Mine network security operation system

Abstract

The invention relates to the technical field of mine network safety operation, in particular to a mine network safety operation system, which comprises a data acquisition and preprocessing module, the data acquisition and preprocessing module acquires various equipment and sensor data of a mine network, and the data quality is improved through denoising of an auto-encoder and processing of a Gaussian mixture model; the threat detection and intelligent analysis module adopts a DCNN and RL combined model and can accurately monitor attack behaviors; the defense strategy generation and response module generates and adjusts a defense strategy in real time according to an attack type and a network state by means of a hybrid reinforcement learning and genetic algorithm; the quantum encryption and secure communication module encrypts transmission data by using a QKD technology to ensure the security of the transmission data; and the event response and recovery module quickly responds to the security event and recovers the system through a self-adaptive algorithm. According to the invention, mine network security challenges are effectively handled, security is comprehensively improved, mine production continuity is ensured, and reliable guarantee is provided for mine network security operation.

Description

Technical Field

[0001] The present invention relates to the technical field of mine network security operation, and in particular to a mine network security operation system. Background Art

[0002] In today's digital age, the process of informatization transformation in the mining industry is accelerating, and the role of mining networks in production operations is becoming more and more critical. The mining network covers a large number of equipment and systems, including but not limited to the interconnection between various sensors (used to collect environmental and equipment operation data such as temperature, pressure, vibration, etc.), production equipment (such as mining machinery, transportation equipment, etc.), monitoring systems (real-time monitoring of mining production areas and equipment status), and management information systems (handling production plans, personnel scheduling, resource management, etc.). However, with the widespread application of network technology, mining network security faces severe challenges. On the one hand, network attack methods are becoming increasingly complex and diverse, and hackers may exploit system vulnerabilities. On the other hand, the mining network environment is complex, and the equipment is diverse and widely distributed, which makes network management and security protection more difficult. The operating systems and communication protocols of different types of equipment may be different, which increases the complexity of unified deployment and management of security policies; at the same time, the harsh environment of the mine site (such as high temperature, high humidity, strong electromagnetic interference, etc.) may also affect the normal operation of network equipment, reduce the stability and security of the network, and thus affect the continuity and safety of mining production.

[0003] Existing network security solutions on the market have many limitations when dealing with network security issues in mines. Traditional network security protection technologies mainly focus on boundary protection, such as firewalls and intrusion detection systems, but they are insufficient in detecting and defending against internal attacks and new complex attacks. Firewalls can only filter network traffic based on preset rules, and it is difficult to identify disguised or deformed malicious traffic; although intrusion detection systems can detect known attack patterns, they are often powerless against unknown attacks. In addition, existing security solutions lack the ability to dynamically evaluate and adaptively adjust the overall security of mine networks. The mine network environment is complex and changeable, and the equipment status and network traffic may change at any time. The existing system cannot adjust the security strategy according to these changes in time, resulting in a significant reduction in the protection effect when facing dynamically changing security threats. At the same time, the existing solutions are not perfect in terms of safeguards for data security transmission. In mine production, a large amount of sensitive data (such as geological data, production plans, equipment operation data, etc.) needs to be transmitted in the network. Once the data is leaked, it may have a serious impact on the production operation and economic benefits of mining enterprises. The existing encryption technology may have problems such as complex key management and easy cracking of encryption algorithms, which cannot meet the high requirements of mine networks for secure data transmission. Therefore, a mine network security operation system is proposed to address the above problems. Summary of the invention

[0004] The purpose of the present invention is to provide a mine network security operation system to solve the problems raised in the above background technology.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] A mine network security operation system, comprising:

[0007] Data acquisition and preprocessing module: It is connected to various devices and sensors in the mine network to collect real-time data from the devices and sensors, and to perform denoising and standardization on the collected real-time data;

[0008] Threat detection and intelligent analysis module: It is connected to the data acquisition and preprocessing module, and uses a model that combines deep convolutional neural network DCNN and reinforcement learning RL to monitor attack behaviors in the mine network in real time based on preprocessed data and perform threat detection;

[0009] The defense strategy generation and response module is connected to the threat detection and intelligent analysis module, which uses hybrid reinforcement learning and genetic algorithms to automatically generate defense strategies and make real-time adjustments based on the different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mine network;

[0010] Quantum encryption and secure communication module: It is connected to the data transmission link in the mine network and encrypts the data transmitted in the mine network through quantum key distribution (QKD) technology to ensure the security of data transmission;

[0011] Incident response and recovery module: It is connected to the threat detection and intelligent analysis module and the defense strategy generation and response module. After receiving the security event information detected by the threat detection and intelligent analysis module, it initiates emergency response through an adaptive algorithm and quickly restores the system to ensure the continuity of mine production.

[0012] As a preferred solution, the data acquisition and preprocessing module uses an autoencoder and a Gaussian mixture model GMM to denoise, normalize and standardize the data, including:

[0013] Autoencoder denoising: Assume the input data is , the autoencoder consists of the encoder function and the decoder function The encoder will input data Mapping to a low-dimensional latent space representation , the decoder then restores the data from the latent space to obtain ; Parameters are learned by minimizing the reconstruction error, which is measured by the mean square error MSE, as follows: ,in, is the number of data samples, and are the original data and the reconstructed data respectively. elements; by optimizing the loss function, adjusting the parameters of the encoder and decoder, the reconstructed data Close to original data , remove the noise component and get the denoised data ;

[0014] Gaussian mixture model GMM processing: for data denoised by the autoencoder , assuming that it obeys The probability density function of the mixture of Gaussian distributions is: ,in, For the The mixing coefficient of the Gaussian distribution satisfies , Indicates the mean The covariance matrix is The Gaussian distribution probability density function is, ,in, is the data dimension, and the maximum likelihood estimation method is used to estimate and Parameters, data Perform normalization and standardization.

[0015] As a preferred solution, the threat detection and intelligent analysis module includes:

[0016] Deep convolutional neural network DCNN feature extraction: For the input preprocessed data, let the convolution kernel be , biased to , the output of the convolutional layer It is obtained through convolution operation, and the formula is: ,in, Represents the convolutional layer at position The output at are the number of rows and columns of the convolution kernel, respectively. is the coordinate position of the output feature map, It is an activation function. After the operations of convolution layer and pooling layer, the features are extracted and converted into vector representation.

[0017] Reinforcement learning RL optimization: Assume that the agent is at time The status is , the action taken is set to , the reward of environmental feedback is , the state transition probability is , reinforcement learning is based on Markov decision process MDP, the goal is to maximize the long-term cumulative reward ,in, is the discount factor, , Represents the agent at time The reward obtained from the environment is the agent’s policy function To select actions, the value function Update according to the relevant update formula to dynamically optimize the detection strategy of the deep convolutional neural network DCNN.

[0018] As a preferred solution, the operation of the defense strategy generation and response module includes:

[0019] Hybrid reinforcement learning to evaluate defensive actions: Assume the state space is , the action space is , hybrid reinforcement learning based on Learning is combined with the policy gradient method. Study section according to the corresponding Value update method update Value, in the policy gradient part, the policy function Parameters Updated by the gradient ascent algorithm, the goal is to maximize the expected reward , and its gradient calculation formula is: , evaluates defensive action options based on the current state and attack type;

[0020] Genetic algorithm optimizes defense strategy combination: Encode defense action options to form individuals, and set the population size to ,individual The encoding is represented as , through the fitness function Evaluate individual fitness, and define the fitness function based on factors related to the effectiveness of the defense strategy; use basic genetic algorithm operations including selection, crossover, and mutation to iterate and evolve to generate the optimal defense strategy combination;

[0021] Real-time adjustment and deployment: The generated defense strategy is adjusted in real time according to the attack type and system status, and deployed to the relevant security protection equipment in the mining network.

[0022] As a preferred solution, the quantum encryption and secure communication module ensures data transmission security according to the following steps:

[0023] Quantum Key Distribution (QKD) key generation: Based on the quantum key distribution protocol, the sender prepares a quantum bit sequence and sends it to the receiver. After the two parties publicly compare part of the information through the classical channel, they generate a quantum key after error correction and privacy amplification steps. ,Among them, error correction and privacy amplification operations are implemented according to the corresponding standard mathematical models and algorithm processes to ensure that the quantum key meets the security requirements;

[0024] Data encryption and decryption: quantum keys As the key of the symmetric encryption algorithm, let the data block to be encrypted be , the encrypted ciphertext is encrypted by the encryption function Get, at the receiving end using the corresponding quantum key To decrypt, the decryption function is .

[0025] As a preferred solution, the adaptive algorithm of the event response and recovery module is a reinforcement learning algorithm, which implements emergency response and system recovery according to the following process:

[0026] Input state determination: Determine the input state of the reinforcement learning algorithm based on the threat information received in real time ,Threat information includes relevant quantitative features of security incidents;

[0027] Reinforcement learning strategy adjustment: Assume that the action space of the emergency response strategy is , the agent is in state Take action , rewards from environmental feedback According to the effect of taking actions on restoring the system and reducing production interruption time, based on the Markov decision process MDP, through the value function and the policy function Learn the optimal strategy according to the corresponding update formula and dynamically adjust the emergency response strategy;

[0028] Strategy execution and system recovery: Quickly execute the determined emergency response strategy to reduce mine production interruption time and restore the mine network system to normal operation.

[0029] It can be seen from the technical solution provided by the present invention that the mine network security operation system provided by the present invention has the following beneficial effects:

[0030] The data acquisition and preprocessing module provided by the present invention is connected to various devices and sensors in the mine network to realize real-time data acquisition; the autoencoder and Gaussian mixture model GMM are used to process data; the autoencoder measures the reconstruction error with mean square error MSE and minimizes it to learn parameters through encoder and decoder functions, effectively removes noise in the data and improves data accuracy; the Gaussian mixture model GMM assumes that the denoised data obeys a mixture of multiple Gaussian distributions, and after the maximum likelihood estimation of the parameters, the data is normalized and standardized, so that data of different devices and magnitudes can be uniformly compared and analyzed, and the ability to identify abnormal patterns is enhanced, laying a solid data foundation for subsequent safe operations;

[0031] The threat detection and intelligent analysis module adopts a combination of deep convolutional neural network DCNN and reinforcement learning RL architecture; DCNN's convolution operation and pooling layer operation can automatically extract data features, the convolution kernel sliding calculation captures local features, and the pooling layer downsampling retains key features and improves computing efficiency and model invariance, which can keenly detect abnormal patterns in network traffic and equipment operation data; reinforcement learning RL is based on the Markov decision process MDP. The intelligent agent defines the state, takes actions and obtains rewards based on the features extracted by DCNN and the real-time state of the network. By iteratively updating the value function and strategy function, the threat detection strategy is dynamically optimized, effectively responding to new and complex attacks, and improving detection accuracy and timeliness;

[0032] The defense strategy generation and response module generates defense strategies with the help of hybrid reinforcement learning and genetic algorithm; hybrid reinforcement learning combined with - learning and evaluating defensive actions with policy gradient methods, -Learning Update The value evaluates the long-term return of the action, and the policy gradient updates the policy function parameters to select the optimal action; the genetic algorithm encodes the defense action options as individuals, and evaluates the fitness through the fitness function that comprehensively considers factors such as the attack blocking success rate, network performance impact and recovery speed. After iterative evolution through selection, crossover and mutation operations, the optimal strategy combination is searched. The defense strategy can be adjusted according to the real-time situation of the mine network, the overall defense capability can be improved, and network security can be guaranteed;

[0033] The quantum encryption and security communication module connects the data transmission link of the mine network and uses quantum key distribution (QKD) technology to ensure data security. The sender prepares a quantum bit sequence and sends it. The two parties compare information through the classical channel and use the principles of quantum mechanics to detect eavesdropping to ensure the security of key K generation. The generated quantum key is used as the key of the symmetric encryption algorithm to ensure the confidentiality and integrity of the transmitted data, prevent information leakage from causing safety accidents, and effectively ensure the safe and stable operation of mine production.

[0034] The incident response and recovery module works in coordination with the threat detection and intelligent analysis module and the defense strategy generation and response module to respond to security incidents through adaptive algorithms (reinforcement learning algorithms). After receiving security incident information, it determines the input state based on quantitative features such as event type and severity, and selects the optimal emergency response strategy based on the Markov decision process MDP after adjusting the value function and policy function. It performs operations such as enabling backup equipment and adjusting the network topology, and continuously monitors the system status. It evaluates the optimization strategy based on the recovery situation, reduces production interruption time, ensures the continuity of mine production, and reduces the impact of security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 The present invention is a schematic diagram of the overall structure of a mine network security operation system. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0037] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0038] like Figure 1 As shown, an embodiment of the present invention provides a mine network security operation system, including a data acquisition and preprocessing module, a threat detection and intelligent analysis module, a defense strategy generation and response module, a quantum encryption and secure communication module, and an event response and recovery module.

[0039] In this embodiment, the data acquisition and preprocessing module is connected to various devices and sensors in the mine network to collect real-time data from the devices and sensors, and to perform denoising and standardization on the collected real-time data. The specific operation steps are as follows:

[0040] Step S1: Autoencoder denoising

[0041] Step S1-1: Data mapping and restoration

[0042] Assume that the real-time data collected from the equipment and sensors in the mine network is ; The autoencoder consists of the encoder function and the decoder function Composition; First, the encoder operates on the input data and maps it to a low-dimensional latent space representation ,Right now This process can be regarded as a feature extraction and compression of the original data, converting high-dimensional data containing information such as the operating status of mining equipment into Convert to a low-dimensional vector ,For example, multi-dimensional data such as temperature, pressure, and vibration collected by multiple sensors can be mapped into a low-dimensional space to highlight the key features of the data;

[0043] Next, the decoder extracts Restore the data and get ; The decoder attempts to obtain the low-dimensional representation of , reconstruct the original data Restore data as similarly as possible ; For example, regenerate estimates of parameters such as temperature, pressure, vibration, etc. based on the information in the low-dimensional vector , making it close to the original collected data in terms of value ;

[0044] Step S1-2: Reconstruction error calculation and parameter learning

[0045] Calculate the reconstruction error and use the mean square error MSE as the measurement standard; the mean square error formula middle, is the number of data samples collected, It is the original data The elements, It is the data restored by the decoder No. elements; for example, if the mining equipment data at m moments are collected, then n=m, and for each parameter (such as temperature, pressure, etc.) at each moment, calculate its original value With restored value Then sum and average all these squared differences to get the reconstruction error ;

[0046] The parameters of the autoencoder are learned by minimizing the reconstruction error; during the optimization process, the parameters of the encoder and decoder (such as weights and biases in the neural network) are continuously adjusted to reconstruct the data. Gradually approaching the original data ; When the reconstruction error reaches the minimum value or meets certain convergence conditions, it is considered that the autoencoder has learned the appropriate parameters. At this time, the denoised data While removing noise, the useful information in the original data is retained to the greatest extent; for example, in a mining environment, the data collected by the sensor may be affected by noise such as electromagnetic interference. After the autoencoder denoises, the data Can more accurately reflect the actual operating status of mining equipment;

[0047] Step S2: Gaussian mixture model GMM processing

[0048] Step S2-1: Probability density function hypothesis

[0049] For the mining equipment data after autoencoder denoising , assuming that it obeys a distribution composed of a mixture of K Gaussian distributions, its probability density function is ,in, For the The mixing coefficient of the Gaussian distribution satisfies ; Taking the temperature data of mining equipment as an example, it may be a mixture of multiple different "sub-distributions" (Gaussian distributions), each of which may correspond to different equipment operating states or environmental conditions. The data comes from The probability weight of the subset distribution; Indicates the mean The covariance matrix is The Gaussian distribution probability density function is, ,in, The goal of maximum likelihood estimation is to find a set of parameter values ​​so that the observed data The probability (likelihood function) of is the largest; for multi-parameter data of mining equipment (such as temperature, pressure, vibration, etc.), is the number of parameters, It is The mean of a Gaussian distribution in each parameter dimension, Describes the covariance relationship of the data in each parameter dimension, reflecting the correlation and discreteness between different parameters;

[0050] Step S2-2: Parameter estimation and data processing

[0051] The maximum likelihood estimation method is used to estimate and Parameters; The goal of maximum likelihood estimation is to find a set of parameter values ​​so that the observed data The probability (likelihood function) of is the largest; for the equipment data in the mining network, according to the existing denoised data , using the mathematical algorithm of maximum likelihood estimation to calculate the most likely and ; For example, based on the historical operating data of mining equipment, the mean, covariance and weight of each sub-distribution (Gaussian distribution) in the mixed distribution are determined by maximum likelihood estimation;

[0052] Using the estimated parameters to Normalization and standardization are performed; normalization maps the data to a specific interval (such as or Standardization gives the data specific statistical characteristics (such as a mean of 0, a standard deviation of 1, etc.); the processed mining network data is more convenient and effective in subsequent analysis and processing; for example, mining equipment data from different sources and different magnitudes (such as temperature data in the range of tens of degrees, pressure data in the range of hundreds of megapascals, etc.) can be compared and analyzed on the same scale after normalization and standardization, which helps to more accurately identify abnormal patterns in the data, thereby detecting security threats such as network attacks or equipment failures, and providing a better data foundation for subsequent threat detection and intelligent analysis modules.

[0053] In this embodiment, the threat detection and intelligent analysis module is connected to the data acquisition and preprocessing module, and a model combining a deep convolutional neural network DCNN and reinforcement learning RL is used to monitor the attack behavior in the mine network in real time based on the preprocessed data and perform threat detection; the specific operation steps are as follows:

[0054] Step S1: Deep Convolutional Neural Network DCNN feature extraction

[0055] Step S1-1: Convolution operation

[0056] Assume that the preprocessed mining network data received from the data acquisition and preprocessing module is the input data; first determine the convolution kernel (Its size is , is the number of rows, is the number of columns) and the offset ; For each position in the input data , the output of the convolutional layer It is obtained by the following convolution operation: ,in, Represents the element value of the input data at the corresponding position; activation function You can choose common functions such as ReLU (Rectified Linear Unit), which introduces nonlinear factors and enhances the expressiveness of the model. For example, when processing the sequence data of parameters such as temperature, pressure, vibration, etc. collected by sensors of mining equipment, the convolution kernel Slide on the data according to the set step size. For each sliding position, calculate the sum of the products of the convolution kernel element and the corresponding input data element, plus the bias , and finally through the activation function Get the output feature map Elements in ,This process can extract local features in the data, such as detecting local change features such as the rising or falling trend of temperature in the temperature data series;

[0057] Step S1-2: Pooling layer operation and feature conversion

[0058] After completing the convolution layer operation, the pooling layer operation is performed next; the main function of the pooling layer is to downsample the feature map output by the convolution layer to reduce the amount of data and maintain the main features; common pooling methods include maximum pooling and average pooling. For example, if the maximum pooling is used, in a small local area (such as or The maximum value in the region is selected as the representative value of the region, which can highlight the significant features in the data and has a certain invariance to slight translation and rotation of the data; in the processing of mining network data, for example, for the characteristic map of equipment operation parameters, the pooling operation can reduce the impact of subtle fluctuations caused by sensor measurement errors on subsequent analysis, while retaining key information in the data;

[0059] After a series of operations in the convolution layer and the pooling layer, the extracted features are converted into vector representations. Specifically, the feature maps output by the pooling layer are arranged in a certain order (such as from left to right, from top to bottom) into a one-dimensional vector. This vector can comprehensively reflect the key information in the mine network data. For example, it combines the features of equipment temperature, pressure, vibration and other aspects into a vector, providing a basis for subsequent analysis (such as comparison with normal operating modes) and decision-making (such as determining whether there is an attack behavior).

[0060] Step S2: Reinforcement Learning RL Optimization

[0061] Step S2-1: State, action and reward definition

[0062] Step S2-1-1: State definition: Assume that the agent is at time Status , which is determined based on the feature vector extracted by the deep convolutional neural network DCNN and some current status information of the mining network; specifically, the status It can include the following parts: first, the feature vector of the equipment operation parameters extracted by DCNN, such as the comprehensive feature representation of equipment temperature, pressure, vibration and other parameters after feature extraction; second, the current status information of the mine network, such as the network traffic size (including total traffic, traffic distribution of each device, etc.), device connection status (number of connected devices, connection duration, type of connected device, etc.), network data packet transmission delay, etc.; these information combined comprehensively reflect the status of the mine network at all times. For example, when the temperature characteristics of a key device in the mine network fluctuate abnormally, the network traffic suddenly increases, and a new unknown device attempts to connect, these information together constitute the state of the agent at this time. ;

[0063] Step 2-1-2: Action definition; the agent is in state You can take a variety of actions ,These actions are mainly aimed at the operation of mine network security; for example, This may include blocking suspicious network connections (when a connection is detected to be a potential security risk, the connection is cut off to prevent the potential attack from spreading further), isolating abnormal devices (if a device is judged to be abnormal, it is isolated from the network to prevent it from affecting other normal devices), adjusting network security policies (such as changing firewall rules, encryption methods, etc. to enhance the network's defense capabilities against specific attacks), issuing security alerts (notifying network administrators to pay attention to the current network status so that manual intervention can be carried out for further inspection and processing), etc.;

[0064] Step S2-1-3: Reward definition; reward for environmental feedback It is set based on the effect of the agent's actions on detecting attacks and maintaining mine network security; if the agent's actions successfully prevent a potential attack (such as timely blocking the intrusion connection of malware), it will receive a higher positive reward, such as ; If the action helps improve network security (for example, after adjusting the security policy, the network shows higher security in subsequent tests), it will also receive a positive reward, such as On the contrary, if the action leads to misjudgment (such as mistakenly blocking the connection of normal equipment) or causes unnecessary interference to normal production (such as frequent alarms without real safety threats, affecting mine production operations), a negative reward will be obtained, such as -5 or -10;

[0065] Step S2-2: Optimization based on Markov decision process MDP

[0066] Step S2-2-1: Goal setting; reinforcement learning based on Markov decision process , whose goal is to maximize the long-term cumulative reward ,in, is the discount factor, , Represents the agent at time The reward obtained from the environment when Used to weigh the importance of future rewards and current rewards; When it is close to 1, , indicating that rewards in the distant future also have a greater impact on current decisions. The agent pays more attention to long-term interests and will consider the continuous impact of current actions on future network security status. When approaching, , the intelligent agent pays more attention to the current immediate rewards, and the decision-making is more focused on the immediate safety effect of the current action; for example, in a mining network, if an action is taken, although it may cause certain production inconveniences in the short term (such as temporarily isolating some equipment for inspection), it can greatly improve network security in the long run (avoiding possible large-scale attacks that lead to long-term production stoppages). When it is larger, the agent may be more inclined to take this action;

[0067] Step S2-2-2: Strategy function and action selection; the agent uses the strategy function To select an action, the function represents the state Take action For example, when the mine network is in a state of high traffic and abnormal connection requests When the policy function It may be calculated that the probability of blocking the connection is 0.7, the probability of issuing an alarm is 0.2, and the probability of adjusting the security policy is 0.1; the agent randomly selects an action to execute based on these probabilities (other action selection strategies can also be used, such as selecting the action with the highest probability, etc.);

[0068] Step S2-2-3: Value function update and strategy optimization; Value function Update according to the relevant update formula to dynamically optimize the detection strategy of the deep convolutional neural network DCNN; value function Indicates that the agent is in state long-term value when it is found that taking a specific action in a certain state can bring higher long-term cumulative rewards, such as in a certain network state After taking the action of isolating abnormal devices, the subsequent network security is significantly improved and the long-term cumulative rewards increase, then the value function update formula will increase the state The value of isolating abnormal device actions is estimated, and then the policy function is adjusted , increasing the probability of choosing to isolate abnormal equipment actions in this state, thereby optimizing the entire threat detection and response strategy; during the continuous operation of the mining network, the intelligent agent continuously adjusts the value function and strategy function according to new data and environmental feedback (rewards), gradually improving the detection accuracy and response effectiveness of various attack behaviors, and ensuring the safe and stable operation of the mining network.

[0069] In this embodiment, the defense strategy generation and response module is connected to the threat detection and intelligent analysis module, and a hybrid reinforcement learning and genetic algorithm are used to automatically generate defense strategies, which are adjusted in real time according to different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mine network; the specific operation steps are as follows:

[0070] Step S1: Hybrid reinforcement learning to evaluate defensive actions

[0071] Step S1-1: State space and action space definition

[0072] Step S1-1-1: state space construction; state space It covers many aspects of information. First, it includes information related to attacks identified by the threat detection and intelligent analysis module. For example, when a network attack is detected, the attack type will be clearly identified, such as DDoS (distributed denial of service) attack, QL injection attack, malware propagation, etc. At the same time, the severity of the attack will be determined, which can be divided into minor, moderate, severe and other levels, based on factors such as the attack traffic size, attack duration, and possible impact range. In addition, it also includes detailed information on the device or network area affected by the attack, such as device name, IP address range, location in the network topology, etc.

[0073] The real-time status information of the network itself is also an important part of the state space; including the current network traffic size, traffic distribution (such as the traffic ratio between different areas and different devices), equipment load status (such as CPU usage, memory occupancy, etc.), currently deployed defense strategies and their effectiveness evaluation (such as the filtering effect of enabled firewall rules on network traffic, the false alarm rate and missed alarm rate of intrusion detection systems, etc.); this information combined fully describes the actual status of the mine network when it is attacked. ; For example, at a certain moment, the state It may indicate that a moderate DDOS attack has been detected. The attack source IP address range is [192.168.1.10 - 192.168.1.20], the target is the server area, the total network traffic has reached a peak value, the server device CPU usage rate exceeds 80%, and the current firewall rules partially block the attack traffic but still some of it penetrates;

[0074] Step S1-1-2: Action space determination; Action space It includes various defense actions that the defense strategy generation and response module can take; for example, starting firewall rule updates, dynamically adjusting the firewall's access control list according to the attack type and network status, allowing or prohibiting access to specific IP addresses or ports; isolating infected devices, isolating devices detected to be infected with malware or attacked from the network to prevent the spread of attacks; adjusting network access rights, setting different access levels for different users or device groups, and restricting access to suspicious devices or users; increasing network monitoring frequency, strengthening monitoring of network traffic, device status, etc., so as to detect anomalies in a timely manner; starting a specific detection mode of the intrusion detection system, such as a feature detection mode for a new type of attack or increasing detection sensitivity, etc.; each action All are designed to address specific attack scenarios or improve the security posture of the network;

[0075] Step S1-2: Strategy evaluation and update based on hybrid reinforcement learning

[0076] Step S1-2-1: -Learning part: Hybrid reinforcement learning combines -Learning and Policy Gradient Methods; In the learning part, for each state-action pair , there is a corresponding value , which means that in the state Take action The expected long-term return; initially, The value can be initialized randomly or set based on experience; when an attack event occurs in the mining network, for example, a QL injection attack is detected (status , take the action of starting the intrusion detection system specific detection mode (action ), and then observe the network's reaction and final results; if the attack is successfully blocked, the network resumes normal operation, and according to the pre-set reward mechanism (such as successfully blocking the attack to give reward), combined with the next state The maximum of all actions Value (assuming ,according to Value update formula (in, is the learning rate, is the discount factor) As more attacks occur and are handled, this process is repeated. The value gradually converges to the optimal value, so that the pros and cons of different actions in each state can be evaluated more accurately;

[0077] Step S1-2-2: Policy gradient part; in the policy gradient part, the policy function Parameters Updated by the gradient ascent algorithm, the goal is to maximize the expected reward , the gradient calculation formula is: ; During the operation of the mine network, according to the current status and the policy function Select an action Execution; for example, when the network is under DDoS attack and some devices are overloaded When, according to the current policy function You may choose to isolate some of the affected devices (action The probability is 0.6, choose to increase the network monitoring frequency (action The probability is 0.4; perform the action After that, the gradient is calculated based on the changes in network status and the rewards obtained (such as successfully alleviating device load and partially blocking attack traffic to get a +8 reward). , and update the parameters according to the gradient ascent algorithm ; Update parameters through continuous iteration ,Strategy Function Able to gradually adapt to the attack situation of the mining network and select better defense actions under different conditions , to maximize long-term cumulative rewards;

[0078] Step S1-2-3: Defensive action option evaluation; based on the current state and attack types, using the updated The value and policy functions evaluate defensive action options; for example, when malware is detected spreading in the network (state When, according to the current Value and policy functions , calculate each action ; assuming that after calculation, isolating the infected device (action The expected return is the highest, then is evaluated as the current state The best defensive action option is to minimize the impact on network operations and improve network security while responding to malware propagation attacks;

[0079] Step S2: Genetic algorithm optimizes defense strategy combination

[0080] Step S2-1: Encoding and individual generation

[0081] Step 2-1-1: Defense action encoding; Encode the defense action options evaluated by hybrid reinforcement learning to form individuals; Use a suitable encoding method, such as binary encoding; Map each possible defense action to a binary bit, and combine multiple defense actions into a binary string as an individual; For example, suppose there are 5 defense actions, namely (Start firewall rule update), (Isolate infected devices), (Adjust network access permissions), (Increase network monitoring frequency), (Start the intrusion detection system specific detection mode), you can specify "1" to execute the action, "0" to not execute; an individual may be represented as "10110", indicating the execution of the action , no action is performed and ;

[0082] Step S2-1-2: Population initialization; set the population size to 1 (such as , by randomly generating multiple such binary string individuals , construct the initial population; each individual represents a possible combination of defense strategies, and these individuals will serve as the initial candidate solutions optimized by the genetic algorithm; for example, the generated initial population may contain individuals "01001", "11010", "00111", etc., each of which represents a different combination of defense strategies and covers different defense action selection situations;

[0083] Step S2-2: Fitness evaluation

[0084] Step S2-2-1: fitness function design; through the fitness function Evaluate the fitness of each individual; the fitness function is defined based on multiple factors related to the effectiveness of the defense strategy; for example, the success rate of the defense strategy in blocking attacks is a key factor, which can be obtained through simulated attack tests or actual attack data statistics; if a defense strategy combination can successfully block most attacks and has a high blocking success rate, it will get a higher weight in the fitness function;

[0085] The impact on network operation is also an important factor; including the increase in network latency , which can be measured by monitoring the changes in the transmission time of network data packets before and after the execution of defense strategies; device resource usage , such as the additional usage ratio of CPU, memory and other resources; and the speed of restoring the network to normal state , which is the time required for the network to resume normal operation after being attacked; the fitness function can be a weighted combination of these factors, such as: ; in, is the weight of the corresponding factor, which is set according to the importance of the mine network to different performance indicators; for example, for a mine production control network with high real-time requirements, (Network delay-related weight) may be set larger to prevent the defense strategy from causing excessive network delay that affects the normal control of production equipment;

[0086] Step S2-2-2: Fitness calculation and evaluation; for each individual in the population , calculate its fitness value according to the above fitness function , the higher the fitness value, the better the defense strategy combination corresponding to the individual; for example, the defense strategy combination corresponding to the individual "10101" successfully blocked 80% of the attacks in the actual test. This results in an increase of 10 milliseconds in network latency ( The device resource utilization rate has increased It takes 5 minutes to restore the network to normal state , assuming the weight , then its fitness value ; By calculating the fitness value of each individual, it is possible to quantitatively evaluate all defense strategy combinations in the population, providing a basis for subsequent genetic operations;

[0087] Step S2-3: Genetic operation and iterative evolution

[0088] Step S2-3-1: Selection operation; use the selection operation to select excellent individuals from the current population to enter the next generation population; use a roulette selection method to determine the probability of being selected based on the fitness value of the individual; the higher the fitness value of the individual, the greater the probability of being selected, thereby retaining its excellent genes (i.e., defense strategy combination); for example, calculate the selection probability of each individual in the population , assuming there are three individuals in the population , and their fitness values ​​are Then their selection probabilities are ; Through roulette selection, individuals are randomly selected according to these probabilities to enter the next generation population, and individuals with high fitness have a greater chance of being selected, while individuals with lower fitness The probability of being selected is relatively small, but there is still a certain chance of being retained to maintain the diversity of the population;

[0089] Step S2-3-2: Crossover operation: select the individual with a certain probability (such as Perform a crossover operation; randomly select two individuals, determine the position of the crossover point, and then exchange some genes after the crossover point to generate a new individual; for example, select two individuals "01010" and "10101", randomly select the crossover point as the third position, and obtain "01101" and "10010" after crossover; the purpose of the crossover operation is to combine the excellent genes of different individuals, which may produce a better combination of defense strategies; through the crossover operation, the new individual inherits the characteristics of the parent individuals in choosing different defense actions, increases the diversity of defense strategy combinations in the population, and helps to discover more effective defense strategies;

[0090] Step S2-3-3: mutation operation; with a lower probability (such as Perform mutation operations on certain genes in individuals; randomly select one or more binary bits in individuals to invert; for example, for individual "01010", randomly select the second bit to mutate to get "00010"; mutation operations can introduce new gene combinations to prevent the algorithm from falling into the local optimal solution; in the process of population evolution, although the probability of mutation is low, it brings new possibilities to the population, giving the algorithm the opportunity to jump out of the local optimal area and explore a wider range of defense strategy combination space, thereby finding the global optimal or near-optimal defense strategy combination;

[0091] Step S2-3-4: iterative evolution; through multiple iterations (such as setting the number of iterations , continuously repeating the selection, crossover and mutation operations; in each iteration, firstly, the fitness of individuals in the current population is evaluated according to the fitness function, then the selection operation is performed to retain the excellent individuals, and then the crossover and mutation operations are performed to generate new individuals to form the next generation population; as the iteration proceeds, the population continues to evolve, and the defense strategy combination represented by the individuals is gradually optimized; for example, in the first iteration, the defense strategy combination corresponding to the best individual in the population may be able to successfully block 70% of the attacks and have little impact on network performance; and by the 50th iteration, the defense strategy combination of the best individual may successfully block 85% of the attacks, and performance indicators such as network delay and device resource occupancy are further optimized; when the set number of iterations is reached or other termination conditions are met (such as the fitness of the best individual is no longer improved for several consecutive times), the iteration is stopped, and the defense strategy combination represented by the best individual obtained at this time is the result after genetic algorithm optimization;

[0092] Step S3: Real-time adjustment and deployment

[0093] Step S3-1: Obtaining the basis for policy adjustment

[0094] Step S3-1-1: Identify the attack type; the threat detection and intelligent analysis module continuously monitors the mine network and accurately identifies the attack type; this is achieved by analyzing various information such as network traffic, device behavior, and data characteristics; for example, for network traffic, detect whether there are abnormal traffic patterns, such as a large number of connection requests from the same source IP address (which may be a DDoS attack), abnormal scanning behavior of a specific port (which may be a port scanning attack), etc.; for device behavior, monitor whether the device has abnormal process startup, file access, or system call (which may be caused by malware infection); for data characteristics, analyze whether the data has been tampered with, encrypted, or has abnormal transmission modes, etc.; by combining this information, accurately determine the current attack type, such as determining it as a DDoS attack, malware infection attack, data theft attack, etc., providing key basis for subsequent policy adjustments;

[0095] Step S3-1-2: Real-time network status monitoring; at the same time, pay close attention to the real-time status information of the mine network; including dynamic changes in network traffic, such as the increase and decrease trend of traffic size, the distribution of traffic flow (which areas or devices have large or abnormal traffic); real-time data of equipment performance indicators, such as the CPU usage rate, memory occupancy rate, disk I / O rate, etc., to determine whether the equipment is overloaded or abnormal; changes in network topology, such as whether new equipment is connected, whether the connection relationship between devices has changed abnormally, etc.; these real-time status information combined with attack type information fully reflects the actual situation of the mine network at the current moment, and provides rich data support for the formulation of targeted defense strategy adjustment plans; for example, if it is detected that the CPU usage rate of equipment in a certain area suddenly soars and the network traffic fluctuates abnormally, and malware infection attacks are identified, these information will serve as an important basis for adjusting the defense strategy;

[0096] Step S3-2: Strategy adjustment and optimization

[0097] Step S3-2-1: Dynamic adjustment of parameters; In addition to selecting and combining defense strategies, the relevant parameters of the strategies are also dynamically adjusted according to the real-time situation; for example, for the access control list in the firewall rules, the IP address range and port number that are allowed or prohibited to access are dynamically adjusted according to the size and change trend of the attack traffic; if the attack traffic continues to increase and the source IP address range continues to expand, the firewall blocking range is promptly expanded to more effectively prevent the attack traffic from entering the mine network; for the detection threshold of the intrusion detection system, when the network is in a normal state, the detection threshold can be appropriately increased to reduce false alarms; and when signs of attack are detected or the network state is unstable, the detection threshold is lowered and the detection sensitivity is increased to ensure that potential attack behaviors can be discovered in time; in addition, for the network monitoring frequency, it is adjusted according to the severity and duration of the attack; in the early stage of the attack or when the attack is relatively minor, the normal monitoring frequency is maintained; when the attack intensifies or lasts for a long time, the monitoring frequency is increased to obtain network status information more timely, providing a basis for further adjustment of the defense strategy;

[0098] Step S3-2-2: Strategy collaborative optimization; focus on the collaborative work between different defense strategies to ensure that they can cooperate with each other and maximize their effectiveness when responding to attacks; for example, while isolating infected devices, adjust the network routing strategy to direct the traffic that originally passed through the device to other normal devices or backup links to ensure network connectivity and business continuity; at the same time, work with other security protection tools such as antivirus software and vulnerability repair systems to promptly notify relevant tools to perform virus detection and vulnerability repair operations on infected devices when adopting network-level defense strategies, forming a comprehensive defense system; through this collaborative optimization, improve the overall performance of the entire mine network defense system and its ability to respond to complex attacks;

[0099] Step S3-3: Strategy deployment and implementation

[0100] Step S3-3-1: Security protection equipment adaptation; adapt the adjusted defense strategy to various related security protection equipment in the mine network; different types of security protection equipment have different interfaces and configuration methods, and need to be adapted in a targeted manner; for firewall equipment, convert the updated firewall rules into a format that it can recognize and execute, and configure the rules through the management interface of the equipment (such as command line interface, Web interface, etc.); for intrusion detection systems, send the adjusted detection parameters and mode configuration information to the corresponding devices to ensure that they can detect according to the new strategy; for antivirus gateways, push updated virus databases and protection strategies to enable them to effectively identify and prevent the intrusion of new malware; during the adaptation process, ensure the accuracy and completeness of the configuration information to avoid the security protection equipment from not working properly or vulnerabilities due to configuration errors;

[0101] Step S3-3-2: Deployment order and verification; Determine the deployment order of defense strategies, generally following the principle of first deploying key devices and then common devices, and first deploying core areas and then edge areas; for example, first deploy defense strategies related to key devices such as network core switches and servers to ensure that the core part of the network is protected first; then gradually deploy strategies to edge devices (such as sensor nodes, workstations, etc.); after the strategy deployment of each device is completed, conduct verification to check whether the device has correctly received and executed the new defense strategy; verification can be performed by simulating attack tests, checking device logs, monitoring network traffic and device status, etc.; if it is found that the strategy deployment fails or the device does not execute the strategy as expected, timely troubleshooting and repairs are carried out to ensure that the defense strategy can be reliably implemented in the entire mining network;

[0102] Step S3-3-3: Continuous monitoring and feedback adjustment; after the defense strategy is deployed and implemented, continuously monitor the operating status and defense effect of the mine network; evaluate the effectiveness of the defense strategy by real-time monitoring of network traffic, equipment performance, security incidents and other indicators; if it is found that the network still has security risks or the defense strategy fails to effectively respond to the attack, promptly collect relevant information (such as new features of the attack, changes in network status, etc.), and feedback to the defense strategy generation and response module to trigger a new round of strategy adjustment and optimization process; at the same time, record the deployment and execution of the defense strategy, including deployment time, configuration parameters, equipment response and other information, to form a strategy execution log, and provide data support for subsequent strategy analysis and improvement; through this continuous monitoring and feedback adjustment mechanism, it is ensured that the defense strategy of the mine network can be continuously optimized and improved according to actual conditions to adapt to the ever-changing network security threats.

[0103] In this embodiment, the quantum encryption and security communication module is connected to the data transmission link in the mine network, and the data transmitted in the mine network is encrypted through the quantum key distribution QKD technology to ensure the security of data transmission; the specific operation steps are as follows:

[0104] Step S1: Quantum Key Distribution (QKD) key generation

[0105] Step S1-1: Preparation and transmission of quantum bit sequence

[0106] Step S1-1-1: Quantum state selection and encoding: Based on the selected quantum key distribution protocol (such as BB84 protocol, etc.), the sender must first determine the quantum state used to encode information; for example, for polarization state encoding of photons, the sender can specify the horizontal polarization state Represents binary information "0", vertical polarization state represents "1"; then, a series of quantum bits based on these codes are prepared using specialized quantum devices (such as quantum light sources); for example, to generate a sequence of 100 quantum bits, the sender will generate photons of corresponding polarization states as quantum bits one by one according to the coding rules;

[0107] Step S1-1-2: quantum channel transmission; the prepared quantum bit sequence is sent to the receiver through a quantum channel (such as low-loss optical fiber) specially laid in the mine network; during the transmission process, it is necessary to ensure that the quantum characteristics of the quantum bit are not destroyed, which requires strict control of the environment of the quantum channel, such as maintaining a stable temperature and reducing external electromagnetic field interference; for example, the laying of optical fiber should avoid strong electromagnetic field areas, and appropriate optical fiber materials and packaging technology should be used to reduce the loss and decoherence of photons during transmission, so as to ensure that the quantum bit sequence can accurately reach the receiver from the sender;

[0108] Step S1-2: Comparison of classical channel information

[0109] Step S1-2-1: Measurement basis selection and disclosure; the sender and the receiver communicate through a classical channel (such as an ordinary network communication line); both parties first randomly select a measurement basis to measure the received quantum bits; for example, the measurement basis can be selected as horizontal Vertical polarization base Or diagonally Opposing diagonal polarization basis ( , ,in, Represents the horizontal polarization state (usually corresponding to the binary information "0"), Then, both parties randomly select the positions of some quantum bits (for example, 30 positions out of 100 quantum bits) and make these positions and the measurement basis used public;

[0110] Step S1-2-2: Comparison of measurement results and eavesdropping detection; the receiver measures the quantum bits at the corresponding positions according to the measurement basis information disclosed by the sender, and informs the sender of the measurement results through the classical channel; the sender compares its own measurement results at the same position and measurement basis with the receiver's results; if the proportion of consistent measurement results of both parties reaches a high threshold (such as more than 95%), it means that the security of the quantum channel is high, and the quantum bits are most likely not eavesdropped during transmission; if the consistency ratio is low, there may be eavesdropping, and at this time both parties may need to re-prepare and send quantum bit sequences to ensure the security of key generation;

[0111] Step S1-3: Error correction and privacy amplification

[0112] Step S1-3-1: Determine the error correction code and detect errors; after determining that the quantum channel is highly secure (i.e., the proportion of consistent measurement results meets the requirements), both parties need to perform error correction operations on the remaining undisclosed quantum bits; first, both parties must determine the type of error correction code to be used (such as the classic low-density parity check code LDPC, etc.); then, based on the previously disclosed information on the comparison of the measurement basis and results, calculate the syndrome to detect possible errors in the quantum bits; for example, calculate the value of the syndrome through a specific algorithm, and determine which quantum bits may have errors and the type of errors (such as bit flip errors or phase flip errors, etc.) based on the value of the syndrome;

[0113] Step S1-3-2: Error correction and privacy amplification: Using the error correction algorithm, correct the erroneous quantum bits according to the calculated syndrome information, so that the quantum bit sequences finally obtained by both parties are as consistent as possible; for example, through the decoding algorithm of the LDPC code, find the position of the erroneous bit according to the syndrome and correct it; after the error correction is completed, perform a privacy amplification operation; both parties use a pre-agreed hash function (such as SHA-256, etc.) to process the quantum bit sequence after error correction and compress it into the final quantum key This process will make it so that even if the eavesdropper obtains part of the information in the previous process, after privacy amplification, the effective information that he can obtain will be greatly reduced, thus ensuring the quantum key It has extremely high security and meets the strict requirements of mine network data encryption;

[0114] Step S2: Data encryption and decryption

[0115] Step S2-1: Encryption process

[0116] Step S2-1-1: key distribution and preparation; the quantum key generated by quantum key distribution QKD Safely distribute to the sending end devices (such as sensor nodes, control center servers, etc.) in the mine network that need to encrypt data; before the sending end device transmits data, it ensures that the quantum key Correctly acquired and prepared for encryption operations; for example, in a mining equipment monitoring system, after the sensor node collects the equipment operation data, it first acquires the quantum key before sending the data to the control center. ;

[0117] Step 2-1-2: Encryption algorithm execution; for the data block to be encrypted (such as temperature, pressure, vibration and other parameter data collected by sensors), the sending device uses the selected symmetric encryption algorithm (such as AES algorithm) combined with quantum key Perform encryption operations; specifically, convert the data block Divide it into fixed-length groups (such as 128 bits per group), and then compare each group with the quantum key Perform bitwise XOR and other encryption operations to obtain the encrypted ciphertext ; For example, for a 128-bit data block representing a temperature value , through the use of quantum keys Perform bitwise XOR operation to generate encrypted ciphertext , so that during the data transmission process, even if the ciphertext Illegally obtained, no quantum key The original data cannot be restored 1. Ensure the confidentiality of data;

[0118] Step S2-2: Decryption process

[0119] Step S2-2-1: The ciphertext is received and matched with the key; the receiving device (such as the control center server) receives the encrypted ciphertext After that, first make sure you have the quantum key corresponding to the sender. In the mine network, the receiver obtains the correct quantum key through a secure key management mechanism (such as a key storage and retrieval system that is tightly integrated with the quantum key distribution system). , in order to perform decryption operations;

[0120] Step S2-2-2: Decryption algorithm restoration: The receiving end uses the decryption function corresponding to the encryption process Ciphertext to decrypt; for example, if the encryption process was using quantum keys With data blocks Perform bitwise XOR operation to get the ciphertext , then the quantum key is used again for decryption With ciphertext Perform bitwise XOR operation to restore the original data block In the mining network data transmission scenario, after the control center server receives the encrypted data from the sensor node, it uses the correct quantum key Decryption is performed to obtain accurate equipment operating parameter data, ensuring the integrity and confidentiality of mine network data transmission, allowing data to be transmitted and processed in a secure environment, and supporting the normal production and operation management of the mine.

[0121] In this embodiment, the event response and recovery module is connected to the threat detection and intelligent analysis module and the defense strategy generation and response module. After receiving the security event information detected by the threat detection and intelligent analysis module, the emergency response is initiated through the adaptive algorithm, and the system is quickly restored to ensure the continuity of mine production; specifically, the following steps are included:

[0122] Step S1: Input status determination

[0123] Step S1-1: Security incident information collection

[0124] Step S1-1-1: Establishing an information receiving interface; the event response and recovery module and the threat detection and intelligent analysis module establish an efficient information receiving interface to ensure that security event information can be obtained in real time; this interface can be implemented based on a network communication protocol (such as TCP / IP protocol, etc.), using a reliable data transmission method to ensure the integrity and timeliness of information; for example, when the threat detection and intelligent analysis module detects a security event, it immediately sends the event information to the event response and recovery module through a pre-set interface to avoid delays in emergency response caused by information transmission delays;

[0125] Step S1-1-2: Information classification and organization; The received security event information covers various types, which are first classified; the information types include network attack related information (such as attack type, attack source IP address, attack target, attack means, etc.), equipment failure information (such as equipment name, failure type, failure occurrence time, etc.), data anomaly information (such as data tampering signs, data loss, abnormal data traffic, etc.); then organize this information, remove redundant and erroneous information, and ensure the accuracy and availability of the information; for example, merge and deduplicate information about the same security event from multiple detection sources, and convert information in different formats into a unified format to facilitate subsequent processing; for example, organize network attack information into structured data containing fields such as attack type (such as DDoS attack, SQL injection attack, etc.), attack source IP address range (such as [192.168.1.1-192.168.1.10]), attack target device or system (such as server A, database server, etc.), attack start time (such as 2023-05-0110:00:00), etc.;

[0126] Step S1-2: Quantitative feature extraction and state determination

[0127] Step S1-2-1: Feature selection and calculation; select key features from the sorted security event information and perform quantitative calculations; for network attack events, select features such as the size of the affected network area (such as measured by the number of subnets or IP address segment range), attack traffic intensity (such as the number of packets per second, traffic size, etc.), and attack duration; for equipment failure events, select features such as the decline in key performance indicators of the faulty equipment (such as the value of the equipment temperature increase, the ratio of the speed reduction, etc.), the scope of the fault impact (such as the number of other devices connected to the faulty equipment), etc.; for data anomaly events, select features such as the proportion of abnormal data volume to the total data volume, the rate of abnormal data change, etc.; for example, in a DDoS attack event, the attack traffic intensity is calculated to be 10,000 packets per second, the attack duration is 30 minutes, and the number of affected subnets is 3. These quantitative features will serve as an important basis for constructing the input state;

[0128] Step S1-2-2: state vector construction; the quantized features are combined into a state vector to represent the current security event state s; the dimension of the state vector is determined by the number of selected features, and each dimension corresponds to a feature value; for example, a state vector s=[3,10000,30,0.2] is constructed, where the first element indicates that the number of affected subnets is 3, the second element indicates that the attack traffic intensity is 10,000 packets per second, the third element indicates that the attack duration is 30 minutes, and the fourth element indicates that the proportion of abnormal data volume to the total data volume is 0.2 (assuming that data anomalies exist at the same time); this state vector will be used as the input of the reinforcement learning algorithm for subsequent policy adjustments and decision-making;

[0129] Step S2: Reinforcement learning strategy adjustment

[0130] Step S2-1: Emergency response strategy action space definition

[0131] Step S2-1-1: Enumerate the types of actions; clarify the various possible action types in the emergency response strategy action space A; the action types include but are not limited to network-level operations, such as switching the network topology (such as switching from a star topology to a ring topology to bypass a faulty node), adjusting the network routing strategy (such as dynamically changing the packet forwarding path to avoid congested or attacked areas), starting network traffic cleaning (filtering out malicious attack traffic), etc.; system-level operations, such as restarting the affected system services, switching to a backup system (such as a backup server, backup database, etc.), performing a system snapshot rollback (restoring the system to its previous normal state), etc.; data-level operations, such as starting the data backup and recovery process (backing up important data to a secure storage location and restoring it when needed), adjusting the data encryption and decryption strategy (such as increasing the encryption strength or changing the encryption algorithm during data transmission), etc.; and notification and collaboration actions, such as sending alarm notifications to network administrators (via SMS, email, pop-up windows, etc.), and coordinating with other security protection systems (such as intrusion detection systems, antivirus systems, etc.);

[0132] Step S2-1-2: Action parameter setting; for each action type, determine its related parameter settings; for example, for the action of switching the network topology, it is necessary to set the target topology type (such as the specific parameters of the ring topology, such as the node connection method, link bandwidth allocation, etc.), the switching timing (such as switching when the network delay exceeds a certain threshold or a specific attack is detected) and other parameters; for the data backup and recovery action, it is necessary to set the range of backup data (such as full backup or incremental backup), backup storage location (such as local storage, cloud storage, etc.), recovery point selection (such as selecting the most recent normal backup point for recovery) and other parameters; the reasonable setting of these parameters will affect the execution effect of the action, thereby affecting the overall effect of the emergency response;

[0133] Step S2-2: Reward setting and strategy optimization

[0134] Step S2-2-1: Reward function design; Design reward function To quantify the actions taken In Status The reward function is based on multiple factors, such as system recovery time (if the system can quickly resume normal operation after taking action, a higher positive reward will be given, and the reward value is inversely proportional to the recovery time. For example, if the system returns to normal within 1 minute, the reward is +10, and if it returns to normal within 5 minutes, the reward is +5, etc.), the impact of production interruption (the loss is calculated according to the importance of the mine production business and the interruption time. The smaller the loss, the higher the reward. For example, if a major production interruption is avoided due to emergency response, the reward is +8, and if the production interruption time is extended, a negative reward is given, such as -3), system stability improvement (if the system stability is improved after taking action, such as reduced equipment failure rate, reduced network jitter, etc., a positive reward is given, and the reward value is determined according to the degree of stability improvement), etc. The reward function can be a weighted combination of these factors, such as (in, is the system recovery time, is the production interruption loss ratio, Improve the system stability. is the weight of the corresponding factor);

[0135] Step S2-2-2: Update the value function and strategy function; Based on the Markov decision process MDP, the value function and the policy function Update to optimize the emergency response strategy; value function Indicates in status The long-term value under this condition is updated as (in, is the learning rate, is the discount factor, To take action The next state to be transferred to after that); strategy function Indicates in status Take action The probability of , its update formula is determined according to the specific reinforcement learning algorithm (such as policy gradient algorithm, etc.), for example, (in, are the parameters of the strategy function, is the action value function); in the mine network security incident processing, when in a certain state (such as when the network is attacked and some services are interrupted), according to the current policy function Select an action (such as starting a backup server) and then adjust the value function according to the above update formula based on the changes in system status (such as partial business recovery) and the rewards obtained (such as +6). and the policy function , so that the policy function encounters similar states in the future It can choose better actions when dealing with emergencies to maximize long-term cumulative rewards, improve the effectiveness of emergency response and the speed of system recovery;

[0136] Step S3: Policy execution and system recovery

[0137] Step S3-1: Determine and execute the optimal strategy

[0138] Step S3-1-1: Strategy selection: According to the results of reinforcement learning strategy adjustment, from the strategy function Determine the current state The optimal emergency response strategy under the condition of ; In actual operation, a variety of strategy selection methods can be used, such as selecting the action with the highest probability as the optimal strategy (i.e. , or according to the value function Choose the action that brings the greatest long-term value as the optimal strategy; for example, when the network is under DDoS attack and the service is interrupted When the policy function is calculated, network traffic cleaning is started and switched to the backup server (action ) has the highest probability, reaching 0.7, and the value function value corresponding to this action is is also the largest, so it is determined is the optimal strategy;

[0139] Step S3-1-2: Action execution and coordination; once the optimal strategy is determined, all actions in the strategy are executed immediately, and coordination between actions is ensured; for actions involving multiple devices or systems, an effective coordination mechanism is established to ensure that the actions can be executed in sequence and without conflict; for example, when executing the actions of starting network traffic cleaning and switching to the backup server, first start the traffic cleaning device, configure the cleaning rules, and filter out malicious attack traffic; at the same time, start the switching program of the backup server, and smoothly migrate the business system from the main server to the backup server to ensure business continuity throughout the process; during the execution process, the execution of each action is monitored in real time, and the start time, execution progress, execution results and other information of the action are recorded, so that troubleshooting and processing can be carried out in time when problems arise;

[0140] Step S3-2: System status monitoring and recovery assessment

[0141] Step S3-2-1: Setting and collecting monitoring indicators; setting a series of system status monitoring indicators to comprehensively evaluate the recovery of the mine network system; monitoring indicators include network-level indicators, such as network latency (determined by sending test data packets and measuring round-trip time), network packet loss rate (the ratio of the difference in the number of sent data packets to the number of received data packets to the number of sent data packets), network bandwidth utilization (real-time monitoring of bandwidth usage of network links), etc.; system-level indicators, such as equipment operating status (including equipment temperature, CPU usage, memory occupancy, disk I / O rate, etc.), system service availability (checking whether key system services are running normally, such as Web services, database services, etc.); business-level indicators, such as business system response time (the time from user operation to system return result), business processing success rate (the ratio of the number of successfully processed business requests to the total number of business requests), etc.; data of these indicators are collected in real time through special monitoring tools and software (such as network performance monitors, system management tools, etc.);

[0142] Step S3-2-2: Recovery evaluation and decision-making; regularly evaluate the system recovery status based on the collected monitoring indicator data; set the threshold for recovery evaluation, and when all monitoring indicators reach or exceed the threshold for normal operation, the system is considered to have returned to normal; for example, when the network delay is less than 10 milliseconds (normal threshold), the network packet loss rate is less than 0.1%, the equipment operation status is stable (such as CPU utilization within the normal range), the business system response time is within an acceptable range (such as less than 2 seconds) and the business processing success rate reaches more than 99%, it is determined that the system has returned to normal operation; if it is found during the evaluation process that the system has not fully recovered, continue to collect system status information and feed it back to the reinforcement learning algorithm to trigger a new round of strategy adjustment and execution until the system is fully restored to normal, ensuring that the continuity of mine production is not seriously affected; at the same time, after the system returns to normal, summarize and analyze the entire emergency response and recovery process, record the cause of the incident, the emergency response measures taken, the system recovery time and other information, and provide experience reference for the handling of similar security incidents in the future.

[0143] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A mine network security operation system, characterized by: include: Data acquisition and preprocessing module: It is connected to various devices and sensors in the mine network to collect real-time data from the devices and sensors, and to perform denoising and standardization on the collected real-time data; Threat detection and intelligent analysis module: It is connected to the data acquisition and preprocessing module, and uses a model combining deep convolutional neural network DCNN and reinforcement learning RL to monitor attack behaviors in the mine network in real time based on preprocessed data and perform threat detection; A defense strategy generation and response module, which is connected to the threat detection and intelligent analysis module, uses hybrid reinforcement learning and genetic algorithm to automatically generate defense strategies, and makes real-time adjustments based on different attack types identified by the threat detection and intelligent analysis module and the real-time system status of the mine network; Quantum encryption and secure communication module: It is connected to the data transmission link in the mine network, and encrypts the data transmitted in the mine network through quantum key distribution QKD technology to ensure the security of data transmission; Event response and recovery module: It is connected to the threat detection and intelligent analysis module and the defense strategy generation and response module. After receiving the security event information detected by the threat detection and intelligent analysis module, it initiates emergency response through an adaptive algorithm and quickly restores the system to ensure the continuity of mine production.

2. A mine network security operation system according to claim 1, characterized in that: The data acquisition and preprocessing module uses an autoencoder and a Gaussian mixture model GMM to perform denoising, normalization and standardization on the data, including: Autoencoder denoising: Assume the input data is , the autoencoder consists of the encoder function and the decoder function The encoder will input data Mapping to a low-dimensional latent space representation , the decoder then restores the data from the latent space to obtain ; Parameters are learned by minimizing the reconstruction error, which is measured by the mean square error MSE, as follows: ,in, is the number of data samples, and are the original data and the reconstructed data respectively. elements; by optimizing and adjusting the parameters of the encoder and decoder, the reconstructed data Close to original data , remove the noise component and get the denoised data ; Gaussian mixture model GMM processing: for data denoised by the autoencoder , assuming that it obeys The probability density function of the mixture of Gaussian distributions is: ,in, For the The mixing coefficient of the Gaussian distribution satisfies , It means the mean The covariance matrix is The Gaussian distribution probability density function is, ,in, is the data dimension, and the maximum likelihood estimation method is used to estimate and Parameters, data Perform normalization and standardization.

3. A mine network security operation system according to claim 1, characterized in that: The threat detection and intelligent analysis module includes: Deep convolutional neural network DCNN feature extraction: For the input preprocessed data, let the convolution kernel be , biased to , the output of the convolutional layer It is obtained through convolution operation, and the formula is: ,in, Represents the convolutional layer at position The output at are the number of rows and columns of the convolution kernel, respectively. is the coordinate position of the output feature map, It is an activation function. After the operations of convolution layer and pooling layer, the features are extracted and converted into vector representation. Reinforcement learning RL optimization: Assume that the agent is at time The status is , the action taken is set to , the reward of environmental feedback is , the state transition probability is , reinforcement learning is based on Markov decision process MDP, the goal is to maximize the long-term cumulative reward ,in, is the discount factor, , Represents the agent at time The reward obtained from the environment is the agent’s policy function To select actions, the value function Update according to the relevant update formula to dynamically optimize the detection strategy of the deep convolutional neural network DCNN.

4. A mine network security operation system according to claim 1, characterized in that: The operation of the defense strategy generation and response module includes: Hybrid reinforcement learning to evaluate defensive actions: Assume the state space is , the action space is , hybrid reinforcement learning based on Learning is combined with the policy gradient method. Study section according to the corresponding Value update method update Value, in the policy gradient part, the policy function Parameters Updated by the gradient ascent algorithm, the goal is to maximize the expected reward , and its gradient calculation formula is: , evaluates defensive action options based on the current state and attack type; Genetic algorithm optimizes defense strategy combination: Encode defense action options to form individuals, and set the population size to ,individual The encoding is represented as , through the fitness function Evaluate individual fitness, and define the fitness function based on factors related to the effectiveness of the defense strategy; use basic genetic algorithm operations including selection, crossover, and mutation to iterate and evolve to generate the optimal defense strategy combination; Real-time adjustment and deployment: The generated defense strategy is adjusted in real time according to the attack type and system status, and deployed to the relevant security protection equipment in the mining network.

5. A mine network security operation system according to claim 1, characterized in that: The quantum encryption and secure communication module ensures data transmission security according to the following steps: Quantum Key Distribution (QKD) key generation: Based on the quantum key distribution protocol, the sender prepares a quantum bit sequence and sends it to the receiver. After the two parties publicly compare part of the information through the classical channel, they generate a quantum key after error correction and privacy amplification steps. ,Among them, error correction and privacy amplification operations are implemented according to the corresponding standard mathematical models and algorithm processes to ensure that the quantum key meets the security requirements; Data encryption and decryption: The quantum key As the key of the symmetric encryption algorithm, let the data block to be encrypted be , the encrypted ciphertext is encrypted by the encryption function Get, at the receiving end using the corresponding quantum key To decrypt, the decryption function is .

6. A mine network security operation system according to claim 1, characterized in that: The adaptive algorithm of the event response and recovery module is a reinforcement learning algorithm, which implements emergency response and system recovery according to the following process: Input state determination: Determine the input state of the reinforcement learning algorithm based on the threat information received in real time ,Threat information includes relevant quantitative features of security incidents; Reinforcement learning strategy adjustment: Assume that the action space of the emergency response strategy is , the agent is in state Take action , rewards from environmental feedback According to the effect of taking actions on restoring the system and reducing production interruption time, based on the Markov decision process MDP, through the value function and the policy function Learn the optimal strategy according to the corresponding update formula and dynamically adjust the emergency response strategy; Strategy execution and system recovery: Quickly execute the determined emergency response strategy to reduce mine production interruption time and restore the mine network system to normal operation.

Images