Industrial Internet of Things safety monitoring method and system

Abstract

The invention provides an industrial Internet of Things safety monitoring method and system, and relates to the technical field of data processing. The method comprises the following steps: acquiring operation parameters of each industrial hardware device; determining a hardware exception score according to the operation parameters; acquiring operation data of each industrial application program; determining a software exception score according to the operation data; acquiring network flow data of each key network node; obtaining a network flow feature vector of the key network node; determining a network anomaly score according to the network traffic data and the network traffic feature vector; according to a result obtained by subtracting weighted summation of the hardware anomaly score, the software anomaly score and the network anomaly score from 1, determining an industrial Internet of Things safety monitoring score; and generating an industrial Internet of Things safety monitoring report according to the industrial Internet of Things safety monitoring score. According to the invention, the comprehensiveness, objectivity and accuracy of safety monitoring of the industrial Internet of Things can be improved through three aspects of hardware conditions, software conditions and network conditions.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an industrial Internet of Things security monitoring method and system. Background Art

[0002] In the related art, the industrial Internet of Things security monitoring method and system provided by CN116302841A can generate a corresponding highlighted monitoring text report through the event annotation window of the abnormal event in the Internet of Things security monitoring text report, and combine the Internet of Things security monitoring text report and the highlighted monitoring text report of the Internet of Things security monitoring text report, so as to focus on the key text set in the Internet of Things security monitoring text report (i.e., the text set corresponding to the abnormal event), and avoid the influence of the noise text paragraphs in the Internet of Things security monitoring text report, thereby significantly improving the accuracy and credibility of the abnormal keyword extraction of the abnormal event. In summary, this solution embodiment can solve or partially solve the technical problem that it is difficult for traditional technology to accurately and reliably extract keywords for abnormal events.

[0003] CN116992393A relates to the field of data processing, and specifically to a safety production monitoring method based on the industrial Internet of Things, including: obtaining a signal wave composed of vibration signal data of machine tools at each time; obtaining a number of time intervals of vibration signal data; obtaining the signal fluctuation degree of each time interval according to the data in each time interval, and obtaining all abnormal time intervals; obtaining a constant value of the baseline according to the data of each abnormal time interval, and obtaining processed vibration signal data; obtaining a number of components and a number of time intervals of each component; obtaining the optimal window step of each component according to the data in each time interval of each component; obtaining the denoised data of each component according to the optimal window step of each component, and obtaining the corrected vibration signal data according to the denoised data of all components; and monitoring according to the corrected vibration signal data. This scheme uses data processing to improve the accuracy of monitoring.

[0004] Therefore, although the relevant technology can improve the accuracy of industrial Internet of Things security monitoring, the relevant technology does not take into account the impact of hardware status, software status and network status on the security of the Industrial Internet of Things. That is, it is impossible to comprehensively monitor the security of the Industrial Internet of Things based on the hardware status, software status and network status.

[0005] The information disclosed in the background technology section of this application is only intended to deepen the understanding of the general background technology of this application, and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to those skilled in the art. Summary of the invention

[0006] The present invention provides an industrial Internet of Things security monitoring method and system, which can solve the technical problem that related technologies cannot comprehensively monitor the security of the industrial Internet of Things according to hardware conditions, software conditions and network conditions.

[0007] According to a first aspect of the present invention, there is provided an industrial Internet of Things security monitoring method, comprising: obtaining operating parameters of each industrial hardware device at multiple moments in a current monitoring cycle, wherein the operating parameters include operating current, operating voltage and operating temperature; determining a hardware anomaly score according to the operating parameters; obtaining operating data of each industrial application in the current monitoring cycle according to security log information, wherein the operating data includes the number of unauthorized accesses, the number of operations and the operating response time; determining a software anomaly score according to the operating data; obtaining network traffic data of each key network node through a network traffic monitoring tool at multiple moments in the current monitoring cycle, wherein the network traffic data includes a traffic rate, a data packet size, a data packet source, a data packet destination and a protocol type; performing feature extraction processing on the network traffic data through a trained network traffic recognition model to obtain a network traffic feature vector of the key network node; determining a network anomaly score according to the network traffic data and the network traffic feature vector; determining an industrial Internet of Things security monitoring score according to a result of subtracting a weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score from 1; and generating an industrial Internet of Things security monitoring report according to the industrial Internet of Things security monitoring score.

[0008] According to a second aspect of the present invention, there is provided an industrial Internet of Things security monitoring system, comprising: an operating parameter module, for obtaining the operating parameters of each industrial hardware device at multiple moments in the current monitoring cycle, wherein the operating parameters include operating current, operating voltage and operating temperature; a hardware anomaly scoring module, for determining the hardware anomaly score according to the operating parameters; an operating data module, for obtaining the operating data of each industrial application program in the current monitoring cycle according to security log information, wherein the operating data includes the number of unauthorized accesses, the number of operations and the operating response time; a software anomaly scoring module, for determining the software anomaly score according to the operating data; and a network traffic data module, for obtaining the status of each key network at multiple moments in the current monitoring cycle through a network traffic monitoring tool. The network traffic data of the node includes traffic rate, data packet size, data packet source, data packet destination and protocol type; a network traffic feature vector module, which is used to perform feature extraction processing on the network traffic data through a trained network traffic recognition model to obtain the network traffic feature vector of the key network node; a network anomaly scoring module, which is used to determine the network anomaly score according to the network traffic data and the network traffic feature vector; an industrial Internet of Things security monitoring scoring module, which is used to determine the industrial Internet of Things security monitoring score according to 1 minus the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score; a monitoring report module, which is used to generate an industrial Internet of Things security monitoring report according to the industrial Internet of Things security monitoring score.

[0009] Technical effect: According to the present invention, by simultaneously monitoring the operating parameters and data of the hardware status, software status and network status, the security status of the industrial Internet of Things can be fully understood, thereby improving the comprehensiveness, objectivity and accuracy of the security monitoring of the industrial Internet of Things. Through the security monitoring score of the industrial Internet of Things, the security status of the industrial Internet of Things can be effectively quantified, which is convenient for quickly identifying potential risks. When determining the hardware anomaly score, the hardware anomaly score can be determined by the similarity between the operating status of the industrial hardware equipment and the standard operating status and the stability of the operating status. The abnormal status of the industrial hardware equipment can be discovered and handled in time, which can reduce production interruptions caused by industrial hardware equipment failures and improve the accuracy and comprehensiveness of the hardware anomaly score. When determining the software anomaly score, the operating status of the industrial application of the industrial Internet of Things can be comprehensively evaluated by the three aspects of the number of unauthorized accesses, the number of operations and the operation response time, so as to determine the software anomaly score, which helps to more accurately identify potential industrial application security risks and improve the accuracy, objectivity and comprehensiveness of the software anomaly score. When determining the network anomaly score, the network anomaly score can be determined by the similarity between the network traffic feature vector and the preset malicious traffic feature vector and the flow rate change range, which can comprehensively evaluate the abnormal situation of the network and help improve the accuracy of the security monitoring of the industrial Internet of Things.

[0010] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present invention. Other features and aspects of the present invention will become more apparent from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can be obtained based on these drawings without creative work.

[0012] Figure 1 A schematic diagram of a process flow of an industrial Internet of Things security monitoring method according to an embodiment of the present invention is exemplarily shown;

[0013] Figure 2 A block diagram of an industrial Internet of Things security monitoring system according to an embodiment of the present invention is exemplarily shown. DETAILED DESCRIPTION

[0014] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0016] Figure 1 A flow chart of an industrial Internet of Things security monitoring method according to an embodiment of the present invention is exemplarily shown, and the method comprises: step S101, obtaining operating parameters of each industrial hardware device at multiple moments in the current monitoring cycle, wherein the operating parameters include operating current, operating voltage and operating temperature; step S102, determining a hardware anomaly score according to the operating parameters; step S103, obtaining operating data of each industrial application in the current monitoring cycle according to security log information, wherein the operating data includes the number of unauthorized accesses, the number of operations and the operating response time; step S104, determining a software anomaly score according to the operating data; step S105, at multiple moments in the current monitoring cycle, using a network traffic monitoring tool, Obtain network traffic data of each key network node, wherein the network traffic data includes traffic rate, data packet size, data packet source, data packet destination and protocol type; step S106, perform feature extraction processing on the network traffic data through a trained network traffic recognition model to obtain a network traffic feature vector of the key network node; step S107, determine a network anomaly score based on the network traffic data and the network traffic feature vector; step S108, determine an industrial Internet of Things security monitoring score based on 1 minus the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score; step S109, generate an industrial Internet of Things security monitoring report based on the industrial Internet of Things security monitoring score.

[0017] According to the industrial Internet of Things security monitoring method of the embodiment of the present invention, by simultaneously monitoring the operating parameters and data of the hardware status, software status and network status, the security status of the industrial Internet of Things can be fully understood, thereby improving the comprehensiveness, objectivity and accuracy of the industrial Internet of Things security monitoring. Through the industrial Internet of Things security monitoring score, the security status of the industrial Internet of Things can be effectively quantified, which is convenient for quickly identifying potential risks.

[0018] According to an embodiment of the present invention, in step S101, each detection cycle can be set to 10 minutes, 20 minutes, etc., and the interval between adjacent moments can be set to 10 seconds, 20 seconds, etc., and the present invention does not limit this. The operating parameters of industrial hardware equipment are collected in real time through current sensors, voltage sensors, and temperature sensors to provide a data basis for subsequent safety monitoring and abnormality detection.

[0019] According to an embodiment of the present invention, in step S102, a hardware anomaly score is determined according to the operating parameters.

[0020] According to one embodiment of the present invention, step S102 includes: obtaining standard operating parameters of each industrial hardware device, wherein the standard operating parameters include a standard operating current, a standard operating voltage, and a standard operating temperature; determining an operating state vector of the hardware device based on the operating current, the operating voltage, and the operating temperature of each industrial hardware device; determining a standard operating state vector of the hardware device based on the standard operating current, the standard operating voltage, and the standard operating temperature of each industrial hardware device; obtaining the average operating parameters of each industrial hardware device in the current monitoring cycle, wherein the average operating parameters include an average operating current, an average operating voltage, and an average operating temperature; determining a hardware anomaly score based on the operating state vector, the standard operating state vector, the average operating parameters, and the operating parameters.

[0021] According to one embodiment of the present invention, the standard operating parameters of industrial hardware equipment are the expected values ​​of industrial hardware equipment under normal and optimal working conditions. The operating current, operating voltage and operating temperature are combined to obtain an operating state vector, that is, the operating current, operating voltage and operating temperature are all elements of the operating state vector, wherein the operating state vector represents the current operating state of the industrial hardware equipment. Similarly, the standard operating current, standard operating voltage and standard operating temperature are combined to obtain a standard operating state vector, which represents the operating state of the industrial hardware equipment under ideal conditions. The average operating current is the average value of the operating current at multiple moments in the current monitoring cycle, the average operating voltage is the average value of the operating voltage at multiple moments in the current monitoring cycle, and the average operating temperature is the average value of the operating temperature at multiple moments in the current monitoring cycle.

[0022] According to an embodiment of the present invention, determining a hardware anomaly score according to the operating state vector, the standard operating state vector, the average operating parameter and the operating parameter includes: determining a hardware anomaly score D1 according to formula (1),

[0023]

[0024]

[0025] Among them, I i，k is the operating current of the ith industrial hardware device at the kth moment in the current monitoring cycle, V i，k is the operating voltage of the ith industrial hardware device at the kth moment in the current monitoring cycle, T i，k is the operating temperature of the i-th industrial hardware device at the k-th moment in the current monitoring period, I i，p is the standard operating current of the ith industrial hardware device, V i，p is the standard operating voltage of the i-th industrial hardware device, T i，p is the standard operating temperature of the i-th industrial hardware device, is the operating state vector of the i-th industrial hardware device at the k-th moment in the current monitoring cycle, is the standard operating state vector of the ith industrial hardware device at the kth moment in the current monitoring cycle, for The transposed vector of is the average operating current of the ith industrial hardware device in the current monitoring period, is the average operating voltage of the i-th industrial hardware device in the current monitoring period, is the average operating temperature of the i-th industrial hardware device in the current monitoring period, α1 and α2 are preset weights, α1+α2=1, n i is the number of industrial hardware devices, n k is the number of moments in the monitoring cycle, i≤n i , k≤n k , and i, k, n i and n k Both are positive integers, max is the maximum value function, and min is the minimum value function.

[0026] According to one embodiment of the present invention, in formula (1), It is the cosine similarity between the operating state vector of the ith industrial hardware device at the kth moment in the current monitoring cycle and the standard operating state vector of the ith industrial hardware device at the kth moment in the current monitoring cycle. The larger the cosine similarity, the more similar the operating state of the industrial hardware device is to the standard operating state. The result of 1 minus the cosine similarity can be obtained. The closer the result is to 1, the less similar the operating state of the industrial hardware device is to the standard operating state, and the operating state of the industrial hardware device is abnormal. The average of the results of multiple industrial hardware devices at multiple moments in the current monitoring cycle can represent the degree of abnormality of the operating state of the industrial hardware device. The larger the average value, the more serious the degree of abnormality of the operating state of the industrial hardware device.

[0027] According to one embodiment of the present invention, in formula (1), It is the ratio of the difference between the maximum and minimum operating current of the i-th industrial hardware device at multiple moments in the current monitoring cycle to the average operating current, that is, the relative difference between the maximum and minimum operating current. The larger the relative difference, the more unstable the operating current and the more unstable the operating state of the i-th industrial hardware device. Indicates the relative difference between the maximum and minimum values ​​of the operating voltage. The larger the relative difference, the more unstable the operating voltage and the more unstable the operating state of the i-th industrial hardware device. Indicates the relative difference between the maximum and minimum values ​​of the operating temperature. The larger the relative difference, the more unstable the operating temperature and the more unstable the operating state of the i-th industrial hardware device. The average value obtained by averaging the above three relative differences of multiple industrial hardware devices can represent the stability of the operating states of multiple industrial hardware devices at multiple moments in the current monitoring cycle. The larger the average value, the more unstable the operating state of the industrial hardware device, that is, the more serious the abnormality of the operating state of the industrial hardware device.

[0028] According to one embodiment of the present invention, the weighted sum of the above two items can be obtained to obtain a hardware anomaly score. The higher the hardware anomaly score, the more serious the abnormality of the operating status of the industrial hardware equipment of the Industrial Internet of Things, and the lower the hardware anomaly score, the more normal the operating status of the industrial hardware equipment of the Industrial Internet of Things.

[0029] In this way, the hardware anomaly score can be determined based on the similarity between the operating status of industrial hardware equipment and the standard operating status and the stability of the operating status. Abnormal status of industrial hardware equipment can be discovered and handled in a timely manner, which can reduce production interruptions caused by industrial hardware equipment failures and improve the accuracy and comprehensiveness of hardware anomaly scores.

[0030] According to one embodiment of the present invention, in step S103, the security log information includes a detailed record of the operation data of each industrial application. The number of unauthorized accesses is the number of times a user or program attempts to access an industrial application but fails to pass identity authentication (i.e., unauthorized) during the current monitoring cycle. The number of runs is the actual number of runs of each industrial application during the current monitoring cycle, i.e., the frequency with which the industrial application is started and executed. The operation response time is the time required for the industrial application to respond to a request during the current monitoring cycle.

[0031] According to an embodiment of the present invention, in step S104, a software anomaly score is determined based on the operation data.

[0032] According to one embodiment of the present invention, step S104 includes: obtaining preset operating thresholds for each industrial application, wherein the preset operating thresholds include preset unauthorized access count thresholds, preset operating count thresholds, and preset operating response time thresholds; and determining software anomaly scores based on the preset operating thresholds and the operating data.

[0033] According to one embodiment of the present invention, the actual number of unauthorized accesses is compared with the preset unauthorized access threshold to determine whether it exceeds the normal range. For example, too many unauthorized accesses may lead to sensitive data leakage and malicious access by attackers. The actual number of runs is compared with the preset run threshold to determine whether it is too frequent. For example, frequent runs may lead to excessive consumption of industrial Internet of Things resources (such as CPU, memory, and network bandwidth), thereby affecting the performance of other industrial applications. The actual run response time is compared with the preset run response time threshold to determine whether the response time is too long. For example, too long run response time may lead to business processing delays and reduce overall business efficiency.

[0034] According to an embodiment of the present invention, determining the software anomaly score according to the preset operation threshold and the operation data includes: determining the software anomaly score D2 according to formula (2),

[0035]

[0036] Among them, X j is the number of unauthorized accesses to the jth industrial application in the current monitoring period, X j,p is the preset unauthorized access count threshold for the jth industrial application, Y j is the number of times the jth industrial application is run in the current monitoring period, Y j,p is the preset running number threshold of the jth industrial application, t j is the operating response time of the jth industrial application in the current monitoring period, t j,p is the preset operation response time threshold of the jth industrial application, β1, β2 and β3 are preset weights, β1+β2+β3=1, n j is the number of industrial applications, j≤n j , and j and n j All are positive integers, and if is a conditional function.

[0037] According to one embodiment of the present invention, in formula (2), Indicates that when the number of unauthorized accesses to the jth industrial application in the current monitoring period is greater than or equal to the preset unauthorized access number threshold of the jth industrial application, the conditional function value is Otherwise, the conditional function value is 0. It is the relative difference between the number of unauthorized accesses to the jth industrial application in the current monitoring period and the preset unauthorized access threshold for the jth industrial application, indicating the degree of deviation between the number of unauthorized accesses and the preset unauthorized access threshold. The larger the relative difference, the greater the degree to which the number of unauthorized accesses exceeds the threshold, the more malicious accesses there are, and the risk of data leakage exists. It represents the average value of the conditional function corresponding to the number of unauthorized accesses to all industrial applications in the current monitoring period. The higher the average value, the more serious the abnormality of the number of unauthorized accesses to the industrial applications. Indicates that when the number of runs of the jth industrial application in the current monitoring period is greater than or equal to the preset run number threshold of the jth industrial application, the conditional function value is Otherwise, the conditional function value is 0. It is the relative difference between the number of runs of the jth industrial application in the current monitoring period and the preset run number threshold of the jth industrial application, indicating the degree of deviation between the run number and the preset run number threshold. The larger the relative difference is, the greater the degree to which the run number exceeds the threshold, the more frequently the industrial application runs, and there is a risk of abuse of the industrial application. It represents the average value of the conditional function corresponding to the running times of all industrial applications in the current monitoring period. The higher the average value, the more serious the abnormality of the running times of the industrial applications. Indicates that when the operation response time of the jth industrial application in the current monitoring period is greater than or equal to the preset operation response time threshold of the jth industrial application, the conditional function value is Otherwise, the conditional function value is 0. It is the relative difference between the operating response time of the jth industrial application in the current monitoring period and the preset operating response time threshold of the jth industrial application, indicating the degree of deviation between the operating response time and the preset operating response time threshold. The larger the relative difference is, the greater the degree to which the operating response time exceeds the threshold, the slower the operating response time of the industrial application, and there is a risk of decreased business processing rate. It represents the average value of the conditional function corresponding to the running response time of all industrial applications in the current monitoring period. The higher the average value is, the more serious the abnormality of the running response time of the industrial application is.

[0038] According to one embodiment of the present invention, the average values ​​of the conditional functions corresponding to the above three items are weighted and summed to obtain a software anomaly score. The higher the software anomaly score, the more serious the abnormality of the operating status of the industrial application of the Industrial Internet of Things. The lower the software anomaly score, the more normal the operating status of the industrial application of the Industrial Internet of Things.

[0039] In this way, the operating status of industrial applications of the Industrial Internet of Things can be comprehensively evaluated through the three aspects of the number of unauthorized accesses, the number of operations, and the operation response time, so as to determine the software anomaly score, which helps to more accurately identify potential industrial application security risks and improve the accuracy, objectivity and comprehensiveness of the software anomaly score.

[0040] According to one embodiment of the present invention, in step S105, the network traffic monitoring tool can capture and analyze the data flow information in the network in real time, which is a key means to obtain network traffic data. Key network nodes are places that are critical to the overall network performance, security or business continuity, such as core switches, routers, firewalls, key servers and important industrial control units. The traffic rate is the data transmission rate through the network node per unit time, expressed in bits per second. The data packet size is the number of bytes per data packet, reflecting the scale of the transmitted data. The source of the data packet is the starting address of the data packet, that is, the IP address of the sender. The destination of the data packet is the target address of the data packet, that is, the IP address of the receiver. The protocol type is the network protocol used to identify the data packet, which helps to analyze the mode and characteristics of data transmission.

[0041] According to one embodiment of the present invention, in step S106, the network traffic identification model may be a convolutional neural network model. Using the trained network traffic identification model, feature extraction processing is performed on the network traffic data to obtain network traffic feature vectors of each key network node. The network traffic feature vector may represent specific traffic features and may comprehensively describe the network traffic status of the key network node as a whole, such as the traffic rate, data packet size, etc.

[0042] According to an embodiment of the present invention, in step S107, a network anomaly score is determined based on the network traffic data and the network traffic feature vector.

[0043] According to one embodiment of the present invention, step S107 includes: obtaining preset malicious traffic feature vectors of multiple known malicious traffic types; obtaining historical traffic rates of each key network node at multiple times in the last historical monitoring cycle; and determining a network anomaly score based on the preset malicious traffic feature vector, the network traffic feature vector, the historical traffic rate and the traffic rate.

[0044] According to one embodiment of the present invention, the preset malicious traffic feature vector represents a series of feature sets predefined according to different malicious attack modes, and the feature set is used to characterize various specific malicious traffic, such as specific behavior patterns of malware communication, unique network activity characteristics of phishing website traffic, etc. By extracting the key attributes or behavior indicators of the malicious traffic through the network traffic identification model, the corresponding preset malicious traffic feature vector can be constructed to compare and identify potential malicious traffic in real time during network monitoring. By comparing the current traffic rate with the historical traffic rate, abnormal traffic patterns can be identified.

[0045] According to an embodiment of the present invention, determining a network anomaly score according to the preset malicious traffic feature vector, the network traffic feature vector, the historical traffic rate and the traffic rate includes: determining a network anomaly score D3 according to formula (3),

[0046]

[0047]

[0048] Among them, F s is the network traffic feature vector of the sth key network node, F e,p is the preset malicious traffic feature vector of the e-th known malicious traffic type, F e,p The transposed vector, W s,k is the traffic rate of the sth key network node at the kth moment in the current monitoring period, W s,h,k is the historical traffic rate of the sth key network node at the kth moment in the previous historical monitoring period, γ1 and γ2 are preset weights, and γ1+γ2=1, n e is the number of known malicious traffic types, n k is the number of moments in the monitoring cycle, e≤n e , k≤n k , and e, k, n e and n k All are positive integers, max is the maximum value function, and if is the conditional function.

[0049] According to one embodiment of the present invention, in formula (3), It is the maximum value of the similarity between the network traffic feature vector of the s-th key network node and the preset malicious traffic feature vectors of multiple known malicious traffic types. The larger the value is, the more likely the s-th key network node is to be attacked by malicious traffic. It is the average value of the probability of malicious traffic attack on all key network nodes. The larger the average value, the more abnormal the network is. Indicates that when the maximum value of the traffic rate of the sth key network node at multiple moments in the current monitoring period is greater than or equal to the maximum value of the historical traffic rate of the sth key network node at multiple moments in the previous historical monitoring period, the conditional function value is Otherwise, the conditional function value is 0. It is the relative difference between the maximum value of the flow rate of the sth key network node at multiple moments in the current monitoring cycle and the maximum value of the historical flow rate of the sth key network node at multiple moments in the previous historical monitoring cycle, indicating the degree of deviation between the maximum value of the flow rate and the maximum value of the historical flow rate. The larger the relative difference, the greater the degree to which the maximum value of the flow rate exceeds the maximum value of the historical flow rate, the more abnormal the network flow is, and there is a network security risk. The higher the average value of the conditional function corresponding to all key network nodes, the more serious the network flow anomaly. The weighted sum of the above two items can be obtained to obtain the network anomaly score. The higher the network anomaly score, the more serious the network condition of the industrial Internet of Things, and the lower the network anomaly score, the better the network condition of the industrial Internet of Things.

[0050] In this way, the network anomaly score can be determined by the similarity between the network traffic feature vector and the preset malicious traffic feature vector and the magnitude of the traffic rate change, which can comprehensively evaluate the network anomalies and help improve the accuracy of industrial Internet of Things security monitoring.

[0051] According to one embodiment of the present invention, in step S108, after determining the hardware anomaly score, the software anomaly score and the network anomaly score, the industrial Internet of Things security monitoring score can be obtained by subtracting the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score from 1. The closer the industrial Internet of Things security monitoring score is to 1, the higher the security of the industrial Internet of Things is, and the closer the industrial Internet of Things security monitoring score is to 0, the lower the security of the industrial Internet of Things is.

[0052] According to one embodiment of the present invention, in step S109, if the industrial Internet of Things security monitoring score is greater than a preset threshold, it means that the industrial Internet of Things security is relatively high and no early warning is required. If the industrial Internet of Things security monitoring score is less than or equal to the preset threshold, it means that the industrial Internet of Things security is relatively low, and an early warning report is generated, a detailed emergency plan is formulated, and the monitoring and maintenance of the industrial Internet of Things are strengthened.

[0053] According to the industrial Internet of Things security monitoring method of the embodiment of the present invention, by simultaneously monitoring the operating parameters and data of the three aspects of hardware status, software status and network status, the security status of the industrial Internet of Things can be fully understood, thereby improving the comprehensiveness, objectivity and accuracy of the industrial Internet of Things security monitoring. Through the industrial Internet of Things security monitoring score, the security status of the industrial Internet of Things can be effectively quantified, which is convenient for quickly identifying potential risks. When determining the hardware anomaly score, the hardware anomaly score can be determined by the similarity between the operating status of the industrial hardware equipment and the standard operating status and the stability of the operating status. The abnormal status of the industrial hardware equipment can be discovered and handled in time, which can reduce production interruptions caused by industrial hardware equipment failures and improve the accuracy and comprehensiveness of the hardware anomaly score. When determining the software anomaly score, the operating status of the industrial application of the industrial Internet of Things can be comprehensively evaluated through the three aspects of the number of unauthorized accesses, the number of operations and the operation response time, so as to determine the software anomaly score, which helps to more accurately identify potential industrial application security risks and improve the accuracy, objectivity and comprehensiveness of the software anomaly score. When determining the network anomaly score, the network anomaly score can be determined by the similarity between the network traffic feature vector and the preset malicious traffic feature vector and the range of change in the traffic rate. This can comprehensively evaluate the network anomalies and help improve the accuracy of industrial Internet of Things security monitoring.

[0054] Figure 2The block diagram of the industrial Internet of Things security monitoring system according to an embodiment of the present invention is exemplarily shown, and the system includes: an operating parameter module, which is used to obtain the operating parameters of each industrial hardware device at multiple moments in the current monitoring cycle, wherein the operating parameters include operating current, operating voltage and operating temperature; a hardware anomaly scoring module, which is used to determine the hardware anomaly score according to the operating parameters; an operating data module, which is used to obtain the operating data of each industrial application in the current monitoring cycle according to security log information, wherein the operating data includes the number of unauthorized accesses, the number of operations and the operating response time; a software anomaly scoring module, which is used to determine the software anomaly score according to the operating data; a network traffic data module, which is used to obtain the information of each industrial application in the current monitoring cycle through a network traffic monitoring tool at multiple moments in the current monitoring cycle; Network traffic data of key network nodes, wherein the network traffic data includes traffic rate, data packet size, data packet source, data packet destination and protocol type; a network traffic feature vector module, used to perform feature extraction processing on the network traffic data through a trained network traffic recognition model to obtain the network traffic feature vector of the key network node; a network anomaly scoring module, used to determine the network anomaly score based on the network traffic data and the network traffic feature vector; an industrial Internet of Things security monitoring scoring module, used to determine the industrial Internet of Things security monitoring score based on 1 minus the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score; a monitoring report module, used to generate an industrial Internet of Things security monitoring report based on the industrial Internet of Things security monitoring score.

[0055] It should be understood by those skilled in the art that the embodiments of the present invention described above and shown in the accompanying drawings are only examples and do not limit the present invention. The purpose of the present invention has been fully and effectively achieved. The functional and structural principles of the present invention have been demonstrated and explained in the embodiments, and the embodiments of the present invention may be deformed or modified in any way without departing from the principles.

Claims

1. A method for industrial Internet of Things security monitoring, characterized in that: include: At multiple moments in the current monitoring cycle, the operating parameters of each industrial hardware device are obtained, wherein the operating parameters include operating current, operating voltage and operating temperature; based on the operating parameters, the hardware anomaly score is determined; based on the security log information, the operating data of each industrial application in the current monitoring cycle is obtained, wherein the operating data includes the number of unauthorized accesses, the number of operations and the operating response time; based on the operating data, the software anomaly score is determined; at multiple moments in the current monitoring cycle, the network traffic data of each key network node is obtained through a network traffic monitoring tool, wherein the network traffic data includes traffic rate, data packet size, data packet source, data packet destination and protocol type; through a trained network traffic recognition model, feature extraction processing is performed on the network traffic data to obtain the network traffic feature vector of the key network node; based on the network traffic data and the network traffic feature vector, the network anomaly score is determined; based on 1 minus the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score, the industrial Internet of Things security monitoring score is determined; based on the industrial Internet of Things security monitoring score, an industrial Internet of Things security monitoring report is generated.

2. The industrial Internet of Things security monitoring method according to claim 1, characterized in that: According to the operating parameters, a hardware anomaly score is determined, including: obtaining standard operating parameters of each industrial hardware device, wherein the standard operating parameters include a standard operating current, a standard operating voltage, and a standard operating temperature; determining an operating state vector of the hardware device according to the operating current, the operating voltage, and the operating temperature of each industrial hardware device; determining a standard operating state vector of the hardware device according to the standard operating current, the standard operating voltage, and the standard operating temperature of each industrial hardware device; obtaining the average operating parameters of each industrial hardware device in the current monitoring period, wherein the average operating parameters include an average operating current, an average operating voltage, and an average operating temperature; determining a hardware anomaly score according to the operating state vector, the standard operating state vector, the average operating parameters, and the operating parameters.

3. The industrial Internet of Things security monitoring method according to claim 2 is characterized in that: Determining a hardware anomaly score according to the operating state vector, the standard operating state vector, the average operating parameter and the operating parameter includes: determining a hardware anomaly score according to the formula Determine the hardware anomaly score D1, where I i,k is the operating current of the ith industrial hardware device at the kth moment in the current monitoring cycle, V i,k is the operating voltage of the ith industrial hardware device at the kth moment in the current monitoring period, T i,k is the operating temperature of the i-th industrial hardware device at the k-th moment in the current monitoring period, I i,p is the standard operating current of the ith industrial hardware device, V i,p is the standard operating voltage of the i-th industrial hardware device, T i,p is the standard operating temperature of the i-th industrial hardware device, is the operating state vector of the i-th industrial hardware device at the k-th moment in the current monitoring cycle, is the standard operating state vector of the ith industrial hardware device at the kth moment in the current monitoring cycle, for The transposed vector of is the average operating current of the i-th industrial hardware device in the current monitoring period, is the average operating voltage of the i-th industrial hardware device in the current monitoring period, is the average operating temperature of the i-th industrial hardware device in the current monitoring period, ɑ1 and ɑ2 are preset weights, α1+α2=1, n i is the number of industrial hardware devices, n k is the number of moments in the monitoring cycle, i≤n i , k≤n k , and i, k, n i and n k They are all positive integers, max is the maximum value function, and min is the minimum value function.

4. The industrial Internet of Things security monitoring method according to claim 1, characterized in that: Determine a software anomaly score based on the operating data, including: obtaining preset operating thresholds for each industrial application, wherein the preset operating thresholds include a preset unauthorized access count threshold, a preset operating count threshold, and a preset operating response time threshold; determine the software anomaly score based on the preset operating thresholds and the operating data.

5. The industrial Internet of Things security monitoring method according to claim 4 is characterized in that: Determining a software anomaly score according to the preset operating threshold and the operating data includes: determining a software anomaly score according to the formula Determine the software anomaly score D2, where X j is the number of unauthorized accesses to the jth industrial application in the current monitoring period, X j,p is the preset unauthorized access count threshold for the jth industrial application, Y j is the number of times the jth industrial application is run in the current monitoring period, Y j,p is the preset running number threshold of the jth industrial application, t j is the operating response time of the jth industrial application in the current monitoring period, t j,p is the preset operation response time threshold of the jth industrial application, β1, β2 and β3 are preset weights, β1+β2+β3=1, n j is the number of industrial applications, j≤n j , and j and n j All are positive integers, and if is a conditional function.

6. The industrial Internet of Things security monitoring method according to claim 1, characterized in that: Determine a network anomaly score based on the network traffic data and the network traffic feature vector, including: obtaining preset malicious traffic feature vectors of multiple known malicious traffic types; obtaining historical traffic rates of each key network node at multiple moments in the last historical monitoring cycle; and determine a network anomaly score based on the preset malicious traffic feature vector, the network traffic feature vector, the historical traffic rate, and the traffic rate.

7. The industrial Internet of Things security monitoring method according to claim 6, characterized in that: Determining a network anomaly score according to the preset malicious traffic feature vector, the network traffic feature vector, the historical traffic rate and the traffic rate includes: determining a network anomaly score according to the formula Determine the network anomaly score D3, where F s is the network traffic feature vector of the sth key network node, F e,p is the preset malicious traffic feature vector of the e-th known malicious traffic type, F e,p The transposed vector, W s,k is the traffic rate of the sth key network node at the kth moment in the current monitoring period, W s,h,k is the historical traffic rate of the sth key network node at the kth moment in the previous historical monitoring period, γ1 and γ2 are preset weights, and γ1+γ2=1, n e is the number of known malicious traffic types, n k is the number of moments in the monitoring cycle, e≤n e , k≤n k , and e, k, n e and n k All are positive integers, max is the maximum value function, and if is the conditional function.

8. An industrial Internet of Things security monitoring system, characterized in that: include: An operation parameter module is used to obtain the operation parameters of each industrial hardware device at multiple moments in the current monitoring cycle, wherein the operation parameters include the operation current, the operation voltage and the operation temperature; a hardware anomaly scoring module is used to determine the hardware anomaly score based on the operation parameters; an operation data module is used to obtain the operation data of each industrial application in the current monitoring cycle based on the security log information, wherein the operation data includes the number of unauthorized accesses, the number of operations and the operation response time; a software anomaly scoring module is used to determine the software anomaly score based on the operation data; a network traffic data module is used to obtain the network traffic data of each key network node through the network traffic monitoring tool at multiple moments in the current monitoring cycle, wherein the The network traffic data includes traffic rate, data packet size, data packet source, data packet destination and protocol type; a network traffic feature vector module is used to perform feature extraction processing on the network traffic data through a trained network traffic identification model to obtain the network traffic feature vector of the key network node; a network anomaly scoring module is used to determine the network anomaly score based on the network traffic data and the network traffic feature vector; an industrial Internet of Things security monitoring scoring module is used to determine the industrial Internet of Things security monitoring score based on 1 minus the weighted sum of the hardware anomaly score, the software anomaly score and the network anomaly score; a monitoring report module is used to generate an industrial Internet of Things security monitoring report based on the industrial Internet of Things security monitoring score.

Images