Industrial Internet of Things safety monitoring method and system based on deep learning

Abstract

The invention relates to the technical field of industrial safety monitoring, in particular to an industrial internet of things safety monitoring method and system based on deep learning, and the method comprises the steps: collecting historical monitoring data in a historical period, and creating an anomaly recognition network model, the abnormal identification network model is trained based on the data transmission information, the data network transmission and the historical monitoring data to obtain a trained abnormal identification network model, whether the current production transmission data meets the data network transmission specification is judged, and if yes, the current time sequence feature and the current flow distribution feature are determined; and inputting the current time sequence feature and the current flow distribution feature into an anomaly recognition network model for anomaly recognition to obtain an anomaly recognition result, judging whether the anomaly recognition result has an anomaly feature, and if yes, generating an alarm instruction. According to the invention, the detection accuracy and safety of the current production transmission data are improved.

Description

Technical Field

[0001] The present application relates to the technical field of industrial safety monitoring, and in particular to a deep learning-based industrial Internet of Things safety monitoring method and system. Background Art

[0002] With the rapid development of the Industrial Internet of Things, network security has become a key challenge to ensure production stability and data security. In the past, the security monitoring of the Industrial Internet of Things mainly relied on fixed-rule detection systems and statistical analysis methods. These methods can identify known abnormal patterns, but when faced with complex and changing network traffic and new attack methods, they have the limitations of insufficient detection accuracy, low real-time performance, and difficulty in dealing with unknown threats. Summary of the invention

[0003] In order to solve at least one of the above technical problems, the present application provides an industrial Internet of Things security monitoring method and system based on deep learning.

[0004] In the first aspect, the present application provides an industrial Internet of Things security monitoring method based on deep learning, which adopts the following technical solutions: Acquire data transmission information within a historical period, current production transmission data, and data network transmission specifications, wherein the data transmission information is the transmission information of product production data, production equipment data, and production environment data on an industrial manufacturing production line during network transmission, and the data network transmission specifications are transmission determination specifications for determining whether data transmission information is abnormal or not; Collecting historical monitoring data within the historical period, the historical monitoring data being network abnormal transmission data of the data transmission information corresponding to different time nodes; Creating an anomaly recognition network model, and training the anomaly recognition network model based on the data transmission information, the data network transmission, and the historical monitoring data to obtain a trained anomaly recognition network model; Determine whether the current production transmission data meets the data network transmission specification. If so, determine the current time series characteristics and the current traffic distribution characteristics based on the current production transmission data, and input the current time series characteristics and the current traffic distribution characteristics into the anomaly identification network model for anomaly identification to obtain anomaly identification results; Determine whether the abnormal identification result has abnormal features. If so, generate an alarm instruction to control the alarm device to issue an abnormal data transmission alarm.

[0005] In a possible implementation, the training of the anomaly recognition network model based on the data transmission information, the data network transmission, and the historical monitoring data to obtain the trained anomaly recognition network model includes: Determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specification based on the data transmission information; if so, decompose the production transmission data to obtain transmission abnormality data of the production data group corresponding to each production product, convert the transmission abnormality data into a pixel grayscale image, extract the time series features and flow distribution features in the pixel grayscale image, and extract the extracted time series features and flow distribution features; The time series characteristics, traffic distribution characteristics and historical monitoring data are input into the anomaly recognition network model for training to obtain a trained anomaly recognition network model.

[0006] In a possible implementation, the extracting of the time series features and the flow distribution features in the pixel grayscale image, extracting the time series features and the flow distribution features, and then further comprising: Arranging the traffic distribution characteristics according to the transmission time nodes according to the time series characteristics to obtain an abnormal traffic fluctuation graph of the abnormal transmission data; Arrange the current traffic distribution characteristics according to the transmission time nodes according to the current time series characteristics to obtain a current traffic fluctuation graph of the current production transmission data; The current traffic fluctuation graph and the abnormal traffic fluctuation graph are fitted according to the transmission time nodes to determine whether there are abnormalities in the current production transmission data corresponding to the different transmission time nodes; if so, a data transmission abnormality analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

[0007] In a possible implementation manner, performing data transmission anomaly analysis on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission includes: Determine the highest flow transmission rate and the lowest flow transmission rate in the historical production data transmission process according to the data transmission information, and use the highest flow transmission rate and the lowest flow transmission rate as the transmission numerator, and use the time used in each production data transmission process as the transmission denominator; The transmission rate change value of each production data transmission process is obtained according to the ratio of the transmission numerator to the transmission denominator; Arranging the transmission rate change values ​​in time sequence to obtain a data transmission sequence of the data transmission information; Segmenting the data transmission sequence to obtain two or more transmission data segments; According to the data security situation of each change value corresponding to each transmission data segment occurring within a preset future time, an abnormal analysis is performed on the current production transmission data to obtain the abnormal transmission degree.

[0008] In a possible implementation, the data transmission sequence is segmented to obtain two or more transmission data segments, including: Determine all the split points in the transmission sequence according to the transmission rate change value of each production data transmission process in the data transmission sequence and each transmission rate value; The transmission sequence is segmented according to all segmentation points, the similarity of the change value sequences corresponding to each two adjacent transmission sequences is obtained, and whether each two adjacent transmission sequences need to be merged is determined according to the similarity to obtain two or more transmission data segments.

[0009] In the second aspect, the present application provides an industrial Internet of Things security monitoring system based on deep learning, which adopts the following technical solutions: An industrial Internet of Things security monitoring system based on deep learning, comprising: A data acquisition module is used to acquire data transmission information within a historical period, current production transmission data, and data network transmission specifications. The data transmission information is the transmission information of product production data, production equipment data, and production environment data on an industrial manufacturing production line during network transmission. The data network transmission specifications are transmission determination specifications for determining whether data transmission information is abnormal or not; A data collection module, used for collecting historical monitoring data within the historical period, wherein the historical monitoring data is network abnormal transmission data of the data transmission information corresponding to different time nodes; A model creation module, used to create an anomaly recognition network model, and train the anomaly recognition network model based on the data transmission information, the data network transmission and the historical monitoring data to obtain a trained anomaly recognition network model; A feature recognition module is used to determine whether the current production transmission data meets the data network transmission specification. If so, the current time series feature and the current traffic distribution feature are determined based on the current production transmission data, and the current time series feature and the current traffic distribution feature are input into the anomaly recognition network model for anomaly recognition to obtain anomaly recognition results. The abnormal alarm module is used to determine whether the abnormal identification result has abnormal characteristics. If so, an alarm instruction is generated to control the alarm device to issue an abnormal data transmission alarm.

[0010] In a possible implementation, when the model creation module trains the anomaly recognition network model based on the data transmission information, the data network transmission, and the historical monitoring data to obtain the trained anomaly recognition network model, it is specifically used to: Determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specification based on the data transmission information; if so, decompose the production transmission data to obtain transmission abnormality data of the production data group corresponding to each production product, convert the transmission abnormality data into a pixel grayscale image, extract the time series features and flow distribution features in the pixel grayscale image, and extract the extracted time series features and flow distribution features; The time series characteristics, traffic distribution characteristics and historical monitoring data are input into the anomaly recognition network model for training to obtain a trained anomaly recognition network model.

[0011] In another possible implementation, the system further includes: a historical feature sorting module, a current feature sorting module and an abnormality analysis module, wherein: The historical feature sorting module is used to sort the traffic distribution features according to the transmission time nodes according to the time series features to obtain the abnormal traffic fluctuation graph of the transmission abnormal data; The current feature sorting module is used to sort the current traffic distribution features according to the transmission time nodes according to the current time series features to obtain the current traffic fluctuation graph of the current production transmission data; The abnormality analysis module is used to fit the current traffic fluctuation graph and the abnormal traffic fluctuation graph according to the transmission time nodes, and determine whether there are abnormalities in the current production transmission data corresponding to different transmission time nodes. If so, data transmission abnormality analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

[0012] In another possible implementation, when the abnormality analysis module performs data transmission abnormality analysis on the current production transmission data based on the data transmission information to obtain the abnormal transmission degree, it is specifically used to: Determine the highest flow transmission rate and the lowest flow transmission rate in the historical production data transmission process according to the data transmission information, and use the highest flow transmission rate and the lowest flow transmission rate as the transmission numerator, and use the time used in each production data transmission process as the transmission denominator; The transmission rate change value of each production data transmission process is obtained according to the ratio of the transmission numerator to the transmission denominator; Arranging the transmission rate change values ​​in time sequence to obtain a data transmission sequence of the data transmission information; Segmenting the data transmission sequence to obtain two or more transmission data segments; According to the data security situation of each change value corresponding to each transmission data segment occurring within a preset future time, an abnormal analysis is performed on the current production transmission data to obtain the abnormal transmission degree.

[0013] In another possible implementation, when the abnormality analysis module performs segment processing on the data transmission sequence to obtain two or more transmission data segments, the abnormality analysis module is specifically configured to: Determine all the split points in the transmission sequence according to the transmission rate change value of each production data transmission process in the data transmission sequence and each transmission rate value; The transmission sequence is segmented according to all segmentation points, the similarity of the change value sequences corresponding to each two adjacent transmission sequences is obtained, and whether each two adjacent transmission sequences need to be merged is determined according to the similarity to obtain two or more transmission data segments.

[0014] In a third aspect, the present application provides an electronic device, which adopts the following technical solution: at least one processor; Memory; At least one application, wherein at least one application is stored in a memory and configured to be executed by at least one processor, and at least one application is configured to: execute an industrial Internet of Things security monitoring method based on deep learning as described in any one of the first aspects.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute any industrial Internet of Things security monitoring method based on deep learning as described in the first aspect.

[0016] In summary, the present application includes at least one of the following beneficial technical effects: When the industrial production data collected by the industrial Internet of Things is transmitted, data transmission information within a historical period, current production transmission data and data network transmission specifications are obtained. The data transmission information is the transmission information of product production data, production equipment data and production environment data on the industrial manufacturing production line during network transmission. The data network transmission specification is a transmission determination specification for determining whether the data transmission information is abnormal. Then, historical monitoring data within the historical period is collected. The historical monitoring data is the network abnormal transmission data of the data transmission information corresponding to different time nodes. Then, an abnormality recognition network model is created, and the abnormality recognition network model is trained based on the data transmission information, the data network transmission and the historical monitoring data to obtain a trained abnormality recognition network model. Then, it is determined whether the current production transmission data meets the data network transmission specification. If it does, the current time series characteristics and the current traffic distribution characteristics are determined based on the current production transmission data, and the current time series characteristics and the current traffic distribution characteristics are input into the abnormality recognition network model for abnormality recognition to obtain an abnormality recognition result. Then, it is determined whether the abnormality recognition result has abnormal characteristics. If it does, an alarm instruction is generated to control the alarm device to perform data abnormality transmission alarm. The present application improves the detection accuracy and security of the current production transmission data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of an industrial Internet of Things security monitoring method based on deep learning is provided in an embodiment of the present application.

[0018] Figure 2 A schematic diagram of the structure of an industrial Internet of Things security monitoring system based on deep learning provided in an embodiment of the present application.

[0019] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following is combined with Figure 1-3 This application is described in further detail.

[0021] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, a person skilled in the art may make non-creative modifications to the present embodiment as needed, but such modifications are protected by the patent law as long as they are within the scope of the present application.

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0024] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0025] The embodiment of the present application provides a method for industrial Internet of Things security monitoring based on deep learning, which is executed by an electronic device, wherein the electronic device can be an independent physical electronic device, or an electronic device cluster or distributed system composed of multiple physical electronic devices, or a cloud electronic device that provides cloud computing services. The embodiment of the present application is not limited here, such as Figure 1 As shown, the method includes: Step S10: Acquire data transmission information within a historical period, current production transmission data, and data network transmission specifications.

[0026] Among them, data transmission information is the transmission information of product production data, production equipment data and production environment data on the industrial manufacturing production line during network transmission, and the data network transmission specification is the transmission determination specification for determining whether the data transmission information is abnormal or not.

[0027] For the embodiment of the present application, the current production transmission data refers to the product production data, production equipment status data and production environment monitoring data that are being generated or prepared to be transmitted through the network on the industrial manufacturing production line at the current moment. These data are key information that reflects the production status in real time. The data network transmission specification is a set of rules for determining whether the data transmission information meets the expected standard or whether there is an abnormality. It includes multiple aspects such as the rate requirements for data transmission, the standardized definition of the data format, the security protocol for data transmission, and the error handling mechanism, aiming to ensure that the transmission of data in the network is both efficient and safe. The product production data on the industrial manufacturing production line is a variety of data directly related to product manufacturing in the industrial production process, such as product model, production batch, raw material usage, processing progress, etc. The production equipment data covers the operating status, maintenance records, fault alarms and other information of all equipment on the production line, and is important data to ensure the smooth progress of production. The production environment data is the data of external environmental factors that affect the production process, such as temperature, humidity, noise level, air quality, etc., which are crucial to ensure product quality and production safety.

[0028] In the embodiment of the present application, the automated script or data capture tool periodically retrieves the data transmission information within the specified historical period from the historical database and stores it in a dedicated data analysis platform. At the same time, the electronic device monitors and captures the transmission data generated on the current production line in real time to ensure the integrity and real-time nature of the data. Then, according to the pre-defined data network transmission specifications, the collected data is compared and analyzed using data analysis software or algorithms to identify any possible anomalies or non-compliance with the specifications.

[0029] Step S11, collecting historical monitoring data within a historical period.

[0030] Among them, the historical monitoring data is the network abnormal transmission data of the data transmission information corresponding to different time nodes.

[0031] For the embodiments of the present application, there is a part of the transmission data in the historical monitoring data that meets the data network transmission specification, but there are transmission anomalies. For such transmission anomaly data, it is impossible to implement transmission data interception alarm processing only according to the data network transmission specification. Therefore, in order to improve the transmission accuracy and security of the data transmitted at the current moment, the present application obtains all network anomaly transmission data with network anomalies corresponding to different time nodes in the historical period. Different time nodes refer to specific time points or time periods within the historical period, and each time node corresponds to a specific set of monitoring data. These time nodes can be uniform (such as every hour, every day) or uneven, depending on the monitoring frequency and data collection strategy.

[0032] In the embodiment of the present application, a network management system (NMS) or a security information and event management (SIEM) system is used to automatically collect and analyze historical monitoring data, monitor the network status in real time and accurately, and automatically identify and report network anomalies. By configuring corresponding rules and thresholds, the electronic device can automatically capture and store network abnormal transmission data.

[0033] Step S12: create an anomaly recognition network model, and train the anomaly recognition network model based on data transmission information, data network transmission, and historical monitoring data to obtain a trained anomaly recognition network model.

[0034] For the embodiments of the present application, a recurrent neural network (RNN) or its variants such as a long short-term memory network (LSTM) is used to process time series data to capture long-term dependencies in the data. Then, the structure of the RNN or LSTM model is defined, and its input and output are determined. Time series data related to data transmission information, data network transmission, and historical monitoring data are collected. Next, these data are cleaned and preprocessed to remove noise and outliers. After that, the RNN or LSTM model is trained using the processed data, and the parameters of the model are optimized by methods such as gradient descent. Finally, the recognition effect of the model is verified, and adjustments and optimizations are made according to actual needs.

[0035] Step S13, determine whether the current production transmission data meets the data network transmission specifications. If so, determine the current time series characteristics and the current traffic distribution characteristics based on the current production transmission data, and input the current time series characteristics and the current traffic distribution characteristics into the anomaly recognition network model for anomaly recognition to obtain anomaly recognition results.

[0036] Specifically, in the process of data network transmission, in order to ensure the accuracy and security of the current production transmission data, it is necessary to determine whether the current production transmission data meets the established data network transmission specifications. This step checks the integrity, format, size, transmission rate and other aspects of the data. If the current production transmission data meets the data network transmission specifications, further feature extraction and anomaly identification work will be carried out. Specifically, the current time series features and current traffic distribution features will be determined based on the current production transmission data. Time series features usually refer to the characteristics of data changes over time, such as trends, periodicity, seasonality, etc., while traffic distribution features describe the distribution of data in the network, such as the peak value, valley value, fluctuation range, etc. of traffic. After extracting these features, they are sent as input data to the previously trained anomaly identification network model. By learning the normal and abnormal patterns in the historical data, the anomaly identification network model can automatically classify and judge the newly input data and identify whether there are abnormal transmission behaviors outside the data network transmission specifications. The anomaly recognition network model outputs an anomaly recognition result. If the result is abnormal, the abnormal transmission data and abnormal factors corresponding to the anomaly in the historical monitoring data will be output. According to the output results, the maintenance personnel will take corresponding measures to handle the abnormal data or adjust the network transmission strategy to ensure the security and stability of the network.

[0037] Specifically, the anomaly recognition network model is trained based on data transmission information, data network transmission, and historical monitoring data to obtain a trained anomaly recognition network model, including: Based on the data transmission information, determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specifications. If so, decompose the production transmission data to obtain the transmission anomaly data of the production data group corresponding to each production product. Convert the transmission anomaly data into a pixel grayscale image, and extract the time series features and flow distribution features in the pixel grayscale image. Input the extracted time series features and flow distribution features, and the historical monitoring data into the anomaly recognition network model for training to obtain the trained anomaly recognition network model.

[0038] Step S13: determine whether the abnormal identification result has abnormal features. If so, generate an alarm instruction to control the alarm device to issue an abnormal data transmission alarm.

[0039] Specifically, after identifying a network anomaly, the electronic device generates an alarm instruction and sends the alarm instruction to the alarm device. After receiving the alarm instruction, the alarm device immediately triggers the alarm mechanism and sends an emergency notification to the network administrator or security team through SMS, email, instant messaging tools, etc. The notification content contains key information such as the type of anomaly, the time of occurrence, and the scope of impact, ensuring that the security team can respond quickly and take effective measures.

[0040] In an embodiment of the present application, when the industrial production data collected by the industrial Internet of Things is transmitted, data transmission information within a historical period, current production transmission data and data network transmission specifications are obtained. The data transmission information is the transmission information of product production data, production equipment data and production environment data on the industrial manufacturing production line during network transmission. The data network transmission specification is a transmission determination specification for determining whether the data transmission information is abnormal or not. Then, historical monitoring data within the historical period is collected. The historical monitoring data is the network abnormal transmission data of the data transmission information corresponding to different time nodes. Then, an abnormal identification network model is created, and the abnormal identification network model is trained based on the data transmission information, data network transmission and historical monitoring data to obtain a trained abnormal identification network model. Then, it is determined whether the current production transmission data meets the data network transmission specification. If it meets, the current time series characteristics and the current traffic distribution characteristics are determined based on the current production transmission data, and the current time series characteristics and the current traffic distribution characteristics are input into the abnormal identification network model for abnormal identification to obtain an abnormal identification result. Then, it is determined whether the abnormal identification result has abnormal characteristics. If so, an alarm instruction is generated to control the alarm device to perform data abnormal transmission alarm. The present application improves the detection accuracy and real-time performance of the current production transmission data.

[0041] A possible implementation method of the embodiment of the present application is to extract time series features and traffic distribution features in the pixel grayscale image, and then to extract the time series features and traffic distribution features, and then also include: according to the time series features, the traffic distribution features are sorted according to the transmission time nodes to obtain an abnormal traffic fluctuation graph of the abnormal transmission data; according to the current time series features, the current traffic distribution features are sorted according to the transmission time nodes to obtain a current traffic fluctuation graph of the current production transmission data; the current traffic fluctuation graph and the abnormal traffic fluctuation graph are fitted according to the transmission time nodes to determine whether there are abnormalities in the current production transmission data corresponding to different transmission time nodes; if so, data transmission anomaly analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

[0042] Specifically, the highest flow transmission rate and the lowest flow transmission rate in the historical production data transmission process are determined according to the data transmission information, and the highest flow transmission rate and the lowest flow transmission rate are used as the transmission numerator, and the time used for each production data transmission process is used as the transmission denominator. The transmission rate change value of each production data transmission process is obtained according to the ratio of the transmission numerator to the transmission denominator, and the transmission rate change values ​​are arranged in time series to obtain a data transmission sequence of the data transmission information. The data transmission sequence is segmented to obtain two or more transmission data segments, and the current production transmission data is analyzed for abnormalities according to the data security situation of each change value corresponding to each transmission data segment within a preset time in the future to obtain the degree of abnormal transmission.

[0043] Specifically, all the segmentation points in the transmission sequence are determined according to the transmission rate change value of each production data transmission process in the data transmission sequence and each transmission rate value, the transmission sequence is segmented according to all the segmentation points, and the similarity of the change value sequences corresponding to each two adjacent transmission sequences is obtained. According to the similarity, it is determined whether each two adjacent transmission sequences need to be merged, and two or more transmission data segments are obtained.

[0044] The following is an introduction to an industrial Internet of Things security monitoring system based on deep learning provided in an embodiment of the present application. The industrial Internet of Things security monitoring system based on deep learning described below and the industrial Internet of Things security monitoring method based on deep learning described above can be referenced to each other. Please refer to Figure 2 , Figure 2 : is a structural diagram of an industrial Internet of Things security monitoring system 20 based on deep learning provided in an embodiment of the present application, including: The data acquisition module 21 is used to acquire data transmission information in the historical period, current production transmission data and data network transmission specifications. The data transmission information is the transmission information of product production data, production equipment data and production environment data on the industrial manufacturing production line during network transmission. The data network transmission specifications are transmission determination specifications for determining whether the data transmission information is abnormal or not; The data collection module 22 is used to collect historical monitoring data within a historical period, where the historical monitoring data is network abnormal transmission data of data transmission information corresponding to different time nodes; A model creation module 23 is used to create an anomaly recognition network model, and train the anomaly recognition network model based on data transmission information, data network transmission and historical monitoring data to obtain a trained anomaly recognition network model; The feature recognition module 24 is used to determine whether the current production transmission data meets the data network transmission specification. If so, the current time series feature and the current traffic distribution feature are determined based on the current production transmission data, and the current time series feature and the current traffic distribution feature are input into the anomaly recognition network model for anomaly recognition to obtain anomaly recognition results. The abnormal alarm module 25 is used to determine whether the abnormal identification result has abnormal characteristics. If so, an alarm instruction is generated to control the alarm device to issue an abnormal data transmission alarm.

[0045] In one possible implementation of the embodiment of the present application, when the model creation module 23 trains the anomaly recognition network model based on data transmission information, data network transmission, and historical monitoring data to obtain the trained anomaly recognition network model, it is specifically used to: Based on the data transmission information, determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specification. If it does, decompose the production transmission data to obtain the transmission abnormality data of the production data group corresponding to each production product, convert the transmission abnormality data into a pixel grayscale image, and extract the time series features and flow distribution features in the pixel grayscale image, and extract the extracted time series features and flow distribution features; The time series characteristics, traffic distribution characteristics and historical monitoring data are input into the anomaly recognition network model for training to obtain the trained anomaly recognition network model.

[0046] In another possible implementation of the embodiment of the present application, the system 20 further includes: a historical feature sorting module, a current feature sorting module and an abnormality analysis module, wherein: The historical feature sorting module is used to sort the traffic distribution characteristics according to the transmission time nodes based on the time series characteristics, and obtain the abnormal traffic fluctuation diagram of the transmission abnormal data; The current feature sorting module is used to sort the current traffic distribution features according to the transmission time nodes according to the current time series features to obtain the current traffic fluctuation graph of the current production transmission data; The anomaly analysis module is used to fit the current traffic fluctuation graph with the abnormal traffic fluctuation graph according to the transmission time nodes, and determine whether there are anomalies in the current production transmission data corresponding to different transmission time nodes. If so, data transmission anomaly analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

[0047] In another possible implementation of the embodiment of the present application, when the abnormality analysis module performs data transmission abnormality analysis on the current production transmission data based on the data transmission information to obtain the abnormal transmission degree, it is specifically used to: Determine the highest flow rate and the lowest flow rate in the historical production data transmission process according to the data transmission information, and use the highest flow rate and the lowest flow rate as the transmission numerator, and use the time used in each production data transmission process as the transmission denominator; The transmission rate change value of each production data transmission process is obtained according to the ratio of the transmission numerator to the transmission denominator; Arranging the transmission rate change values ​​in time sequence to obtain a data transmission sequence of data transmission information; Segmenting the data transmission sequence to obtain two or more transmission data segments; According to the data security situation of each change value corresponding to each transmission data segment occurring in the future preset time, an abnormal analysis is performed on the current production transmission data to obtain the abnormal transmission degree.

[0048] In another possible implementation of the embodiment of the present application, when the abnormal analysis module performs segmentation processing on the data transmission sequence to obtain two or more transmission data segments, it is specifically used to: Determine all the split points in the transmission sequence according to the transmission rate change value of each production data transmission process in the data transmission sequence and each transmission rate value; The transmission sequence is segmented according to all the segmentation points, and the similarity of the change value sequence corresponding to each two adjacent transmission sequences is obtained. According to the similarity, it is determined whether each two adjacent transmission sequences need to be merged to obtain two or more transmission data segments.

[0049] The present application embodiment provides an electronic device, such as Figure 3 As shown, Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, Figure 3 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0050] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of the present application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0051] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0052] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0053] The memory 303 is used to store application code for executing the solution of the embodiment of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the content shown in the above method embodiment.

[0054] Among them, electronic devices include but are not limited to: mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0055] A computer-readable storage medium provided in an embodiment of the present application is introduced below. The computer-readable storage medium described below and the method described above can be referenced to each other.

[0056] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the industrial Internet of Things security monitoring method based on deep learning are implemented.

[0057] Since the embodiments of the computer-readable storage medium part and the embodiments of the method part correspond to each other, the embodiments of the computer-readable storage medium part refer to the description of the embodiments of the method part.

[0058] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0059] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A deep learning-based industrial Internet of Things security monitoring method, characterized in that: include: Acquire data transmission information within a historical period, current production transmission data, and data network transmission specifications, wherein the data transmission information is the transmission information of product production data, production equipment data, and production environment data on an industrial manufacturing production line during network transmission, and the data network transmission specifications are transmission determination specifications for determining whether data transmission information is abnormal or not; Collecting historical monitoring data within the historical period, the historical monitoring data being network abnormal transmission data of the data transmission information corresponding to different time nodes; Creating an anomaly recognition network model, and training the anomaly recognition network model based on the data transmission information, the data network transmission, and the historical monitoring data to obtain a trained anomaly recognition network model; Determine whether the current production transmission data meets the data network transmission specification. If so, determine the current time series characteristics and the current traffic distribution characteristics based on the current production transmission data, and input the current time series characteristics and the current traffic distribution characteristics into the anomaly identification network model for anomaly identification to obtain anomaly identification results; Determine whether the abnormal identification result has abnormal features. If so, generate an alarm instruction to control the alarm device to issue an abnormal data transmission alarm.

2. According to the deep learning-based industrial Internet of Things security monitoring method of claim 1, it is characterized in that: The training of the anomaly recognition network model based on the data transmission information, the data network transmission and the historical monitoring data to obtain the trained anomaly recognition network model includes: Determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specification based on the data transmission information; if so, decompose the production transmission data to obtain transmission abnormality data of the production data group corresponding to each production product, convert the transmission abnormality data into a pixel grayscale image, extract the time series features and flow distribution features in the pixel grayscale image, and extract the extracted time series features and flow distribution features; The time series characteristics, traffic distribution characteristics and historical monitoring data are input into the anomaly recognition network model for training to obtain a trained anomaly recognition network model.

3. According to the deep learning-based industrial Internet of Things security monitoring method of claim 2, it is characterized in that: The step of extracting the time series features and the flow distribution features in the pixel grayscale image, and extracting the time series features and the flow distribution features, further comprises: Arranging the traffic distribution characteristics according to the transmission time nodes according to the time series characteristics to obtain an abnormal traffic fluctuation graph of the abnormal transmission data; Arrange the current traffic distribution characteristics according to the transmission time nodes according to the current time series characteristics to obtain a current traffic fluctuation graph of the current production transmission data; The current traffic fluctuation graph and the abnormal traffic fluctuation graph are fitted according to the transmission time nodes to determine whether there are abnormalities in the current production transmission data corresponding to the different transmission time nodes; if so, a data transmission abnormality analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

4. The industrial Internet of Things security monitoring method based on deep learning according to claim 3 is characterized in that: The performing data transmission anomaly analysis on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission includes: Determine the highest flow transmission rate and the lowest flow transmission rate in the historical production data transmission process according to the data transmission information, and use the highest flow transmission rate and the lowest flow transmission rate as the transmission numerator, and use the time used in each production data transmission process as the transmission denominator; The transmission rate change value of each production data transmission process is obtained according to the ratio of the transmission numerator to the transmission denominator; Arranging the transmission rate change values ​​in time sequence to obtain a data transmission sequence of the data transmission information; Segmenting the data transmission sequence to obtain two or more transmission data segments; According to the data security situation of each change value corresponding to each transmission data segment occurring within a preset future time, an abnormal analysis is performed on the current production transmission data to obtain the abnormal transmission degree.

5. The industrial Internet of Things security monitoring method based on deep learning according to claim 4 is characterized in that: The data transmission sequence is segmented to obtain two or more transmission data segments, including: Determine all the split points in the transmission sequence according to the transmission rate change value of each production data transmission process in the data transmission sequence and each transmission rate value; The transmission sequence is segmented according to all segmentation points, the similarity of the change value sequences corresponding to each two adjacent transmission sequences is obtained, and whether each two adjacent transmission sequences need to be merged is determined according to the similarity to obtain two or more transmission data segments.

6. An industrial Internet of Things security monitoring system based on deep learning, characterized in that: include: A data acquisition module is used to acquire data transmission information within a historical period, current production transmission data, and data network transmission specifications. The data transmission information is the transmission information of product production data, production equipment data, and production environment data on an industrial manufacturing production line during network transmission. The data network transmission specifications are transmission determination specifications for determining whether data transmission information is abnormal or not; A data collection module, used for collecting historical monitoring data within the historical period, wherein the historical monitoring data is network abnormal transmission data of the data transmission information corresponding to different time nodes; A model creation module, used to create an anomaly recognition network model, and train the anomaly recognition network model based on the data transmission information, the data network transmission and the historical monitoring data to obtain a trained anomaly recognition network model; A feature recognition module is used to determine whether the current production transmission data meets the data network transmission specification. If so, the current time series feature and the current traffic distribution feature are determined based on the current production transmission data, and the current time series feature and the current traffic distribution feature are input into the anomaly recognition network model for anomaly recognition to obtain anomaly recognition results. The abnormal alarm module is used to determine whether the abnormal identification result has abnormal characteristics. If so, an alarm instruction is generated to control the alarm device to issue an abnormal data transmission alarm.

7. The industrial Internet of Things security monitoring system based on deep learning according to claim 6 is characterized in that: When the model creation module trains the anomaly recognition network model based on the data transmission information, the data network transmission and the historical monitoring data to obtain the trained anomaly recognition network model, it is specifically used to: Determine whether the production transmission data corresponding to the historical monitoring data meets the data network transmission specification based on the data transmission information; if so, decompose the production transmission data to obtain transmission abnormality data of the production data group corresponding to each production product, convert the transmission abnormality data into a pixel grayscale image, extract the time series features and flow distribution features in the pixel grayscale image, and extract the extracted time series features and flow distribution features; The time series characteristics, traffic distribution characteristics and historical monitoring data are input into the anomaly recognition network model for training to obtain a trained anomaly recognition network model.

8. The industrial Internet of Things security monitoring system based on deep learning according to claim 6 is characterized in that: The system also includes: a historical feature sorting module, a current feature sorting module and an abnormality analysis module, wherein: The historical feature sorting module is used to sort the traffic distribution features according to the transmission time nodes according to the time series features to obtain the abnormal traffic fluctuation graph of the transmission abnormal data; The current feature sorting module is used to sort the current traffic distribution features according to the transmission time nodes according to the current time series features to obtain the current traffic fluctuation graph of the current production transmission data; The abnormality analysis module is used to fit the current traffic fluctuation graph and the abnormal traffic fluctuation graph according to the transmission time nodes, and determine whether there are abnormalities in the current production transmission data corresponding to different transmission time nodes. If so, data transmission abnormality analysis is performed on the current production transmission data based on the data transmission information to obtain the degree of abnormal transmission.

9. An electronic device, characterized in that: The electronic device includes: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute an industrial Internet of Things security monitoring method based on deep learning as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that: include: A computer program is stored which can be loaded by a processor and executes an industrial Internet of Things security monitoring method based on deep learning as described in any one of claims 1 to 5.

Images