Industrial control network security monitoring method based on cloud edge collaboration and computer equipment

Abstract

The embodiment of the invention relates to the field of security monitoring, in particular to an industrial control network security monitoring method based on cloud edge collaboration and computer equipment. A specific embodiment of the method comprises the following steps: an edge node terminal collects initial monitoring video information and initial equipment operation information; the edge node terminal carries out extraction processing on the initial monitoring video information to generate an initial monitoring picture information sequence; the edge node terminal performs data preprocessing on the initial monitoring picture information sequence and the initial equipment operation information to generate a monitoring picture information sequence and equipment operation information; the edge node terminal sends the monitoring picture information sequence and the equipment operation information to the center node terminal; the central node terminal performs abnormal behavior recognition processing on the monitoring picture information sequence and the equipment operation information to generate abnormal behavior information; and the central node terminal sends the abnormal behavior information to an alarm terminal for alarm processing. According to the embodiment, the security of the industrial control network can be improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security monitoring, and specifically to an industrial control network security monitoring method and computer equipment based on cloud-edge collaboration. Background Art

[0002] Discovering security incidents in industrial control networks and issuing alarms can improve the security of industrial control networks. At present, when conducting industrial control network security monitoring, the commonly used method is to upload the monitoring video under the industrial control network to the cloud, use the cloud computing center to identify abnormal behaviors in the monitoring video and issue alarms.

[0003] However, in practice, it is found that when the above method is used for industrial control network security monitoring, the following technical problems often occur: When the cloud computing center processes data in a centralized manner, all surveillance videos are handed over to the cloud computing center for processing, which will lead to network congestion, long response time, etc., and cannot meet the real-time security monitoring of the industrial control network. It is difficult to issue alarms for abnormal behaviors in a timely manner, resulting in low security of the industrial control network. Summary of the invention

[0004] The content of this application is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this application is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0005] Some embodiments of the present application propose an industrial control network security monitoring method, a computer device, and a computer-readable storage medium based on cloud-edge collaboration to solve one or more of the technical problems mentioned in the above background technology section.

[0006] In the first aspect, some embodiments of the present application provide an industrial control network security monitoring method based on cloud-edge collaboration, the method comprising: the edge node terminal collects initial monitoring video information and initial equipment operation information; the edge node terminal extracts and processes the initial monitoring video information to generate an initial monitoring picture information sequence; the edge node terminal performs data preprocessing on the initial monitoring picture information sequence and the initial equipment operation information to generate a monitoring picture information sequence and equipment operation information; the edge node terminal sends the monitoring picture information sequence and the equipment operation information to the central node terminal; the central node terminal performs abnormal behavior identification processing on the monitoring picture information sequence and the equipment operation information in response to receiving the monitoring picture information sequence and the equipment operation information sent by the edge node terminal to generate abnormal behavior information; the central node terminal sends the abnormal behavior information to the alarm terminal for alarm processing in response to determining that the abnormal behavior information meets a preset abnormal condition.

[0007] In a second aspect, the present application also provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the method described in any implementation of the first aspect is implemented.

[0008] In a third aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0009] The above-mentioned embodiments of the present application have the following beneficial effects: through the industrial control network security monitoring method based on cloud-edge collaboration of some embodiments of the present application, the security of the industrial control network can be improved. Specifically, the reason for the low security of the industrial control network is that when the cloud computing center centrally processes data, all the monitoring videos are handed over to the cloud computing center for processing, which will cause network congestion, long response time, etc., and cannot meet the real-time nature of industrial control network security monitoring, and it is difficult to warn abnormal behavior in time. Based on this, in some embodiments of the present application, the industrial control network security monitoring method based on cloud-edge collaboration, first, the edge node terminal collects initial monitoring video information and initial equipment operation information. Thus, data can be collected through the edge node terminal. Secondly, the above-mentioned edge node terminal extracts and processes the above-mentioned initial monitoring video information to generate an initial monitoring picture information sequence. Then, the above-mentioned edge node terminal performs data preprocessing on the above-mentioned initial monitoring picture information sequence and the above-mentioned initial equipment operation information to generate a monitoring picture information sequence and equipment operation information. Thus, the edge node terminal can preprocess the collected data so that the processed data can be sent to the central node terminal later. Then, the edge node terminal sends the monitoring picture information sequence and the device operation information to the central node terminal. Thus, the edge node terminal can send the pre-processed data to the central node terminal to reduce the network congestion caused by large-scale data upload. Afterwards, the central node terminal performs abnormal behavior recognition processing on the monitoring picture information sequence and the device operation information in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal to generate abnormal behavior information. Thus, the central node terminal can perform abnormal behavior recognition on the pre-processed data, reducing the delay of industrial control network security monitoring. Finally, the central node terminal responds to determining that the abnormal behavior information meets the preset abnormal condition, and sends the abnormal behavior information to the alarm terminal for alarm processing. Thus, the abnormal behavior information can be alarmed to improve the security of the industrial control network. Therefore, the monitoring video can be pre-processed by edge computing, and then the data pre-processed data can be processed by abnormal behavior recognition through cloud computing. Therefore, through cloud-edge collaboration, that is, the combination of edge computing and cloud computing, monitoring videos and equipment operation information can be processed, reducing the delay in data transmission, improving the real-time security monitoring of industrial control networks, and timely warning of abnormal behaviors. In turn, the security of industrial control networks can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other features, advantages and aspects of the embodiments of the present application will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0011] Figure 1 is a flow chart of some embodiments of the industrial control network security monitoring method based on cloud-edge collaboration according to the present application; Figure 2 is a schematic diagram of a computer device suitable for implementing some embodiments of the present application; Figure 3 This is a schematic diagram of an application scenario of the industrial control network security monitoring method based on cloud-edge collaboration according to the present application. DETAILED DESCRIPTION

[0012] Embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.

[0013] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0014] It should be noted that the concepts such as "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0015] It should be noted that the modifications of "one" and "plurality" mentioned in the present application are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0016] The names of the messages or information exchanged between multiple devices in the embodiments of the present application are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0017] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0018] Figure 1 The process 100 of some embodiments of the industrial control network security monitoring method based on cloud-edge collaboration according to the present application is shown. The industrial control network security monitoring method based on cloud-edge collaboration includes the following steps: Step 101: The edge node terminal collects initial monitoring video information and initial equipment operation information.

[0019] In some embodiments, the edge node terminal can collect initial monitoring video information and initial device operation information from the storage terminal. The initial monitoring video information can represent the video of the industrial control device under the industrial control network. The initial device operation information can include but is not limited to at least one of the following: device identification, device size, and device operation data. The device identification can uniquely identify an industrial control device. The device operation data can include but is not limited to at least one of the following: temperature, humidity, and dust concentration. The edge node terminal can be an edge server. The edge node terminal can be connected to a central node terminal. The central node terminal can be connected to at least one edge node terminal. The central node terminal can be a cloud computing server.

[0020] For example, industrial control equipment can be but is not limited to: PLC (Programmable Logic Controller), DCS (Distributed Control System), FCS (Fieldbus Control System), temperature sensor, humidity sensor, dust concentration sensor, electric actuator, hydraulic actuator, industrial computer.

[0021] Step 102: The edge node terminal extracts and processes the initial monitoring video information to generate an initial monitoring picture information sequence.

[0022] In some embodiments, the edge node terminal may extract and process the initial monitoring video information to generate an initial monitoring picture information sequence.

[0023] In practice, the edge node terminal may extract and process the initial monitoring video information through the following steps to generate an initial monitoring picture information sequence: The first step is to perform frame extraction processing on the initial monitoring video information to generate an initial monitoring frame picture information sequence. In practice, the edge node terminal can determine each frame of the video represented by the initial monitoring video information as the initial monitoring frame picture information to obtain the initial monitoring frame picture information sequence.

[0024] In the second step, for each initial monitoring frame image information in the initial monitoring frame image information sequence, the following deletion sub-steps are performed: In the first sub-step, feature extraction is performed on the initial monitoring frame image information to generate first feature information. In practice, the edge node terminal may perform feature extraction on the initial monitoring frame image information using a preset feature extraction algorithm to generate first feature information. For example, the preset feature extraction algorithm may be a SIFT (Scale-invariant feature transform) algorithm.

[0025] The second sub-step is to perform feature extraction processing on the target initial monitoring frame image information to generate second feature information. The target initial monitoring frame image information may be the next initial monitoring frame image information of the initial monitoring frame image information in the initial monitoring frame image information sequence. In practice, the edge node terminal may perform feature extraction processing on the target initial monitoring frame image information through the preset feature extraction algorithm to generate the second feature information.

[0026] The third sub-step is, in response to determining that the first characteristic information is the same as the second characteristic information, deleting the initial monitoring frame picture information from the initial monitoring frame picture information sequence.

[0027] In the third step, the deleted initial monitoring frame picture information sequence is determined as the initial monitoring picture information sequence.

[0028] Step 103: The edge node terminal performs data preprocessing on the initial monitoring picture information sequence and the initial device operation information to generate a monitoring picture information sequence and device operation information.

[0029] In some embodiments, the edge node terminal may perform data preprocessing on the initial monitoring picture information sequence and the initial device operation information to generate a monitoring picture information sequence and device operation information.

[0030] In practice, the edge node terminal may perform data preprocessing on the initial monitoring picture information sequence and the initial device operation information through the following steps to generate a monitoring picture information sequence and device operation information: In the first step, for each initial monitoring picture information in the above initial monitoring picture information sequence, the following picture cleaning sub-steps are performed: In the first sub-step, the initial monitoring image information is subjected to noise reduction processing to generate monitoring noise reduction image information. In practice, the edge node terminal can perform noise reduction processing on the initial monitoring image information by using a preset noise reduction algorithm to generate monitoring noise reduction image information. For example, the preset noise reduction algorithm can be: a mean filter algorithm.

[0031] The second sub-step is to perform a repair process on the monitoring noise reduction image information to generate the monitoring repair image information. In practice, the edge node terminal can perform a repair process on the monitoring noise reduction image information by using a preset repair algorithm to generate the monitoring repair image information. For example, the preset repair algorithm can be: PMRF (Posterior-MeanRectified Flow, posterior mean correction flow) algorithm.

[0032] The third sub-step is to enhance the monitoring repair image information to generate monitoring image information. In practice, the edge node terminal can enhance the monitoring repair image information by using a preset enhancement algorithm to generate monitoring image information. For example, the preset enhancement algorithm can be: a histogram equalization algorithm.

[0033] In the second step, each generated monitoring picture information is determined as a monitoring picture information sequence.

[0034] The third step is to perform data cleaning on the initial device operation information to generate device operation information. In practice, the edge node terminal can remove the information representing the empty space from the initial device operation information to obtain the device operation information.

[0035] Step 104: The edge node terminal sends the monitoring picture information sequence and the equipment operation information to the central node terminal.

[0036] In some embodiments, the edge node terminal may send the monitoring picture information sequence and the device operation information to the central node terminal.

[0037] Step 105 , in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal, the central node terminal performs abnormal behavior recognition processing on the monitoring picture information sequence and the device operation information to generate abnormal behavior information.

[0038] In some embodiments, the central node terminal may perform abnormal behavior identification processing on the monitoring picture information sequence and the device operation information in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal to generate abnormal behavior information.

[0039] In practice, in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal, the central node terminal may perform abnormal behavior recognition processing on the monitoring picture information sequence and the device operation information through the following steps to generate abnormal behavior information: In the first step, the above-mentioned monitoring picture information sequence is input into the user behavior recognition model to generate a user behavior information set. Among them, the user behavior recognition model can be a pre-trained neural network model with the monitoring picture information sequence as input and the user behavior information set as output. Here, the user behavior information in the user behavior information set can represent the behavior operation. The behavior operation can be but not limited to: the first behavior operation, the second behavior operation, the third behavior operation, and the fourth behavior operation. For example, the first behavior operation can represent that the user wears a safety helmet. The second behavior operation can represent that the user goes to the operation area (all areas under the industrial control network). The third behavior operation can represent that the user goes to the construction area (the area where the industrial control equipment under the industrial control network is located, and here, the operation area can include the construction area). The fourth behavior operation can represent that the user carries dangerous items (for example, dangerous items can be: lighters, cigarette butts, etc.).

[0040] In the second step, the above-mentioned monitoring picture information sequence is input into the user identity recognition model to generate a user identity information set. Among them, the user behavior information in the user behavior information set can correspond to the user identity information in the user identity information set. Here, the user identity recognition model can be a pre-trained neural network model that takes the monitoring picture information sequence as input and the user identity information set as output. The user identity information in the user identity information set can uniquely identify a user. The user identity information in the user identity information set can be but is not limited to: the first user identity information (operator), the second user identity information (construction personnel). Here, the user represented by the first user identity information can perform the first behavior operation and the second behavior operation. The user represented by the second user identity information can perform the first behavior operation and the third behavior operation.

[0041] In the third step, for each user behavior information in the above user behavior information set, in response to determining that the user identity information corresponding to the above user behavior information meets the preset abnormal identity condition, the preset abnormal information is determined as the first abnormal behavior information. Among them, the preset abnormal identity condition can be: the user represented by the user identity information does not perform the first behavior operation. The preset abnormal identity condition can also be: the user represented by the user identity information performs the fourth behavior operation. The preset abnormal identity condition can also be: when the user identity information is the second user identity information, the user represented by the user identity information performs the second behavior operation and does not perform the third behavior operation. The preset abnormal information can be information representing that "the current user has performed an abnormal operation."

[0042] In the fourth step, in response to determining that the above-mentioned equipment operation information satisfies the preset abnormal operation condition, the above-mentioned equipment operation information and the preset abnormal operation information are determined as the second abnormal behavior information. The preset abnormal operation condition may be: the equipment operation data included in the equipment operation information satisfies the preset abnormal data condition. Here, the preset abnormal data condition may be: when the equipment operation data represents the temperature, the equipment operation data is greater than the preset temperature threshold (for example, the preset temperature threshold may be 40 degrees Celsius). The preset abnormal data condition may also be: when the equipment operation data represents the humidity, the equipment operation data is greater than the preset humidity (for example, the preset humidity may be 85%). The preset abnormal data condition may also be: when the equipment operation data represents the dust concentration, the equipment operation data is greater than the preset concentration (for example, the preset concentration may be 10 mg / m3). The preset abnormal operation information may be information representing "abnormality during equipment operation".

[0043] In a fifth step, the first abnormal behavior information and the second abnormal behavior information are determined as abnormal behavior information.

[0044] Optionally, before inputting the monitoring picture information sequence into the user behavior recognition model to generate the user behavior information set, the method further includes: The first step is to obtain the first training sample set.

[0045] In some embodiments, the central node terminal may obtain the first training sample set from the terminal device via a wired connection or a wireless connection. The first training sample in the first training sample set may include: a sample monitoring picture information sequence and a sample user behavior information set.

[0046] It should be noted that the above wireless connection methods may include but are not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0047] The second step is to determine the initial user behavior recognition model.

[0048] In some embodiments, the central node terminal may determine an initial user behavior recognition model, which may include an initial dense sampling model, an initial trajectory tracking model, an initial feature extraction model, and an initial feature encoding model.

[0049] Here, the initial dense sampling model may be a neural network model that takes sample monitoring image information as input and takes the initial densely collected feature information group as output. For example, the initial dense sampling model may be a Dense sampling model.

[0050] The initial trajectory tracking model may be a neural network model that takes the initial densely sampled feature information group sequence as input and takes the initial trajectory tracking information set as output. For example, the initial trajectory tracking model may be an Improved Dense Trajectories model.

[0051] The initial feature extraction model may be a neural network model that takes the initial trajectory tracking information as input and takes the initial trajectory feature information as output. For example, the initial feature extraction model may include: a first feature extraction model, a second feature extraction model, a third feature extraction model, and a normalization model. For example, the first feature extraction model may be a HOG (Histogram of Oriented Gradients) feature extraction model. The second feature extraction model may be a HOF (Histograms of Oriented Optical Flow) feature extraction model. The third feature extraction model may be an MBH (Motion Boundary Histograms) feature extraction model. The normalization model may be an L2 norm normalization model.

[0052] The initial feature encoding model may be a neural network model that takes the initial trajectory feature information as input and takes the initial user behavior information as output. For example, the initial feature encoding model may be a Fisher Vector encoding model.

[0053] The third step is to select the first target training sample from the first training sample set.

[0054] In some embodiments, the central node terminal may select a first target training sample from the first training sample set. In practice, the central node terminal may randomly select a first training sample from the first training sample set as the first target training sample.

[0055] In the fourth step, each sample monitoring picture information in the sample monitoring picture information sequence included in the selected first target training sample is input into the initial dense sampling model to generate an initial dense sampling feature information group to obtain an initial dense sampling feature information group sequence.

[0056] In some embodiments, the above-mentioned central node terminal can input each sample monitoring picture information in the sample monitoring picture information sequence included in the selected first target training sample into the initial dense sampling model to generate an initial dense sampling feature information group and obtain an initial dense sampling feature information group sequence.

[0057] In the fifth step, the initial densely sampled feature information group sequence is input into the initial trajectory tracking model to generate an initial trajectory tracking information set.

[0058] In some embodiments, the central node terminal may input the initial densely sampled feature information group sequence into the initial trajectory tracking model to generate an initial trajectory tracking information set.

[0059] In the sixth step, each initial trajectory tracking information in the initial trajectory tracking information set is input into the initial feature extraction model to generate initial trajectory feature information, thereby obtaining the initial trajectory feature information set.

[0060] In some embodiments, the central node terminal may input each initial trajectory tracking information in the initial trajectory tracking information set into an initial feature extraction model to generate initial trajectory feature information and obtain an initial trajectory feature information set.

[0061] In the seventh step, each initial trajectory feature information in the initial trajectory feature information set is input into the initial feature encoding model to generate initial user behavior information, thereby obtaining the initial user behavior information set.

[0062] In some embodiments, the central node terminal may input each initial trajectory feature information in the initial trajectory feature information set into an initial feature coding model to generate initial user behavior information and obtain an initial user behavior information set.

[0063] In the eighth step, based on the first preset loss function, a first difference value between the initial user behavior information set and the sample user behavior information set included in the selected first target training sample is determined.

[0064] In some embodiments, the central node terminal may determine a first difference value between the initial user behavior information set and the sample user behavior information set included in the selected first target training sample based on a first preset loss function. For example, the first preset loss function may be, but is not limited to: mean square error loss function (MSE), hinge loss function, cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0065] In a ninth step, in response to determining that the first difference value is greater than or equal to the first preset difference value, adjusting the network parameters of the initial user behavior recognition model.

[0066] In some embodiments, the central node terminal may adjust the network parameters of the initial user behavior recognition model in response to determining that the first difference value is greater than or equal to the first preset difference value. For example, the first difference value and the first preset difference value may be differentiated. On this basis, the parameters of the initial user behavior recognition model are adjusted using methods such as back propagation and gradient descent. For example, the first preset difference value may be 0.1.

[0067] Optionally, in response to determining that the first difference value is less than the first preset difference value, the initial user behavior recognition model is determined as the trained user behavior recognition model.

[0068] In some embodiments, the central node terminal may determine the initial user behavior recognition model as the trained user behavior recognition model in response to determining that the first difference value is less than the first preset difference value.

[0069] Thus, firstly, the dense sampling points in the sample monitoring image information can be collected through the initial dense sampling model. Secondly, the user's trajectory information can be identified through the initial trajectory tracking model. Then, the first feature extraction model, the second feature extraction model, and the third feature extraction model included in the initial feature extraction model can be used to extract feature information that takes into account a relatively comprehensive range. After that, the initial user behavior information can be more accurately identified through the initial coding model. Therefore, by training the initial user behavior recognition model including the initial dense sampling model, the initial trajectory tracking model, the initial feature extraction model, and the initial feature coding model, a relatively accurate user behavior recognition model can be obtained, so that relatively accurate user behavior information can be identified, so that relatively accurate abnormal behavior information can be identified based on the relatively accurate user behavior information in the future. Thus, the abnormal behavior can be more accurately alarmed through relatively accurate abnormal behavior information. Thus, the security of the industrial control network can be improved.

[0070] Optionally, before inputting the monitoring picture information sequence into the user identity recognition model to generate the user identity information set, the method further includes: The first step is to obtain the second training sample set.

[0071] In some embodiments, the central node terminal may obtain the second training sample set from the terminal device via a wired connection or a wireless connection. The first training sample in the second training sample set may include: a sample monitoring picture information sequence and a sample user identity information set.

[0072] The second step is to determine the initial user identity recognition model.

[0073] In some embodiments, the central node terminal may determine an initial user identity recognition model, which may include an initial face tracking model, an initial feature point positioning model, an initial screening model, an initial face feature extraction model, and an initial face matching model.

[0074] Here, the initial face tracking model may be a face detection and tracking model that takes a sample monitoring picture information sequence as input and an initial face identification information group set as output. Here, the initial face tracking model is used to: determine the position and size of the face, and track the correspondence between frames of the same person. For example, the initial face tracking model may include a face detection model (e.g., a Viola-Jones model) and a face tracking model (e.g., a CT (compressive tracking) model). Here, each initial face identification information included in the initial face identification information group in the initial face identification information group set corresponds to the same user.

[0075] The initial feature point positioning model may be a neural network model that takes initial face identification information as input and initial face feature information as output. For example, the initial feature point positioning model may be an AAM (active appearance model).

[0076] The initial screening model may be a neural network model that takes the initial facial feature information group as input and takes the initial facial feature screening information as output. For example, the initial screening model may be a GIQA (Generated Image Quality Assessment) model.

[0077] The initial facial feature extraction model may be a neural network model that takes the initial facial feature screening information as input and takes the initial facial feature information as output. For example, the initial facial feature extraction model may be a LGBP (Local Binary Pattern) feature extraction model.

[0078] The initial face matching model may be a neural network model that takes initial face feature information as input and initial user identity information as output. For example, the initial face matching model may be an elastic template matching model.

[0079] The third step is to select a second target training sample from the second training sample set.

[0080] In some embodiments, the central node terminal may select a second target training sample from the second training sample set. In practice, the central node terminal may randomly select a second training sample from the second training sample set as the second target training sample.

[0081] In the fourth step, the sample monitoring picture information sequence included in the selected second target training sample is input into the initial face tracking model to obtain an initial face identification information set.

[0082] In some embodiments, the central node terminal may input the sample monitoring picture information sequence included in the selected second target training sample into the initial face tracking model to obtain an initial face identification information set.

[0083] The fifth step is to input each initial face identification information in the initial face identification information set into the initial feature point positioning model to generate initial face feature information and obtain the initial face feature information set.

[0084] In some embodiments, the central node terminal may input each initial face identification information in the initial face identification information set into the initial feature point positioning model to generate initial face feature information and obtain the initial face feature information set.

[0085] In the sixth step, each initial facial feature information group in the initial facial feature information group set is input into the initial screening model to generate initial facial feature screening information and obtain the initial facial feature screening information set.

[0086] In some embodiments, the central node terminal may input each initial facial feature information group in the initial facial feature information group set into an initial screening model to generate initial facial feature screening information and obtain an initial facial feature screening information set.

[0087] In the seventh step, the sample monitoring image information corresponding to each initial facial feature screening information in the initial facial feature screening information set is input into the initial facial feature extraction model to generate initial facial feature information and obtain the initial facial feature information set.

[0088] In some embodiments, the above-mentioned central node terminal can input the sample monitoring image information corresponding to each initial facial feature screening information in the initial facial feature screening information set into the initial facial feature extraction model to generate initial facial feature information and obtain the initial facial feature information set.

[0089] In the eighth step, each initial facial feature information in the initial facial feature information set is input into the initial face matching model to generate initial user identity information, thereby obtaining an initial user identity information set.

[0090] In some embodiments, the central node terminal may input each initial facial feature information in the initial facial feature information set into an initial facial matching model to generate initial user identity information and obtain an initial user identity information set.

[0091] In the ninth step, based on the second preset loss function, a second difference value between the initial user identity information set and the sample user identity information set included in the selected second target training sample is determined.

[0092] In some embodiments, the central node terminal may determine the second difference value between the initial user identity information set and the sample user identity information set included in the selected second target training sample based on a preset loss function. For example, the second preset loss function may be, but is not limited to: mean square error loss function (MSE), hinge loss function, cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, log loss function, square loss function, exponential loss function, etc.

[0093] In step 10, in response to determining that the second difference value is greater than or equal to the second preset difference value, adjusting the network parameters of the initial user identity recognition model.

[0094] In some embodiments, the central node terminal may adjust the network parameters of the initial user identity recognition model in response to determining that the second difference value is greater than or equal to the second preset difference value. For example, the second difference value and the second preset difference value may be differentiated. On this basis, the parameters of the initial user identity recognition model are adjusted using methods such as back propagation and gradient descent. For example, the second preset difference value may be 0.1.

[0095] Optionally, in response to determining that the second difference value is less than the second preset difference value, the initial user identity recognition model is determined as the trained user identity recognition model.

[0096] In some embodiments, the central node terminal may determine the initial user identity recognition model as the trained user identity recognition model in response to determining that the second difference value is less than the second preset difference value.

[0097] Thus, firstly, the facial features and facial trajectory information of the user can be more accurately located through the initial face tracking model. Secondly, the various feature points (e.g., eyes, nose, mouth, etc.) of the face can be more accurately located through the initial feature point positioning model. Then, the initial face feature information with the highest quality among the various initial face feature information in the initial face feature information group can be screened out through the initial screening model. Then, the various feature points of the face can be extracted through the initial face feature extraction model. After that, the user identity information of the current user can be more accurately identified through the face matching model. Therefore, a more accurate user identity recognition model can be obtained by training the initial user identity recognition model including the initial face tracking model, the initial feature point positioning model, the initial screening model, the initial face feature extraction model, and the initial face matching model, so that more accurate user identity information can be identified, so that more accurate abnormal behavior information can be identified later according to the more accurate user identity information. Thus, more accurate abnormal behavior information can be used to warn of abnormal behavior more accurately. Thus, the security of the industrial control network can be improved.

[0098] Step 106: In response to determining that the abnormal behavior information meets a preset abnormal condition, the central node terminal sends the abnormal behavior information to the alarm terminal for alarm processing.

[0099] In some embodiments, the central node terminal may send the abnormal behavior information to the alarm terminal for alarm processing in response to determining that the abnormal behavior information meets the preset abnormal condition. The preset abnormal condition may be: the abnormal behavior information is not empty. Here, the alarm terminal may be: a terminal that displays warning text or emits a prompt sound in response to receiving the abnormal behavior information.

[0100] Optionally, the above method further includes: In the first step, the central node terminal obtains the first user information of the first user terminal in response to receiving the abnormal information viewing request sent by the first user terminal.

[0101] In some embodiments, in response to receiving an abnormal information viewing request sent by a first user terminal, the central node terminal may obtain the first user information of the first user terminal from the terminal device through a wired connection or a wireless connection. The abnormal information viewing request may indicate that the first user terminal wants to view abnormal behavior information. The first user information may uniquely identify the first user terminal.

[0102] In the second step, in response to determining that the first user information and the abnormal information viewing request satisfy a first preset viewing condition, the central node terminal encrypts the abnormal behavior information corresponding to the abnormal information viewing request to generate abnormal behavior encrypted information, and sends the abnormal behavior encrypted information to the first user terminal.

[0103] In some embodiments, in response to determining that the first user information and the abnormal information viewing request meet the first preset viewing condition, the central node terminal may encrypt the abnormal behavior information corresponding to the abnormal information viewing request to generate abnormal behavior encrypted information, and may send the abnormal behavior encrypted information to the first user terminal. In practice, first, in response to determining that the first user information and the abnormal information viewing request meet the first preset viewing condition, the central node terminal may encrypt the abnormal behavior information corresponding to the abnormal information viewing request through a preset encryption algorithm to generate abnormal behavior encrypted information. Then, the central node terminal may send the abnormal behavior encrypted information to the first user terminal.

[0104] Among them, the first preset viewing condition may be: the preset permission table includes the above-mentioned first user information, and the permission information corresponding to the above-mentioned first user information in the preset permission table includes the above-mentioned abnormal information viewing request. The preset permission table is a pre-set form filled in by the operator. The preset permission table may include permission information. The permission information may include permission user information and permission information viewing request. The permission user information can uniquely identify a user terminal. The permission information viewing request may represent that the operator agrees to the permission user information to view the specified information (for example, abnormal behavior information, surveillance video information of the edge node terminal). For example, the preset encryption algorithm may be but is not limited to: DES (Data Encryption Standard) algorithm, AES (Advanced Encryption Standard) algorithm.

[0105] Therefore, encrypting the abnormal behavior information can improve the security of the abnormal behavior information during transmission.

[0106] In the third step, the central node terminal obtains the second user information of the second user terminal in response to receiving the surveillance video viewing request sent by the second user terminal.

[0107] In some embodiments, in response to receiving a surveillance video viewing request sent by a second user terminal, the central node terminal may obtain the second user information of the second user terminal from the terminal device through a wired connection or a wireless connection. The surveillance video viewing request may indicate that the second user terminal wants to view the surveillance video information of the edge node terminal. The second user information may uniquely identify the second user terminal.

[0108] In the fourth step, in response to determining that the second user information and the surveillance video viewing request meet the second preset viewing condition, the central node terminal sends the surveillance video viewing request to the edge node terminal corresponding to the surveillance video viewing request to receive the surveillance video information sent by the edge node terminal.

[0109] In some embodiments, in response to determining that the second user information and the surveillance video viewing request meet the second preset viewing condition, the central node terminal may send the surveillance video viewing request to the edge node terminal corresponding to the surveillance video viewing request to receive the surveillance video information sent by the edge node terminal. The second preset viewing condition may be that the preset permission table includes the second user information, and the permission information corresponding to the second user information in the preset permission table includes the surveillance video viewing request.

[0110] In the fifth step, the central node terminal sends the monitoring video information to the second user terminal in response to receiving the monitoring video information sent by the edge node terminal.

[0111] In some embodiments, the central node terminal may send the monitoring video information to the second user terminal in response to receiving the monitoring video information sent by the edge node terminal.

[0112] The above-mentioned embodiments of the present application have the following beneficial effects: through the industrial control network security monitoring method based on cloud-edge collaboration of some embodiments of the present application, the security of the industrial control network can be improved. Specifically, the reason for the low security of the industrial control network is that when the cloud computing center centrally processes data, all the monitoring videos are handed over to the cloud computing center for processing, which will cause network congestion, long response time, etc., and cannot meet the real-time nature of industrial control network security monitoring, and it is difficult to warn abnormal behavior in time. Based on this, in some embodiments of the present application, the industrial control network security monitoring method based on cloud-edge collaboration, first, the edge node terminal collects initial monitoring video information and initial equipment operation information. Thus, data can be collected through the edge node terminal. Secondly, the above-mentioned edge node terminal extracts and processes the above-mentioned initial monitoring video information to generate an initial monitoring picture information sequence. Then, the above-mentioned edge node terminal performs data preprocessing on the above-mentioned initial monitoring picture information sequence and the above-mentioned initial equipment operation information to generate a monitoring picture information sequence and equipment operation information. Thus, the edge node terminal can preprocess the collected data so that the processed data can be sent to the central node terminal later. Then, the edge node terminal sends the monitoring picture information sequence and the device operation information to the central node terminal. Thus, the edge node terminal can send the pre-processed data to the central node terminal to reduce the network congestion caused by large-scale data upload. Afterwards, the central node terminal performs abnormal behavior recognition processing on the monitoring picture information sequence and the device operation information in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal to generate abnormal behavior information. Thus, the central node terminal can perform abnormal behavior recognition on the pre-processed data, reducing the delay of industrial control network security monitoring. Finally, the central node terminal responds to determining that the abnormal behavior information meets the preset abnormal condition, and sends the abnormal behavior information to the alarm terminal for alarm processing. Thus, the abnormal behavior information can be alarmed to improve the security of the industrial control network. Therefore, the monitoring video can be pre-processed by edge computing, and then the data pre-processed data can be processed by abnormal behavior recognition through cloud computing. Therefore, through cloud-edge collaboration, that is, the combination of edge computing and cloud computing, monitoring videos and equipment operation information can be processed, reducing the delay in data transmission, improving the real-time security monitoring of industrial control networks, and timely warning of abnormal behaviors. In turn, the security of industrial control networks can be improved. The present application also provides a computer device 200. Figure 2As shown, the computer device 200 includes: a bus 201, a processor 202, a memory 203 and a communication interface 204. The processor 202, the memory 203 and the communication interface 204 communicate with each other through the bus 201. The computer device 200 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computer device 200.

[0113] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 2 The bus 201 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 201 may include a path for transmitting information between various components of the computer device 200 (for example, the memory 203, the processor 202, and the communication interface 204).

[0114] The processor 202 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0115] The memory 203 may include a volatile memory, such as a random access memory (RAM). The memory 203 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0116] The memory 203 stores executable program codes, and the processor 202 executes the executable program codes to respectively implement the functions of the aforementioned acquisition module, sampling module, determination module, and mixing module, thereby implementing the aforementioned industrial control network security monitoring method based on cloud-edge collaboration. That is, the memory 203 stores instructions for executing the aforementioned industrial control network security monitoring method based on cloud-edge collaboration.

[0117] The communication interface 204 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computer device 200 and other devices or a communication network.

[0118] An embodiment of the present application also provides a chip, which includes a processor and a data interface. The processor reads instructions stored in a memory through the data interface to execute the above-mentioned industrial control network security monitoring method based on cloud-edge collaboration.

[0119] The embodiment of the present application also provides a computer-readable storage medium. The above-mentioned computer-readable storage medium can be any available medium that can be stored by the computing device or a data storage device such as a data center containing one or more available media. The above-mentioned available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned industrial control network security monitoring method based on cloud-edge collaboration. Figure 3 This is a schematic diagram of an application scenario of the industrial control network security monitoring method based on cloud-edge collaboration according to the present application.

[0120] exist Figure 3In the application scenario, first, the edge node terminal 301 can collect initial monitoring video information 304 and initial equipment operation information 305. In this application scenario, the initial monitoring video information 304 can be "monitoring video A". The initial equipment operation information 305 can be "equipment A, 220*150*200, 50 degrees Celsius". Secondly, the edge node terminal 301 can extract and process the initial monitoring video information 304 to generate an initial monitoring picture information sequence 306. In this application scenario, the initial monitoring picture information sequence 306 can be "picture 1, picture 2, picture 5, picture 8, picture 9". Then, the edge node terminal 301 can perform data preprocessing on the initial monitoring picture information sequence 306 and the initial equipment operation information 305 to generate a monitoring picture information sequence 307 and equipment operation information 308. In this application scenario, the monitoring picture information sequence 307 can be "picture 1A, picture 2A, picture 5A, picture 8A, picture 9A". The device operation information 308 may be "device A, 220*150*200, 50 degrees Celsius". Then, the edge node terminal 301 may send the monitoring picture information sequence 307 and the device operation information 308 to the central node terminal 302. Afterwards, the central node terminal 302 performs abnormal behavior recognition processing on the monitoring picture information sequence 307 and the device operation information 308 in response to receiving the monitoring picture information sequence 307 and the device operation information 308 sent by the edge node terminal 301 to generate abnormal behavior information 309. In this application scenario, the abnormal behavior information 309 may be "user A, not wearing a safety helmet, device A, 50 degrees Celsius". Finally, in response to determining that the abnormal behavior information 309 meets the preset abnormal condition, the central node terminal 302 sends the abnormal behavior information 309 to the alarm terminal 303 for alarm processing. The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0121] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for industrial control network security monitoring based on cloud-edge collaboration, comprising: The edge node terminal collects initial monitoring video information and initial equipment operation information; The edge node terminal extracts and processes the initial monitoring video information to generate an initial monitoring picture information sequence; The edge node terminal performs data preprocessing on the initial monitoring picture information sequence and the initial device operation information to generate a monitoring picture information sequence and device operation information; The edge node terminal sends the monitoring picture information sequence and the device operation information to the central node terminal; The central node terminal performs abnormal behavior recognition processing on the monitoring picture information sequence and the device operation information in response to receiving the monitoring picture information sequence and the device operation information sent by the edge node terminal to generate abnormal behavior information; In response to determining that the abnormal behavior information meets a preset abnormal condition, the central node terminal sends the abnormal behavior information to an alarm terminal for alarm processing.

2. The industrial control network security monitoring method based on cloud-edge collaboration according to claim 1, wherein: The method further comprises: The central node terminal acquires first user information of the first user terminal in response to receiving the abnormal information viewing request sent by the first user terminal; In response to determining that the first user information and the abnormal information viewing request meet a first preset viewing condition, the central node terminal encrypts the abnormal behavior information corresponding to the abnormal information viewing request to generate abnormal behavior encrypted information, and sends the abnormal behavior encrypted information to the first user terminal; The central node terminal acquires the second user information of the second user terminal in response to receiving the surveillance video viewing request sent by the second user terminal; In response to determining that the second user information and the surveillance video viewing request meet a second preset viewing condition, the central node terminal sends the surveillance video viewing request to an edge node terminal corresponding to the surveillance video viewing request to receive the surveillance video information sent by the edge node terminal; In response to receiving the monitoring video information sent by the edge node terminal, the central node terminal sends the monitoring video information to the second user terminal.

3. The industrial control network security monitoring method based on cloud-edge collaboration according to claim 1, wherein: The extracting and processing the initial monitoring video information to generate an initial monitoring picture information sequence includes: Performing frame extraction processing on the initial monitoring video information to generate an initial monitoring frame picture information sequence; For each initial monitoring frame picture information in the initial monitoring frame picture information sequence, the following deletion steps are performed: Performing feature extraction processing on the initial monitoring frame image information to generate first feature information; Performing feature extraction processing on target initial monitoring frame picture information to generate second feature information, wherein the target initial monitoring frame picture information is the next initial monitoring frame picture information of the initial monitoring frame picture information in the initial monitoring frame picture information sequence; In response to determining that the first characteristic information is the same as the second characteristic information, deleting the initial monitoring frame picture information from the initial monitoring frame picture information sequence; The deleted initial monitoring frame picture information sequence is determined as the initial monitoring picture information sequence.

4. The industrial control network security monitoring method based on cloud-edge collaboration according to claim 1, wherein: The performing data preprocessing on the initial monitoring picture information sequence and the initial device operation information to generate the monitoring picture information sequence and the device operation information includes: For each initial monitoring picture information in the initial monitoring picture information sequence, the following picture cleaning steps are performed: Performing noise reduction processing on the initial monitoring picture information to generate monitoring noise reduction picture information; Performing restoration processing on the monitoring noise reduction image information to generate monitoring restoration image information; Performing enhancement processing on the monitoring repair image information to generate monitoring image information; Determine each generated monitoring picture information as a monitoring picture information sequence; The initial equipment operation information is subjected to data cleaning processing to generate equipment operation information.

5. The industrial control network security monitoring method based on cloud-edge collaboration according to claim 1, wherein: The performing abnormal behavior recognition processing on the monitoring picture information sequence and the equipment operation information to generate abnormal behavior information includes: Inputting the monitoring picture information sequence into a user behavior recognition model to generate a user behavior information set; Inputting the monitoring picture information sequence into a user identity recognition model to generate a user identity information set, wherein the user behavior information in the user behavior information set corresponds to the user identity information in the user identity information set; For each piece of user behavior information in the user behavior information set, in response to determining that the user identity information corresponding to the user behavior information satisfies a preset abnormal identity condition, determining the preset abnormal information as first abnormal behavior information; In response to determining that the device operation information meets a preset abnormal operation condition, determining the device operation information and the preset abnormal operation information as second abnormal behavior information; The first abnormal behavior information and the second abnormal behavior information are determined as abnormal behavior information.

6. A computer device, wherein: The computer device comprises a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the steps of the method according to any one of claims 1 to 5 are implemented.

7. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images