Industrial information adaptive anti-intrusion supervision system and method based on Internet of Things

Abstract

The present invention relates to the technical field of industrial Internet of Things security, and discloses an industrial information adaptive anti-intrusion supervision system and method based on the Internet of Things. The system comprises an industrial information network intrusion information identification module, an industrial information network intrusion firewall matching module, and an industrial information network intrusion processing feedback module. The industrial information anti-intrusion security processing firewall type is comprehensively and accurately matched based on big data storage industrial information security processing firewall type parameters combined with intelligent recognition algorithms and industrial information network intrusion virus identification parameters and security level analysis parameters, so as to realize adaptive and scientific selection of industrial firewall types based on industrial information network intrusion virus information and data security level information, thereby improving the industrial information anti-intrusion supervision effect of the industrial Internet of Things.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial Internet of Things security, and specifically to an industrial information adaptive anti-intrusion supervision system and method based on the Internet of Things. Background Art

[0002] Industrial Internet of Things is the integration of various types of collection and control sensors or controllers with perception and monitoring capabilities, as well as mobile communications, intelligent analysis and other technologies into all aspects of the industrial production process, thereby greatly improving manufacturing efficiency, improving product quality, reducing product costs and resource consumption, and ultimately achieving a new stage of upgrading traditional industries to intelligence. The application of industrial Internet of Things has the characteristics of real-time, automation, embedded, security and information interoperability; with the promotion and application of industrial Internet of Things, it not only improves the digitization and intelligence of industrial production, but also increases the security risks of industrial production data transmission. The existing industrial Internet of Things only uses a single type of industrial information anti-intrusion software to monitor industrial information intrusion during industrial information transmission, and cannot accurately analyze the industrial information security level and the type of industrial information network intrusion virus, nor can it intelligently match the required industrial information security processing firewall type, which reduces the intelligence and security of industrial information security supervision.

[0003] The Chinese invention patent with announcement number CN117155703B discloses a network security testing and evaluation system and method, which sets up a security testing platform, an external factor analysis and evaluation unit, an internal factor analysis and evaluation unit, a self-test feedback unit, a dual evaluation and analysis unit, and an early warning display unit; accurately analyzes the external and internal factor data of network security intrusion, scientifically supervises the integrity of the external security risk level and the internal security risk level early warning, improves the timeliness and effectiveness of the early warning, and comprehensively evaluates network security; however, the above technical solution cannot adaptively set the network virus processing solution based on the network virus type, which reduces network security. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In order to solve the problem that the existing industrial Internet of Things only uses a single type of industrial information anti-intrusion software to monitor industrial information intrusion during industrial information transmission, cannot accurately analyze the industrial information security level and the type of industrial information network intrusion virus, and cannot intelligently match the required industrial information security processing firewall type, which reduces the intelligence and security of industrial information security supervision, the above purpose is to accurately collect industrial information network transmission feature data, accurately identify the type of industrial information network intrusion virus, intelligently analyze industrial information security level parameters, scientifically match the target industrial information security processing firewall type, accurately search for industrial information security processing firewall applications, autonomously and efficiently execute industrial information network transmission antivirus processing operations, and visually feedback industrial information anti-intrusion supervision result information.

[0006] (II) Technical solution

[0007] The present invention is implemented by the following technical scheme: an industrial information adaptive anti-intrusion supervision method based on the Internet of Things, the method comprising the following steps:

[0008] S1. Collect transmission characteristic data of industrial information network;

[0009] S2. Performing identification processing of the network transmission intrusion virus type in the industrial information based on the industrial information network transmission characteristic data and the industrial information network intrusion virus characteristic data, and generating industrial information network intrusion virus type identification data; when no virus exists, directly ending this industrial information intrusion prevention and supervision operation;

[0010] S3. When a virus exists, the data security level of the industrial information is analyzed and processed based on the industrial information network transmission characteristic data and the characteristic keyword data of industrial information of different security levels to generate target industrial information security level analysis data;

[0011] S4. Perform matching processing on the type of security processing firewall required for target industrial information anti-intrusion according to the network intrusion virus identification parameters, security level analysis parameters and industrial information security processing firewall type data of the industrial information, and construct target industrial information security processing firewall type matching data;

[0012] S5. Based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, a search and processing is performed on the target industrial information security processing firewall application required for intrusion prevention, and the target industrial information security processing firewall application data is generated;

[0013] S6. Execute an industrial information network transmission antivirus processing operation according to the target industrial information security processing firewall application data, and collect industrial information network transmission feature update data;

[0014] S7, after performing industrial information antivirus processing based on the industrial information network transmission characteristic update data and the industrial information network intrusion virus characteristic data, network transmission intrusion virus type identification processing is performed, industrial information network intrusion virus type identification update data is generated, and industrial information anti-intrusion supervision result feedback operation is performed.

[0015] Preferably, the operation steps of collecting the transmission characteristic data of the industrial information network are as follows:

[0016] S11. Collect industrial production information sent by industrial production workshops using the industrial Internet of Things communication network through the industrial Internet of Things supervision platform online, and generate industrial information network transmission characteristic data The industrial information network transmission characteristic data includes industrial production operation preparation information, industrial production process control information and industrial production output information transmitted through the Internet of Things network.

[0017] The present invention accurately collects industrial information network transmission feature information online through the industrial Internet of Things supervision platform, thereby providing real data support for accurately identifying the types of viruses that invade the industrial information network.

[0018] Preferably, the network transmission intrusion virus type identification processing in the industrial information is performed based on the industrial information network transmission characteristic data and the industrial information network intrusion virus characteristic data, and the industrial information network intrusion virus type identification data is generated; when there is no virus, the operation steps of directly ending the industrial information intrusion prevention and supervision operation are as follows:

[0019] S21. Establish a data set of industrial information network intrusion virus characteristics , ;in Indicates Industrial information network intrusion virus feature data corresponding to the industrial virus types, Indicates the maximum value of the number of industrial virus types; the industrial information network intrusion virus feature data represents virus feature code data of different types of industrial viruses invading industrial information through the Internet of Things communication network;

[0020] S22, using a depth-restricted search algorithm to transmit characteristic data of the industrial information network The industrial information network intrusion virus feature data set Industrial information network intrusion virus feature data Perform data matching and generate industrial information network intrusion virus type identification data based on the data matching results ;

[0021] when and The data matching is successful, indicating that the industrial information transmitted through the Internet of Things exists If there are industrial viruses, the industrial information network intrusion virus type identification data will be output If it exists, the text information of industrial virus type will be output;

[0022] when and If the data is not matched successfully, it means that there is no industrial virus in the industrial information transmitted through the Internet of Things, and the industrial information network intrusion virus type identification data is output. If it does not exist, the industrial information intrusion prevention supervision operation will be terminated directly.

[0023] The present invention achieves the effect of online monitoring of industrial information network intrusion virus types by scientifically presetting industrial information network intrusion virus feature information and combining a deep restricted search algorithm with industrial information network transmission feature information to accurately identify the types of network transmission intrusion viruses in industrial information.

[0024] Preferably, when a virus exists, the steps of performing data security level analysis and processing of industrial information based on the industrial information network transmission characteristic data and characteristic keyword data of industrial information of different security levels to generate target industrial information security level analysis data are as follows:

[0025] S31, when the industrial information network invades the virus type identification data When it exists, establish a data set of industrial information feature keywords with different security levels ,in Indicates Different security level industrial information feature keyword data corresponding to the security level, the different security level industrial information feature keyword data Including keywords of enterprise name, enterprise address, enterprise contact information, legal representative name and legal representative position in industrial production process records; Indicates Different security level industrial information feature keyword data corresponding to the security level, the different security level industrial information feature keyword data Including emergency rescue drill time keywords, emergency rescue drill location keywords and emergency rescue drill content keywords recorded in industrial production processes; Indicates Different security level industrial information feature keyword data corresponding to the security level, the different security level industrial information feature keyword data Includes production task keywords, production time keywords and production responsible personnel name keywords recorded in industrial production processes; Indicates Different security level industrial information feature keyword data corresponding to the security level, the different security level industrial information feature keyword data It includes the keywords of the time of production accident, the location of production accident, the type of production accident, the solution for production accident and the cause of production accident recorded in the industrial production process; Indicates Different security level industrial information feature keyword data corresponding to the security level, the different security level industrial information feature keyword data It includes production financial keywords, customer information keywords, production process keywords and production technology name keywords recorded in industrial production processes. to Indicates that the security level of industrial information increases in sequence;

[0026] S32, using a bidirectional search algorithm to transmit the characteristic data of the industrial information network A data set of industrial information characteristics keywords with different security levels The characteristic keyword data of industrial information with different security levels are matched with the data keywords, and the characteristic data of industrial information network transmission is searched out. The industrial information security level text information with the largest security level number corresponding to the industrial information feature keyword data of different security levels that match, and generate the target industrial information security level analysis data through data identification .

[0027] The present invention performs an accurate assessment of the data security level of industrial information by standardly storing characteristic keyword parameters of industrial information with different security levels and combining a two-way search algorithm with characteristic information of industrial information network transmission, thereby achieving the effect of intelligent detection of the importance of industrial information transmission data in the Industrial Internet of Things.

[0028] Preferably, the target industrial information security processing firewall type matching processing required for anti-intrusion security processing is performed according to the network intrusion virus identification parameters, security level analysis parameters and industrial information security processing firewall type data of the industrial information, and the operation steps for constructing the target industrial information security processing firewall type matching data are as follows:

[0029] S41. Establish a data set of industrial information security processing firewall types , ;in Indicates Industrial information security processing firewall type data corresponding to the industrial information intrusion prevention information type, Indicates the maximum number of industrial information intrusion prevention information types; the industrial information intrusion prevention information type indicates the index type information for specific identification of firewall types generated by combining industrial information network intrusion virus identification information and industrial information security level analysis information; the industrial information security processing firewall type data indicates the identity text information of different types of industrial information security processing firewalls, and the industrial information security processing firewall type data includes packet filtering firewall type, state detection firewall type, Web application firewall type and application layer DDoS firewall type;

[0030] S42, identifying the type of virus invading the industrial information network and the target industrial information security level analysis data Data collection related to the industrial information security processing firewall type Industrial Information Security Processing Firewall Type Data Perform character matching between the intrusion virus type and the industrial information security level, and search for the industrial information network intrusion virus type identification data and the target industrial information security level analysis data The corresponding industrial information security processing firewall type data , and build the target industrial information security processing firewall type matching data , execute and generate the target industrial information security processing firewall type matching data The specific steps are as follows:

[0031] S421, initializing algorithm parameters, population size N, maximum number of iterations T;

[0032] S422, initializing the population, calculating fitness, and determining the firewall type search pathfinder and the firewall type search follower;

[0033] S423, according to the position formula Data collection on firewall types performed in the industrial information security process Update the firewall type search pathfinder position in the search space, where t represents the current iteration number of the algorithm; Indicates the firewall type search pathfinder after the tth iteration Data collection on firewall types in the industrial information security process The position in the search space, Indicates the firewall type search pathfinder after the t-1th iteration Data collection on firewall types in the industrial information security process The position in the search space, Indicates the firewall type search pathfinder after the t+1th iteration Data collection on firewall types in the industrial information security process The position in the search space, The step size factor for the pathfinder movement for the firewall type search, It follows a uniform distribution in [0,1];

[0034] S424, according to the position formula Perform an update on the Firewall Type Search Follower in the Industrial Information Security Processing Firewall Type Data Set The position in the search space where Indicates the firewall type search follower after the tth iteration Data collection on firewall types in the industrial information security process The position in the search space, Indicates the firewall type search follower after the t+1th iteration Data collection on firewall types in the industrial information security process Position in the search space; Indicates that other firewall types search for followers after the tth iteration Data collection on firewall types in the industrial information security process Search for positions in the space, where the firewall type searches for followers Mobile not only with firewall type search pathfinder location Related, and subject to other firewall types search follower location The impact of Represents a firewall type search among followers in the industrial information security processing firewall type data set The position distance parameter in the search space, Represents the firewall type search pathfinder and the firewall type search follower in the industrial information security processing firewall type data set The position distance parameter in the search space, , ; represents the interaction coefficient between firewall type search followers, It represents the attraction coefficient of the firewall type search pathfinder to the firewall type search follower. , All are uniformly distributed in [1,2]; The step size factor for the movement of firewall type search followers and other firewall type search followers, The step size factor for the firewall type search follower and firewall type search pathfinder moves, , All are random numbers in the range [0,1];

[0035] S425, calculate the fitness value and update the global optimal value, that is, in the industrial information security processing firewall type data set In the search space, the identification data of the intrusion virus type and the industrial information security level are searched according to the intrusion virus type and the industrial information security level character matching. and the target industrial information security level analysis data Matching the industrial information security processing firewall type data ;

[0036] S426: When the maximum number of iterations is met, output the data for identifying the type of the industrial information network intrusion virus searched in step S425. and the target industrial information security level analysis data Matching the industrial information security processing firewall type data , and perform data identification to build the target industrial information security processing firewall type matching data .

[0037] The present invention achieves the effect of adaptively and scientifically selecting the type of industrial firewall based on industrial information network intrusion virus information and data security level information by combining the firewall type parameters based on big data storage industrial information security processing and the pathfinder optimization algorithm with the network intrusion virus identification parameters of industrial information.

[0038] Preferably, based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, the target industrial information security processing firewall application required for anti-intrusion security processing is searched and processed, and the operation steps for generating the target industrial information security processing firewall application data are as follows:

[0039] S51. Establish an industrial information security processing firewall application data collection ,in Indicates the type of industrial information security processing firewall data Corresponding industrial information security processing firewall application data, wherein the industrial information security processing firewall application data represents application data corresponding to different types of industrial information security processing firewalls;

[0040] S52, using a bidirectional search algorithm to match the target industrial information security processing firewall type data Data collection with the Industrial Information Security Processing Firewall Application Industrial Information Security Processing Firewall Application Data Perform firewall type keyword matching to search for the target industrial information security processing firewall type matching data The corresponding industrial information security processing firewall application data , and generate the target industrial information security processing firewall application data through data identification .

[0041] The present invention achieves the effect of efficient and reliable search of industrial information security processing firewall applications by autonomously and efficiently searching for security processing firewall applications required for industrial information intrusion prevention based on the target industrial information security processing firewall type matching parameters combined with a two-way search algorithm and the industrial information security processing firewall application.

[0042] Preferably, the steps of performing the industrial information network transmission antivirus processing operation according to the target industrial information security processing firewall application data and collecting the industrial information network transmission feature update data are as follows:

[0043] S61. The Industrial Internet of Things supervision platform processes firewall application data based on the target industrial information security. Start running the firewall application and execute the transmission characteristic data of the industrial information network Perform anti-virus processing on industrial information network transmission;

[0044] S62, after the anti-virus processing of industrial information network transmission is completed, the characteristic data of the industrial information network transmission is collected through the industrial Internet of Things supervision platform at the same time Industrial information network transmission feature update data generated after antivirus processing .

[0045] The present invention adopts the industrial Internet of Things supervision platform to autonomously and accurately execute the industrial information network transmission anti-virus processing operation according to the target industrial information security processing firewall application, so as to improve the security and efficiency of the industrial Internet of Things industrial information anti-intrusion anti-virus operation.

[0046] Preferably, the steps of performing network transmission intrusion virus type identification processing after industrial information antivirus processing based on the industrial information network transmission characteristic update data and the industrial information network intrusion virus characteristic data, generating industrial information network intrusion virus type identification update data and performing industrial information anti-intrusion supervision result feedback operation are as follows:

[0047] S71, using the depth-restricted search algorithm in step S22 to update the industrial information network transmission feature data The industrial information network intrusion virus feature data set Industrial information network intrusion virus feature data Perform data matching and generate industrial information network intrusion virus type identification update data based on the data matching results ;

[0048] when and The data matching is successful, indicating that the industrial information after antivirus processing still exists. If there are industrial viruses, the industrial information network intrusion virus type identification update data will be output If it exists, the text information of industrial virus type will be output;

[0049] when and If the data is not matched successfully, it means that there is no industrial virus in the industrial information after antivirus processing, then the industrial information network intrusion virus type identification update data is output for not existing;

[0050] S72, updating the data of the type of virus invading the industrial information network The industrial information anti-intrusion supervision result feedback operation is performed through the display end of the industrial Internet of Things supervision platform, and the display end includes the display screen of the industrial Internet of Things supervision platform and the handheld mobile terminal of the industrial production supervisor.

[0051] The present invention dynamically collects the transmission characteristics of industrial information networks after antivirus processing through the industrial Internet of Things supervision platform, updates the parameters, and combines the deep restricted search algorithm with the characteristic data of industrial information network intrusion viruses to accurately identify and feedback the types of intrusion viruses transmitted through the network after industrial information antivirus processing, thereby achieving the effect of intuitive and visual feedback of the industrial information anti-intrusion supervision results of the Industrial Internet of Things.

[0052] An industrial information adaptive anti-intrusion supervision system based on the Internet of Things, used to implement the industrial information adaptive anti-intrusion supervision method based on the Internet of Things, the system includes an industrial information network intrusion information identification module, an industrial information network intrusion firewall matching module, and an industrial information network intrusion processing feedback module;

[0053] The industrial information network intrusion information identification module includes an industrial information network transmission feature information collection unit, an industrial information network intrusion virus feature parameter storage unit, an industrial information network intrusion virus type identification unit, a different security level industrial information feature keyword storage unit, and a target industrial information security level analysis unit;

[0054] The industrial information network transmission characteristic information collection unit collects industrial information network transmission characteristic data through the industrial Internet of Things supervision platform; the industrial information network intrusion virus characteristic parameter storage unit is used to store industrial information network intrusion virus characteristic data; the industrial information network intrusion virus type identification unit performs network transmission intrusion virus type identification processing in industrial information based on the industrial information network transmission characteristic data and the industrial information network intrusion virus characteristic data, and generates industrial information network intrusion virus type identification data; the industrial information characteristic keyword storage unit of different security levels is used to store industrial information characteristic keyword data of different security levels; the target industrial information security level analysis unit performs data security level analysis processing of industrial information based on the industrial information network transmission characteristic data and the industrial information characteristic keyword data of different security levels, and generates target industrial information security level analysis data;

[0055] The industrial information network intrusion firewall matching module includes an industrial information security processing firewall type storage unit, a target industrial information security processing firewall type matching unit, an industrial information security processing firewall application storage unit, and a target industrial information security processing firewall application unit;

[0056] The industrial information security processing firewall type storage unit is used to store industrial information security processing firewall type data; the target industrial information security processing firewall type matching unit performs matching processing on the target industrial information security processing firewall type required for anti-intrusion according to the network intrusion virus identification parameters and security level analysis parameters of the industrial information and the industrial information security processing firewall type data, and constructs the target industrial information security processing firewall type matching data; the industrial information security processing firewall application storage unit is used to store industrial information security processing firewall application data; the target industrial information security processing firewall application unit performs search processing on the target industrial information security processing firewall application required for anti-intrusion based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, and generates the target industrial information security processing firewall application data;

[0057] The industrial information network intrusion processing feedback module includes an industrial information network transmission antivirus processing operation execution unit, an industrial information network transmission feature information update collection unit, an industrial information network intrusion virus type update identification unit, and an industrial information anti-intrusion supervision result feedback unit;

[0058] The industrial information network transmission antivirus processing operation execution unit executes the industrial information network transmission antivirus processing operation according to the target industrial information security processing firewall application data; the industrial information network transmission feature information update collection unit collects industrial information network transmission feature update data through the industrial Internet of Things supervision platform; the industrial information network intrusion virus type update identification unit performs network transmission intrusion virus type identification processing after industrial information antivirus processing based on the industrial information network transmission feature update data and the industrial information network intrusion virus feature data, and generates industrial information network intrusion virus type identification update data; the industrial information anti-intrusion supervision result feedback unit executes the industrial information anti-intrusion supervision result feedback operation based on the industrial information network intrusion virus type identification update data combined with the display end of the industrial Internet of Things supervision platform.

[0059] (III) Beneficial effects

[0060] The present invention provides an industrial information adaptive anti-intrusion monitoring system and method based on the Internet of Things. It has the following beneficial effects:

[0061] 1. Accurately collect industrial information network transmission feature information online through the Industrial Internet of Things supervision platform to provide real data support for the accurate identification of industrial information network intrusion virus types; scientifically preset industrial information network intrusion virus feature information combined with intelligent search algorithms and industrial information network transmission feature information to accurately identify the types of network transmission intrusion viruses in industrial information, realize online monitoring of industrial information network intrusion virus types, and improve the security of the Industrial Internet of Things communication network; standardize the storage of industrial information feature keyword parameters of different security levels and combine intelligent search algorithms with industrial information network transmission feature information to accurately evaluate the data security level of industrial information, realize intelligent detection of the importance of industrial information transmission data in the Industrial Internet of Things, improve the intelligence and reliability of the Industrial Internet of Things communication network, and increase the security of industrial information transmission.

[0062] 2. Based on the big data storage industrial information security processing firewall type parameters combined with intelligent recognition algorithms and industrial information network intrusion virus recognition parameters and security level analysis parameters, comprehensive and accurate matching of industrial information anti-intrusion security processing firewall types is carried out to achieve adaptive and scientific selection of industrial firewall types based on industrial information network intrusion virus information and data security level information, thereby improving the industrial Internet of Things industrial information anti-intrusion supervision effect; based on the target industrial information security processing firewall type matching parameters combined with intelligent search algorithms and industrial information security processing firewall applications, autonomous and efficient search and processing of security processing firewall applications required for industrial information anti-intrusion is carried out, thereby achieving efficient and reliable search of industrial information security processing firewall applications and improving the efficiency of industrial Internet of Things industrial information anti-intrusion supervision.

[0063] 3. Through the Industrial Internet of Things supervision platform, the industrial information network transmission anti-virus processing operations are autonomously and accurately performed according to the target industrial information security processing firewall application, thereby improving the security and efficiency of the Industrial Internet of Things industrial information anti-intrusion anti-virus operations; through the Industrial Internet of Things supervision platform, the industrial information network transmission characteristics after anti-virus processing are dynamically collected and updated. Parameters and the combination of intelligent search algorithms and industrial information network intrusion virus feature data are used to accurately identify and feedback the type of intrusion virus in the network transmission after industrial information anti-virus processing, so as to achieve intuitive and visual feedback of the Industrial Internet of Things industrial information anti-intrusion supervision results, and improve the intuitiveness and reliability of the Industrial Internet of Things industrial information anti-intrusion supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 A schematic diagram of a module of an industrial information adaptive anti-intrusion monitoring system based on the Internet of Things provided by the present invention;

[0065] Figure 2 A flow chart of the industrial information adaptive anti-intrusion supervision method based on the Internet of Things provided by the present invention. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0067] The embodiments of the industrial information adaptive anti-intrusion supervision system and method based on the Internet of Things are as follows:

[0068] Embodiment 1:

[0069] See also Figure 1 - Figure 2 , an industrial information adaptive anti-intrusion supervision method based on the Internet of Things, the method comprises the following steps:

[0070] S1. Collect transmission characteristic data of industrial information network;

[0071] S2. Identify and process the type of network transmission intrusion virus in the industrial information based on the industrial information network transmission characteristic data and the industrial information network intrusion virus characteristic data, and generate industrial information network intrusion virus type identification data; when no virus exists, directly end this industrial information intrusion prevention and supervision operation;

[0072] S3. When a virus exists, the data security level of industrial information is analyzed and processed based on the industrial information network transmission characteristic data and the characteristic keyword data of industrial information with different security levels to generate target industrial information security level analysis data;

[0073] S4. Perform matching processing on the type of security processing firewall required for target industrial information anti-intrusion according to the network intrusion virus identification parameters, security level analysis parameters and industrial information security processing firewall type data of the industrial information, and construct target industrial information security processing firewall type matching data;

[0074] S5. Based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, search and process the security processing firewall application required for the target industrial information intrusion prevention, and generate the target industrial information security processing firewall application data;

[0075] S6. Perform anti-virus processing of industrial information network transmission according to target industrial information security processing firewall application data, and collect industrial information network transmission feature update data;

[0076] S7. Perform industrial information antivirus processing based on the industrial information network transmission feature update data and the industrial information network intrusion virus feature data, identify the type of network transmission intrusion virus, generate industrial information network intrusion virus type identification update data and perform industrial information anti-intrusion supervision result feedback.

[0077] For further information, see Figure 1 - Figure 2 ,The steps for collecting transmission characteristic data of industrial information network are as follows:

[0078] S11. Collect industrial production information sent by industrial production workshops using the industrial Internet of Things communication network through the industrial Internet of Things supervision platform online, and generate industrial information network transmission characteristic data ,The characteristic data transmitted by the industrial information network includes ,industrial production operation preparation information, industrial production process ,control information and industrial production output information transmitted through the ,Internet of Things network.

[0079] Based on the industrial information network transmission feature data and the industrial information network intrusion virus feature data, the network transmission intrusion virus type identification processing in the industrial information is performed, and the industrial information network intrusion virus type identification data is generated; when there is no virus, the operation steps for directly ending this industrial information intrusion prevention and supervision operation are as follows:

[0080] S21. Establish a data set of industrial information network intrusion virus characteristics , ;in Indicates Industrial information network intrusion virus feature data corresponding to the industrial virus types, Indicates the maximum number of industrial virus types; Industrial information network intrusion virus feature data indicates the virus feature code data of different types of industrial viruses invading industrial information through the Internet of Things communication network;

[0081] S22, using the depth-restricted search algorithm to transmit characteristic data of industrial information network Industrial information network intrusion virus feature data collection Industrial information network intrusion virus feature data Perform data matching and generate industrial information network intrusion virus type identification data based on the data matching results ;

[0082] when and The data matching is successful, indicating that the industrial information transmitted through the Internet of Things exists If there are industrial viruses, the industrial information network intrusion virus type identification data will be output If it exists, the text information of industrial virus type will be output;

[0083] when and If the data is not matched successfully, it means that there is no industrial virus in the industrial information transmitted through the Internet of Things, and the industrial information network intrusion virus type identification data is output. If it does not exist, the industrial information intrusion prevention supervision operation will be terminated directly.

[0084] When a virus exists, the data security level of industrial information is analyzed and processed based on the industrial information network transmission feature data and the feature keyword data of industrial information with different security levels. The operation steps to generate the target industrial information security level analysis data are as follows:

[0085] S31. When the industrial information network invades the virus type identification data When it exists, establish a data set of industrial information feature keywords with different security levels ,in Indicates Keyword data of industrial information characteristics at different security levels corresponding to security levels, Keyword data of industrial information characteristics at different security levels Including keywords of enterprise name, enterprise address, enterprise contact information, legal representative name and legal representative position in industrial production process records;

[0086] Indicates Keyword data of industrial information characteristics at different security levels corresponding to security levels, Keyword data of industrial information characteristics at different security levels Including emergency rescue drill time keywords, emergency rescue drill location keywords and emergency rescue drill content keywords recorded in industrial production processes;

[0087] Indicates Keyword data of industrial information characteristics at different security levels corresponding to security levels, Keyword data of industrial information characteristics at different security levels Includes production task keywords, production time keywords and production responsible personnel name keywords recorded in industrial production processes;

[0088] Indicates Keyword data of industrial information characteristics at different security levels corresponding to security levels, Keyword data of industrial information characteristics at different security levels It includes the keywords of the time of production accident, the location of production accident, the type of production accident, the solution for production accident and the cause of production accident recorded in the industrial production process;

[0089] Indicates Keyword data of industrial information characteristics at different security levels corresponding to security levels, Keyword data of industrial information characteristics at different security levels It includes production financial keywords, customer information keywords, production process keywords and production technology name keywords recorded in industrial production processes. to Indicates that the security level of industrial information increases in sequence;

[0090] S32, using a two-way search algorithm to transmit characteristic data from the industrial information network Industrial information feature keyword data sets with different security levels The characteristic keyword data of industrial information with different security levels are matched with data keywords to search for characteristic data transmitted by industrial information network The industrial information security level text information with the largest security level number corresponding to the industrial information feature keyword data of different security levels is matched, and the target industrial information security level analysis data is generated through data identification. .

[0091] Through the industrial information network transmission characteristic information collection unit, the industrial Internet of Things supervision platform is used to accurately collect the industrial information network transmission characteristic information online, providing real data support for the accurate identification of the industrial information network intrusion virus type; the industrial information network intrusion virus characteristic parameter storage unit and the industrial information network intrusion virus type identification unit cooperate with each other, scientifically preset the industrial information network intrusion virus characteristic information, combined with the intelligent search algorithm and the industrial information network transmission characteristic information to accurately identify the network transmission intrusion virus type in the industrial information, realize the online monitoring of the industrial information network intrusion virus type, and improve the security of the industrial Internet of Things communication network; the industrial information characteristic keyword storage unit with different security levels and the target industrial information security level analysis unit cooperate with each other, standardly store the industrial information characteristic keyword parameters with different security levels, combine the intelligent search algorithm and the industrial information network transmission characteristic information to accurately evaluate the data security level of the industrial information, realize the intelligent detection of the importance of industrial information transmission data of the Industrial Internet of Things, improve the intelligence and reliability of the Industrial Internet of Things communication network, and increase the security of industrial information transmission.

[0092] For further information, see Figure 1 - Figure 2 According to the network intrusion virus identification parameters, security level analysis parameters and industrial information security processing firewall type data of industrial information, the target industrial information security processing firewall type matching processing is performed, and the operation steps for constructing the target industrial information security processing firewall type matching data are as follows:

[0093] S41. Establish a data set of industrial information security processing firewall types , ;in Indicates Industrial information security processing firewall type data corresponding to the industrial information intrusion prevention information type, Indicates the maximum number of industrial information intrusion prevention information types; industrial information intrusion prevention information types indicate index type information for specific identification of firewall types generated by combining industrial information network intrusion virus identification information and industrial information security level analysis information; industrial information security processing firewall type data indicates identity text information of different types of industrial information security processing firewalls, and industrial information security processing firewall type data includes packet filtering firewall type, state detection firewall type, Web application firewall type, and application layer DDoS firewall type;

[0094] S42, Identify the type of viruses that invade industrial information networks and target industrial information security level analysis data Data collection related to industrial information security firewall types Industrial Information Security Processing Firewall Type Data Perform character matching between the intrusion virus type and the industrial information security level, and search for the industrial information network intrusion virus type identification data and target industrial information security level analysis data Corresponding industrial information security processing firewall type data , and build the target industrial information security processing firewall type matching data , execute and generate target industrial information security processing firewall type matching data The specific steps are as follows:

[0095] S421, initializing algorithm parameters, population size N, maximum number of iterations T;

[0096] S422, initializing the population, calculating fitness, and determining the firewall type search pathfinder and the firewall type search follower;

[0097] S423, according to the position formula Data collection on firewall types in industrial information security processing Update the firewall type search pathfinder position in the search space, where t represents the current iteration number of the algorithm; Indicates the firewall type search pathfinder after the tth iteration Data collection on firewall types in industrial information security The position in the search space, Indicates the firewall type search pathfinder after the t-1th iteration Data collection on firewall types in industrial information security The position in the search space, Indicates the firewall type search pathfinder after the t+1th iteration Data collection on firewall types in industrial information security The position in the search space, The step size factor for the pathfinder movement for the firewall type search, It follows a uniform distribution in [0,1];

[0098] S424, according to the position formula Update Firewall Type Search Followers in Industrial Information Security Processing Firewall Type Data Collection The position in the search space where Indicates the firewall type search follower after the tth iteration Data collection on firewall types in industrial information security The position in the search space, Indicates the firewall type search follower after the t+1th iteration Data collection on firewall types in industrial information security Position in the search space; Indicates that other firewall types search for followers after the tth iteration Data collection on firewall types in industrial information security Search for positions in the space, where the firewall type searches for followers Mobile not only with firewall type search pathfinder location Related, and subject to other firewall types search follower location The impact of Represents the firewall type search followers in the industrial information security processing firewall type data set The position distance parameter in the search space, Represents the firewall type search pathfinder and firewall type search follower in the industrial information security processing firewall type data set The position distance parameter in the search space, , ; represents the interaction coefficient between firewall type search followers, It represents the attraction coefficient of the firewall type search pathfinder to the firewall type search follower. , All are uniformly distributed in [1,2]; The step size factor for the movement of firewall type search followers and other firewall type search followers, The step size factor for the firewall type search follower and firewall type search pathfinder moves, , All are random numbers in the range [0,1];

[0099] S425, calculate the fitness value and update the global optimal value, that is, in the industrial information security processing firewall type data set In the search space, the data related to the intrusion virus type and the industrial information security level are searched for and identified by the industrial information network intrusion virus type. and target industrial information security level analysis data Matching industrial information security processing firewall type data ;

[0100] S426: When the maximum number of iterations is met, output the data for identifying the type of virus that invades the industrial information network that is searched out in step S425. and target industrial information security level analysis data Matching industrial information security processing firewall type data , and perform data identification to build the target industrial information security processing firewall type matching data .

[0101] Based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, the target industrial information security processing firewall application required for anti-intrusion security processing is searched and processed, and the operation steps for generating the target industrial information security processing firewall application data are as follows:

[0102] S51. Establish an industrial information security processing firewall application data collection ,in Indicates industrial information security processing firewall type data Corresponding industrial information security processing firewall application data, the industrial information security processing firewall application data represents application data corresponding to different types of industrial information security processing firewalls;

[0103] S52, using a two-way search algorithm to match the target industrial information security processing firewall type data Processing firewall application data collection with industrial information security Industrial Information Security Processing Firewall Application Data Perform firewall type keyword matching to search for target industrial information security processing firewall type matching data Corresponding industrial information security processing firewall application data , and generate the target industrial information security processing firewall application data through data identification .

[0104] Through the cooperation of the industrial information security processing firewall type storage unit and the target industrial information security processing firewall type matching unit, the industrial information anti-intrusion security processing firewall type is comprehensively and accurately matched based on the big data storage industrial information security processing firewall type parameters combined with the intelligent recognition algorithm and the industrial information network intrusion virus recognition parameters and security level analysis parameters, so as to realize the adaptive scientific selection of industrial firewall types based on the industrial information network intrusion virus information and data security level information, and improve the industrial information anti-intrusion supervision effect of the industrial Internet of Things; the target industrial information security processing firewall application unit, based on the target industrial information security processing firewall type matching parameters combined with the intelligent search algorithm and the industrial information security processing firewall application, performs autonomous and efficient search and processing of the security processing firewall application required for industrial information anti-intrusion, so as to realize efficient and reliable search of the industrial information security processing firewall application, and improve the efficiency of the industrial information anti-intrusion supervision of the Industrial Internet of Things.

[0105] For further information, see Figure 1 - Figure 2 , the steps for performing industrial information network transmission antivirus processing operations based on the target industrial information security processing firewall application data and collecting industrial information network transmission feature update data are as follows:

[0106] S61. The Industrial Internet of Things supervision platform processes firewall application data based on target industrial information security Start the firewall application and execute the characteristic data transmission of the industrial information network Perform anti-virus processing on industrial information network transmission;

[0107] S62. After the anti-virus processing of industrial information network transmission is completed, the characteristic data of industrial information network transmission is collected through the industrial Internet of Things supervision platform at the same time. Industrial information network transmission feature update data generated after antivirus processing .

[0108] The following are the steps for performing industrial information anti-virus processing and network transmission intrusion virus type identification processing based on the industrial information network transmission feature update data and the industrial information network intrusion virus feature data, generating industrial information network intrusion virus type identification update data and performing industrial information anti-intrusion supervision result feedback operations:

[0109] S71, using the depth-restricted search algorithm in step S22 to update the industrial information network transmission feature data Industrial information network intrusion virus feature data collection Industrial information network intrusion virus feature data Perform data matching and generate industrial information network intrusion virus type identification update data based on the data matching results ;

[0110] when and The data matching is successful, indicating that the industrial information after antivirus processing still exists. If there are industrial viruses, the industrial information network intrusion virus type identification update data will be output If it exists, the text information of industrial virus type will be output;

[0111] when and If the data is not matched successfully, it means that there is no industrial virus in the industrial information after antivirus processing, then the industrial information network intrusion virus type identification update data is output for not existing;

[0112] S72, update data on the type of virus that invades the industrial information network The feedback of industrial information anti-intrusion supervision results is performed through the display end of the industrial Internet of Things supervision platform. The display end includes the display screen of the industrial Internet of Things supervision platform and the handheld mobile terminal of the industrial production supervisor.

[0113] Through the industrial information network transmission anti-virus processing operation execution unit, the industrial Internet of Things supervision platform is used to autonomously and accurately execute the industrial information network transmission anti-virus processing operation according to the target industrial information security processing firewall application, thereby improving the security and efficiency of the industrial information anti-intrusion anti-virus operation of the industrial Internet of Things; the industrial information network transmission feature information update collection unit and the industrial information anti-intrusion supervision result feedback unit cooperate with each other, and the industrial information network transmission feature update parameters after anti-virus processing are dynamically collected through the industrial Internet of Things supervision platform, and the intelligent search algorithm and the industrial information network intrusion virus feature data are combined to accurately identify and feedback the type of network transmission intrusion virus after industrial information anti-virus processing, so as to realize the intuitive and visual feedback of the industrial information anti-intrusion supervision results of the industrial Internet of Things, and improve the intuitiveness and reliability of the industrial information anti-intrusion supervision of the industrial Internet of Things.

[0114] Embodiment 2:

[0115] See also Figure 1 - Figure 2 , an industrial information adaptive anti-intrusion supervision system based on the Internet of Things, used to implement an industrial information adaptive anti-intrusion supervision method based on the Internet of Things, the system includes an industrial information network intrusion information identification module, an industrial information network intrusion firewall matching module, and an industrial information network intrusion processing feedback module;

[0116] The industrial information network intrusion information identification module includes an industrial information network transmission feature information collection unit, an industrial information network intrusion virus feature parameter storage unit, an industrial information network intrusion virus type identification unit, a different security level industrial information feature keyword storage unit, and a target industrial information security level analysis unit;

[0117] An industrial information network transmission characteristic information collection unit collects industrial information network transmission characteristic data through an industrial Internet of Things supervision platform; an industrial information network intrusion virus characteristic parameter storage unit is used to store industrial information network intrusion virus characteristic data; an industrial information network intrusion virus type identification unit performs network transmission intrusion virus type identification processing in industrial information based on industrial information network transmission characteristic data and industrial information network intrusion virus characteristic data, and generates industrial information network intrusion virus type identification data; a different security level industrial information characteristic keyword storage unit is used to store different security level industrial information characteristic keyword data; a target industrial information security level analysis unit performs data security level analysis processing on industrial information based on industrial information network transmission characteristic data and different security level industrial information characteristic keyword data, and generates target industrial information security level analysis data;

[0118] The industrial information network intrusion firewall matching module includes an industrial information security processing firewall type storage unit, a target industrial information security processing firewall type matching unit, an industrial information security processing firewall application storage unit, and a target industrial information security processing firewall application unit;

[0119] An industrial information security processing firewall type storage unit is used to store industrial information security processing firewall type data; a target industrial information security processing firewall type matching unit performs matching processing on the target industrial information security processing firewall type required for anti-intrusion according to the network intrusion virus identification parameters and security level analysis parameters of the industrial information and the industrial information security processing firewall type data, and constructs the target industrial information security processing firewall type matching data; an industrial information security processing firewall application storage unit is used to store industrial information security processing firewall application data; a target industrial information security processing firewall application unit performs search processing on the target industrial information security processing firewall application required for anti-intrusion based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, and generates the target industrial information security processing firewall application data;

[0120] The industrial information network intrusion processing feedback module includes an industrial information network transmission anti-virus processing operation execution unit, an industrial information network transmission feature information update collection unit, an industrial information network intrusion virus type update identification unit, and an industrial information anti-intrusion supervision result feedback unit;

[0121] The industrial information network transmission antivirus processing operation execution unit executes the industrial information network transmission antivirus processing operation according to the target industrial information security processing firewall application data; the industrial information network transmission feature information update collection unit collects the industrial information network transmission feature update data through the industrial Internet of Things supervision platform; the industrial information network intrusion virus type update identification unit performs network transmission intrusion virus type identification processing after industrial information antivirus processing based on the industrial information network transmission feature update data and the industrial information network intrusion virus feature data, and generates industrial information network intrusion virus type identification update data; the industrial information anti-intrusion supervision result feedback unit executes the industrial information anti-intrusion supervision result feedback operation based on the industrial information network intrusion virus type identification update data combined with the display end of the industrial Internet of Things supervision platform.

[0122] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An industrial information adaptive anti-intrusion supervision method based on the Internet of Things, characterized in that: The method comprises the following steps: S1, collect industrial information network transmission characteristic data I; S2. Performing identification processing of the network transmission intrusion virus type in the industrial information based on the industrial information network transmission characteristic data and the industrial information network intrusion virus characteristic data, and generating industrial information network intrusion virus type identification data; when no virus exists, directly ending this industrial information intrusion prevention and supervision operation; The S2 comprises the following steps: S21. Establish the industrial information network intrusion virus feature data set A = (a1,…,a o ,…,a θ ), o=1,2,3,…,θ; where a o represents the industrial information network intrusion virus feature data corresponding to the oth industrial virus type, and θ represents the maximum number of industrial virus types; S22, using a depth-limited search algorithm to compare the I with the a in the A o Perform data matching and generate industrial information network intrusion virus type identification data A based on the data matching results shibie ; When I and a o If the data matching is successful, the industrial information network intrusion virus type identification data A is output. shibie If it exists, the text information of industrial virus type will be output; When I and a o If the data is not matched successfully, the industrial information network intrusion virus type identification data A is output shibie If it does not exist, the industrial information anti-intrusion supervision operation will be terminated directly; S3. When a virus exists, the data security level of the industrial information is analyzed and processed based on the industrial information network transmission characteristic data and the characteristic keyword data of industrial information of different security levels to generate target industrial information security level analysis data; The S3 comprises the following steps: S31, when the A shibie When exists, establish a set of industrial information characteristic keyword data of different security levels B = (b1, ..., b5), where b1 represents industrial information characteristic keyword data of different security levels corresponding to the first security level; b2 represents industrial information characteristic keyword data of different security levels corresponding to the second security level; b3 represents industrial information characteristic keyword data of different security levels corresponding to the third security level; b4 represents industrial information characteristic keyword data of different security levels corresponding to the fourth security level; b5 represents industrial information characteristic keyword data of different security levels corresponding to the fifth security level, where b1 to b5 represent that the security levels of industrial information increase in sequence; S32, using a bidirectional search algorithm to perform data keyword matching between the I and the industrial information feature keyword data of different security levels in B, searching for the industrial information security level text information with the largest security level number corresponding to the industrial information feature keyword data of different security levels matching the I, and generating the target industrial information security level analysis data b through data identification I ; S4. Perform matching processing on the type of security processing firewall required for target industrial information anti-intrusion according to the network intrusion virus identification parameters, security level analysis parameters and industrial information security processing firewall type data of the industrial information, and construct target industrial information security processing firewall type matching data; The S4 comprises the following steps: S41. Establish a data set of industrial information security processing firewall types where c p Indicates the industrial information security processing firewall type data corresponding to the pth industrial information anti-intrusion information type, Indicates the maximum number of industrial information intrusion prevention information types; S42, the A shibie and the b I The same as the C in c p Perform character matching of the intrusion virus type and industrial information security level to search for the A shibie and the b I The corresponding c p , and build the target industrial information security processing firewall type matching data Execute and generate the target industrial information security processing firewall type matching data The specific steps are as follows: S421, initializing algorithm parameters, population size N, maximum number of iterations T; S422, initializing the population, calculating fitness, and determining the firewall type search pathfinder and the firewall type search follower; S423, updating the firewall type search pathfinder position in the C search space according to the position formula; S424, updating the position of the firewall type search follower in the C search space according to the position formula; S425, calculate the fitness value and update the global optimal value, that is, search for the intrusion virus type and industrial information security level character matching in the C search space. shibie and the b I Match the c p ; S426: When the maximum number of iterations is met, output the output from step S425 that matches the A shibie and the b I Match the c p , and perform data identification to build the target industrial information security processing firewall type matching data S5. Based on the target industrial information security processing firewall type matching data and the industrial information security processing firewall application data, a search and processing is performed on the target industrial information security processing firewall application required for intrusion prevention, and the target industrial information security processing firewall application data is generated; S6. Execute an industrial information network transmission antivirus processing operation according to the target industrial information security processing firewall application data, and collect industrial information network transmission feature update data; S7, after performing industrial information antivirus processing based on the industrial information network transmission characteristic update data and the industrial information network intrusion virus characteristic data, network transmission intrusion virus type identification processing is performed, industrial information network intrusion virus type identification update data is generated, and industrial information anti-intrusion supervision result feedback operation is performed.

2. The method for adaptively preventing intrusion and monitoring industrial information based on the Internet of Things according to claim 1 is characterized in that: The S1 comprises the following steps: S11. Collect industrial production information sent by industrial production workshops using the industrial Internet of Things communication network through the industrial Internet of Things supervision platform online, and generate industrial information network transmission characteristic data I.

3. The method for adaptively preventing intrusion and monitoring industrial information based on the Internet of Things according to claim 1 is characterized in that: The S5 comprises the following steps: S51. Establish an industrial information security processing firewall application data collection where c' p Indicates the industrial information security processing firewall type data c p The corresponding industrial information security processes firewall application data; S52, using a bidirectional search algorithm to and C' in c' p Perform firewall type keyword matching and search for the following The corresponding c' p , and after data identification, generate the target industrial information security processing firewall application data c' mubaio .

4. The method for adaptively preventing intrusion and monitoring industrial information based on the Internet of Things according to claim 3 is characterized in that: The S6 comprises the following steps: S61, Industrial Internet of Things supervision platform is based on the above c' mubaio Start running a firewall application program and perform anti-virus processing on the industrial information network transmission of the I; S62. After the antivirus processing of industrial information network transmission is completed, the industrial information network transmission feature update data I' generated after the antivirus processing of I is synchronously collected through the industrial Internet of Things supervision platform.

5. The method for industrial information adaptive anti-intrusion supervision based on the Internet of Things according to claim 4 is characterized in that: The S7 comprises the following steps: S71, using the depth-limited search algorithm in step S22 to compare the I' with the a in A. o Perform data matching and generate industrial information network intrusion virus type identification update data A based on the data matching results gengxin ; When I' and a o If the data matching is successful, the industrial information network intrusion virus type identification update data A is output. gengxin If it exists, the text information of industrial virus type will be output; When I' and a o If the data is not matched successfully, the industrial information network intrusion virus type identification update data A is output gengxin for not existing; S72, the A gengxin The industrial information anti-intrusion supervision result feedback operation is performed through the display end of the industrial Internet of Things supervision platform, and the display end includes the display screen of the industrial Internet of Things supervision platform and the handheld mobile terminal of the industrial production supervisor.

6. An industrial information adaptive anti-intrusion monitoring system based on the Internet of Things, used to implement the industrial information adaptive anti-intrusion monitoring method based on the Internet of Things as described in any one of claims 1 to 5, characterized in that: The system includes an industrial information network intrusion information identification module, an industrial information network intrusion firewall matching module, and an industrial information network intrusion processing feedback module.

Images