Multi-source data physical security situation monitoring method and device based on three-dimensional digital model

Abstract

The invention relates to the technical field of data processing, and discloses a multi-source data physical security situation monitoring method and device based on a three-dimensional digital model, and the method comprises the steps: integrating data from different devices and systems through employing a multi-source data fusion mode, analyzing and extracting security situation abnormal information, and carrying out the monitoring of a multi-source data physical security situation. Then, through security situation grading database matching, determining a security situation anomaly number, a situation security level and an abnormal behavior action sequence set in a current environment, screening security situation presentation by considering the situation security level, and generating a three-dimensional model representing a security situation condition; and performing selective presentation on the virtual simulation main body in the corresponding three-dimensional model by considering the abnormal behavior action sequence set, and finally determining the visual presentation time of each three-dimensional model by considering the number of the security situation anomalies. The physical security situation monitoring efficiency of large-order-of-magnitude network working equipment in a large entity space is improved, and the monitoring and visualization presentation rationality is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and device for monitoring physical security situation of multi-source data based on a three-dimensional digital model. Background Art

[0002] With the rapid development of computer, communication and Internet of Things technologies, the monitoring needs of the Internet and physical environment are becoming increasingly complex and diversified; at the same time, network attack technologies and new security threats continue to emerge, which puts higher requirements on the real-time, accuracy and intelligence level of security monitoring systems.

[0003] Traditional security monitoring systems are mostly based on two-dimensional images or data tables, which are difficult to fully and intuitively reflect the real state and security situation of the physical environment. Especially when facing the security situation monitoring needs of a large number of network working devices in a large physical space, the monitoring results based on two-dimensional images or data tables cannot enable managers to quickly understand and locate the current abnormal security situation and areas, resulting in the inability to make timely and accurate responses and maintenance to the current security situation, which will affect the stability of the Internet environment in the physical space; at the same time, when monitoring a large number of network working devices, there are also problems such as limited visualization resources and different visualization priorities for different security situations, which makes it impossible for managers to focus on key security situation issues from the current large amount of security situation information, affecting the overall operation of the Internet in the physical space.

[0004] Therefore, how to improve the efficiency of physical security situation monitoring of large numbers of network working equipment in large physical spaces and enhance the rationality of monitoring and visualization to ensure the overall stable operation of the Internet in the physical space is a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present invention provides a method and device for monitoring physical security situation based on multi-source data of a three-dimensional digital model, aiming to solve at least one of the above-mentioned technical problems.

[0006] To achieve the above object, the present invention provides a multi-source data physical security situation monitoring method, comprising the following steps:

[0007] Collect several security-related data of the target entity space and construct a security-related data set;

[0008] Performing data fusion processing on several items of security-related data in the security-related data set, and extracting security situation abnormal information from the several items of security-related data after data fusion;

[0009] Based on the abnormal security situation information, matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database; wherein the security situation monitoring elements include the number of abnormal security situation, the situation security level and the abnormal behavior action sequence set;

[0010] According to the situation security level in the security situation abnormal information, construct a three-dimensional model of the current security situation in the physical environment; wherein the three-dimensional model includes a plurality of virtual model bodies;

[0011] Generate a three-dimensional model graphical strategy by using the abnormal behavior action sequence set in the abnormal security situation information, and send the three-dimensional model graphical strategy to a security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model;

[0012] Based on the number of security situation anomalies in each monitoring cycle, a three-dimensional model visualization strategy for the current monitoring cycle is generated, driving the security situation user management terminal to convert the three-dimensional model visualization graphic of the current monitoring cycle into a three-dimensional model visualization picture.

[0013] Optionally, the steps of collecting several security-related data of the target entity space and constructing a security-related data set include:

[0014] Acquire several security-related data collected by different network monitoring devices in the target physical space; wherein the network monitoring device includes at least one of a network traffic monitor, a system log server, and a security event log device;

[0015] Data cleaning and normalization are performed on the several items of security-related data to remove invalid, duplicate and erroneous data, and data from different sources are formatted and unified to construct a security-related data set to obtain the several items of security-related data.

[0016] Optionally, the step of performing data fusion processing on several items of security-related data in the security-related data set to extract abnormal security situation information from the several items of security-related data after data fusion specifically includes:

[0017] Extracting a plurality of security-associated data features of each security-associated data in the security-associated data set to construct a security-associated data feature set;

[0018] Comparing each security-associated data feature in the security-associated data feature set with a standard range of each security-associated data feature stored in a standard security-associated database; wherein each standard range has a plurality of segments with different security situation quantization values;

[0019] According to the comparison result, the security situation quantification value corresponding to each security-related data feature in the plurality of security-related data is output as security situation abnormality information.

[0020] Optionally, based on the abnormal security situation information, the step of matching the security situation monitoring elements corresponding to the abnormal security situation information in a security situation classification database specifically includes:

[0021] Accessing a security situation classification database; wherein the security situation classification database stores several security situation abnormality categories, security situation quantization value ranges of security-related data feature combinations corresponding to each security situation abnormality category, and abnormal behavior action sequence sets;

[0022] Based on the security situation quantization value corresponding to each security-related data feature in the plurality of security-related data items recorded in the security situation abnormality information, a security situation abnormality category that meets the security situation quantization value range requirement of the corresponding security-related data feature combination is matched in the security situation classification database to obtain the number of security situation abnormalities and the abnormal behavior action sequence set;

[0023] Determine the situation security level of each security situation abnormality category according to the proportion of the difference between the security situation quantification value corresponding to each security-related data feature and the situation security optimal value of each security situation abnormality category in each security situation quantification value range within the security situation quantification value range;

[0024] The number of security situation anomalies, the situation security level of each security situation anomaly category, and the abnormal behavior action sequence set are used as security situation monitoring elements corresponding to the security situation anomaly information.

[0025] Optionally, the step of constructing a three-dimensional model of the current security situation in the physical environment according to the situation security level in the security situation abnormal information specifically includes:

[0026] Extracting the situation security level of each security situation abnormality category in the security situation abnormality information, sorting them in order from low to high security levels, and obtaining a list of security situation abnormality categories;

[0027] The security situation anomaly category with the highest target ratio in the security situation anomaly category list is used as the security situation anomaly category to be monitored, and the physical environment information of each security situation anomaly category to be monitored is queried in the physical environment database; wherein the physical environment information includes a number of associated working devices of the security situation anomaly category to be monitored, the operation data of each associated working device and the setting location information in the target physical space, and the information of the management personnel responsible for the current work maintenance of each associated working device;

[0028] Generate a three-dimensional model of the target physical space based on the associated working equipment, setting location information and management personnel information in the physical environment information of each security situation anomaly category to be monitored;

[0029] According to the situation security level of each abnormal security situation category to be monitored, the virtual model bodies corresponding to the associated working equipment and management personnel in the three-dimensional model of the target physical space are assigned corresponding colors, and the operating data of the associated working equipment is attached to the virtual model bodies of the associated working equipment to obtain a three-dimensional model of the current security situation in the physical environment.

[0030] Optionally, using the abnormal behavior action sequence set in the abnormal security situation information to generate a three-dimensional model graphical strategy, sending the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic step based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model, specifically includes:

[0031] Obtaining an abnormal behavior action sequence set corresponding to each abnormal security situation category to be monitored; wherein the abnormal behavior action sequence set includes a combination of associated working devices corresponding to the abnormal security situation category to be monitored, which have abnormal behaviors at different time periods;

[0032] According to the first associated working device combination with abnormal behavior of each type of security situation abnormality to be monitored in each monitoring cycle, predict the second associated working device combination with abnormal behavior in the next monitoring cycle; wherein the second associated working device combination is configured as a set of the first associated working device combination and the associated working device combination in a time period after the time period corresponding to the first associated working device combination in the abnormal behavior action sequence set;

[0033] The second associated working device combination predicted in each monitoring cycle is used as the three-dimensional model graphical strategy for the next monitoring cycle, and the three-dimensional model graphical strategy is sent to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and several virtual model bodies of the three-dimensional model.

[0034] Optionally, based on the number of security situation anomalies in each monitoring period, a three-dimensional model visualization strategy for the current monitoring period is generated, and the security situation user management terminal is driven to convert the three-dimensional model visualization graphic of the current monitoring period into a three-dimensional model visualization screen step, specifically including:

[0035] Based on the number of security situation anomalies in each monitoring cycle, determine the security situation anomaly category to be monitored in the current monitoring cycle according to the previous target ratio in the security situation anomaly category list;

[0036] According to the number of security situation anomaly categories to be monitored in the current monitoring cycle and the duration of the monitoring cycle, determine the initial visualization duration of each security situation anomaly category to be monitored, obtain the situation security level corresponding to each security situation anomaly category to be monitored, and generate the visualization duration adjustment ratio of each security situation anomaly category to be monitored according to the preset level and ratio conversion rules;

[0037] The initial visualization duration of each security situation anomaly category to be monitored is corrected by utilizing the visualization duration adjustment ratio, and a three-dimensional model visualization strategy for the current monitoring period is generated, which drives the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring period into a three-dimensional model visualization screen, so that the security situation user management terminal switches the three-dimensional model visualization graphics of each security situation anomaly category to be monitored according to the corrected visualization duration of each security situation anomaly category to be monitored, and generates a three-dimensional model visualization screen.

[0038] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a multi-source data physical security situation monitoring device, comprising:

[0039] The acquisition module is used to collect several security-related data of the target entity space and construct a security-related data set;

[0040] An extraction module is used to perform data fusion processing on several items of security-related data in the security-related data set, and extract security situation abnormal information from the several items of security-related data after data fusion;

[0041] A matching module, for matching the security situation abnormality information with the security situation monitoring elements corresponding to the security situation abnormality information in a security situation classification database based on the security situation abnormality information; wherein the security situation monitoring elements include the number of security situation abnormalities, the situation security level and the abnormal behavior action sequence set;

[0042] A construction module, used to construct a three-dimensional model of the current security situation in a physical environment according to the situation security level of the security situation abnormal information; wherein the three-dimensional model includes a plurality of virtual model bodies;

[0043] A generating module, used for generating a three-dimensional model graphical strategy by using the abnormal behavior action sequence set of the abnormal security situation information, and sending the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model;

[0044] The conversion module is used to generate a three-dimensional model visualization strategy for the current monitoring cycle based on the number of security situation anomalies in each monitoring cycle, and drive the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring cycle into a three-dimensional model visualization picture.

[0045] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a multi-source data physical security situation monitoring device, which includes: a memory, a processor, and a multi-source data physical security situation monitoring program stored on the memory and executable on the processor, and when the multi-source data physical security situation monitoring program is executed by the processor, the steps of the multi-source data physical security situation monitoring method as described above are implemented.

[0046] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a storage medium, on which a multi-source data physical security situation monitoring program is stored, and when the multi-source data physical security situation monitoring program is executed by a processor, the steps of the above-mentioned multi-source data physical security situation monitoring method are implemented.

[0047] The beneficial effects of the present invention are as follows: a multi-source data physical security situation monitoring method, device, equipment and storage medium are proposed, by acquiring several security-related data of the target physical space, integrating data from different devices and systems by multi-source data fusion, analyzing and extracting the abnormal security situation information in the current environment, and then determining the number of security situation anomalies, situation security level and abnormal behavior action sequence set in the current environment by matching the security situation classification database, considering the situation security level to screen the security situation presentation and generate a three-dimensional model representing the security situation status, considering the abnormal behavior action sequence set to selectively present the virtual simulation subject in the corresponding three-dimensional model, and finally considering the number of security situation anomalies to determine the visualization presentation time of each three-dimensional model, thereby improving the physical security situation monitoring efficiency of large-scale network working equipment in a large physical space, improving the rationality of monitoring and visualization presentation, helping managers to quickly understand and locate the current abnormal security situation and area, and being able to focus on key security situation issues from the current large amount of security situation information, and ensuring the overall stable operation of the Internet in the physical space. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 A schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention;

[0050] Figure 2 It is a flow chart of an embodiment of a method for monitoring physical security situation of multi-source data of the present invention;

[0051] Figure 3 It is a structural block diagram of an embodiment of a multi-source data physical security situation monitoring device of the present invention.

[0052] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] like Figure 1 As shown, Figure 1 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present invention.

[0055] like Figure 1 As shown, the device may include: a processor 1001, such as a CPU, a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or it may be a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0056] Those skilled in the art will understand that Figure 1 The structure of the device shown in the figure does not constitute a limitation of the device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0057] like Figure 1As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a multi-source data physical security situation monitoring program.

[0058] exist Figure 1 In the terminal shown, the network interface 1004 is mainly used to connect to the backend server and communicate data with the backend server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the multi-source data physical security situation monitoring program stored in the memory 1005 and perform the following operations:

[0059] Collect several security-related data of the target entity space and construct a security-related data set;

[0060] Performing data fusion processing on several items of security-related data in the security-related data set, and extracting security situation abnormal information from the several items of security-related data after data fusion;

[0061] Based on the abnormal security situation information, matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database; wherein the security situation monitoring elements include the number of abnormal security situation, the situation security level and the abnormal behavior action sequence set;

[0062] According to the situation security level in the security situation abnormal information, construct a three-dimensional model of the current security situation in the physical environment; wherein the three-dimensional model includes a plurality of virtual model bodies;

[0063] Generate a three-dimensional model graphical strategy by using the abnormal behavior action sequence set in the abnormal security situation information, and send the three-dimensional model graphical strategy to a security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model;

[0064] Based on the number of security situation anomalies in each monitoring cycle, a three-dimensional model visualization strategy for the current monitoring cycle is generated, driving the security situation user management terminal to convert the three-dimensional model visualization graphic of the current monitoring cycle into a three-dimensional model visualization picture.

[0065] The specific embodiments of the present invention applied to the device are basically the same as the embodiments of the following method for monitoring physical security situation using multi-source data, and will not be described in detail here.

[0066] The embodiment of the present invention provides a method for monitoring the physical security situation of multi-source data. Figure 2 , Figure 2It is a flow chart of an embodiment of a method for monitoring physical security situation of multi-source data of the present invention.

[0067] In this embodiment, the multi-source data physical security situation monitoring method includes the following steps:

[0068] S100: Collect several security-related data of the target entity space and construct a security-related data set;

[0069] S200: performing data fusion processing on a plurality of items of security-related data in the security-related data set, and extracting abnormal security situation information from the plurality of items of security-related data after data fusion;

[0070] S300: Based on the abnormal security situation information, matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database; wherein the security situation monitoring elements include the number of abnormal security situation, the situation security level and the abnormal behavior action sequence set;

[0071] S400: constructing a three-dimensional model of the current security situation in a physical environment according to the situation security level in the security situation abnormality information; wherein the three-dimensional model includes a plurality of virtual model bodies;

[0072] S500: Generate a three-dimensional model graphical strategy using the abnormal behavior action sequence set in the security situation abnormal information, and send the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model;

[0073] S600: Based on the number of security situation anomalies in each monitoring period, generate a three-dimensional model visualization strategy for the current monitoring period, and drive the security situation user management terminal to convert the three-dimensional model visualization graphic of the current monitoring period into a three-dimensional model visualization picture.

[0074] It should be noted that most traditional security monitoring systems are based on two-dimensional images or data tables, which are difficult to fully and intuitively reflect the real state and security situation of the physical environment. In particular, when facing the security situation monitoring needs of a large number of network working devices in a large physical space, the monitoring results based on two-dimensional images or data tables cannot enable managers to quickly understand and locate the current abnormal security situation and areas, resulting in the inability to make timely and accurate responses and maintenance to the current security situation, which will affect the stability of the Internet environment in the physical space; at the same time, when monitoring a large number of network working devices, there are also problems such as limited visualization resources and different visualization priorities for different security situations, which makes it impossible for managers to focus on key security situation issues from the current large amount of security situation information, affecting the overall operation of the Internet in the physical space.

[0075] In order to solve the above problems, this embodiment integrates data from different devices and systems by adopting a multi-source data fusion method, analyzes and extracts security situation abnormality information, and then determines the number of security situation abnormalities, situation security level and abnormal behavior action sequence set in the current environment through security situation classification database matching, considers the situation security level to screen the security situation presentation and generate a three-dimensional model representing the security situation status, considers the abnormal behavior action sequence set to selectively present the virtual simulation subject in the corresponding three-dimensional model, and finally considers the number of security situation abnormalities to determine the visualization presentation time of each three-dimensional model, thereby improving the efficiency of physical security situation monitoring of large-scale network working equipment in large physical spaces and improving the rationality of monitoring and visualization presentation.

[0076] In a preferred embodiment, the steps of collecting several security-related data of the target entity space and constructing a security-related data set specifically include:

[0077] S110: Acquire a number of security-related data collected by different network monitoring devices in the target physical space; wherein the network monitoring device includes at least one of a network traffic monitor, a system log server, and a security event log device;

[0078] S120: Performing data cleaning and data normalization processing on the plurality of security-related data, removing invalid, duplicate and erroneous data, and formatting and unifying data from different sources to construct a security-related data set to obtain the plurality of security-related data.

[0079] On this basis, a step of performing data fusion processing on several items of security-related data in the security-related data set to extract abnormal security situation information from the several items of security-related data after data fusion specifically includes:

[0080] S210: extracting a plurality of security-related data features of each security-related data in the security-related data set to construct a security-related data feature set;

[0081] S220: Compare each security-associated data feature in the security-associated data feature set with a standard range of each security-associated data feature stored in a standard security-associated database; wherein each standard range has a plurality of sections with different security situation quantization values;

[0082] S230: According to the comparison result, the security situation quantization value corresponding to each security-related data feature in the plurality of security-related data items is output as security situation abnormality information.

[0083] In this embodiment, a multi-source data fusion method is adopted to integrate data from different devices and systems, break data silos, and consider several security-related data collected by multiple network monitoring devices at the same time. After data cleaning and normalization, each security-related data feature is compared with the standard range of each security-related data feature stored in the standard security-related database to determine the abnormal security situation information, improve the accuracy of the security situation analysis of the current network environment, and provide a basis for subsequent security situation awareness and abnormal visualization.

[0084] In a preferred embodiment, based on the abnormal security situation information, the step of matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database specifically includes:

[0085] S310: Accessing a security situation classification database; wherein the security situation classification database stores several security situation abnormality categories, security situation quantization value ranges of security-related data feature combinations corresponding to each security situation abnormality category, and abnormal behavior action sequence sets;

[0086] S320: Based on the security situation quantization value corresponding to each security-related data feature in the plurality of security-related data items recorded in the security situation abnormality information, a security situation abnormality category that meets the security situation quantization value range requirement of the corresponding security-related data feature combination is matched in the security situation classification database to obtain the number of security situation abnormalities and the abnormal behavior action sequence set;

[0087] S330: determining the situation security level of each security situation abnormality category according to the proportion of the difference between the security situation quantization value corresponding to each security-related data feature and the situation security optimal value of each security situation abnormality category in each security situation quantization value range within the security situation quantization value range;

[0088] S340: The number of security situation anomalies, the situation security level of each security situation anomaly category, and the abnormal behavior action sequence set are used as security situation monitoring elements corresponding to the security situation anomaly information.

[0089] In this embodiment, the number of security situation anomalies, situation security level, and abnormal behavior action sequence set in the current environment are determined by matching the security situation classification database. Therefore, the security situation presentation can be screened by considering the situation security level and a three-dimensional model representing the security situation status can be generated. The virtual simulation subject in the corresponding three-dimensional model can be selectively presented by considering the abnormal behavior action sequence set. Finally, the visual presentation time of each three-dimensional model can be determined by considering the number of security situation anomalies. Through multi-source data fusion technology and three-dimensional digital modeling technology, a comprehensive perception and visual display of the physical environment security situation can be achieved.

[0090] In a preferred embodiment, the step of constructing a three-dimensional model of the current security situation in the physical environment according to the situation security level in the security situation abnormal information specifically includes:

[0091] S410: extracting the situation security level of each security situation abnormality category in the security situation abnormality information, sorting them in order from low to high security levels, and obtaining a list of security situation abnormality categories;

[0092] S420: taking the security situation anomaly category with the highest target ratio in the security situation anomaly category list as the security situation anomaly category to be monitored, querying the physical environment information of each security situation anomaly category to be monitored in the physical environment database; wherein the physical environment information includes a number of associated working devices of the security situation anomaly category to be monitored, the operating data of each associated working device and the setting location information in the target physical space, and the information of the management personnel responsible for the current work maintenance of each associated working device;

[0093] S430: Generate a three-dimensional model of the target physical space based on the associated working equipment, setting location information and management personnel information in the physical environment information of each security situation abnormality category to be monitored;

[0094] S440: According to the situation security level of each abnormal security situation category to be monitored, the virtual model bodies corresponding to the associated working equipment and management personnel in the three-dimensional model of the target physical space are assigned corresponding colors, and the operating data of the associated working equipment is attached to the virtual model bodies of the associated working equipment to obtain a three-dimensional model of the current security situation in the physical environment.

[0095] In this embodiment, the security situation anomaly categories to be monitored are extracted from the security situation anomaly information in order of situation security level from low to high, and then the associated working equipment of each security situation anomaly category to be monitored, the operating data of each associated working equipment and the setting location information in the target physical space, and the information of the management personnel responsible for the current work and maintenance of each associated working equipment are determined according to the physical environment database. Finally, a three-dimensional model of each virtual simulation theme is generated in the target physical space through three-dimensional modeling, and a realistic three-dimensional model of the physical environment is constructed using the three-dimensional modeling module, and the fused security situation data is mapped to the model to help users intuitively understand the security situation of the physical environment.

[0096] In a preferred embodiment, a three-dimensional model graphical strategy is generated by using the abnormal behavior action sequence set in the security situation abnormal information, and the three-dimensional model graphical strategy is sent to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic step based on the three-dimensional model graphical strategy and several virtual model bodies of the three-dimensional model, which specifically includes:

[0097] S510: Obtain an abnormal behavior action sequence set corresponding to each security situation abnormality category to be monitored; wherein the abnormal behavior action sequence set includes a combination of associated working devices corresponding to the security situation abnormality category to be monitored, which have abnormal behaviors at different time periods;

[0098] S520: predicting a second associated working device combination with abnormal behavior in the next monitoring cycle according to the first associated working device combination with abnormal behavior of each security situation abnormality category to be monitored in each monitoring cycle; wherein the second associated working device combination is configured as a set of associated working device combinations in a time period after the first associated working device combination and the corresponding time period of the first associated working device combination in the abnormal behavior action sequence set;

[0099] S530: Use the second associated working device combination predicted in each monitoring cycle as the three-dimensional model graphical strategy for the next monitoring cycle, and send the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and several virtual model bodies of the three-dimensional model.

[0100] On this basis, based on the number of security situation anomalies in each monitoring cycle, a three-dimensional model visualization strategy for the current monitoring cycle is generated, and the security situation user management terminal is driven to convert the three-dimensional model visualization graphics of the current monitoring cycle into a three-dimensional model visualization screen step, specifically including:

[0101] S610: Based on the number of security situation anomalies in each monitoring cycle, determine the security situation anomaly category to be monitored in the current monitoring cycle according to the previous target ratio in the security situation anomaly category list;

[0102] S620: Determine the initial visualization duration of each security situation anomaly category to be monitored according to the number of security situation anomaly categories to be monitored in the current monitoring cycle and the duration of the monitoring cycle, obtain the situation security level corresponding to each security situation anomaly category to be monitored, and generate the visualization duration adjustment ratio of each security situation anomaly category to be monitored according to the preset level and ratio conversion rule;

[0103] S630: Use the visualization time adjustment ratio to correct the initial visualization time of each security situation anomaly category to be monitored, generate a three-dimensional model visualization strategy for the current monitoring period, and drive the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring period into a three-dimensional model visualization screen, so that the security situation user management terminal switches the three-dimensional model visualization graphics of each security situation anomaly category to be monitored according to the corrected visualization time of each security situation anomaly category to be monitored, and generates a three-dimensional model visualization screen.

[0104] In this embodiment, the virtual simulation subject in the corresponding three-dimensional model is selectively presented considering the abnormal behavior action sequence set, and finally the visualization presentation time of each three-dimensional model is determined considering the number of security situation anomalies. Through multi-source data fusion technology and three-dimensional digital modeling technology, a comprehensive perception and visualization of the physical environment security situation is achieved. In this way, the security situation information is displayed to the user in the form of charts, images, etc. through the visualization display module, helping the user to intuitively understand the security situation of the physical environment. In this way, the efficiency of physical security situation monitoring of large-scale network working equipment in large physical spaces can be improved, and the rationality of monitoring and visualization presentation can be improved, which can help managers quickly understand and locate the current security situation abnormalities and areas, focus on key security situation issues from the current large amount of security situation information, and ensure the overall stable operation of the Internet in the physical space.

[0105] In addition, in order to achieve the above-mentioned purpose, the present invention also provides a multi-source data physical security situation monitoring device, comprising:

[0106] Reference Figure 3 , Figure 3 It is a structural block diagram of an embodiment of a multi-source data physical security situation monitoring device of the present invention.

[0107] like Figure 3 As shown, the multi-source data physical security situation monitoring device proposed in the embodiment of the present invention includes:

[0108] The acquisition module 10 is used to acquire several security-related data of the target entity space and construct a security-related data set;

[0109] An extraction module 20 is used to perform data fusion processing on a plurality of items of security-related data in the security-related data set, and extract abnormal security situation information from the plurality of items of security-related data after data fusion;

[0110] A matching module 30 is used to match the security situation monitoring elements corresponding to the security situation abnormal information in a security situation classification database based on the security situation abnormal information; wherein the security situation monitoring elements include the number of security situation abnormalities, the situation security level and the abnormal behavior action sequence set;

[0111] A construction module 40 is used to construct a three-dimensional model of the current security situation in a physical environment according to the situation security level of the security situation abnormal information; wherein the three-dimensional model includes a plurality of virtual model bodies;

[0112] A generating module 50 is used to generate a three-dimensional model graphical strategy by using the abnormal behavior action sequence set of the abnormal security situation information, and send the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model;

[0113] The conversion module 60 is used to generate a three-dimensional model visualization strategy for the current monitoring cycle based on the number of security situation anomalies in each monitoring cycle, and drive the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring cycle into a three-dimensional model visualization picture.

[0114] Other embodiments or specific implementations of the multi-source data physical security situation monitoring device of the present invention can refer to the above-mentioned method embodiments and will not be described in detail here.

[0115] In addition, the present invention also proposes a multi-source data physical security situation monitoring device, which includes: a memory, a processor, and a multi-source data physical security situation monitoring program stored on the memory and executable on the processor, and when the multi-source data physical security situation monitoring program is executed by the processor, the steps of the multi-source data physical security situation monitoring method as described above are implemented.

[0116] The specific implementation methods of the multi-source data physical security situation monitoring device of the present application are basically the same as the various embodiments of the multi-source data physical security situation monitoring method described above, and will not be repeated here.

[0117] In addition, the present invention also proposes a readable storage medium, the readable storage medium includes a computer readable storage medium, on which a multi-source data physical security situation monitoring program is stored. The readable storage medium may be Figure 1 The memory 1005 in the terminal may also be at least one of a ROM (Read-Only Memory) / RAM (Random Access Memory), a magnetic disk, and an optical disk. The readable storage medium includes a number of instructions for enabling a multi-source data physical security situation monitoring device with a processor to execute the multi-source data physical security situation monitoring method described in each embodiment of the present invention.

[0118] The specific implementation methods in the readable storage medium of the present application are basically the same as the various embodiments of the above-mentioned multi-source data physical security situation monitoring method, and will not be repeated here.

[0119] It is understood that, in the description of this specification, the description with reference to the terms "one embodiment", "another embodiment", "other embodiments", or "first to Nth embodiments" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0120] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0121] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0122] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate rather than limit the technical solutions of the present invention. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the present invention can still be modified or replaced by equivalents. Any modification or partial replacement that does not depart from the spirit and scope of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A multi-source data physical security situation monitoring method based on a three-dimensional digital model, characterized in that: The following steps are involved: Collect several security-related data of the target entity space and construct a security-related data set; Performing data fusion processing on several items of security-related data in the security-related data set, and extracting security situation abnormal information from the several items of security-related data after data fusion; Based on the abnormal security situation information, matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database; wherein the security situation monitoring elements include the number of abnormal security situation, the situation security level and the abnormal behavior action sequence set; According to the situation security level in the security situation abnormal information, construct a three-dimensional model of the current security situation in the physical environment; wherein the three-dimensional model includes a plurality of virtual model bodies; Generate a three-dimensional model graphical strategy by using the abnormal behavior action sequence set in the abnormal security situation information, and send the three-dimensional model graphical strategy to a security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model; Based on the number of security situation anomalies in each monitoring cycle, a three-dimensional model visualization strategy for the current monitoring cycle is generated, driving the security situation user management terminal to convert the three-dimensional model visualization graphic of the current monitoring cycle into a three-dimensional model visualization picture.

2. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model according to claim 1, characterized in that: The steps of collecting several security-related data of the target entity space and constructing a security-related data set include: Acquire several security-related data collected by different network monitoring devices in the target physical space; wherein the network monitoring device includes at least one of a network traffic monitor, a system log server, and a security event log device; Data cleaning and normalization are performed on the several items of security-related data to remove invalid, duplicate and erroneous data, and data from different sources are formatted and unified to construct a security-related data set to obtain the several items of security-related data.

3. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model as claimed in claim 2, characterized in that: The step of performing data fusion processing on several items of security-related data in the security-related data set and extracting abnormal security situation information from the several items of security-related data after data fusion specifically includes: Extracting a plurality of security-associated data features of each security-associated data in the security-associated data set to construct a security-associated data feature set; Comparing each security-associated data feature in the security-associated data feature set with a standard range of each security-associated data feature stored in a standard security-associated database; wherein each standard range has a plurality of segments with different security situation quantization values; According to the comparison result, the security situation quantification value corresponding to each security-related data feature in the plurality of security-related data is output as security situation abnormality information.

4. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model as claimed in claim 2, characterized in that: Based on the abnormal security situation information, the step of matching the security situation monitoring elements corresponding to the abnormal security situation information in the security situation classification database specifically includes: Accessing a security situation classification database; wherein the security situation classification database stores several security situation abnormality categories, security situation quantization value ranges of security-related data feature combinations corresponding to each security situation abnormality category, and abnormal behavior action sequence sets; Based on the security situation quantization value corresponding to each security-related data feature in the plurality of security-related data items recorded in the security situation abnormality information, a security situation abnormality category that meets the security situation quantization value range requirement of the corresponding security-related data feature combination is matched in the security situation classification database to obtain the number of security situation abnormalities and the abnormal behavior action sequence set; Determine the situation security level of each security situation abnormality category according to the proportion of the difference between the security situation quantification value corresponding to each security-related data feature and the situation security optimal value of each security situation abnormality category in each security situation quantification value range within the security situation quantification value range; The number of security situation anomalies, the situation security level of each security situation anomaly category, and the sequence set of abnormal behavior actions are used as security situation monitoring elements corresponding to the security situation anomaly information.

5. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model as claimed in claim 4, characterized in that: According to the situation security level in the security situation abnormal information, the step of constructing a three-dimensional model of the current security situation in the physical environment specifically includes: Extracting the situation security level of each security situation abnormality category in the security situation abnormality information, sorting them in order from low to high security levels, and obtaining a list of security situation abnormality categories; The security situation anomaly category with the highest target ratio in the security situation anomaly category list is used as the security situation anomaly category to be monitored, and the physical environment information of each security situation anomaly category to be monitored is queried in the physical environment database; wherein the physical environment information includes a number of associated working devices of the security situation anomaly category to be monitored, the operation data of each associated working device and the setting location information in the target physical space, and the information of the management personnel responsible for the current work maintenance of each associated working device; Generate a three-dimensional model of the target physical space based on the associated working equipment, setting location information and management personnel information in the physical environment information of each security situation anomaly category to be monitored; According to the situation security level of each abnormal security situation category to be monitored, the virtual model bodies corresponding to the associated working equipment and management personnel in the three-dimensional model of the target physical space are assigned corresponding colors, and the operating data of the associated working equipment is attached to the virtual model bodies of the associated working equipment to obtain a three-dimensional model of the current security situation in the physical environment.

6. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model as claimed in claim 1, characterized in that: The steps of generating a three-dimensional model graphical strategy by using the abnormal behavior action sequence set in the abnormal security situation information, and sending the three-dimensional model graphical strategy to the security situation user management terminal so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model, specifically include: Obtaining an abnormal behavior action sequence set corresponding to each abnormal security situation category to be monitored; wherein the abnormal behavior action sequence set includes a combination of associated working devices corresponding to the abnormal security situation category to be monitored, which have abnormal behaviors at different time periods; According to the first associated working device combination with abnormal behavior of each type of security situation abnormality to be monitored in each monitoring cycle, predict the second associated working device combination with abnormal behavior in the next monitoring cycle; wherein the second associated working device combination is configured as a set of the first associated working device combination and the associated working device combination in a time period after the time period corresponding to the first associated working device combination in the abnormal behavior action sequence set; The second associated working device combination predicted in each monitoring cycle is used as the three-dimensional model graphical strategy for the next monitoring cycle, and the three-dimensional model graphical strategy is sent to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and several virtual model bodies of the three-dimensional model.

7. The method for monitoring physical security situation based on multi-source data of a three-dimensional digital model as claimed in claim 6, characterized in that: Based on the number of security situation anomalies in each monitoring cycle, a three-dimensional model visualization strategy for the current monitoring cycle is generated, and the security situation user management terminal is driven to convert the three-dimensional model visualization graphic of the current monitoring cycle into a three-dimensional model visualization screen step, specifically including: Based on the number of security situation anomalies in each monitoring cycle, determine the security situation anomaly category to be monitored in the current monitoring cycle according to the previous target ratio in the security situation anomaly category list; According to the number of security situation anomaly categories to be monitored in the current monitoring cycle and the duration of the monitoring cycle, determine the initial visualization duration of each security situation anomaly category to be monitored, obtain the situation security level corresponding to each security situation anomaly category to be monitored, and generate the visualization duration adjustment ratio of each security situation anomaly category to be monitored according to the preset level and ratio conversion rules; The initial visualization duration of each security situation anomaly category to be monitored is corrected by utilizing the visualization duration adjustment ratio, and a three-dimensional model visualization strategy for the current monitoring period is generated, which drives the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring period into a three-dimensional model visualization screen, so that the security situation user management terminal switches the three-dimensional model visualization graphics of each security situation anomaly category to be monitored according to the corrected visualization duration of each security situation anomaly category to be monitored, and generates a three-dimensional model visualization screen.

8. A multi-source data physical security situation monitoring device based on a three-dimensional digital model, characterized in that: include: The acquisition module is used to collect several security-related data of the target entity space and construct a security-related data set; An extraction module is used to perform data fusion processing on several items of security-related data in the security-related data set, and extract security situation abnormal information from the several items of security-related data after data fusion; A matching module, for matching the security situation abnormality information with the security situation monitoring elements corresponding to the security situation abnormality information in a security situation classification database based on the security situation abnormality information; wherein the security situation monitoring elements include the number of security situation abnormalities, the situation security level and the abnormal behavior action sequence set; A construction module, used to construct a three-dimensional model of the current security situation in a physical environment according to the situation security level of the security situation abnormal information; wherein the three-dimensional model includes a plurality of virtual model bodies; A generating module, used for generating a three-dimensional model graphical strategy by using the abnormal behavior action sequence set of the abnormal security situation information, and sending the three-dimensional model graphical strategy to the security situation user management terminal, so that the security situation user management terminal generates a three-dimensional model visualization graphic based on the three-dimensional model graphical strategy and a plurality of virtual model bodies of the three-dimensional model; The conversion module is used to generate a three-dimensional model visualization strategy for the current monitoring cycle based on the number of security situation anomalies in each monitoring cycle, and drive the security situation user management terminal to convert the three-dimensional model visualization graphics of the current monitoring cycle into a three-dimensional model visualization picture.

Images