Network security monitoring method, system and device of industrial internet and storage medium

Abstract

The invention relates to a network security monitoring method, system and device of an industrial internet and a storage medium, and belongs to the technical field of network security, the method is applied to a buffer area, and the method comprises the following steps: obtaining abnormal request information, the abnormal request information comprises a destination code and a request task, the destination code is a code of a terminal device used for executing the request task, and marking the terminal device with the destination code as a destination terminal device; determining an associated code according to the destination code and the request task, marking the terminal device with the associated code as an associated terminal device, the associated terminal device being located in the internal area; calculating an association degree score of the association code according to the importance level and the association level of the association terminal device; and generating interference information according to the correlation score. The method and the device have the effect of improving the network security of the industrial internet.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security monitoring method, system, device and storage medium for the industrial Internet. Background Art

[0002] At present, network security technology is very mature. In terms of hardware, various types of network security equipment are set up, such as firewalls, virtual private network (VPN) equipment, intrusion detection systems and intrusion prevention systems, switches, encryption equipment, and network security audit equipment. In terms of software, it includes security policies deployed in various network security equipment, such as identity and access management software, encryption software, security information and time management software, and vulnerability scanning software. Through the multi-layer protection of hardware equipment and software systems, the target device is protected from network attacks.

[0003] In order to ensure the data communication security performance of the Industrial Internet, the Industrial Internet is divided into an internal area and a buffer area. The internal area and the buffer area also form a local area network. The core target devices that need to be encrypted are stored in the internal area, while the public server facilities and network security equipment are stored in the buffer area. Server facilities include corporate Web servers, FTP servers, and forums. When the external network accesses the Industrial Internet, it can only access the terminal devices in the buffer area, but cannot directly access the terminal devices in the internal network.

[0004] In the prior art, when attack information sent by an external network is identified in the buffer area, the attack information in the buffer area is usually cleared directly. However, with the development of hacker technology, if the attack information in the buffer area is only cleared without knowing the nodes that the attack information actually wants to attack, it may lead to hackers finding weak nodes of the Industrial Internet after continuous trial and error, thus causing security risks to the Industrial Internet. Summary of the invention

[0005] In order to improve the network security of the industrial Internet, the present application provides a network security monitoring method, system, device and storage medium for the industrial Internet.

[0006] In a first aspect of the present application, a network security monitoring method for an industrial Internet is provided. The method is applied in a buffer area and includes: Acquire abnormal request information, the abnormal request information including a destination code and a request task, the destination code being a code of a terminal device for executing the request task, and mark the terminal device having the destination code as a destination terminal device; determining an associated code according to the purpose code and the requested task, marking a terminal device having the associated code as an associated terminal device, wherein the associated terminal device is located in an internal area; Calculating the relevance score of the associated code according to the importance level and the relevance level of the associated terminal device; Interference information is generated according to the correlation score.

[0007] By adopting the above technical solution, when it is determined that the request information is abnormal request information, the associated terminal device located in the internal area is determined according to the purpose code and request task of the abnormal request information. Since the terminal devices located in the internal area need to be kept confidential, after obtaining the associated terminal device, the association score of the associated code of the associated terminal device is calculated according to the importance level and association level of the associated terminal device in the internal area, and the importance of the associated terminal device in the internal area is evaluated by the association score, and finally interference information is generated according to the importance. It can be seen that when the abnormal request information is identified in the buffer area, the present application can clarify the attack direction of the abnormal request information, and then generate interference information according to the attack direction, so as to prevent hackers from finding the weak points of the internal area in the process of multiple trial and error, so as to improve the network security of the industrial Internet.

[0008] In a possible implementation manner: the calculating the association score of the association code according to the importance level and the association level of the associated terminal device includes: An initial score is calculated based on the historical association times of the association code; Calculating a first score according to the initial score and the importance level of the associated terminal device; Calculating a second score according to the initial score and the association level of the associated terminal device; The association score of the association code is calculated according to the first score and the second score.

[0009] By adopting the above technical solution, when calculating the association score, the present application first obtains an initial score based on the historical number of associations of the association code, and then adjusts the initial score based on the importance level of the associated terminal device and the association level of the associated terminal device to obtain the corresponding first score and second score, and finally obtains the association score through the first score and the second score, thereby improving the accuracy of the association score calculated by the present application.

[0010] In a possible implementation, the initial score is calculated using the following calculation formula: Initial score = historical association times * preset score, The historical number of associations refers to the number of associations of the association code during the monitoring period, and the preset score range is 3-10 points.

[0011] By adopting the above technical solution, the initial score is proportional to the number of historical associations. When the number of historical associations is greater, the initial score is also higher, thereby providing data support for timely attention to associated terminal devices with a large number of associations.

[0012] In a possible implementation manner, the step of calculating the first score according to the initial score and the importance level of the associated terminal device includes: Matching a corresponding security level according to the type of the associated terminal device; Determining a security level of data processed by the associated terminal device; Selecting the highest security level among the security level corresponding to the type of the associated terminal device and the security level of the data processed by the associated terminal device as the importance level; Obtaining corresponding weights according to the importance level matching; The first score is calculated based on the initial score and the weight corresponding to the importance level.

[0013] By adopting the above technical solution, when calculating the first score, the security level of the associated terminal device itself and the security level of the data processed by it are fully considered, and finally the security level with the highest security level is used as the importance level. Then, the first score is calculated based on the weight corresponding to the importance level and the initial score, so that the accuracy of the calculated first score can be guaranteed to be higher.

[0014] In a possible implementation manner, the first score is obtained by calculating using the following calculation formula, including: F1=S(1+p), Among them, F1 is the first score, S is the initial score, and p is the weight corresponding to the importance level.

[0015] In a possible implementation manner, the step of calculating the second score according to the initial score and the association level of the associated terminal device includes: Determining a primary association level according to the interaction frequency between the associated terminal device and other terminal devices in the internal area; Determining a final association level according to the primary association level, the ratio of the traffic used by the associated terminal device during interaction to the total traffic used by the internal area; Matching corresponding weights according to the final association level; A second score is calculated based on the initial score and the weight corresponding to the final association level.

[0016] By adopting the above technical solution, when calculating the second score, the interaction frequency between the associated terminal device and other terminal devices and the amount of traffic occupied by them are fully considered, so as to evaluate the information flow of the associated terminal device. Then, according to the weight mapped by the information flow, the second score is calculated according to the weight and the initial score, so as to ensure that the calculated second score has a higher accuracy.

[0017] In a possible implementation manner, the determining the associated code according to the purpose code and the request task includes: Identify the type of the abnormal request information; Retrieve a terminal device located in the internal area and participating in executing the request information of the type when the destination terminal device executes the request information of the type, take the terminal device as a first associated terminal device, and take the code of the first associated terminal device as a first code; Using a terminal device that generates response data identical or similar to the abnormal request information and is located in the internal area as a second associated terminal device, and using a code of the second associated terminal device as a second code; The associated code is obtained according to the first code and the second code.

[0018] By adopting the above technical solution, by marking all terminal devices that have a corresponding relationship with the abnormal request information and are located in the internal area as associated terminal devices, it is convenient to evaluate the attack direction of the abnormal request information on a large scale, thereby ensuring the accuracy of the evaluation results.

[0019] In a second aspect of the present application, a network security monitoring system for an industrial Internet is provided. The system comprises: A data acquisition module, used to acquire abnormal request information, wherein the abnormal request information includes a destination code and a request task, wherein the destination code is a code of a terminal device for executing the request task, and a terminal device having the destination code is marked as a destination terminal device; A data determination module is used to determine an associated code according to the purpose code and the request task, and mark a terminal device having the associated code as an associated terminal device, wherein the associated terminal device is located in an internal area: A data calculation module, used for calculating the relevance score of the association code according to the importance level and relevance level of the association terminal device; A data generation module is used to generate interference information according to the association score.

[0020] In a third aspect of the present application, a network security monitoring device for an industrial Internet is provided. The device comprises: a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, any of the above-mentioned network security monitoring methods for the industrial Internet is implemented.

[0021] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, any of the above-mentioned network security monitoring methods for the industrial Internet is implemented.

[0022] In summary, the present application includes the following beneficial technical effects: When it is determined that the request information is abnormal request information, the associated terminal device located in the internal area is determined according to the purpose code and request task of the abnormal request information. Since the terminal devices located in the internal area need to be kept confidential, after obtaining the associated terminal device, the association score of the associated code of the associated terminal device is calculated according to the importance level and association level of the associated terminal device in the internal area, and the importance of the associated terminal device in the internal area is evaluated by the association score, and finally interference information is generated according to the importance. It can be seen that when the abnormal request information is identified in the buffer area, the present application can clarify the attack direction of the abnormal request information, and then generate interference information according to the attack direction, so as to prevent hackers from finding the weak points of the internal area in the process of multiple trial and error, so as to improve the network security of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a schematic diagram of an exemplary operating environment of an embodiment of the present application.

[0024] Figure 2 This is a flow chart of the network security monitoring method for the industrial Internet of an embodiment of the present application.

[0025] Figure 3 It is a block diagram of the network security monitoring system of the industrial Internet of an embodiment of the present application.

[0026] Explanation of the reference numerals: 100, local area network; 110, internal area; 120, buffer area; 121, data acquisition module; 122, data determination module; 123, data calculation module; 124, data generation module; 200, external network. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0028] Figure 1 A schematic diagram of an exemplary operating environment in which the embodiments of the present application can be implemented is shown, the operating environment includes a local area network 100 and an external network 200, the local area network 100 includes an internal area 110 and a buffer area 120. When the external network 200 and the local area network 100 interact with each other, the information is exchanged through the buffer area 120.

[0029] Specifically, the internal area 110 contains core terminal devices that require confidentiality, such as various types of sensors, core servers, and storage devices. The terminal devices in the internal area 110 can access the terminal devices in the buffer area 120 and the terminal devices in the external network 200.

[0030] The buffer area 120 stores public server facilities and network security equipment, such as enterprise Web servers, FTP servers, and forums, and network security equipment such as routers, firewalls, security gateways, switches, and other electronic devices. By setting up the buffer area 120, the internal area 110 can be isolated from the external network 200, so that the external network 200 cannot directly access the internal area 110, and when the external network 200 accesses the local area network 100, the request information sent by the external network 200 must also be subject to security verification by the network security equipment, such as multiple security verifications such as user identity authentication, access control, authority management, and multi-factor identity authentication.

[0031] The external network 200 can be another local area network 100 or a wide area network. Since the terminal devices contained in the external network 200 are various and the offensive terminal devices in the external network 200 have strong hiding capabilities and are difficult to trace through the network, many local area networks 100 can only passively perform security checks on the external network 200 with which they communicate, and when an offensive terminal device is identified, it can usually only intercept the access of the offensive terminal device, but it is difficult to trace the source and eliminate security risks from the source. Therefore, many offensive terminal devices usually attack each local area network 100 indiscriminately, and may find the weak nodes of the local area network 100 after multiple trials and errors, and then conduct a large-scale attack on the entire local area network 100 targeting the weak nodes.

[0032] Based on the security risks existing when the local area network 100 communicates with the external network 200, this application proposes a network security monitoring method for the industrial Internet, which is applied to Figure 1 In the buffer area 120. Figure 2 As shown, the main process of the network security monitoring method of the Industrial Internet is described as follows.

[0033] Step S100: Acquire abnormal request information, where the abnormal request information includes a destination code and a requested task.

[0034] When the external network 200 sends a request message to the local area network 100, the security network device first performs a security check on the request message. The specific security check may be one or more security check processes such as user identity authentication, access control, and authority management, which are not limited in this application. If the request message passes the security check, the request message is executed; if the request message fails the security check, the request message is marked as an abnormal request message and the process proceeds to step S200.

[0035] Specifically, the abnormal request information includes a destination code and a request task. The destination code is the code of the terminal device that executes the request task, which can be the IP address of the terminal device, or the MAC code or serial number. It should be noted that the terminal devices with the destination code are collectively referred to as destination terminal devices.

[0036] The request task includes the specific content of the request information, which specifies the data content returned after the destination terminal device executes the request task. For example, it specifies that the destination terminal device A returns the temperature control data of the local area network 100 after executing the request task.

[0037] Step S200 : determining an associated code according to the requested task and the destination code, and the terminal device having the associated code is located in the internal area 110 .

[0038] Based on the abnormal request information, the type of the abnormal request information is first identified. The specific identification method can be to obtain the type of the abnormal request information through protocol parsing, or to use predefined patterns or rules to match the content of the request task, such as regular expressions, keyword matching, specific format matching, etc., and then determine the type of the abnormal request information based on the matching results.

[0039] After obtaining the type of abnormal request information, the terminal device located in the internal area 110 and participating in the execution of the request of the type when the target terminal device executes the request information of the type is retrieved, and the terminal device is used as the first associated terminal device, and the code of the first associated terminal device is used as the first code. At the same time, the terminal device that can generate the same or similar response data as the abnormal request information and is located in the internal area 110 is used as the second associated terminal device, and the code of the second associated terminal device is used as the second code.

[0040] The response data of the above-mentioned abnormal request information refers to: data returned to the terminal device after the destination terminal device executes the request information. Normally, when the request information is not marked as abnormal request information, the destination terminal device will generate response data for the request information, but when the request information is marked as abnormal request information, the destination terminal device stops running the abnormal request information, but will judge the response data generated when executing the normal request information of the same type as the abnormal request information based on the historical execution data, and use the response data as the response data of the abnormal request information. For example, the request information is to obtain the temperature control data in the local area network 100, and the returned temperature control data is used as the response data. If the information requesting the temperature control data is identified as abnormal request information once, the temperature control data is still used as the response data, and the sensor that generates the temperature control data is used as the second associated terminal device, and the code of the second associated terminal device is the second code.

[0041] Finally, the first code and the second code obtained are collectively referred to as associated codes. It should be noted that, hereinafter, terminal devices having associated codes are collectively referred to as associated terminal devices.

[0042] Step S300: Calculate the association score of the association code according to the importance level and association level of the association terminal device.

[0043] Since most of the terminal devices in the internal network are core devices or devices that need to be encrypted, when they are marked as associated terminal devices, their importance in the internal area 110 needs to be evaluated. The higher the confidentiality level of the associated terminal device, the greater the loss when it is attacked; and the higher the degree of association between the associated terminal device and other terminal devices in the internal area 110, the wider the area that needs to be protected when it is attacked, and the higher the difficulty of protection. Therefore, it is necessary to pay close attention to these two types of associated terminal devices.

[0044] In this example, the importance of the two types of associated terminal devices is evaluated by calculating the association scores of the association codes, and for each associated terminal device, its association score needs to be calculated. For the sake of convenience, the following takes the process of calculating the association score of one of the association codes as an example: Step S310: Calculate an initial score according to the historical association times of the association code.

[0045] In a specific example, the historical association times refer to the association times of the association codes within the monitoring time period. The monitoring time period may be one month, three months, half a year or one year. The specific selected monitoring time period needs to be determined according to the frequency of the local area network 100 being attacked during the actual application process. The higher the frequency of the local area network 100 being attacked, the smaller the monitoring time period is. This can not only reduce data redundancy, but also ensure the accuracy of the obtained association times.

[0046] The initial score is determined based on the number of historical associations. In a specific example, one association number corresponds to a preset score. In this example, the preset score is selected from a score range of 3-10 points to avoid the situation where the difference in the initial scores becomes larger when the difference in the number of historical associations between the two association codes increases, thereby affecting the accuracy of the subsequent calculation of the association score. In this example, the number of historical associations of the association code is proportional to the initial score, that is, the initial score = historical association number * preset score.

[0047] Step S320: Calculate a first score based on the initial score and the importance level of the associated terminal device.

[0048] Specifically, the importance level of the associated terminal device is determined according to the type of the associated terminal device and the security level of the data it processes. This application sets a corresponding security level for each type of terminal device in advance, for example, a first security level, a second security level and a third security level are set, and the first security level> the second security level> the third security level, then the memory that stores all data and the core server with the highest confidentiality level are at the first security level, and the edge sensor can be placed at the second security level because it only generates part of the data, and the terminal device used for early warning neither stores nor generates data, but only issues an early warning when a terminal device failure is detected, so it is placed in the third security level.

[0049] At the same time, the importance level of the associated terminal device is also determined according to the security level of the data processed by the terminal device. For example, a first security level, a second security level, a third security level, a fourth security level and a fifth security level are set, and the first security level> the second security level> the third security level> the fourth security level> the fifth security level. The data used to encrypt the memory and the core server has the highest security level and is placed in the first security level. The data integrity in the memory is relatively high, so it can be placed in the second security level. The core server runs the control logic for controlling different terminal devices, so the core server is also placed in the second security level, and the data collected by the edge sensor is placed in the third security level, and the warning information generated by the warning terminal device is placed in the fourth security level. Finally, the information uploaded from the buffer area 120 is placed in the fifth security level.

[0050] Therefore, after obtaining the associated terminal device, first match a corresponding security level according to the type of the associated terminal device, then according to the security level of the data processed by the associated terminal device, and finally confirm the importance level of the associated terminal device. The importance level selected in this example is: from the security level corresponding to the type of the associated terminal device and the security level of the processed data, select the security level with the highest security level as the importance level of the associated terminal device. For example, the type of core server B itself is in the first security level. If core server B needs to further process the data in the memory, then since the data in the memory is in the second security level, the highest security level of core server B is the first security level, and the first security level will also be used as the importance level of core server B.

[0051] In this example, different importance levels correspond to different weights, and the corresponding weights can be matched according to the importance levels. For example, when the importance level is the first security level, the corresponding weight is 100%, when the importance level is the second security level, the corresponding weight is 60%, and when the importance level is the third security level, the corresponding weight is 10%. It should be noted that the above weights are only examples, and in actual use, they can be adaptively adjusted as needed.

[0052] Based on the initial score and the weight corresponding to the importance level, the first score is calculated: F1=S(1+p), where F1 is the first score, S is the initial score, and p is the weight corresponding to the importance level.

[0053] Step S330: Calculate a second score based on the initial score and the association level of the associated terminal device.

[0054] Specifically, the association level is determined according to the interaction frequency between the associated terminal device and other terminal devices and the traffic volume during the interaction process. For example, the interaction frequency range is set in advance as 0-10, 11-30, 31-50, 51-80, 81-100 and above 100, and 0-10, 11-30, 31-50, 51-80, 81-100 and above 100 correspond to the association levels of level 6, level 5, level 4, level 3, level 2 and level 1, respectively. Then, according to the interaction frequency range into which the interaction frequency falls, the association level corresponding to the interaction frequency of the associated terminal device is determined, and the association level is used as the primary association level. Then, the ratio of the traffic used by the associated terminal device during interaction to the total traffic used by the internal area is calculated to determine the final association level. For example, the interaction frequency of the associated terminal device C is 55, and the calculated ratio is 5%. Then the association value is calculated as: L=55+5%*100, that is, the association value L of the associated terminal device is 60 points. Since 60 still falls within the range of 51-80, the association level of the associated terminal device C corresponds to level three.

[0055] Different association levels correspond to different weights, and the corresponding weights are matched according to the association levels. For example, when the association level is level 1, the corresponding weight is 100%, when the association level is level 2, the corresponding weight is 85%, when the association level is level 3, the corresponding weight is 65%, when the association level is level 4, the corresponding weight is 45%, when the association level is level 5, the corresponding weight is 25%, and when the association level is level 6, the corresponding weight is 5%. It should also be noted that the above weights are only examples, and in actual use, they can be adaptively adjusted as needed.

[0056] Based on the initial score and the weight corresponding to the association level, the second score is calculated: F2=S(1+q), where F2 is the second score, S is the initial score, and q is the weight corresponding to the association level.

[0057] Step S334: Calculate the association score of the association code according to the first score and the second score.

[0058] In a specific example, the calculation formula for calculating the association score of the association code is: D=F1+F2, that is, the sum of the first score and the second score is used as the association score.

[0059] In other examples, the calculation formula for calculating the association score of the association code is: D=max(F1, F2), that is, from the first score and the second score, the maximum value is selected as the association score.

[0060] In general, the relevance score of the association code is calculated based on the importance level and relevance level of the associated terminal device.

[0061] Step S400: Generate interference information according to the correlation score.

[0062] Based on the relevance score, the associated code with a relevance score higher than the score threshold is used as the target code, and a garbled code information is generated as interference information for the terminal device corresponding to the target code. Specifically, an interference area is set in the buffer area 120, and the interference area is used to generate interference information. When the buffer area 120 receives abnormal request information again and the relevance score of the associated terminal device corresponding to the abnormal request information is higher than the score threshold, the buffer area 120 first calls the interference information in the interference area, and then clears the abnormal request information, so as to avoid the aggressive terminal devices in the external network from finding the weak nodes in the local area network 100 based on the clues of previous visits, or to avoid the security risks caused by unclean cleaning of abnormal request information when the aggressive terminal devices are more aggressive.

[0063] Figure 3 A block diagram of a network security monitoring system for an industrial Internet according to an embodiment of the present application is shown, the system comprising a data acquisition module 121, a data determination module 122, a data calculation module 123 and a data generation module 124.

[0064] The data acquisition module 121 is used to acquire abnormal request information, which includes a request task and a purpose code.

[0065] The data determination module 122 is used to determine the associated code according to the request task and the purpose code, and the terminal device with the associated code is located in the internal area 110.

[0066] The data calculation module 123 is used to calculate the relevance score of the associated code according to the importance level and the relevance level of the associated terminal device.

[0067] The data generating module 124 is used to generate interference information according to the correlation score.

[0068] The modules involved in the embodiments described in the present application may be implemented by software or by hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a data acquisition module 121, a data determination module 122, a data calculation module 123 and a data generation module 124. The names of these modules do not constitute a limitation on the modules themselves in some cases, for example, the data acquisition module 121 may also be described as a "module for obtaining abnormal request information".

[0069] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0070] In order to better execute the program of the above method, the present application also provides a network security monitoring device for the industrial Internet, which includes a memory and a processor.

[0071] The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above-mentioned network security monitoring method for the industrial Internet, etc.; the data storage area may store data involved in the above-mentioned network security monitoring method for the industrial Internet, etc.

[0072] The processor may include one or more processing cores. The processor calls the data stored in the memory by running or executing the instructions, programs, code sets or instruction sets stored in the memory, performs various functions of the present application and processes data. The processor may be at least one of a special purpose integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It is understandable that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application are not specifically limited.

[0073] The present application also provides a computer-readable storage medium, for example, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes. The computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above-mentioned network security monitoring method for the industrial Internet.

[0074] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A network security monitoring method for industrial Internet, applied in a buffer area (120), characterized in that: include: Acquire abnormal request information, the abnormal request information including a destination code and a request task, the destination code being a code of a terminal device for executing the request task, and mark the terminal device having the destination code as a destination terminal device; Determining an associated code according to the purpose code and the requested task, marking a terminal device having the associated code as an associated terminal device, wherein the associated terminal device is located in an internal area (110); Calculating the relevance score of the associated code according to the importance level and the relevance level of the associated terminal device; Interference information is generated according to the correlation score.

2. The network security monitoring method of the industrial Internet according to claim 1 is characterized in that: The calculating the association score of the association code according to the importance level and the association level of the associated terminal device includes: An initial score is calculated based on the historical association times of the association code; Calculating a first score according to the initial score and the importance level of the associated terminal device; Calculating a second score according to the initial score and the association level of the associated terminal device; The association score of the association code is calculated according to the first score and the second score.

3. The network security monitoring method of the industrial Internet according to claim 2 is characterized in that: The initial score is calculated by the following calculation formula: Initial score = historical association times * preset score, The historical number of associations refers to the number of associations of the association code during the monitoring period, and the preset score range is 3-10 points.

4. The network security monitoring method of the industrial Internet according to claim 2 is characterized in that: The calculating the first score according to the initial score and the importance level of the associated terminal device includes: Matching a corresponding security level according to the type of the associated terminal device; Determining a security level of data processed by the associated terminal device; Selecting the highest security level among the security level corresponding to the type of the associated terminal device and the security level of the data processed by the associated terminal device as the importance level; Obtaining corresponding weights according to the importance level matching; The first score is calculated based on the initial score and the weight corresponding to the importance level.

5. The network security monitoring method of the industrial Internet according to claim 4 is characterized in that: The first score is calculated by the following calculation formula, including: F1=S(1+p), Among them, F1 is the first score, S is the initial score, and p is the weight corresponding to the importance level.

6. The network security monitoring method of the industrial Internet according to claim 2 is characterized in that: The calculating the second score according to the initial score and the association level of the associated terminal device includes: Determining a primary association level according to the interaction frequency between the associated terminal device and other terminal devices in the internal area (110); Determining a final association level according to the primary association level, the ratio of the traffic used by the associated terminal device during interaction to the total traffic used by the internal area (110); Matching corresponding weights according to the final association level; A second score is calculated based on the initial score and the weight corresponding to the final association level.

7. The network security monitoring method of the industrial Internet according to claim 1 is characterized in that: The determining of the associated code according to the purpose code and the requested task includes: Identify the type of the abnormal request information; Retrieving a terminal device located in the internal area (110) and participating in executing the request information of the type when the target terminal device executes the request information of the type, taking the terminal device as a first associated terminal device, and taking a code of the first associated terminal device as a first code; Using a terminal device that generates response data identical or similar to the abnormal request information and located in the internal area (110) as a second associated terminal device, and using a code of the second associated terminal device as a second code; The associated code is obtained according to the first code and the second code.

8. A network security monitoring system for industrial Internet, characterized in that: include: A data acquisition module (121) is used to acquire abnormal request information, wherein the abnormal request information includes a destination code and a request task, wherein the destination code is a code of a terminal device for executing the request task, and the terminal device having the destination code is marked as a destination terminal device; A data determination module (122) is used to determine an associated code according to the purpose code and the requested task, and mark a terminal device having the associated code as an associated terminal device, wherein the associated terminal device is located in the internal area (110): A data calculation module (123), used for calculating the relevance score of the associated code according to the importance level and the relevance level of the associated terminal device; A data generation module (124) is used to generate interference information according to the correlation score.

9. A network security monitoring device for industrial Internet, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images