is: in the two-dimensional discrete space, the neighborhood radius is centered at the target point. The circular range formed, is a preset first value; is the first The absolute difference between the abnormality level of the security log corresponding to the two-dimensional data point and the abnormality level of the security log corresponding to the target point; is the first The Euclidean distance between the two-dimensional data points and the target point; is the preset third hyperparameter; is an exponential function with a natural constant as base; is the saliency value of the target point in the two-dimensional discrete space.

[0031] Furthermore, the method of screening out a number of normal security logs and a number of abnormal security logs according to the size of the significant value includes the following specific steps:

[0032] A significant anomaly threshold is preset, and the security logs corresponding to the two-dimensional data points whose significant values ​​are greater than or equal to the significant anomaly threshold are regarded as abnormal security logs, and the security logs corresponding to the two-dimensional data points whose significant values ​​are less than the significant anomaly threshold are regarded as normal security logs.

[0033] The present invention also proposes an industrial network security log collection system, which includes the following modules:

[0034] Data collection module: used to obtain several security logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time, wherein the security log includes the visitor information, access time and access times of the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop;

[0035] Two-dimensional discrete space module: used to obtain the instability of each device in the food production workshop according to the equipment's operating time, number of maintenance times and duration of each maintenance; obtain the importance of each safety log of each device in the food production workshop according to the change in the interval between adjacent safety logs, the equipment's production output and production quality rating within the time interval between adjacent safety logs; construct a two-dimensional discrete space of equipment and safety logs based on instability and importance;

[0036] Final abnormality degree module: used to obtain the initial abnormality degree of the visitor in each security log of each device in the food production workshop according to the difference between the visitor's access time in the security log and the employee's working time, the number of visits to the device in the security log and the instability of the device; the initial abnormality degree is corrected according to the number of other security logs before the visitor's access in the security log to be analyzed and the frequency of access, so as to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop;

[0037] Security log storage module: used to use the final abnormality degree of the visitor in each security log of each device in the food production workshop as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, obtain the significant value of each two-dimensional data point in the two-dimensional discrete space; according to the size of the significant value, screen out several normal security logs and several abnormal security logs; store the normal security logs and abnormal security logs separately.

[0038] The present invention also proposes an industrial network security log collection medium, on which computer instructions are stored, and when the computer instructions are executed by a processor, the steps of the aforementioned method are implemented.

[0039] The beneficial effect of the technical solution of the present invention is that by performing correlation analysis on security logs and production data, abnormal security logs that have a significant impact on the operation of food production equipment and product quality can be quickly located, thereby improving the efficiency and accuracy of abnormal log screening. In combination with the CA significance detection algorithm, by constructing a two-dimensional discrete space of equipment and security logs, potential illegal access or parameter modification behaviors can be effectively identified, which helps to ensure the stability of the production line of the food production workshop and the safety of food, and reduce the potential risks in the quality and safety of the produced food. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 A flowchart of a method for collecting industrial network security logs provided by an embodiment of the present invention;

[0042] Figure 2 A flowchart for screening normal security logs and abnormal security logs provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the industrial network security log collection method, system and medium proposed by the present invention, its specific implementation method, structure, features and effects in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0044] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0045] The following describes in detail a specific scheme of an industrial network security log collection method, system and medium provided by the present invention in conjunction with the accompanying drawings.

[0046] See also Figure 1 and Figure 2 , which respectively show a flowchart of a method for collecting industrial network security logs and a flowchart for screening normal security logs and abnormal security logs provided by an embodiment of the present invention, the method comprising the following steps:

[0047] Step S001, obtain several safety logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time; obtain the production output and production quality rating of each device within the time interval of adjacent safety logs; obtain the working hours of employees in the food production workshop.

[0048] It should be noted that the main purpose of this embodiment is to collect abnormal safety logs and normal safety logs that appear in each device in the food production workshop during the preset operating time, and reduce the hidden dangers in the produced food after analysis. Data is collected first before starting the analysis.

[0049] Specifically, obtain several security logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time, wherein the security log includes the visitor information, access time and number of visits to the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop.

[0050] It should be noted that obtaining a number of safety logs, the number of maintenance times and the duration of each maintenance for each device in a food production workshop within the preset operating time, and obtaining the production output and production quality rating of each device within the time interval of adjacent safety logs are existing methods, which will not be repeated in this embodiment. The preset operating time in this embodiment is 30 days, which can be adjusted according to the actual implementation situation.

[0051] At this point, several safety logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time are obtained, and the production output and production quality rating of each device within the time interval of adjacent safety logs are obtained.

[0052] Step S002: According to the running time, maintenance times and duration of each maintenance of the equipment, the instability of each equipment in the food production workshop is obtained; according to the change of the interval between adjacent safety logs of the equipment, the production output and production quality rating of the equipment in the time interval between adjacent safety logs, the importance of each safety log of each equipment in the food production workshop is obtained; according to the instability and importance, a two-dimensional discrete space of equipment and safety logs is constructed.

[0053] It should be noted that in food production workshops, multiple automated devices work together through the Internet, which will generate a large amount of security logs and other information. The logs reflect key information such as the operating status of the equipment and parameter modifications, which directly affect food quality and production efficiency. By collecting logs and combining them with data such as the equipment's maintenance history and production quality, the CA (Context-Aware) saliency detection algorithm is used to evaluate the saliency of the logs, and screen out abnormal logs that have a significant impact on production safety and food quality. For example, fine-tuning the temperature or stirring speed in the equipment's security log may lead to the production of unqualified food, while illegal access or unauthorized operations may also interfere with production. Through the multi-scale analysis and abnormal saliency evaluation of the CA saliency detection algorithm, potential security threats can be quickly identified to ensure the stability and safety of the food production process.

[0054] It should be noted that when screening abnormal security logs in a food production workshop, due to the large number of security logs in the workshop, it is impossible to screen out the abnormal logs in the first time. The CA significance detection algorithm can highlight the significant area in the image or space, that is, the area that is obviously different from the surrounding environment or eye-catching. Therefore, this embodiment considers using the CA significance detection algorithm to screen abnormal logs. Before starting the analysis, it is necessary to first construct a two-dimensional discrete space for equipment and security logs.

[0055] It should be noted that when food production workshops are producing food, the stability of different equipment has different effects on food production. Therefore, it is necessary to analyze the instability of the equipment based on the equipment's operating time, number of maintenance times, and the duration of each maintenance. The greater the instability, the more attention the equipment needs.

[0056] Specifically, according to the equipment's operating time, number of maintenance times and duration of each maintenance, the instability of each equipment in the food production workshop is obtained, as follows:

[0057] Any equipment in the food production workshop is recorded as the equipment to be analyzed.

[0058]

[0059] In the formula, is the operating time of the equipment to be analyzed; The number of maintenance times for the equipment to be analyzed; The device to be analyzed The duration of the maintenance; is the sigmoid function, used for normalization; is the instability of the device to be analyzed.

[0060] It should be noted that Indicates the failure frequency of the equipment to be analyzed in the food production workshop. The more times the equipment to be analyzed is repaired, the higher the failure frequency of the equipment to be analyzed, the more unstable the equipment to be analyzed is, and the more attention needs to be paid; Indicates the cumulative maintenance time of the equipment to be analyzed. The longer the cumulative time, the longer the failure time of the equipment to be analyzed, the more unstable the equipment to be analyzed is, and it needs special attention.

[0061] It should be noted that in a food production workshop, the equipment parameters of each device are adjusted multiple times to be the most suitable for the production workshop, so that the production efficiency of the production workshop reaches the relatively optimal level and the safety level reaches the relatively highest level. Therefore, when the parameters of the equipment change, the production efficiency and production safety in the workshop will decrease. By analyzing the changes in the interval length of adjacent safety logs of the equipment, the production output and production quality rating of the equipment in the time interval of adjacent safety logs, the importance of each safety log of each device in the food production workshop is obtained.

[0062] Specifically, according to the change of the interval length of the equipment between adjacent safety logs, the production output and production quality rating of the equipment within the time interval of adjacent safety logs, the importance of each safety log of each equipment in the food production workshop is obtained, as follows:

[0063]

[0064] In the formula, For the device to be analyzed The standardized value of the time interval between two adjacent security logs, and the specific standardization method adopts the Z-score standardization method; For the device to be analyzed The production output in the time interval of the adjacent safety logs is The absolute difference in production output within the time interval of adjacent security logs, the The specific time interval between adjacent security logs is: The time of the security log is The length of the time period composed of the time of the security logs is recorded as the time interval between the i-th adjacent security logs. , The total number of security logs of the device to be analyzed; For the device to be analyzed The production quality ratings in the time interval between the first and second security logs are The absolute difference in production quality ratings within the time interval of adjacent security logs; is the first preset hyperparameter, the purpose of which is to prevent the denominator from being 0. to give a narrative; To take the absolute value; is the sigmoid function, used for normalization; The device to be analyzed The importance of a security log.

[0065] It should be noted that Indicates the change in the interval time of adjacent security logs of the device to be analyzed. The larger the standardized value of the interval time, the greater the difference between the current interval time of adjacent security logs and the average interval level, and the more obvious the fluctuation of security log changes is compared with the usual time. The greater the importance of a security log; and They respectively represent the difference in production output and production quality rating within the time interval of two adjacent security logs of the device to be analyzed. If the production output and production quality rating have changed significantly within the time interval, it means that the device is adjusting parameters and has not reached the optimal device parameters. At this time, the importance of the security log is relatively small. Otherwise, the importance of the security log is high.

[0066] It should be noted that in the CA saliency detection algorithm, the spatial distance is based on the position between regions in the image. For adjacent regions, the closer the distance, the more similar their color distance should be. If they are not similar, it means that there is a difference between the region and the surrounding areas, and the significance of the region is higher. In this embodiment, since there are no direct parameters in the graph, after obtaining the instability of each device in the food production workshop and the importance of each safety log of each device in the food production workshop, it is necessary to construct a two-dimensional discrete space about the equipment and the safety log based on them.

[0067] Specifically, according to instability and importance, a two-dimensional discrete space of equipment and security logs is constructed as follows:

[0068] Obtain the instability of all equipment in a food production workshop; obtain the importance of all safety logs of all equipment in the food production workshop; construct a two-dimensional rectangular coordinate system using instability as the horizontal axis and importance as the vertical axis, mark the two-dimensional data points determined by the instability of each equipment in the food production workshop and the importance of each safety log of each equipment in the two-dimensional rectangular coordinate system, and use the two-dimensional rectangular coordinate system containing several marks as the two-dimensional discrete space of the equipment and the safety log.

[0069] At this point, a two-dimensional discrete space of device and security logs is constructed.

[0070] Step S003: According to the difference between the visitor's access time in the security log and the employee's working hours, the number of visits to the device in the security log and the instability of the device, the initial abnormality degree of the visitor in each security log of each device in the food production workshop is obtained; according to the number of other security logs before the visitor's access in the security log to be analyzed and the frequency of visits, the initial abnormality degree is corrected to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop.

[0071] It should be noted that each safety log in a food production workshop can only represent the aggregation of the importance of equipment and safety logs in a two-dimensional discrete space, and cannot represent the anomalies of the safety logs. In a food production workshop, different employees are responsible for different equipment areas. Each employee has his or her own daily working hours and work locations, and these hours and locations will not change significantly. Therefore, for each safety log, the time and location for modifying or viewing the parameters of the equipment in the log are also the same. In addition, in order to facilitate the monitoring and control of production equipment in the current workshops, many devices are connected to the Internet, so it is possible that non-staff or staff members remotely control the equipment. Malicious illegal access operations and illegal modification operations lead to hidden dangers in the quality and safety of the food finally produced; and two-dimensional data points with similar distribution in two-dimensional discrete space have relatively similar differences. The greater the difference in abnormal performance, the more likely the information recorded in the security log corresponding to the data point is abnormal access information. Therefore, it is necessary to analyze the degree of abnormality of the visitor in each security log. A security log will record a visitor, so it can reflect the degree of abnormality of the security log. Therefore, based on the distribution of the two-dimensional data points of the security log in the two-dimensional discrete space and the difference in abnormal performance, the significance of each security log is calculated, so as to further combine the CA significance detection algorithm to screen abnormal security logs.

[0072] Specifically, according to the difference between the visitor's access time and the employee's working time in the security log, the number of visits to the equipment in the security log, and the instability of the equipment, the initial abnormality level of the visitor in each security log of each equipment in the food production workshop is obtained, as follows:

[0073] Any security log of the device to be analyzed is recorded as the security log to be analyzed.

[0074]

[0075] In the formula, The access time of the visitor in the security log to be analyzed; is the median working hours of employees in food production workshops; Working hours for employees in food production workshops; The number of times the visitor in the security log to be analyzed accesses the device to be analyzed; The number of times the visitor in the security log to be analyzed accesses all the equipment in the food production workshop; The instability of the equipment to be analyzed; To take the absolute value; is the second preset hyperparameter, the purpose of which is to prevent the denominator from being 0. to give a narrative; The initial abnormality level of the visitor in the security log to be analyzed.

[0076] It should be noted that Indicates the difference between the median of the access time and the normal access time. The larger the difference, the greater the deviation between the median of the access time and the normal access time, and the more likely it is an abnormal access. The greater the initial abnormality of the visitor in the security log to be analyzed; Indicates the access frequency of the security log to be analyzed. The lower the access frequency of the security log to be analyzed, the more sudden the access is during normal operation. The greater the initial abnormality of the visitor in the security log to be analyzed, the greater the analysis is combined with the instability of the device to be analyzed. The instability can reflect the stability of the device to be analyzed. The greater the instability, the worse the stability of the device to be analyzed, and the more likely it is to be abnormal.

[0077] It should be noted that during food production, it is not just one device that is producing, but multiple devices that are working together. Therefore, for those who want to perform remote illegal access operations and illegal modification operations, accessing only one device cannot reduce the production efficiency of the food production workshop or obtain all the complete equipment parameters. Usually, there will be multiple consecutive abnormal accesses within a period of time, and only one abnormal access record may be a normal operation such as job transfer. Therefore, it is necessary to analyze the previous multiple security logs of each visitor to obtain the final abnormality level of the visitor in the security log.

[0078] Specifically, the initial abnormality level is corrected according to the number of other security logs accessed by the visitor in the security log to be analyzed and the frequency of access, and the final abnormality level of the visitor in each security log of each device in the food production workshop is obtained, as follows:

[0079]

[0080] In the formula, is the initial abnormality degree of the visitor in the security log to be analyzed; the visitor in the security log to be analyzed is recorded as the target visitor, The number of other security logs before the target visitor accesses the security log to be analyzed. Before the target visitor accesses the security log to be analyzed The initial abnormality level of the visitor in other security logs, Before the target visitor accesses the security log to be analyzed The time interval between other security logs and the security log to be analyzed; The final abnormality level of the visitor in the security log to be analyzed.

[0081] It should be noted that Indicates the initial abnormality of the same visitor accessing other security logs. It indicates the time interval between the same visitor accessing other security logs and the security log to be analyzed. The greater the initial abnormality of accessing other security logs, the more abnormal it is. If the time interval of accessing other security logs is short, the more frequent the access, the more likely it is that there are multiple consecutive abnormal accesses. The more abnormal the visitor in the security log to be analyzed, the more abnormal the visitor is. right Perform weighted correction to obtain the final abnormality level of the visitor in the security log to be analyzed.

[0082] At this point, the final abnormality level of the visitor in each security log of each device in the food production workshop is obtained.

[0083] Step S004: use the final abnormality degree of the visitor in each security log of each device in the food production workshop as the abnormality degree of each security log of each device in the food production workshop; obtain the significance value of each two-dimensional data point in the two-dimensional discrete space according to the abnormality degree and the two-dimensional discrete space; screen out several normal security logs and several abnormal security logs according to the size of the significant value; and store the normal security logs and the abnormal security logs separately.

[0084] It should be noted that after obtaining the final abnormality degree of the visitor in each security log, it is used as a parameter for calculating the saliency value of each point in the two-dimensional discrete space of the computing device and the security log in the CA saliency detection algorithm. The distance between the points in the constructed two-dimensional discrete space is used as another parameter of the CA algorithm to obtain the saliency value of each point in the two-dimensional discrete space, thereby screening out normal security logs and abnormal security logs.

[0085] Specifically, the final abnormality degree of the visitor in each security log of each device in the food production workshop is used as the abnormality degree of each security log of each device in the food production workshop.

[0086] It should be noted that, since one security log corresponds to one visitor, the final abnormality degree of the visitor in the security log is used as the abnormality degree of the security log for subsequent analysis.

[0087] Furthermore, according to the abnormality degree and the two-dimensional discrete space, the significant value of each two-dimensional data point in the two-dimensional discrete space is obtained, as follows:

[0088] The two-dimensional data points corresponding to the security log to be analyzed in the two-dimensional discrete space are recorded as target points.

[0089]

[0090] In the formula, is the number of other two-dimensional data points in the neighborhood of the target point. The specific method for obtaining the neighborhood of the target point is: in the two-dimensional discrete space, the neighborhood radius is centered at the target point. The circular range formed, is the preset first value. to give a narrative; is the first The absolute difference between the abnormality level of the security log corresponding to the two-dimensional data point and the abnormality level of the security log corresponding to the target point; is the first The Euclidean distance between the two-dimensional data points and the target point; is the third preset hyperparameter, the purpose of which is to prevent the denominator from being 0. to give a narrative; is an exponential function with a natural constant as the base. The model is used to realize the inverse proportional relationship and normalization processing. is the input of the model; is the saliency value of the target point in the two-dimensional discrete space.

[0091] It should be noted that This means that when the distance between the target point and other points in the neighborhood in the two-dimensional discrete space of the device and the security log is closer, the abnormality degree between the two-dimensional data points corresponding to the security log should be similar. The larger the value is, the greater the difference in the degree of abnormality between the corresponding security logs. By comparing multiple two-dimensional data points in the neighborhood, the significance value of the target point in the two-dimensional discrete space is obtained. The larger the significance value is, the more significant the security log corresponding to the two-dimensional data point is, and the more likely it is an abnormal security log.

[0092] Furthermore, according to the size of the significant value, several normal security logs and several abnormal security logs are screened out, as follows:

[0093] The preset significant anomaly threshold is 0.7. The security logs corresponding to the two-dimensional data points whose significance values ​​are greater than or equal to the significant anomaly threshold are regarded as abnormal security logs, and the security logs corresponding to the two-dimensional data points whose significance values ​​are less than the significant anomaly threshold are regarded as normal security logs.

[0094] Specifically, normal security logs and abnormal security logs are stored separately.

[0095] It should be noted that storing normal security logs and abnormal security logs separately is an existing method, which will not be repeated in this embodiment; for the abnormal security logs, the staff needs to further verify whether the logs will affect the actual production and the confidentiality of the production formula, and reduce abnormal situations that may pose hidden dangers to the quality and safety of the food produced.

[0096] Through the above steps, an industrial network security log collection method is completed.

[0097] Another embodiment of the present invention provides an industrial network security log collection system, which includes the following modules:

[0098] Data collection module: used to obtain several security logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time, wherein the security log includes the visitor information, access time and access times of the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop;

[0099] Two-dimensional discrete space module: used to obtain the instability of each device in the food production workshop according to the equipment's operating time, number of maintenance times and duration of each maintenance; obtain the importance of each safety log of each device in the food production workshop according to the change in the interval between adjacent safety logs, the equipment's production output and production quality rating within the time interval between adjacent safety logs; construct a two-dimensional discrete space of equipment and safety logs based on instability and importance;

[0100] Final abnormality degree module: used to obtain the initial abnormality degree of the visitor in each security log of each device in the food production workshop according to the difference between the visitor's access time in the security log and the employee's working time, the number of visits to the device in the security log and the instability of the device; the initial abnormality degree is corrected according to the number of other security logs before the visitor's access in the security log to be analyzed and the frequency of access, so as to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop;

[0101] Security log storage module: used to use the final abnormality degree of the visitor in each security log of each device in the food production workshop as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, obtain the significant value of each two-dimensional data point in the two-dimensional discrete space; according to the size of the significant value, screen out several normal security logs and several abnormal security logs; store the normal security logs and abnormal security logs separately.

[0102] Another embodiment of the present invention provides an industrial network security log collection medium, on which computer instructions are stored, and when the computer instructions are executed by a processor, the following operations are performed:

[0103] Obtain several security logs, maintenance times and duration of each maintenance for each device in a food production workshop within a preset operating time, wherein the security log includes visitor information, access time and number of visits to the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop; obtain the instability of each device in the food production workshop based on the operating time, maintenance times and duration of each maintenance of the equipment; obtain the importance of each security log of each device in the food production workshop based on the changes in the time interval between adjacent security logs, the production output and production quality rating of the equipment within the time interval between adjacent security logs; construct a two-dimensional discrete space of equipment and security logs based on instability and importance; The initial abnormality degree of the visitor in each security log of each device in the food production workshop is obtained based on the differences in working hours, the number of visits to the device in the security log and the instability of the device; the initial abnormality degree is corrected according to the number of other security logs visited by the visitor in the security log to be analyzed and the frequency of visits, so as to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop; the final abnormality degree of the visitor in each security log of each device in the food production workshop is used as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, the significant value of each two-dimensional data point in the two-dimensional discrete space is obtained; according to the size of the significant value, a number of normal security logs and a number of abnormal security logs are screened out; the normal security logs and the abnormal security logs are stored separately.

[0104] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for collecting industrial network security logs, characterized in that: The method comprises the following steps: Obtain several security logs, maintenance times and duration of each maintenance for each device in the food production workshop during the preset operating time, wherein the security log includes the visitor information, access time and access times of the device; obtain the production output and production quality rating of each device within the time interval of adjacent security logs; obtain the working hours of employees in the food production workshop; According to the running time, maintenance times and duration of each maintenance of the equipment, the instability of each equipment in the food production workshop is obtained; according to the change of the interval between adjacent safety logs of the equipment, the production output and production quality rating of the equipment in the time interval between adjacent safety logs, the importance of each safety log of each equipment in the food production workshop is obtained; according to the instability and importance, a two-dimensional discrete space of equipment and safety logs is constructed; According to the difference between the visitor's access time and the employee's working time in the security log, the number of visits to the equipment in the security log and the instability of the equipment, the initial abnormality degree of the visitor in each security log of each equipment in the food production workshop is obtained; according to the number of other security logs before the visitor's visit in the security log to be analyzed and the frequency of visits, the initial abnormality degree is corrected to obtain the final abnormality degree of the visitor in each security log of each equipment in the food production workshop; The final abnormality degree of the visitor in each security log of each device in the food production workshop is used as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, the significance value of each two-dimensional data point in the two-dimensional discrete space is obtained; according to the size of the significance value, several normal security logs and several abnormal security logs are screened out; the normal security logs and the abnormal security logs are stored separately.

2. According to claim 1, the industrial network security log collection method is characterized in that: The instability of each device in the food production workshop is obtained according to the running time of the equipment, the number of maintenance times and the duration of each maintenance, and the specific steps included are as follows: Any equipment in the food production workshop is recorded as the equipment to be analyzed; In the formula, is the operating time of the equipment to be analyzed; The number of maintenance of the equipment to be analyzed; The device to be analyzed The duration of the maintenance; is the sigmoid function; is the instability of the device to be analyzed.

3. According to claim 2, the industrial network security log collection method is characterized in that: The importance of each safety log of each device in the food production workshop is obtained according to the change of the interval length of adjacent safety logs of the device, the production output and production quality rating of the device in the time interval of adjacent safety logs, and the specific steps include the following: In the formula, For the device to be analyzed The standardized value of the time interval between adjacent security logs; For the device to be analyzed The production output in the time interval of the adjacent safety logs is The absolute difference in production output within the time interval of adjacent security logs, the The specific time interval between adjacent security logs is: The time of the security log is The length of the time period formed by the time of the i-th security log is recorded as the time interval between the i-th adjacent security logs; For the device to be analyzed The production quality ratings in the time interval between the first and second security logs are The absolute difference in production quality ratings within the time interval of adjacent security logs; is the first preset hyperparameter; To take the absolute value; is the sigmoid function; The device to be analyzed The importance of a security log.

4. According to claim 1, the industrial network security log collection method is characterized in that: The two-dimensional discrete space of equipment and security logs is constructed according to instability and importance, and the specific steps include the following: Obtain the instability of all equipment in a food production workshop; obtain the importance of all safety logs of all equipment in the food production workshop; construct a two-dimensional rectangular coordinate system using instability as the horizontal axis and importance as the vertical axis, mark the two-dimensional data points determined by the instability of each equipment in the food production workshop and the importance of each safety log of each equipment in the two-dimensional rectangular coordinate system, and use the two-dimensional rectangular coordinate system containing several marks as the two-dimensional discrete space of the equipment and the safety log.

5. According to claim 2, the industrial network security log collection method is characterized in that: The method of obtaining the initial abnormality degree of the visitor in each security log of each device in the food production workshop according to the difference between the visitor's access time and the employee's working time in the security log, the number of visits to the device in the security log, and the instability of the device, includes the following specific steps: Any security log of the device to be analyzed is recorded as the security log to be analyzed; In the formula, The access time of the visitor in the security log to be analyzed; is the median working hours of employees in food production workshops; Working hours for employees in food production workshops; The number of times the visitor in the security log to be analyzed accesses the device to be analyzed; The number of times the visitor in the security log to be analyzed accesses all the equipment in the food production workshop; To take the absolute value; is the preset second hyperparameter; The initial abnormality level of the visitor in the security log to be analyzed.

6. According to claim 5, the industrial network security log collection method is characterized in that: The initial abnormality degree is corrected according to the number of other security logs accessed by the visitor in the security log to be analyzed and the frequency of access, so as to obtain the final abnormality degree of the visitor in each security log of each device in the food production workshop, including the following specific steps: In the formula, is the initial abnormality level of the visitor in the security log to be analyzed; The visitor in the security log to be analyzed is recorded as the target visitor. The number of other security logs before the target visitor accesses the security log to be analyzed. Before the target visitor accesses the security log to be analyzed The initial abnormality level of the visitor in other security logs, Before the target visitor accesses the security log to be analyzed The time interval between other security logs and the security log to be analyzed; The final abnormality level of the visitor in the security log to be analyzed.

7. The industrial network security log collection method according to claim 5, characterized in that: The specific steps of obtaining the significant value of each two-dimensional data point in the two-dimensional discrete space according to the abnormality degree and the two-dimensional discrete space are as follows: The two-dimensional data points corresponding to the security log to be analyzed in the two-dimensional discrete space are recorded as target points; In the formula, is the number of other two-dimensional data points in the neighborhood of the target point. The specific method for obtaining the neighborhood of the target point is: in the two-dimensional discrete space, the neighborhood radius is centered at the target point. The circular range formed, is a preset first value; is the first The absolute difference between the abnormality level of the security log corresponding to the two-dimensional data point and the abnormality level of the security log corresponding to the target point; is the first The Euclidean distance between the two-dimensional data points and the target point; is the preset third hyperparameter; is an exponential function with a natural constant as base; is the saliency value of the target point in the two-dimensional discrete space.

8. The industrial network security log collection method according to claim 1, characterized in that: The specific steps of screening out a number of normal security logs and a number of abnormal security logs according to the size of the significant value are as follows: A significant anomaly threshold is preset, and the security logs corresponding to the two-dimensional data points whose significant values ​​are greater than or equal to the significant anomaly threshold are regarded as abnormal security logs, and the security logs corresponding to the two-dimensional data points whose significant values ​​are less than the significant anomaly threshold are regarded as normal security logs.

9. An industrial network security log collection system, characterized in that: The system includes the following modules: Data collection module: used to obtain several safety logs, maintenance times and duration of each maintenance for each device in the food production workshop within the preset operating time, wherein the safety log includes the visitor information, access time and access times of the device; obtain the production output and production quality rating of each device within the time interval of adjacent safety logs; Get the working hours of employees in food production workshops; Two-dimensional discrete space module: used to obtain the instability of each device in the food production workshop according to the equipment's operating time, number of maintenance times and duration of each maintenance; obtain the importance of each safety log of each device in the food production workshop according to the change in the interval between adjacent safety logs, the equipment's production output and production quality rating within the time interval between adjacent safety logs; construct a two-dimensional discrete space of equipment and safety logs based on instability and importance; Final abnormality degree module: used to obtain the initial abnormality degree of the visitor in each security log of each device in the food production workshop according to the difference between the visitor's access time in the security log and the employee's working time, the number of visits to the device in the security log, and the instability of the device; The initial abnormality level is corrected according to the number of other security logs accessed by the visitor in the security log to be analyzed and the frequency of access, so as to obtain the final abnormality level of the visitor in each security log of each device in the food production workshop; Security log storage module: used to use the final abnormality degree of the visitor in each security log of each device in the food production workshop as the abnormality degree of each security log of each device in the food production workshop; according to the abnormality degree and the two-dimensional discrete space, obtain the significant value of each two-dimensional data point in the two-dimensional discrete space; according to the size of the significant value, screen out a number of normal security logs and a number of abnormal security logs; Normal security logs and abnormal security logs are stored separately.

10. An industrial network security log collection medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by a processor, the steps of an industrial network security log collection method described in any one of claims 1 to 8 are implemented.

Images