A secure and intelligent processing method for industrial Internet data

Abstract

The present invention discloses a method for intelligent data security processing of industrial Internet, which relates to the field of data processing technology. The method comprises: monitoring the data storage module of the industrial Internet and outputting a behavior monitoring data set; performing the first trial threat source capture and obtaining a set of trial threat sources; performing classification and obtaining multiple types of trial threat sources; obtaining the chain attack probability of each trial threat source, and identifying the identified trial threat source with a probability greater than or equal to a preset attack probability; establishing a hidden Markov model, predicting the identified trial threat source, outputting a predicted attack chain, and performing security defense processing based on the predicted attack chain. The method solves the technical problem that it is difficult to effectively identify and predict potential threat sources and their chain attack paths in the industrial Internet in the prior art. By establishing a hidden Markov model, the threat source is accurately classified and the attack chain is predicted, so that security defense measures are taken in advance, achieving the technical effect of improving the efficiency and accuracy of data security processing.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method for secure and intelligent processing of industrial Internet data. Background Art

[0002] With the rapid development of the Industrial Internet, the deep integration of industrial systems and information networks continues to strengthen, but the resulting data security risks are also becoming increasingly prominent. Traditional security protection methods, which rely primarily on rule matching and static analysis, are unable to cope with increasingly complex cyberattacks. This is especially true when facing advanced persistent threats (APTs). Existing technologies struggle to detect potential threat sources hidden in normal behavior and lack effective mechanisms for predicting chain attack paths, resulting in lagging and imperfect security defenses. Therefore, how to use intelligent methods to monitor and accurately identify potential threat sources in the Industrial Internet in real time and predict possible attack chains has become a key issue that needs to be addressed. Summary of the Invention

[0003] This application provides an intelligent processing method for industrial Internet data security, which solves the technical problem in the existing technology that it is difficult to effectively identify and predict potential threat sources and their chain attack paths in the industrial Internet.

[0004] In view of the above problems, this application provides a method for intelligent data security processing in the industrial Internet.

[0005] This application provides a method for intelligent data security processing on the industrial Internet, the method comprising:

[0006] Obtain an industrial Internet data storage module, monitor the industrial Internet data storage module, and output a behavior monitoring data set; perform an initial trial threat source capture on the behavior monitoring data set to obtain a trial threat source set; classify the trial threat source set to obtain multiple categories of trial threat sources; obtain the chain attack probability of each trial threat source by analyzing each category of trial threat sources in the multiple categories of trial threat sources, and identify identified trial threat sources with a probability greater than or equal to a preset attack; establish a hidden Markov model, predict the identified trial threat source according to the hidden Markov model, output a predicted attack chain, and perform security defense processing based on the predicted attack chain.

[0007] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0008] First, an industrial Internet data storage module is obtained, the industrial Internet data storage module is monitored, and a behavior monitoring data set is output. Next, the behavior monitoring data set is subjected to an initial capture of a tentative threat source to obtain a set of tentative threat sources. Further, the set of tentative threat sources is classified to obtain multiple categories of tentative threat sources. Then, by analyzing each of the multiple categories of tentative threat sources, the chain attack probability of each tentative threat source is obtained, and identified tentative threat sources with an attack probability greater than or equal to a preset probability are identified. Finally, a hidden Markov model is established, and the identified tentative threat sources are predicted according to the hidden Markov model, and a predicted attack chain is output. Security defense processing is performed based on the predicted attack chain. This solves the technical problem in the existing technology of the difficulty in effectively identifying and predicting potential threat sources and their chain attack paths in the industrial Internet. By establishing a hidden Markov model, threat sources are accurately classified and attack chains are predicted, so that security defense measures can be taken in advance, achieving the technical effect of improving the efficiency and accuracy of data security processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A flowchart of a method for intelligent data security processing in the industrial Internet provided in an embodiment of the present application;

[0011] Figure 2 A flowchart of the first trial threat source capture in an industrial Internet data security intelligent processing method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] This application solves the technical problem in the existing technology that it is difficult to effectively identify and predict potential threat sources and their chain attack paths in the industrial Internet by providing an intelligent processing method for industrial Internet data security.

[0013] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0014] It should be noted that the terms "including" and "having" are intended to cover non-exclusive inclusions. For example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or are inherent to these processes, methods, products or devices.

[0015] Examples, such as Figure 1 As shown, the embodiment of the present application provides a method for intelligent processing of industrial Internet data security, wherein the method includes:

[0016] Obtain an industrial Internet data storage module, monitor the industrial Internet data storage module, and output a behavior monitoring data set.

[0017] First, it's necessary to locate and acquire the Industrial Internet's data storage module. This data storage module may include a database, file storage system, or other form of storage device, storing various data during the operation of the Industrial Internet. By monitoring the Industrial Internet's data storage module, such as real-time tracking of data read and write operations, access rights, and data modification behaviors, a behavioral monitoring dataset is generated. This behavioral monitoring dataset records key information such as the time, type, data involved, and accessors of various operations, providing data support for subsequent threat source analysis and chain attack probability prediction.

[0018] An initial trial threat source capture is performed on the behavior monitoring data set to obtain a trial threat source set.

[0019] After obtaining the behavioral monitoring data set, it is necessary to conduct a preliminary analysis of the behavioral data therein, including techniques such as pattern recognition and anomaly detection of the data, in order to identify behavioral characteristics that may pose potential risks. These characteristics may include abnormal access patterns (such as frequent attempts to access restricted resources), abnormal data traffic (such as large amounts of data transmission in a short period of time), abnormal user behavior (such as access during non-working hours), etc. Through the analysis of behavioral monitoring data, the first tentative threat capture is carried out; the so-called tentative threat source capture refers to the use of heuristic algorithms or preset rules to select those operations or events similar to known attack patterns or abnormal behaviors from the monitoring data set as potential threat sources; after the tentative threat source capture is completed, the identified potential threat behaviors will be summarized to form a tentative threat source set. Each threat source in the tentative threat source set represents a possible security risk, but its true nature or extent of the attack has not yet been confirmed.

[0020] Furthermore, if Figure 2 As shown, the behavior monitoring data set is subjected to an initial trial threat source capture to obtain a trial threat source set, and the method includes:

[0021] The behavior monitoring data set is subjected to abnormal feature identification through a threat source behavior analysis model to obtain a real-time threat source set; a historical threat source repository is obtained, wherein the historical threat source repository stores historical threat source records of the industrial Internet data storage module; the real-time threat source set is returned to the historical threat source repository for traversal, and the threat source that is returned as empty is used as the first trial threat source, and the trial threat source set is output.

[0022] Deploy a pre-trained threat source behavior analysis model, which can identify abnormal features in the behavior monitoring data set, which are associated with potential security threats. The random forest algorithm can be selected to train the threat source behavior analysis model. Specifically, collect threat source behavior data from sources such as network logs, traffic monitoring, intrusion detection systems, etc., including normal behavior and abnormal behavior; remove duplicate data, process missing values, convert data types, etc. to ensure data quality; extract features meaningful for threat source behavior analysis from the original data, such as attack type, attack frequency, attack target, timestamp, etc.; label each data to indicate whether it is normal behavior or abnormal behavior (threat source behavior); divide the data set into training set and test set (or validation set), usually in a ratio of 70% training set and 30% test set; for each data in the training set, randomly select a feature subset and build multiple decision trees; at each node of the decision tree, select the best feature for splitting according to criteria such as information gain and Gini coefficient, until Until the stopping condition is met (such as reaching the maximum depth, the number of samples contained in the node is less than the minimum number of sample splits, etc.); at each node of the decision tree, the best feature is selected for splitting based on criteria such as information gain and Gini coefficient, until the stopping condition is met (such as reaching the maximum depth, the number of samples contained in the node is less than the minimum number of sample splits, etc.); for each data in the test set, let it be predicted by all decision trees, and finally determine its category (normal behavior or abnormal behavior) based on the voting results; use the test set to evaluate the performance of the model, and calculate indicators such as accuracy, recall rate, and F1 score; adjust the parameters of the random forest based on the evaluation results, such as increasing the number of decision trees, adjusting the size of the feature subset, etc., to improve model performance; deploy the trained random forest model (threat source behavior analysis model) in the actual environment to identify and monitor threat source behavior.

[0023] The threat source behavior analysis model is used to conduct an in-depth analysis of the behavior monitoring data set, identify abnormal features, and generate a real-time threat source set. The real-time threat source set contains all possible threat behaviors currently monitored. The historical threat source repository is retrieved from the industrial Internet data storage module. The historical threat source repository records past threat sources and related information, including previously identified threat sources and their behavioral characteristics. These historical records provide a reference for the identification and verification of current real-time threat sources. Each threat source in the real-time threat source set is returned to the historical threat source repository for traversal matching; if a real-time threat source does not find a corresponding matching record in the historical records, it means that the threat source is a new threat source that has not been seen before; for those real-time threat sources that return empty results, they are marked as first-time trial threat sources, and these newly discovered threat sources are aggregated to form a trial threat source set.

[0024] Furthermore, the abnormal characteristics include the preset number and interval of repeated attempts, the difference between the data packet structure and regular data requests, and the IP address, geographic location and device characteristics of the probing behavior.

[0025] Preferably, anomaly characteristics include the number and interval of pre-set repeated attempts, the degree of difference in packet structure from regular data requests, and the IP address, geographic location, and device characteristics of the probing behavior. By combining these anomaly characteristics, potential threat sources can be more comprehensively identified, especially those using probing behavior to launch attacks. These characteristics not only effectively detect potential attacks but also provide data support for subsequent security strategies, enhancing defense effectiveness.

[0026] Preset the number and interval of repeated attempts: When analyzing behavioral monitoring data, the behavioral characteristics of repeated operations will be captured, especially the behavior of multiple consecutive attempts to access the same resource or interface; if the same IP address or user attempts to access restricted resources (such as logging into the system, accessing sensitive data, etc.) multiple times in a short period of time, and exceeds the preset number or interval, it will be regarded as a potential trial behavior.

[0027] The difference between the data packet structure and regular data requests: The transmitted data packet is parsed and its structure is analyzed and compared with normal data requests. If the format, size, or field content of the data packet differs significantly from a regular data request, this may be a sign of an attacker probing or exploiting a vulnerability. By calculating the difference between the data packets, abnormal behavior can be identified.

[0028] IP address, geographic location, and device characteristics of probing behavior: Record and analyze the IP address, geographic location information, and device hardware characteristics (such as operating system, browser fingerprint, MAC address, etc.) of each access behavior; if the access behavior comes from a suspicious IP address, the geographic location is abnormal (such as inconsistent with the device's historical location), or the device characteristics suddenly change (such as using a different operating system or browser), it will be marked as abnormal behavior.

[0029] The set of probe threat sources is classified to obtain multiple categories of probe threat sources.

[0030] Extract key features of each threat source from the set of probing threat sources. These features include, but are not limited to, access behavior patterns, IP addresses, geographic locations, device characteristics, packet structure, number of repeated attempts, and intervals. By extracting these features, a detailed feature vector for each threat source can be generated. Based on the extracted threat source features, an appropriate classification algorithm is selected to classify the probing threat sources. Based on different feature combinations, the probing threat sources are divided into multiple categories, such as scanning attacks, brute force attacks, phishing attacks, and unauthorized access.

[0031] Furthermore, the set of probe threat sources is classified to obtain multiple types of probe threat sources, and the method includes:

[0032] The set of probe threat sources is extracted to obtain the address characteristics, attack pattern characteristics, and behavior characteristics of each probe threat source; and the set of probe threat sources is classified using a K-means clustering algorithm based on the address characteristics, attack pattern characteristics, and behavior characteristics of each probe threat source to obtain multiple categories of probe threat sources.

[0033] Preferably, the IP address, geographic location, subnet information, etc. of each probing threat source are extracted; the attack behavior pattern of each probing threat source is identified, including scanning frequency, port access status, abnormality of data packet structure, requested path, etc., and the attack pattern characteristics are used to identify the specific type of attack; the access behavior of each threat source is analyzed, including the number of repeated accesses, access time interval, request frequency, response time, etc.; the features of the above three aspects are combined to form a feature vector of each probing threat source, each feature vector containing address features, attack pattern features and behavior features, which are used for subsequent cluster analysis. The extracted threat source feature vectors are clustered using the K-means clustering algorithm. The K-means algorithm first randomly initializes K cluster centers (i.e., K categories); the Euclidean distance between each tentative threat source feature vector and the current cluster center is calculated, and each tentative threat source is assigned to the cluster center closest to it; in each iteration, the center position (i.e., cluster center) of all tentative threat sources in each category is recalculated, and all threat sources are reclassified based on the new center; this process is iterated continuously until the cluster centers converge or the set maximum number of iterations is reached, ultimately obtaining K stable cluster categories; after classification by the K-means clustering algorithm, the tentative threat sources are divided into multiple categories, each of which reflects different attack characteristics and behavior patterns, facilitating subsequent security processing and threat warning.

[0034] By analyzing each of the multiple types of probing threat sources, the chain attack probability of each probing threat source is obtained, and the probing threat sources with an attack probability greater than or equal to a preset probability are identified.

[0035] Through in-depth analysis of each type of probing threat source, we focus on its attack behavior patterns and attack chain characteristics. For example, we analyze whether the threat source exhibits the characteristics of a multi-stage attack, such as continuous behaviors such as scanning, penetration, and data leakage. Based on historical attack data, we evaluate the success probability of similar attack behaviors; by comparing the behavior pattern of the current threat source with the pattern of historically known chain attacks, we calculate the probability of it successfully completing a multi-stage attack. Based on actual business needs and risk tolerance, we set a preset chain attack probability threshold. This threshold is used to distinguish between high-risk and low-risk threat sources. For example, if the chain attack probability of a threat source is greater than or equal to the threshold, the threat source will be considered to have a higher risk. The calculated chain attack probabilities are sorted, and threat sources with attack probabilities greater than or equal to the preset threshold are screened out. These threat sources are identified as probing threat sources, indicating that they have a higher probability of launching a chain attack.

[0036] Furthermore, by analyzing each of the multiple types of probing threat sources, the chain attack probability of each probing threat source is obtained, and the method includes:

[0037] Acquire multiple chain attack patterns, including a privilege escalation attack chain, a data leakage attack chain, and a denial of service attack chain; extract a first-sequence threat source corresponding to the chain attack pattern for each probe threat source; perform a matching degree analysis between the first-sequence threat source and each probe threat source, and generate a chain attack probability for each probe threat source based on the matching degree.

[0038] Preferably, multiple chain attack modes are established based on known attack paths and behavioral characteristics, including but not limited to privilege escalation attack chain, data leakage attack chain and denial of service attack chain; wherein, privilege escalation attack chain refers to starting from probing system vulnerabilities, obtaining high privileges through privilege escalation tools, and ultimately controlling the system; data leakage attack chain refers to the attacker starting from preliminary vulnerability detection, gradually infiltrating into the database or file system, and obtaining sensitive data; denial of service attack chain is to understand the performance bottleneck of the target system through initial network probing, gradually increase the intensity of the attack, and ultimately lead to system denial of service (DDoS). These first-sequence threat sources are extracted from multiple chain attack patterns. The first-sequence threat source is the first operation of each chain attack pattern. For each tentative threat source, a matching analysis is performed based on its behavior pattern and the first-sequence threat source in the chain attack pattern. Similarity algorithms (such as cosine similarity and Euclidean distance) can be used to compare the behavioral characteristics of the threat source (such as network requests, access paths, operation sequences, etc.) with the characteristics of the first-sequence threat source to calculate the matching degree. Based on the size of the matching degree, a corresponding chain attack probability is generated for each tentative threat source. If a tentative threat source highly matches the first-sequence threat sources of multiple chain attack patterns, its chain attack probability will be significantly increased.

[0039] A hidden Markov model is established, the identified tentative threat source is predicted according to the hidden Markov model, a predicted attack chain is output, and security defense processing is performed based on the predicted attack chain.

[0040] A Hidden Markov Model (HMM) is trained using a large amount of historical attack data. By learning the behavioral patterns of threat sources, it establishes the transition relationships between attack steps and the probability distributions of different observed variables. This trained HMM accurately captures the multi-stage characteristics of chain attacks. For identified threat sources, their current behavior (observed anomalies) is fed into the HMM. The model then predicts the next possible attack action based on its current state. Using the Viterbi algorithm, the HMM can predict the most likely attack chain path for the threat source based on its observation sequence. For example, the model might predict privilege escalation or data exfiltration as the next step in the attack chain. By analyzing the currently observed behavior and inferring state transitions, the HMM outputs a complete predicted attack chain path. This predicted attack chain includes the steps already completed by the threat source, as well as its possible next attack steps and paths. Based on the predicted attack chain output by the HMM, appropriate security measures can be implemented in real time. For example, if a threat source is predicted to escalate privileges or leak data, its network access rights can be blocked in advance; for a predicted data leakage attack chain, sensitive data can be encrypted or locked in advance to prevent data theft; for different predicted attack paths, firewall rules can be dynamically adjusted to block specific access or operations.

[0041] Through the predictions and outputs of the Hidden Markov Model, the system can predict the next move of the threat source based on potential chain attack behaviors and take effective security measures to prevent further escalation of the attack. This dynamic prediction and defense mechanism greatly improves data security in the Industrial Internet environment.

[0042] Furthermore, a hidden Markov model is established, and the method includes:

[0043] The core parameters of the model are obtained, including the chain transition stage, the observed threat source, the initial state probability, the state transition probability matrix, and the observation probability matrix; wherein the state transition probability matrix defines the probability of the threat source transferring from one stage to the next in the chain attack mode, and the observation probability matrix is the probability of observing a certain behavior in each stage; the core parameters are forward convergence trained based on the forward algorithm network, and the hidden Markov model is output.

[0044] Specifically, the stages of the attack chain are defined, with each stage representing a step in the attack process. For example, the transfer stages of a chain attack may include scanning, penetration, privilege escalation, data leakage, denial of service, etc., and each stage is a hidden state in the hidden Markov model; the behaviors of threat sources that can be observed by the system are defined, called observation variables. These observed threat sources may include network traffic anomalies, repeated login attempts, port scanning, data reading requests, etc. These behaviors are the external manifestations of a certain stage in the attack chain; the initial probability of the threat source being in different stages at the beginning of the attack chain is defined. Usually, the attack chain starts with more common behaviors, such as scanning or information collection stages; the probability of the threat source transferring from one stage (hidden state) to the next stage in the chain attack mode is defined. The state transition probability matrix reflects the relationship between the various steps of the attack chain; the probability of observing a specific behavior (observation variable) at each stage of the attack chain is defined. The observation probability matrix is used to describe the possibility of different behaviors occurring under various hidden states.

[0045] The forward algorithm is a probability calculation algorithm for hidden Markov models. It calculates the joint probability of an observation sequence through a forward recursive process. The forward algorithm trains the model's core parameters to ensure that the state transition probability matrix and observation probability matrix in the model converge to a stable value. During training, the forward algorithm calculates the optimal path and probability of the hidden state sequence, given a given observation sequence. Specifically, the model's initial state probabilities, state transition probability matrix, and observation probability matrix are initialized. Based on these initial parameters, training data is input and the forward probability value of each hidden state is calculated. The state transition probability matrix and observation probability matrix are updated to maximize the total probability of the current observation sequence. These steps are repeated until the model parameters converge over multiple iterations, ultimately outputting the trained hidden Markov model. After convergence training, the hidden Markov model possesses the ability to predict attack chains. At this point, the model's core parameters (such as the state transition probability matrix and observation probability matrix) have stabilized and can be used to identify and predict the threat actor's next move in a chain attack.

[0046] When describing the hidden Markov model, the state transition probability matrix and the observation probability matrix are two important core parameters. The following uses a specific example to demonstrate these two matrices and related data. The state transition probability matrix is used to describe the probability of a threat source transitioning from one attack stage (hidden state) to the next attack stage. Assume that the stages of the attack chain include: S1: scanning stage, S2: penetration stage, S3: privilege escalation stage, S4: data leakage stage, S5: denial of service stage. Then, the state transition probability matrix can be expressed as:

[0047]

[0048] For example,

[0049] The probability of S1→S2 is 0.6, indicating that if the attacker is in the scanning phase, there is a 60% probability of entering the penetration phase; the probability of S2→S3 is 0.6, indicating that after the penetration phase, the attacker has a 60% probability of attempting to escalate privileges; the probability of S5→S5 is 1.0, indicating that once entering the denial of service phase, the attack chain will no longer move and the attack ends.

[0050] The observation probability matrix is expressed as:

[0051]

[0052] For example,

[0053] P(O1|S1)=0.8 means that there is an 80% probability of observing network traffic anomalies in the scanning phase; P(O2|S3)=0.4 means that there is a 40% probability of observing multiple login failures in the privilege escalation phase; P(O4|S5)=0.8 means that there is an 80% probability of observing server refusal to respond in the denial of service phase.

[0054] The initial state probability vector represents the probability of each attack stage being the starting point of the chain attack; Π = [P(S1)P(S2)P(S3)P(S4)P(S5)].

[0055] For example, Π = [1.0 0.0 0.0 0.0 0.0]; P(S1) = 1.0, indicating that the attack chain always starts from the scanning stage.

[0056] Furthermore, the method of predicting the identified threat source according to the hidden Markov model and outputting a predicted attack chain includes:

[0057] According to the hidden Markov model, an initial state probability of the identified tentative threat source is obtained based on a forward algorithm network; a recursive calculation is performed based on the initial state probability to obtain a recursive termination calculation result, wherein the recursive termination calculation result is the total probability of the attack chain; and according to the recursive termination calculation result, a predicted attack chain is output, wherein the predicted attack chain is the attack chain with the maximum total probability of the attack chain.

[0058] Specifically, based on the initial state probability vector in the hidden Markov model, a forward algorithm is used to obtain the initial state probability of the identified threat source in the chain attack, that is, the probability of which state the attack chain starts from (such as scanning, penetration, privilege escalation, etc.); based on the recursive formula of the forward algorithm, the probability values of all possible hidden states at each time step t+1 are gradually calculated. The recursive calculation formula is: αt+1 (j) is the forward probability of state j at time t+1; α t (i) is the forward probability of state i at time t; a ij is the state transition probability from state i to state j; b j (O t+1 ) is the state j observing event O at time t+1 t+1 At each time step t, by calculating the probability α of all possible transition paths from the current state to the next state t (i)a ij , and combined with the observed events (i.e. b j (O t+1 )), calculate the forward probability of each state; continue the recursive calculation until the last step of the attack chain; when the recursive calculation is completed, obtain a total probability of the attack chain that includes all possible states; based on the result of the recursive termination calculation, select the path with the largest total probability of the attack chain as the predicted attack chain.

[0059] Furthermore, security defense processing is performed based on the predicted attack chain, including generating a security defense strategy, which at least includes access restriction, enhanced protection, and system warning.

[0060] Based on the predicted attack chain, if certain probing threat sources are identified as about to attempt privilege escalation or penetration testing, their access to specific resources can be immediately restricted. For example, malicious IP addresses or sources can be blocked to prevent them from initiating further attack requests; permissions can be adjusted for user accounts or devices involved in the predicted attack chain, reducing their access to critical systems to prevent attackers from gaining control of the system through privilege escalation; and suspected servers or devices can be isolated from the main network to prevent the attack from spreading, especially when the attack chain involves data leakage or lateral movement.

[0061] Based on the predicted attack chain, security policies can be dynamically adjusted to enhance protection. For example, firewall policies can be dynamically updated based on the ports, protocols, or IP addresses involved in the attack chain to block the next step in the attack chain. For attack chain predictions that may trigger privilege escalation or illegal logins, multi-factor authentication (MFA) or stricter authentication requirements can be enabled to ensure that malicious users cannot easily bypass security mechanisms. If the attack chain predicts that the attacker will attempt to steal sensitive data, the relevant data can be encrypted to ensure that even if the data is obtained, it cannot be easily decrypted.

[0062] When the system predicts a potential attack chain, it issues an early warning to the administrator or security team. For example, real-time alerts are issued for suspicious network behavior, including abnormal traffic, repeated login failures, and unauthorized data access, alerting the security team to potential attack chains. The security monitoring platform displays the complete predicted attack chain, including its starting point, possible transfer stages, and final target. This triggers automated response mechanisms, such as shutting down certain services, isolating devices, or initiating security review processes, to reduce human response delays.

[0063] Based on the predictions of the Hidden Markov Model, security defense strategies can automatically adapt to the current attack chain. For example, when a change in the attack chain is detected, the system can automatically adjust defense measures to address the newly emerged attack steps. Defense strategies can be dynamically adjusted based on different attack chains. For example, when a denial of service attack chain is identified, traffic request restrictions will be prioritized, while when a privilege escalation attack chain is identified, user authentication will be prioritized.

[0064] In summary, the embodiments of the present application have at least the following technical effects:

[0065] First, an industrial Internet data storage module is obtained, the industrial Internet data storage module is monitored, and a behavior monitoring data set is output. Next, the behavior monitoring data set is subjected to an initial capture of a tentative threat source to obtain a set of tentative threat sources. Further, the set of tentative threat sources is classified to obtain multiple categories of tentative threat sources. Then, by analyzing each of the multiple categories of tentative threat sources, the chain attack probability of each tentative threat source is obtained, and identified tentative threat sources with an attack probability greater than or equal to a preset probability are identified. Finally, a hidden Markov model is established, and the identified tentative threat sources are predicted according to the hidden Markov model, and a predicted attack chain is output. Security defense processing is performed based on the predicted attack chain. This solves the technical problem in the existing technology of the difficulty in effectively identifying and predicting potential threat sources and their chain attack paths in the industrial Internet. By establishing a hidden Markov model, threat sources are accurately classified and attack chains are predicted, so that security defense measures can be taken in advance, achieving the technical effect of improving the efficiency and accuracy of data security processing.

[0066] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0067] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0068] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. A method for intelligent data security processing in the industrial Internet, characterized in that: The method comprises: Obtain an industrial Internet data storage module, monitor the industrial Internet data storage module, and output a behavior monitoring data set; Performing an initial trial threat source capture on the behavior monitoring data set to obtain a trial threat source set; Classifying the set of probe threat sources to obtain multiple categories of probe threat sources; By analyzing each of the multiple types of probing threat sources, a chain attack probability of each probing threat source is obtained, and a probing threat source having an attack probability greater than or equal to a preset probability is identified; Establishing a hidden Markov model, predicting the identified threat source according to the hidden Markov model, outputting a predicted attack chain, and performing security defense processing based on the predicted attack chain; Performing an initial trial threat source capture on the behavior monitoring data set to obtain a trial threat source set, the method comprising: Perform abnormal feature recognition on the behavior monitoring data set through a threat source behavior analysis model to obtain a real-time threat source set; Obtain a historical threat source repository, where the historical threat source repository stores historical threat source records of the industrial Internet data storage module; The real-time threat source set is returned to the historical threat source storage for traversal, and the threat source that is returned as empty is used as the first tentative threat source, and the tentative threat source set is output.

2. The method for intelligent processing of industrial Internet data security according to claim 1, characterized in that: The abnormal characteristics include the preset number and interval of repeated attempts, the difference between the data packet structure and regular data requests, and the IP address, geographic location and device characteristics of the probing behavior.

3. The method for intelligent processing of industrial Internet data security according to claim 1, characterized in that: The set of probe threat sources is classified to obtain multiple types of probe threat sources, and the method includes: Extracting the set of probe threat sources to obtain address features, attack pattern features, and behavior features of each probe threat source; According to the address characteristics, attack mode characteristics and behavior characteristics of each probe threat source, the probe threat source set is classified using the K-means clustering algorithm to obtain multiple categories of probe threat sources.

4. The method for intelligent processing of industrial Internet data security according to claim 1, characterized in that: By analyzing each of the multiple types of probing threat sources, a chain attack probability of each probing threat source is obtained, the method includes: Acquire multiple chain attack patterns, wherein the multiple chain attack patterns include a privilege escalation attack chain, a data leakage attack chain, and a denial of service attack chain; Extract the first sequence threat source of each probing threat source corresponding to the chain attack mode; A matching degree analysis is performed between the first sequence threat source and each probing threat source, and a chain attack probability of each probing threat source is generated according to the matching degree.

5. The method for intelligent processing of industrial Internet data security according to claim 4, characterized in that: Establish a hidden Markov model, the method includes: Obtaining core model parameters, including chain transfer stages, observed threat sources, initial state probabilities, state transition probability matrices, and observation probability matrices; The state transition probability matrix defines the probability of a threat source transitioning from one stage to the next in a chain attack mode, and the observation probability matrix is the probability of observing a certain behavior in each stage; The core parameters are trained in a forward convergence manner based on a forward algorithm network to output the hidden Markov model.

6. The method for intelligent processing of industrial Internet data security according to claim 4, characterized in that: Predicting the identified threat source according to the hidden Markov model and outputting a predicted attack chain, the method includes: Obtaining the initial state probability of the identified threat source based on the forward algorithm network according to the hidden Markov model; Performing a recursive calculation based on the initial state probability to obtain a recursive termination calculation result, wherein the recursive termination calculation result is the total probability of the attack chain; According to the recursive termination calculation result, a predicted attack chain is output, where the predicted attack chain is the attack chain with the maximum total probability of the attack chain.

7. The method for intelligent processing of industrial Internet data security according to claim 1, characterized in that: Security defense processing is performed based on the predicted attack chain, including generating a security defense strategy, wherein the security defense strategy at least includes access restriction, enhanced protection, and system early warning.

Images